SMS Consent Rules: What Counts as Valid Permission to Text

Express Written Consent vs Express Consent

The TCPA defines two levels of consent for text messages. Express consent is sufficient for informational and transactional messages like appointment reminders or order confirmations. Express written consent is required for marketing and promotional messages. The difference is that written consent must include a clear disclosure that the recipient agrees to receive marketing texts and that consent is not a condition of purchase.

Express written consent can be captured electronically. A web form checkbox, an SMS keyword opt-in, or a digital signature all qualify as "written" under the E-SIGN Act. The key is that the consent must be documented and retrievable, not that it exists on physical paper.

What Makes Consent Valid

For consent to hold up legally, it must include several specific elements. Missing any of these can invalidate the entire consent, leaving you exposed to TCPA claims even if the recipient did technically agree.

• Business identification: The consent language must name your business or the entity that will be sending messages.
• Message type disclosure: The recipient must know whether they are signing up for marketing messages, transactional alerts, or both.
• Frequency disclosure: You must state how often the recipient can expect to receive messages (e.g., "up to 4 messages per month").
• Data rates notice: Include the standard "Message and data rates may apply" disclosure.
• Opt-out instructions: Tell the recipient how to stop messages (e.g., "Reply STOP to unsubscribe").
• Not a condition of purchase: For marketing consent, explicitly state that agreeing to receive texts is not required to make a purchase or receive service.

Common Consent Collection Methods

Web Form Opt-In

The most common method is a checkbox on a web form. The checkbox must be unchecked by default, and the consent language must appear near the checkbox, not buried in terms of service. A pre-checked box does not count as consent. The form should capture the timestamp, IP address, and the exact consent language shown at the time of submission.

SMS Keyword Opt-In

When someone texts a keyword like JOIN or SUBSCRIBE to your number, that text itself serves as consent, provided you immediately send back a confirmation message that includes your business name, message frequency, data rates notice, and opt-out instructions. This is called a single opt-in. Some businesses use double opt-in, where the confirmation message asks the recipient to reply YES to confirm, which provides even stronger consent documentation.

Point-of-Sale Consent

Collecting phone numbers at checkout or in-store requires the same disclosure language. A paper sign-up sheet or tablet form must clearly state that the customer is opting in to text messages, not just providing their phone number for order purposes. The most common mistake is collecting phone numbers for transactional purposes (like delivery updates) and then using them for marketing without separate marketing consent.

Consent Records and Documentation

Keep detailed records of every consent you collect. When a TCPA claim is filed, the burden of proof is on you to show that you had valid consent at the time you sent the message. Your records should include the date and time of consent, the method used (web form, keyword, paper), the exact consent language displayed, and any identifying information (IP address, device, location).

The platform automatically logs opt-in events with timestamps and the method used. For web form opt-ins, make sure your form submission process captures and stores the consent details alongside the contact record. See how to set up opt-in and opt-out for the technical implementation.

Consent Expiration and Revocation

Consent does not last forever. While the TCPA does not specify an exact expiration period, the FCC has indicated that consent becomes stale if you do not send any messages for an extended period (generally 18-24 months). If a subscriber has not heard from you in over a year, it is best practice to send a re-consent message before resuming regular campaigns.

Consent can be revoked at any time by any reasonable method. The subscriber can text STOP, call your business, email you, or tell you in person. You must honor opt-out requests regardless of how they are communicated. See how to handle STOP requests for automatic processing.