The basic premise of off site signatures is that you need to be able to provide a trail of communication that shows that you sent the document to the person who will be signing. This can be as simple as the agency asking the client for their email address, and sending the ROI to that email address. This shows enough intent in the eyes of the law that the person signing is indeed the person signing.
ROI can be sent via email to client, then client either sign digitally with Adobe PDF, or sign and scan, and return via the same email that it was sent to. This is 100% legal.
She (our legal counselor) said if we did a Docusign style workflow (where we email a link to the client, they see the document, they digital sign the document) that would be 100% legal.
Acceptable forms of digital signatures: Client digitally signs with stylus, client types in their name and checks a box that they agree, client clicks a button that they agree (the lawyer said this will hold up in court, but some type of signature is better)
Verbal consent is a no-go. She said its technically possible but you would have to record the phone call where the client says they give permission. She said generally this is not a good idea.