Create a profile with marketing consent
Marketing consent is requested at checkout and recorded with timestamp + source (GDPR/CCPA).