Most advice on customer preference management is written for companies with a marketing operations team. For a company of twenty, the question is what the minimum is, and the answer is a table with four columns and one rule about who may edit it.
One table, not one per tool
The failure mode is a copy of preferences inside each sending tool. Two copies means the answer to did they opt out depends on which system you ask. Pick one store, make it the source, and have the tools read from it even if the reading is a nightly sync.
A tri-state, per channel and topic
On, off, never asked. Never asked is a real state and collapsing it into off loses the ability to invite somebody, while collapsing it into on turns silence into consent. Store it per channel and per topic, because email offers and SMS reminders are different decisions.
A timestamp on every change
The only thing anybody ever asks is whether a message went before or after the person changed their mind. Without a change timestamp that question has no answer and the conversation ends in an apology you cannot support.
A rule about who may edit
Support agents changing preferences on a phone call is legitimate and is also where unattributed changes come from. Record the actor. An agent-made change with the agent's name on it is fine; the same change from nobody is a problem.
When it stops working
At two sending tools with independent audiences, or at the first import from another system. Both introduce a second copy of the truth, and a second copy is the moment a spreadsheet stops being adequate: from then on somebody has to reconcile them, and reconciliation is a job nobody is assigned.
Questions people ask about customer preference management
Can we keep this in the CRM?
Often yes, and it is usually the best choice for a small team because the CRM is already the record of the person. The test is whether the CRM can show the change history rather than only the current value.
What about preferences from a form we imported?
Record the provenance as import and the date. An imported preference with no provenance is one you cannot defend, and imports are where most bad preference data comes from.
Do we need a preference centre page?
Not immediately. An unsubscribe link plus a support route satisfies the obligation. A centre reduces total opt-outs by letting people choose less rather than none, which is a commercial argument rather than a compliance one.