What a compliant SMS opt-in disclosure needs
In the United States, the Telephone Consumer Protection Act (TCPA) requires prior express consent for automated texts, and prior express written consent for marketing texts. The CTIA Messaging Principles and Best Practices, which carriers enforce through 10DLC campaign vetting, spell out what the consent moment should show. The result is a short, consistent checklist:
- The name of the business sending the messages.
- A description of the messages the person will receive, such as appointment reminders or promotions.
- How often messages will arrive, or a statement that frequency varies.
- The phrase "Msg & data rates may apply" or equivalent wording.
- How to opt out (reply STOP) and how to get help (reply HELP).
- A statement that consent is not a condition of purchase, when the texts are promotional.
- Links to a privacy policy and terms that are specific about SMS.
The generator puts all seven elements in a single paragraph of about 70 words, which is short enough to sit next to a checkbox without being hidden behind a "read more" link. Reviewers want to see the full text at the moment of consent.
The checkbox must be unchecked, and separate
A pre-ticked box is not consent. Regulators, carriers and courts have all taken the view that the person must take an action, so the generated HTML never includes the checked attribute. It also leaves out the required attribute: marketing consent cannot be a condition of completing a purchase or booking, so the form must submit without it.
Keep SMS consent on its own checkbox rather than bundling it with "I agree to the terms". If you send both transactional messages (order updates, appointment reminders) and marketing messages, the cleanest approach is two checkboxes with two disclosures, or one disclosure for transactional messages and a separate marketing opt-in. The message types you tick in the generator should match what the checkbox actually covers.
Why the privacy policy clause matters for 10DLC approval
When you register a 10DLC campaign, the registry and the carriers check the privacy policy linked from your form. A common rejection reason is a policy that says mobile numbers may be shared with third parties for marketing. The clause produced here includes the two sentences that platforms such as Twilio and Telnyx recommend: that no mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and that text messaging opt-in data and consent are excluded from any sharing categories listed elsewhere in the policy.
Place the clause in a clearly labelled SMS section of your existing privacy policy, host the policy on the same domain as the form, and link to it from the disclosure. If the form is on a landing page, the privacy and terms links should be visible on that page without scrolling past the submit button.
Honouring STOP and answering HELP
The disclosure promises that STOP ends messages and HELP gets assistance, so the program behind it has to deliver. Most messaging platforms handle STOP automatically and send a confirmation. Your HELP reply should name the business, give a way to reach support and remind people how to opt out. For example: "Acme Dental: for help contact support@example.com or call 555-0100. Reply STOP to unsubscribe."
Keep a record of each consent: the phone number, the timestamp, the page or form used and the exact disclosure text shown at the time. If a complaint arrives months later, that record is what shows the consent was valid. The SMS character counter can help keep your HELP and confirmation messages inside a single segment.
Outside the United States
The structure of the disclosure travels well, but the legal details change. In the United Kingdom, the Privacy and Electronic Communications Regulations (PECR) and UK GDPR apply, and marketing texts to individuals generally need opt-in consent. Canada’s anti-spam law (CASL) requires express consent for commercial messages and specific identification of the sender. Australia’s Spam Act requires consent, sender identification and a working unsubscribe facility. In each case, adjust the frequency and opt-out wording to local conventions and have a local adviser check it. The text from this generator is a starting point, not legal advice.