Most SMS compliance problems come from one misunderstanding: that having someone’s phone number is permission to text them. It is not. Consent to receive text messages is specific, has to be shown to the person at the moment they give it, and has to be recorded. This checklist explains what that means in practice for a US business, in plain English. It is not legal advice, and the details differ in other countries, but the structure is the same almost everywhere.
The rules come from three places. The Telephone Consumer Protection Act (TCPA) is the federal law; it requires prior express consent for automated texts and prior express written consent for marketing texts, and it is enforced through lawsuits with statutory damages per message. The CTIA Messaging Principles and Best Practices are the industry guidelines carriers apply. A2P 10DLC campaign vetting is where a reviewer checks your opt-in against those guidelines before carriers deliver your traffic. The checklist satisfies all three.
1. Know which kind of consent you need
Transactional messages (appointment reminders, order updates, account alerts, verification codes, customer-support replies) need prior express consent: the person gave you their number and agreed to receive those messages. Marketing messages (promotions, offers, newsletters, anything that sells) need prior express written consent: a clear disclosure, an affirmative action such as ticking a box or texting a keyword, and a record of it. “Written” includes electronic.
If you send both, collect both. The clean way is two checkboxes on the form, so that a patient can agree to reminders without agreeing to promotions. Marketing consent can never be a condition of buying or booking.
2. Show a complete disclosure at the moment of consent
The disclosure is the text the person sees when they agree. It must be visible in full next to the checkbox or in the call to action, not behind a link, a tooltip or a “read more”. It needs:
- The name of the business sending the messages.
- What they will receive (the message types).
- How often, or a statement that frequency varies.
- “Msg & data rates may apply.”
- How to opt out (reply STOP) and get help (reply HELP).
- That consent is not a condition of purchase (for marketing).
- Links to your privacy policy and SMS terms.
Seven elements, about 70 words. The opt-in language generator assembles them in the order reviewers expect.
3. Use a separate, unchecked, optional checkbox
On a web form, SMS consent lives on its own checkbox: unchecked by default, not required to submit, and not bundled with “I agree to the terms”. A pre-ticked box is not consent; a required box is not freely given consent; a box that also covers the terms is not specific consent. Carriers reject campaigns for all three, and courts have agreed.
The opt-in checkbox and form builder produces a form with those rules enforced in the HTML, in one-box and two-box versions.
4. Handle keyword opt-ins properly
If people can join by texting a keyword, the call to action where they see the keyword (a sign, a receipt, an ad, a web page) needs the same disclosure elements: business name, message types, frequency, rates, STOP and HELP. Then the first reply they get must confirm what they joined and repeat the essentials. Campaign reviewers ask for the keyword and the confirmation message word for word.
5. Send a confirmation message
Immediately after the opt-in, by form or keyword, send one message: the brand name, what they subscribed to, the frequency, “Msg & data rates may apply”, and how to reply HELP and STOP. Keep it inside one segment (160 GSM-7 characters) so it arrives as one bubble. This message is the person’s record of what they agreed to, and it catches wrong numbers before any marketing goes out.
6. Keep a record of every consent
For each subscriber, store: the phone number, the date and time, where the consent was collected (page URL, keyword, form name, location for paper), the exact disclosure text shown at that time, and the method (checkbox value, keyword received). If a complaint arrives a year later, this record is the whole defence. Form builders and messaging platforms can store most of it; make sure the disclosure text is versioned so you know what was shown on a given date.
7. Honour STOP, answer HELP, and keep both free
STOP (and the usual variants: STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) ends the subscription immediately. Send one confirmation and nothing else. HELP returns the business name and a way to reach support. Neither should cost the person anything beyond their plan, and neither should require a reply. Most platforms automate both; check that the automated replies name your business.
8. Say how often, and stick to it
Whatever the disclosure says about frequency is a promise. “Up to 4 messages per month” means four. If you cannot predict it, say “Message frequency varies” and keep the volume reasonable. Changing frequency materially is a change to the program; update the disclosure, the terms and the privacy policy.
9. Respect quiet hours
The TCPA restricts telemarketing calls and texts to between 8 a.m. and 9 p.m. in the recipient’s local time, and several states have tighter windows and holiday restrictions. Schedule marketing sends in business hours in the recipient’s time zone. Transactional messages such as a verification code the person just requested are different, but a reminder at 6 a.m. still annoys people.
10. Publish a privacy policy and SMS terms
The disclosure links to both, and both must exist, be public, and say specific things. The privacy policy needs an SMS section with the message types, frequency, rates, STOP and HELP, and the statement that mobile information will not be shared with third parties or affiliates for marketing. The terms describe the program: description, frequency, cost, opt-out, help, carrier liability, privacy link. The privacy policy generator and the SMS terms generator produce both from the same inputs.
11. Only message what they agreed to
Consent is for the program described in the disclosure. Someone who opted in to appointment reminders has not opted in to promotions, and someone who opted in to one brand has not opted in to a partner brand. Consent cannot be bought, sold or transferred with a customer list. If the program changes, collect new consent for the new part.
12. Make the opt-in visible to reviewers
If you register an A2P 10DLC campaign, the reviewer needs to see the opt-in. Put the form on a public page, or host a screenshot of gated, in-app or paper flows at a public URL, and describe every opt-in method in the campaign’s message flow. The call-to-action and message flow generator writes that description and the sample messages.
The checklist
Copy this into your ticket or project board and tick each line:
- Transactional and marketing consent are collected separately.
- The disclosure names the business, message types, frequency, rates, STOP and HELP, and says consent is not a condition of purchase.
- The disclosure is fully visible next to the checkbox or in the keyword call to action.
- The SMS checkbox is separate, unchecked and optional.
- Keyword opt-ins show the disclosure and get a compliant confirmation reply.
- A confirmation message goes out immediately after every opt-in.
- Each consent is recorded with number, timestamp, source and the disclosure text shown.
- STOP ends messaging immediately with one confirmation; HELP returns the brand and a contact.
- Frequency matches the disclosure.
- Marketing sends respect 8 a.m. to 9 p.m. recipient local time and state rules.
- Privacy policy has the SMS section and the no-sharing statement; SMS terms are published; both are linked from the form.
- Messages stay within the program people agreed to; no list sharing.
- The opt-in flow is public or documented with a hosted screenshot for campaign review.
Thirteen lines. A program that passes all of them is in good shape with carriers, with the registry, and with the law. The website compliance checker covers the website side of the same list as a scored audit.