SMS Opt-In Consent: How to Collect, Record and Honor Permission

Text messages get read. That’s why businesses love SMS marketing, and why regulators, carriers, and customers watch it closely. A single text sent without proper consent can lead to complaints, carrier filtering, and in some cases legal claims.

The good news: a compliant opt-in process isn’t complicated. It’s a set of clear habits applied every time. Below is a practical setup you can reuse for your own business or for each client account your agency runs.

This article is general information, accurate to our understanding as of 2026. It is not legal advice. SMS rules come from federal law, state law, and carrier policies, and they change. Consult a qualified attorney for your specific situation.

The three layers of SMS rules

It helps to know where the rules come from:

1. Federal law. The Telephone Consumer Protection Act (TCPA) and FCC rules govern many automated calls and texts. Marketing texts generally require prior express written consent.
2. State law. Several states have their own telemarketing and texting laws, some stricter than federal rules on consent, timing, and frequency.
3. Carrier and industry rules. Wireless carriers and industry guidelines, such as those from CTIA, set expectations for consent, opt-out handling, and content. A2P 10DLC registration asks you to describe your opt-in process, and carriers can filter traffic that doesn’t follow the rules.

A good opt-in process is designed to satisfy all three at once.

What “consent” should look like

For marketing texts, aim for consent that is:

• Express: The person actively agrees. No pre-checked boxes.
• Written: Captured in a form, keyword reply, or other record you can store. Electronic signatures and checkboxes generally count.
• Specific: Clear about who will text them and what kind of messages.
• Separate: Not a condition of purchase. Customers should be able to buy without agreeing to marketing texts.
• Documented: Stored with a timestamp, source, and the exact language shown.

Writing clear consent language

Your consent disclosure should tell people what they’re signing up for. A solid disclosure usually includes:

• The business name
• The type of messages (for example, offers, reminders, updates)
• That messages may be sent using automated technology
• That consent is not a condition of purchase
• Expected message frequency
• A note that standard carrier message and data charges may apply
• How to opt out (reply STOP) and get help (reply HELP)
• Links to terms and privacy policy

Here’s an example for an invented fitness studio, Ironleaf Fitness:

☐ Yes, I agree to receive recurring automated marketing and reminder text messages from Ironleaf Fitness at the number provided. Consent is not a condition of purchase. Up to 6 msgs/month. Msg & data rates may apply. Reply STOP to unsubscribe, HELP for help. See our Terms and Privacy Policy.

Note the unchecked box. The person must actively check it.

Opt-in methods and how to use them

Method	How it works	Best practices
Website form	Checkbox next to phone field	Unchecked by default, full disclosure next to the box, store the page URL
Keyword text-in	Customer texts a keyword like JOIN to your number	Send an immediate confirmation with disclosures
In-person / paper	Signup sheet or tablet at the counter	Include full disclosure, store the record digitally
Online checkout	Optional checkbox at purchase	Keep separate from order terms, never required
Verbal (phone)	Customer agrees on a call	Generally weaker for marketing; follow up with a written confirmation text and keep a record

Whatever the method, send a confirmation message right after opt-in. It sets expectations and gives an easy way out:

Ironleaf Fitness: You’re subscribed to texts about classes and offers. Up to 6 msgs/mo. Msg & data rates may apply. Reply HELP for help, STOP to cancel.

Some businesses use a double opt-in, asking the person to reply YES to confirm. It isn’t always required, but it strengthens your records and filters out mistyped numbers.

Transactional vs. marketing messages

Not all texts are treated the same. A reminder about an appointment someone booked is different from a promotional offer. In general:

• Transactional or informational messages (appointment reminders, order updates, replies to inquiries) usually need a lower level of consent, such as the customer providing their number for that purpose.
• Marketing messages (promotions, discounts, “come back” campaigns) generally require prior express written consent.

The safest approach is to collect consent for both at the right moments, and to track which consent each contact has given. Don’t take a number provided for appointment reminders and start sending promotions.

Opt-out handling

Consumers must be able to stop messages easily. Current FCC rules say people can revoke consent through any reasonable means, not just by texting a specific keyword. In practice:

• Honor STOP and common variations like UNSUBSCRIBE, CANCEL, END, and QUIT automatically.
• Honor plain-language requests too. “Please stop texting me” should be treated as an opt-out.
• Act quickly. Process opt-outs promptly; federal rules set a maximum window, and faster is better.
• Send one confirmation of the opt-out, then no further marketing messages.
• Sync opt-outs across tools so a contact who opted out in one place isn’t texted from another.
• Support HELP with a reply that includes the business name and how to get assistance.

Timing and frequency

Quiet hours matter. Federal rules restrict telephone solicitations to between 8 a.m. and 9 p.m. in the recipient’s local time, and some states set narrower windows or limit how many messages you can send in a day. A simple policy that works in most places: schedule marketing texts during normal daytime hours in the contact’s time zone, and keep frequency in line with what you promised in the disclosure.

Record keeping

If a complaint ever comes up, records are your defense. For each contact, store:

• Phone number and name
• Date and time of consent
• Source (form URL, keyword, location)
• Exact consent language shown
• IP address or device info for web forms, where available
• Opt-out date, if any

Keep records for several years. Many businesses keep them at least as long as the relevant statutes of limitations; ask your attorney what’s right for you.

Example: an agency rolls out consent across clients

Maple Street Media, an invented agency, manages SMS for a dozen local businesses, including a salon, a dental office, and a pet groomer. Each client collected phone numbers differently. Some used paper forms, some used online booking, and one had imported an old customer list with no consent records at all.

Maple Street standardized the process:

1. Built one form template with an unchecked SMS consent box and adjustable business name and frequency.
2. Separated consent types with tags like “sms-reminders” and “sms-marketing,” applied automatically on form submission.
3. Added a confirmation text triggered by each opt-in, using workflow automation.
4. Quarantined the imported list. Contacts without documented marketing consent were excluded from promotional campaigns. The client could still invite them to opt in through non-SMS channels, like email or in-store signage.
5. Documented each client’s opt-in flow for their A2P 10DLC campaign registration.

The result was a consistent, explainable process across every account, and cleaner campaign registrations.

How this fits with registration

When you register an A2P 10DLC campaign, carriers ask how people opt in. A well-built process makes that section easy to write and credible to reviewers. See our guide on A2P 10DLC registration for the full walkthrough. On SaaSVisionary, SMS and campaigns are available from the Pro plan, and every plan includes unlimited contacts with tags and custom fields to track consent type and source.

Key takeaways

• SMS rules come from federal law, state law, and carrier policies. Design for all three.
• Use unchecked boxes, clear disclosures, and a confirmation text for every opt-in.
• Track transactional and marketing consent separately.
• Honor STOP and any reasonable opt-out request quickly, and sync opt-outs everywhere.
• Keep detailed consent records. This is general information as of 2026, not legal advice.

FAQ

Can I text customers who gave me their number when they bought something?

It depends on the message. Transactional texts about their purchase are generally fine. Marketing texts usually require prior express written consent, which a purchase alone doesn’t provide. Ask for marketing consent separately with a clear, optional checkbox. This is general information, not legal advice.

Do I need double opt-in for SMS marketing?

It isn’t universally required, but it’s a strong practice. Having the person reply YES confirms they own the number and want messages, and it creates a clear record. Many businesses use single opt-in with a confirmation message, which is often acceptable if disclosures are complete.

Can I import a list of phone numbers and send a promotion?

Only if you have documented consent for marketing texts from each person on the list. Purchased lists and old customer lists without consent records are high risk and can harm your carrier reputation. Invite those contacts to opt in through other channels instead.

What should my HELP message say?

Keep it short. Include the business name, what the messages are about, how to reach support (phone or email), and how to opt out. For example: “Ironleaf Fitness: Class and offer alerts. Call (555) 010-2030 for help. Reply STOP to cancel.”

How long should I keep SMS consent records?

Keep them for several years. Many businesses match or exceed the relevant statutes of limitations for consumer protection claims. Store the timestamp, source, exact language, and opt-out history. Ask your attorney for a retention period that fits your situation.