Text Message Marketing Consent and Revocation Protocols
SMS compliance hinges on verifiable express written consent and immediate, automated revocation protocols to avoid statutory damages.
Text message marketing has evolved into the highest-converting channel for modern businesses, boasting open rates that email can rarely match. However, this intimacy comes with a strict legal price tag. Unlike email, where an “opt-out” model often suffices under CAN-SPAM, SMS marketing operates under an “opt-in” regime governed by the Telephone Consumer Protection Act (TCPA). The distinction is critical: silence is not consent, and a pre-existing business relationship does not automatically authorize promotional texts. The courts treat the mobile inbox as a protected space, and the penalties for intrusion are calculated per violation, often leading to class-action settlements that cripple unprepared organizations.
The operational reality is that compliance breaks down not in policy, but in execution. A marketing manager might upload a list of customers who “consented” via a checkout checkbox, only to realize too late that the disclosure language didn’t explicitly mention automated text messaging. Or, a customer might reply “quit” instead of “STOP,” and a rigid software filter fails to unsubscribe them, triggering a violation for every subsequent message. These process gaps—between legal intent and technical implementation—are where liability thrives.
This guide dissects the compliance architecture required to run a high-volume SMS program without inviting litigation. We will move beyond basic “do not call” rules to cover the specific evidentiary standards for Prior Express Written Consent (PEWC), the nuances of carrier-imposed filtering (10DLC), and the rigorous audit trails needed to defend against “professional plaintiffs” who bait companies into non-compliant texting.
Compliance checkpoints for high-risk SMS campaigns:
- The “Clear and Conspicuous” Standard: The disclosure must be immediately adjacent to the signup button, unbundled from other terms, and explicitly state that consent is not a condition of purchase.
- Double Opt-In (DOI): While not strictly required by the TCPA, carriers heavily favor DOI to prevent “subscription bombing” and it serves as the strongest evidence of intent in court.
- Revocation Recognition: Your system must process natural language opt-outs (e.g., “I don’t want these,” “wrong number”) and not just the standard keyword “STOP.”
- The Abandoned Cart Trap: You cannot text a customer about an abandoned cart unless they explicitly checked a box for marketing SMS earlier in the flow; inputting a number for shipping is not marketing consent.
See more in this category: Digital & Privacy Law
In this article:
Last updated: October 24, 2025.
Quick definition: SMS Compliance refers to the adherence to federal laws (TCPA) and carrier guidelines (CTIA) governing the solicitation, frequency, and content of text messages, centered on obtaining Prior Express Written Consent (PEWC) and honoring opt-outs.
Who it applies to: Any business, non-profit, or entity sending automated text messages (marketing, alerts, or notifications) to consumers, regardless of the sender’s size or the platform used (short code, toll-free, or 10DLC).
Time, cost, and documents:
- Visual Consent Proof: A “session replay” or snapshot of the webform as seen by the user (TrustedForm/Jornaya certificate).
- Terms & Conditions: A dedicated mobile terms page linked directly from the sign-up disclosure.
- Privacy Policy: Explicitly stating that mobile numbers will not be shared with third parties/affiliates for marketing.
- Statute of Limitations: TCPA claims can be brought up to 4 years after the violation; records must be kept longer than this window.
Key takeaways that usually decide disputes:
Further reading:
- Scope of Consent: Consent for “order updates” does not legalize “flash sale” texts. Scope creep is a primary litigation driver.
- Burden of Proof: The sender bears the burden of proving consent was obtained. If your records are missing or ambiguous, you lose.
- Systemic Failures: Class actions often arise not from a single rogue text, but from a software glitch that ignores opt-outs for thousands of users simultaneously.
Quick guide to SMS Marketing Compliance
Navigating the text message landscape requires satisfying two masters: the federal government (legal compliance) and the mobile carriers (delivery compliance). A campaign might be legal but blocked by Verizon or AT&T if it violates their acceptable use policies, or it might be delivered perfectly but result in a lawsuit because the consent wasn’t “written.”
- Written Consent is Non-Negotiable: For marketing texts, you need a digital or physical signature (E-Sign Act compliant) where the user agrees to receive automated messages. A pre-checked box is invalid.
- The Disclosure Block: Before the user hits “Submit,” they must see text stating: “By signing up, I agree to receive recurring automated marketing text messages from [Brand] at the number provided. Consent is not a condition of purchase. Msg & Data rates may apply.”
- SHAFT Restrictions: Carriers strictly regulate content related to Sex, Hate, Alcohol, Firearms, and Tobacco (SHAFT). Violating this leads to immediate blocking of your sending number or short code.
- Identity is Mandatory: Every message (or at least the first one in a thread) must clearly identify the sender (e.g., “BrandName: Thanks for subscribing!”). “Unknown” senders have high complaint rates.
Understanding SMS Consent in practice
The core of SMS compliance is the concept of Prior Express Written Consent (PEWC). Unlike email, where you might infer consent from a business card drop or a purchase, SMS demands a deliberate, documented action. In practice, this means the user interface (UI) of your signup form is a legal document. If the disclosure text is hidden below the “Subscribe” button, or if the font is too small to be easily read on a mobile screen, the consent can be voided in court. The legal standard is whether a “reasonable consumer” would understand they are agreeing to receive texts.
Furthermore, the distinction between Transactional and Promotional messaging is rigid. Transactional messages (shipping notifications, password resets) require only “Prior Express Consent,” which can be satisfied by the user simply providing their number in a relevant context. Promotional messages (coupons, new arrivals, cart reminders) require the higher standard of PEWC. A common operational failure occurs when marketing teams mix these streams—adding a “10% off your next order” coupon to a shipping confirmation text. This “poisoning the well” converts a transactional message into a promotional one, triggering the need for written consent that may not exist.
Carrier filtering algorithms add another layer of complexity. Carriers like T-Mobile and AT&T monitor “throughput” (messages per second) and content “fingerprints.” Even if you have perfect legal consent, sending the exact same message to 100,000 people in one minute will likely trigger a spam filter. Modern compliance involves “snowshoeing” (spreading traffic) or using registered 10DLC (10-digit long code) routes to ensure deliverability.
Hierarchy of Consent Evidence (Best to Worst):
- Level 1 (Gold Standard): Third-party certificate (e.g., Jornaya/TrustedForm) capturing a video replay of the user’s interaction, showing the disclosure was visible and the box was unchecked by default.
- Level 2 (Strong): Double Opt-In (DOI) timestamp logs where the user replied “YES” to a confirmation text from their handset.
- Level 3 (Weak): Internal CRM logs showing a “True” value in the consent column with a timestamp. (Easily fabricated, often challenged).
- Level 4 (Indefensible): “They bought from us so they consented” or imported lists without origin data.
Legal and practical angles that change the outcome
The jurisdiction of the recipient matters, particularly regarding “Mini-TCPA” laws in states like Florida, Washington, and Oklahoma. These state laws often impose stricter rules than the federal TCPA, such as limiting the hours during which texts can be sent (e.g., 8 AM to 8 PM) and defining “autodialers” more broadly. A nationwide campaign sent at 9 PM EST is 6 PM PST (safe for California), but 9 PM in Florida (violation). Smart platforms now use “time-zone intelligence” to queue messages and release them only during legal windows for each specific area code.
Documentation quality is the firewall against class certification. In a dispute, a plaintiff will allege they never saw the disclosure. If the defendant can produce a precise backend log showing the exact version of the webform active at that millisecond, along with the IP address and browser type, the claim often dissolves. Conversely, companies that constantly change their webforms without archiving the code for each version find themselves unable to prove what the user saw three years ago.
Workable paths parties actually use to resolve this
When a violation is alleged—usually via a demand letter from a plaintiff’s firm—the first step is an internal audit. The company must verify: Was the number on the list? Did they opt out? Was the opt-out processed? If the audit reveals a clear failure (e.g., the user texted “STOP” and received a marketing blast two days later), settlement is often the only rational financial path due to strict liability.
However, if the dispute is about the *validity* of the consent, companies often fight back using the “Terms of Service” defense. If the user agreed to Terms that include an arbitration clause and a class action waiver, the company can move to compel individual arbitration. This strategy effectively kills the class action potential, reducing the liability from millions of dollars to a few thousand for a single claim.
Practical application of compliant SMS workflows
Building a compliant SMS list is not about restricting growth; it is about building a sustainable asset. A list built on clear consent converts better and lasts longer than one built on trickery. The workflow below ensures that every number in your database is legally safe to text.
- Design the Intake Point: Create a webform or checkout step. Place the compliance text directly above the CTA button. Ensure the checkbox is unchecked by default.
- Capture the Proof: Integrate a compliance script (like TrustedForm) that generates a unique certificate ID for every submission. Store this URL in your CRM alongside the phone number.
- Trigger the Confirmation (DOI): Send an immediate text: “BrandName: Reply Y to confirm subscription to our alerts. Msg&Data Rates May Apply.” Do not add marketing content to this message.
- Wait for the Handshake: Only move the number to the “Active_Marketing” list once the “Y” reply is received. If no reply, do not text them again.
- Process the Opt-Outs: Configure your SMS gateway to listen for “STOP,” “CANCEL,” “QUIT,” “UNSUBSCRIBE,” and “END.” Upon receipt, immediately trigger a final “You are unsubscribed” message and blacklist the number in the database.
- Regular Hygiene: Every 90 days, run your list against the Reassigned Numbers Database (RND) to purge numbers that have been disconnected and reassigned to new owners who did not consent.
Technical details and relevant updates
The technical landscape of SMS is dominated by 10DLC (10-Digit Long Code) regulations. The major US carriers now require all businesses sending texts over standard 10-digit numbers to register their “Brand” and “Campaign” with The Campaign Registry (TCR). Failure to register results in severe throttling or total blocking of messages. This registration process involves vetting the business’s tax ID and declaring the use case (e.g., “Marketing,” “2FA”).
Record retention is a technical necessity that often gets overlooked. The Statute of Limitations for TCPA is generally 4 years. Therefore, your database retention policy must be set to keep consent logs, opt-out logs, and message content for at least 5 years to be safe. “Deleting” a contact who unsubscribes is a mistake; you should “suppress” them but keep the record of when and how they unsubscribed to prove compliance later.
- Opt-Out Keywords: While “STOP” is standard, systems must also recognize common typos or sentence-based refusals if using AI-driven conversational SMS.
- Frequency Caps: The disclosure often says “up to 4 msgs/month.” Technically exceeding this cap is a contract violation and can be used as evidence of unfair practices, though rarely a standalone TCPA violation.
- Link Shorteners: Avoid public shorteners like bit.ly. Carriers flag these as spam. Use branded short domains (e.g., brand.sms/xyz) for better deliverability and trust.
Statistics and scenario reads
The data reveals a bifurcation in the SMS market: compliant brands see high engagement, while non-compliant brands face increasing blocking rates and legal threats. The metrics below highlight the operational reality of managing SMS channels today.
Consumer Response Distribution
50%
Consumers who simply ignore or delete threads; low risk but low value.
35%
Healthy list hygiene; signifies a functioning compliance loop.
15%
The danger zone; high rates here trigger carrier audits and blocking.
Compliance Impact Indicators
- Carrier Pass Rate: 98% (Registered 10DLC) → 75% (Unregistered). Registration is no longer optional for delivery.
- Litigation Risk: 1 in 10,000 (With TrustedForm) → 1 in 500 (Purchased Lists). Proof of consent is the primary deterrent.
Monitorable Metrics
- Opt-Out Rate (%): Spikes >3% per campaign indicate content fatigue or consent mismatch.
- Delivery Rate (%): Should remain >95%. Drops suggest carrier filtering or bad data.
- Churn vs. Growth: If opt-outs exceed new signups, the program is cannibalizing the audience.
Practical examples of SMS Compliance
Scenario A: The Perfect Opt-In (Defensible)
Context: A shoe retailer adds a popup to their site. It asks for a phone number for “VIP Access.”
The Execution: Below the field, clear text says: “By signing up via text, you agree to receive recurring automated marketing messages from ShoeBrand at the cell number used when signing up. Consent is not a condition of any purchase. Msg & data rates may apply. View Terms & Privacy.”
Why it holds: The consumer cannot miss the terms. The consent is “written” via the click, and “automated” is explicitly disclosed.
Scenario B: The “Checkout” Ambush (Liable)
Context: A customer buys a blender. They enter their phone number in the “Shipping Information” section.
The Execution: The brand takes this number and immediately starts sending “Smoothie Recipe” marketing texts twice a week. They argue the customer “gave them the number.”
Why it fails: Providing a number for shipping is consent only for shipping updates. Using it for marketing exceeds the scope of consent. This is a textbook class-action trigger.
Common mistakes in Text Marketing
Buying “Opt-In” Lists: There is no such thing as a compliant purchased SMS list. Consent is non-transferable. Texting these numbers is an instant violation.
Ignoring “Time of Day” Rules: Sending texts at 8:00 AM EST hits users in California at 5:00 AM. This violates “quiet hours” regulations in multiple states.
Humanizing the Bot: Pretending a bot is a real person (“Hey, it’s Sarah from Marketing!”) can violate truth-in-advertising laws if the interaction is fully automated.
Failing to confirm Opt-Outs: Not sending the final “You have been unsubscribed” message leaves the user unsure and likely to report the number as spam to their carrier.
Using Shared Short Codes: Sharing a number with other businesses poses a risk; if one bad actor gets the code blocked, your compliant program goes down with them.
FAQ about SMS Compliance
Is Double Opt-In (DOI) legally required by the TCPA?
Strictly speaking, no. The TCPA requires “Prior Express Written Consent,” which can be satisfied by a single compliant webform. However, the CTIA (Carrier Association) strongly recommends DOI as a best practice to verify that the person entering the number actually owns the handset.
From a defense perspective, DOI is invaluable. If a plaintiff claims they never signed up, showing a log where they replied “YES” from their own phone is practically irrefutable evidence, whereas a web log alone can be challenged as a “bot” submission.
Can I text my existing email subscribers if I have their phone numbers?
Generally, no. Unless those subscribers explicitly checked a box saying they agree to receive text messages specifically, you cannot cross-pollinate consent. Consent for email marketing does not translate to consent for SMS marketing.
The best approach is to send an email campaign inviting them to sign up for texts (e.g., “Text JOIN to 12345 for exclusive updates”). This creates a new, clean record of consent specific to the SMS channel.
What happens if a customer replies with “Stop please” instead of just “STOP”?
Your system must honor it. The FCC has ruled that consumers can revoke consent using any “reasonable” means. A rigid system that only accepts the exact keyword “STOP” and ignores “quit,” “cancel,” or “please stop” is non-compliant.
Using Natural Language Processing (NLP) or manual review for unrecognized replies is recommended. If a human reads “stop please” and fails to remove the number, the company is liable for subsequent messages.
How often can I text my customers?
There is no hard legal cap on frequency, provided you stay within the “reasonable” expectations set by your disclosure (e.g., “approx. 4 msgs/mo”). However, excessive messaging is the #1 cause of opt-outs and spam reports.
If you drastically exceed the frequency stated in your terms (e.g., sending 5 texts a day when you promised 4 a month), you could face claims for unfair business practices or breach of contract, in addition to damaging your brand reputation.
Can I text a customer who abandoned their cart if they haven’t bought yet?
Only if you collected their phone number earlier in the checkout flow with specific consent for marketing. Many platforms capture the number as it is typed. If the user leaves before checking the “marketing” box, you cannot text them.
The “abandoned cart” text is considered a marketing message, not a transactional one. Therefore, it requires Prior Express Written Consent. Relying on “implied” consent because they started a purchase is a high-risk strategy.
Do B2B texts require the same consent as B2C texts?
Yes, if sent to a mobile phone using an automated system. The TCPA protects the “called party” (the subscriber), and courts have held that business cell phones are protected just like personal ones.
While the National Do Not Call Registry has exemptions for B2B calls, the ban on automated texts without written consent applies broadly. Cold-texting business leads is extremely risky and generally violates carrier policies as well.
What constitutes an “automated system” (ATDS) today?
Following the Supreme Court’s Facebook v. Duguid ruling, the definition of an ATDS narrowed to systems that use a random or sequential number generator. However, many state laws (like Florida’s) have broader definitions that include systems that “automatically select and dial.”
Prudence dictates assuming your text platform is an autodialer. Even if it technically isn’t under federal law, proving that in court is expensive. Obtaining consent covers you regardless of the technology definition.
Do I have to include “STOP to opt out” in every single message?
Carriers recommend including opt-out instructions frequently, but not necessarily in every single SMS if it breaks the conversational flow or character limit. However, it must be in the first message and at regular intervals (e.g., once a month).
Omitting the instructions does not remove the user’s right to opt out. If they reply “STOP” and you didn’t tell them they could, you still have to honor it. Best practice is to append “Txt STOP to end” to all marketing broadcasts.
What is the “Safe Harbor” for reassigned numbers?
The FCC established a Reassigned Numbers Database (RND). If you scrub your list against this database and it tells you a number has not been reassigned, you are shielded from liability if you text it and it turns out it was reassigned.
To claim this safe harbor, you must prove you queried the database before sending the message. If you don’t use the RND and text a number that now belongs to someone else, you are strictly liable for that violation.
Can I use a contest or sweepstakes to build my SMS list?
Yes, but the disclosure must be explicit. You cannot say “Text WIN to 12345 to enter” and then secretly subscribe them to weekly marketing blasts. The disclosure must say “Enter to win AND agree to receive marketing texts.”
If the text messaging aspect is purely for the contest (e.g., notifying the winner), you cannot pivot to marketing afterwards without a separate, distinct consent for that ongoing relationship.
References and next steps
- Audit Your Webforms: Immediately verify that your legal disclosure is visible, un-checked, and explicit about “automated marketing messages.”
- Register for 10DLC: Ensure your brand is registered with The Campaign Registry (TCR) through your SMS provider to avoid carrier blocking.
- Test Your Opt-Out: Personally text “STOP,” “QUIT,” and “CANCEL” to your own campaign to ensure the suppression logic works instantly.
Related reading:
- Digital & Privacy Law
- Understanding the CTIA Messaging Principles and Best Practices.
- The impact of Florida’s Mini-TCPA on national SMS campaigns.
- Differences between Short Codes, Toll-Free, and 10DLC routes.
Normative and case-law basis
The primary federal statute is the Telephone Consumer Protection Act of 1991 (47 U.S.C. § 227), which prohibits the use of automated equipment to call or text mobile numbers without consent. The Federal Communications Commission (FCC) issues binding declaratory rulings that interpret these rules, such as the 2015 Omnibus Ruling confirming that SMS messages are “calls” under the TCPA.
Additionally, the Telemarketing Sales Rule (TSR) enforced by the FTC sets standards for telemarketing conduct. Industry self-regulation is governed by the CTIA (Cellular Telecommunications Industry Association), whose “Messaging Principles and Best Practices” dictate the acceptable use policies enforced by mobile carriers. While CTIA guidelines are not law, violating them results in service termination, which is functionally a death sentence for an SMS program.
For official regulations and updates, consult the Federal Communications Commission (FCC) www.fcc.gov or the CTIA www.ctia.org.
Final considerations
SMS marketing compliance is a dynamic discipline that requires constant vigilance. The days of “blast and pray” are over, replaced by a regime of rigorous permission and hygiene. While the legal environment is hostile to errors, it rewards brands that respect the intimacy of the channel. A compliant program is not just a legal shield; it is a trust signal to your customers that you value their attention and their privacy.
Remember that consent is not a “forever” asset; it degrades over time. If you haven’t texted a customer in six months, re-engaging them carries risk. Treat your SMS database like a garden: weed out the opt-outs, nurture the active users with relevant content, and respect the boundaries set by the law to ensure long-term fruitfulness.
Key point 1: Prior Express Written Consent is mandatory for marketing; “implied” consent does not exist for SMS promo.
Key point 2: Revocation is absolute; honor “STOP” and similar requests immediately to avoid strict liability.
Key point 3: Document everything; retain proof of what the webform looked like at the moment of signup.
- Review the “clear and conspicuous” placement of your disclosures.
- Scrub your list against the Reassigned Numbers Database quarterly.
- Train customer service to handle manual opt-out requests instantly.
This content is for informational purposes only and does not replace individualized legal analysis by a licensed attorney or qualified professional.