The longer answer
Opt-in surfaces matter. POS opt-ins (customer hands over the number at checkout after seeing disclosure language) carry the strongest consent record. Web opt-ins through a checkbox plus phone field on a form, with clear disclosure adjacent, are also strong. Loyalty enrollments often bundle SMS opt-in but the disclosure language has to be explicit, not hidden in terms-of-service.
Double opt-in (confirmation text the subscriber must reply Y to) adds friction but produces the highest-quality lists and the strongest audit defense. Most operators in cannabis use double opt-in as their default for new sources and single opt-in only for highly-trusted channels.
Every opt-in record must include: phone number, timestamp, source, IP (for web), and the exact disclosure language shown. This audit trail is what defends against TCPA suits and state regulator inquiries.