Compliance
What a compliant SMS opt-in actually looks like
The six disclosures your call-to-action needs, the checkbox rules that trip everyone up, and how long you have to keep the evidence.
July 7, 2026·6 min read
Consent is the part of A2P messaging that people assume they already understand. Then a carrier asks them to produce proof for a specific recipient and they discover their CRM stored a boolean.
Consent belongs to one business and one program
Two properties of consent cause most of the trouble.
It is not transferable. Consent given to one business does not transfer to another. Buying a list, acquiring a company, or receiving numbers from a lead generator does not give you consent. This is why “we bought the list from a reputable vendor” is not a defence.
It is per use case. A patient who agreed to appointment reminders has not agreed to marketing. You need a separate, documented opt-in for each program. Stretching one consent across two message types is a common cause of both filtering and complaints.
The six things your call-to-action must disclose
Wherever you collect consent — a web form, a paper form, a phone script, a keyword — the recipient must see all of this before they act:
- Who is sending. Your brand or program name.
- What they will get. “Appointment reminders”, not “messages”.
- How often. “Message frequency varies” is acceptable. So is “up to 4 messages per month”.
- The cost disclaimer. The exact phrase “Message and data rates may apply”.
- How to stop. “Reply STOP to unsubscribe”.
- How to get help. “Reply HELP for help”.
Plus links to your terms and your privacy policy. Burying any of this in a general terms of service does not count — it has to be visible at the moment of consent.
The checkbox rules
For web forms, three rules cause most rejections:
Unchecked by default. A pre-checked box is not consent. This is not a grey area.
Not required to submit. If the form cannot be submitted without ticking the SMS box, that is a forced opt-in and the campaign will be rejected. Consent to marketing messages can never be a condition of purchase.
Separate from everything else. One checkbox that covers email, phone calls, and SMS together is not valid SMS consent. Messaging consent stands alone.
Two more that are easy to miss: the links to your terms and privacy policy have to sit adjacent to the checkbox, not just in the page footer, and the page must be publicly reachable over HTTPS without a login. Reviewers verify link placement on the live form.
A checkbox label that passes
By checking this box, I agree to receive recurring text messages from Northgate Dental at the mobile number provided, including messages sent by automated technology. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to unsubscribe. [Privacy Policy] [SMS Terms]
Every required element is present, in one place, before the person clicks.
Compare that to the version that gets rejected:
I agree to the Terms of Service.
General terms acceptance is not messaging consent, no matter what the terms say.
Consent collected off the web
Keyword. Record the exact keyword and the number it was sent to. “Text JOIN to 315-555-0142.”
Verbal. Record the script your staff read, containing all six disclosures, plus a dated record of the call. A summary of what was probably said is not evidence.
Paper. Keep a copy of the signed form with the disclosures visible on it. For registration, host an image of the blank form at a public URL.
Point of sale. Keep the displayed disclosure and the transaction record.
For anything collected outside a web form, send a double opt-in confirmation. It costs one segment and it converts a weak evidence trail into a strong one.
What you have to be able to produce
A carrier or aggregator can ask for proof of consent for any recipient, at any time, and expect it quickly. Failing to produce it can suspend the campaign and, in a bad case, the brand.
Store, per recipient:
- Timestamp of consent
- Source — the URL, the keyword, the form, the call
- IP address, for web opt-ins
- The exact disclosure text shown at that moment
- The full opt-out history
That fourth item is the one almost everyone misses. If you changed your form copy last year, you need to know which version each subscriber saw. Storing the rendered text at the time of consent is the only reliable way.
Keep all of it for the life of the subscription plus four years.
Revocation is broader than STOP
Since the FCC’s 2025 rules, a consumer can revoke consent by any reasonable method and you must honor it within 10 business days. That includes an email, a phone call to your office, a reply that says “stop texting me” rather than the exact keyword, or a request made to a staff member in person.
This is an operational problem more than a technical one. The person answering your phone has to have a way to get that request into the suppression list. If revocations can arrive on four channels and only one of them is wired up, you have a compliance gap that no platform feature will close for you.
Written by the compliance team at ANTHONY OLIVA, INC., a registered Campaign Service Provider with The Campaign Registry. If something here contradicts what your current provider told you, we are happy to talk it through on the phone.
