The CAN-SPAM act, enforced by the FTC, does not require prior permission to send email, but you cannot send a deceptive commercial message. If a message pretends to not be an advertisement (but is), it is deceptive – advertisements have to be clearly identified as advertisements. A customer can give prior affirmative consent for a sender to send an advertisement that is not clearly identified as an advertisement (the sender can send a "relational" email).
Assuming that you want to set things up so that emails from the vendor are in the relational and transactional bin (that is, it is legally not "a commercial message"), you need to get "affirmative consent", defined in 15 USC 7702(1):
(A) the recipient expressly consented to receive the message, either
in response to a clear and conspicuous request for such consent or at
the recipient’s own initiative; and
(B) if the message is from a party other than the party to which the
recipient communicated such consent, the recipient was given clear and
conspicuous notice at the time the consent was communicated that the
recipient’s electronic mail address could be transferred to such other
party for the purpose of initiating commercial electronic mail
messages.
Nothing in the law requires that the consent be transmitted by email, that it be signed, or anything else. There simply has to be consent. Clarity and conspicuousness are what is most important. Subparagraph (B) is probably particularly applicable in this instance. There are special technological proof issues surrounding the question of whether a recipient has actually consented (see the most recent episode of the X-Files). This is presently beyond the reach of the law: if a person say "Okay" in response to Alexa saying something and this is stored as a pair of text stimulus + reponse string, there are major evidentiary issues which could be raised and at some point legislated. At present, there is no requirement that you record the voice exchange. The law does not say anything at all about a need to "prove" that you got consent. A digital signature is probably pretty clear evidence, but it is not legally required.
Turning to another area of communicative regulation, phone communication is regulated by the FCC (not the FTC), under the Telephone Consumer Protection Act of 1991. Applicable to voice or SMS calls, CG Docket No. 02-278 of 15 Feb 2012 requires prior express written consent of the called party, under various conditions. 47 CFR 64.1200(f)(8) states...
The term prior express written consent means an agreement, in writing,
bearing the signature of the person called that clearly authorizes the
seller to deliver or cause to be delivered to the person called
advertisements or telemarketing messages using an automatic telephone
dialing system or an artificial or prerecorded voice, and the
telephone number to which the signatory authorizes such advertisements
or telemarketing messages to be delivered.
(i) The written agreement shall include a clear and conspicuous
disclosure informing the person signing that:
(A) By executing the agreement, such person authorizes the seller to
deliver or cause to be delivered to the signatory telemarketing calls
using an automatic telephone dialing system or an artificial or
prerecorded voice; and
(B) The person is not required to sign the agreement (directly or
indirectly), or agree to enter into such an agreement as a condition
of purchasing any property, goods, or services.
(ii) The term “signature” shall include an electronic or digital form
of signature, to the extent that such form of signature is recognized
as a valid signature under applicable federal law or state contract
law.
"Writing" is, itself, undefined. However, para 32 of the order, which provides context for the regulation a propos the written agreement and signature requirement, makes it clear that the agreement must be written (which under the ordinary meaning of words does not include "spoken"). To confuse matters a bit, they also say
The FTC has determined that written agreements obtained in compliance
with the E-SIGN Act will satisfy the requirements of its rule, such as, for example, agreements obtained via an email, website form, text message,
telephone keypress, or voice recording. Finally, under the TSR, the
seller bears the burden of proving that a clear and conspicuous
disclosure was provided, and that an unambiguous consent was obtained.
The paragraph uses "agreement" in two ways (this is not unusual): the abstract thing that people are agreeing to, and the act of accepting or agreeing to that thing, typically indicated by a signature. In context, it is clear that the "terms" must be written, but the acceptance or signature can be email, form, SMS, keypress, or voice recording.
Para 34. further addresses the interpretation of "consent", saying
The FTC specifically found that consent obtained via an email, website
form, text message, telephone keypress, or voice recording are in
compliance with the E-SIGN Act and would satisfy the written consent
requirement in the amended TSR
About 4 times they reiterate a voice recording constitutes a signature (they are operating within the domain of the E-SIGN Act, and not generally redefining "written words" to include "spoken words").
