Hm true ToS checkmark is not enough, you need to make the opt-in part clear. But it should be enough to do so when creating a account and for every change. At least if you put a reasonable findable setting page in which allows you to review/change such settings.

But I still believe you can do it once on account creation and then never again if people are logged in and nothing changed.