Most of what I check is already public. Your sending records are readable from the open internet, and your sign-up language is on your own website. I read both, against current US and EU consent rules, and send back one page.
It costs nothing and it doesn't obligate you to anything. If you'd rather hand the page to whoever runs your mail and never speak to me again, that's a perfectly good outcome.
That's the only thing I strictly need. Everything else below helps me read the result properly.
Authentication records, enforcement level, complaint exposure, unsubscribe headers, opt-in wording, registration status.
Plain English, in order of what's actually costing you. No sales deck attached.
You may have noticed the text message box is separate, unticked, and carries more small print than anyone puts on a form. That is deliberate, and it's roughly what the standard actually requires.
Consent has to be its own affirmative act, disclosed at the point of collection, and never bundled with anything else the person is trying to do.
A pre-ticked box isn't consent. A phone field on a booking form isn't consent to market. Consent captured for one company can't be used by another. And every one of those distinctions carries statutory damages per message, per recipient, with no cap on how many recipients a class action can include.
So this form is the demonstration. If you like the wording, take it — copy it onto your own booking flow with my blessing. If you'd rather someone read yours properly first, that's the audit.