← Back to blog

Four SMS Consent Elements US Marketers Must Capture to Avoid TCPA Risk

29 August 2026· 11 min read

Decorative title card illustration framing article title

For marketing texts to US mobile numbers, you need prior express written consent that names your company specifically. Informational messages, like appointment reminders, need a lower standard: prior express consent. The FCC and CTIA are your governing authorities here. If you cannot produce a recorded, company-specific opt-in for any promotional automation running today, pause it now.

TL;DR:

  • Businesses must obtain company-specific, verified consent for marketing messages, with explicit disclosures on message type, frequency, and opt-out instructions.
  • Electronic or written consent must include a clear signature, specific seller identification, and a distinct telephone number, avoiding pre-checked boxes or bundled agreements.
  • Marketers must keep detailed, timestamped records of all opt-ins, disclosures, and opt-outs for at least four years to defend against disputes or legal claims.
  • Campaigns must be scrubbed against the DNC registry, respect quiet hours, and be registered with carriers to prevent filtering or blocking by providers.
  • Operators of small venues and appointment businesses should embed opt-in disclosures directly into booking flows, automating opt-out handling and recordkeeping to ensure compliance.

Table of Contents

Quick compliance checklist: non-negotiables

Before touching another SMS campaign, run your program against this list. Every item here comes straight out of current FCC rule text, not industry rumour.

  • Prior express written consent for anything promotional or marketing-flavoured.
  • Prior express consent (the lower bar) is acceptable for purely informational or transactional texts.
  • Clear opt-in disclosures covering your business identity, message type, expected frequency, message and data rates, a no-purchase-necessary statement, and STOP/HELP instructions.
  • One-to-one consent only. A shared “opt-in to our partners” checkbox no longer satisfies the standard.
  • DNC scrubbing, quiet hours, and carrier registration need to run as ongoing operational tasks, not one-off setup steps.

Miss any one of these and you’re not “mostly compliant.” You’re exposed.

Diagram of four TCPA consent elements required

The TCPA, codified at 47 U.S.C. § 227, and the implementing regulation at 47 C.F.R. § 64.1200(f)(9), set the bar for prior express written consent. Four elements need to be present: a signed agreement (electronic signatures count), a clear and conspicuous disclosure of what the consumer is agreeing to, the specific seller named in that disclosure, and identification of the telephone number the consumer is authorising.

Electronic consent works fine, an unchecked checkbox the consumer actively ticks, a typed name paired with a clear disclosure, or a keyword reply to a clearly labelled campaign. What doesn’t work: pre-checked boxes (the consumer never took an affirmative action), buried consent language in a wall of terms and conditions, or bundled consent that lets one signature authorise texts from multiple unrelated companies.

Hand tapping unchecked consent checkbox on phone

That last point is where the ground shifted. The FCC’s Second Report and Order (FCC 23-107) closed what the industry called the lead-generator loophole: consent now has to be one-to-one, naming a single seller, rather than a blanket authorisation shared across a network of buyers. If your leads come from a comparison site or aggregator, that consent almost certainly no longer covers your texts unless it names your business specifically. Treat purchased lead lists as presumptively risky and demand company-specific consent records with verifiable metadata before you ever load a list into your sending platform.

Marketing vs informational/transactional messages

The line between these two categories decides which consent standard applies, so get the classification right before anything else. Marketing texts sell something: promotions, discounts, new product announcements, “come back and book again” nudges. Transactional or informational texts serve an existing relationship: appointment reminders, order confirmations, shipping updates, account alerts.

The FCC’s own guidance draws that distinction clearly, but the trap is in mixed messages. A booking confirmation that also plugs a seasonal discount tips into marketing territory.

When a message serves both purposes, treat it as marketing. That’s the conservative default, and it’s the one that survives a regulator’s scrutiny or a plaintiff’s lawyer combing through your message logs. Every message still needs a working opt-out, regardless of category.

Exact opt-in disclosure elements and sample language

Hand scrolling opt-in disclosure on smartphone

Regulators expect specific components to appear at the point of opt-in, not buried three clicks deep in a privacy policy. Your disclosure needs to state: your business name, the type of messages the consumer will receive, expected frequency (or a reasonable range), the standard “message and data rates may apply” line, a no-purchase-necessary statement where relevant, and STOP/HELP instructions.

Two web-form examples:

  • Transactional: “By providing your phone number, you agree to receive appointment reminders and booking updates from [Business Name] via SMS. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help.”
  • Marketing: “By checking this box, I agree to receive marketing text messages from [Business Name] at the number provided, including offers and promotions. Consent is not a condition of purchase. Msg frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe, HELP for assistance.”

Two keyword-join examples:

  • Transactional: Text “CONFIRM” to receive booking confirmations from [Business Name]. Reply STOP anytime.
  • Marketing: Text “JOIN” to receive exclusive offers from [Business Name]. Msg & data rates may apply. No purchase necessary. Reply STOP to cancel.

Pro Tip: Version-stamp every disclosure you publish. When your marketing text updates in six months, keep the old wording archived with a date range, so you can prove exactly what a consumer saw when they opted in, not just what your site says today.

Each channel needs its own capture method, and each one needs its own audit trail. Here’s what to log at the moment of opt-in:

  1. Web forms: capture the timestamp, the consumer’s IP address, the exact disclosure text displayed, and confirmation that the checkbox was unchecked by default and actively selected.
  2. SMS keyword joins: log the inbound message, the shortcode or long code used, the timestamp, and the campaign ID tied to that specific opt-in flow.
  3. Paper or in-person forms: keep a signed, scanned copy with the date and time of signature, stored alongside the digital records so everything lives in one searchable archive.
  4. Third-party lead sources: require contractual proof of company-specific consent, meaning the lead generator’s disclosure named your business by name, not just “our marketing partners.”

Skip any one of these and you’ve got a consent claim with no evidence behind it if a recipient disputes ever agreeing to hear from you.

Operational must-dos: opt-outs, DNC, quiet hours and carrier registration

Legal consent gets you in the door. Operational discipline keeps you compliant day to day and keeps carriers from throttling your traffic.

  • Honour STOP immediately. Any recognised opt-out keyword (STOP, UNSUBSCRIBE, CANCEL, QUIT, END) triggers an instant suppression, followed by exactly one confirmation-only reply. No follow-up “are you sure?” messages.
  • Scrub against the National Do-Not-Call Registry. DNC protections now extend to text messages, so marketing sends need list scrubbing before every campaign, not just at signup.
  • Respect quiet hours. Texts should land between 8am and 9pm in the recipient’s local time zone; some states impose narrower windows, so check state rules where you operate.
  • Register your campaigns. A2P 10DLC or short code registration, brand verification, and campaign approval through your carrier or platform are required for branded business-to-consumer traffic in the US. Skip this and your messages get filtered or blocked outright.

Recordkeeping and litigation defence: what to store and retention guidance

If a recipient disputes ever consenting, your records are the entire defence. For every opt-in and opt-out event, store: the timestamp, the exact disclosure text shown at that moment, the consumer’s phone number, the capture method (web form, keyword, paper), IP address where applicable, and the campaign or source ID.

Industry guidance points to retaining these records for at least four years, aligning with the TCPA’s statute of limitations and giving you a defensible buffer if a claim surfaces years after the fact. Store versioned snapshots of your disclosure language in an archive independent of your SMS sending platform. If you switch vendors, export everything, consent logs, opt-out history, and disclosure versions, before you migrate, and confirm the new platform can ingest historical records rather than starting your compliance clock from scratch.

State laws and litigation hotspots

Federal rules set the floor, not the ceiling. Several states run their own “mini-TCPA” statutes with stricter requirements, private rights of action, or higher statutory damages, and plaintiff’s firms have built entire practices around them. Florida, Oklahoma, and Washington have all seen elevated SMS-related litigation volume tied to state-specific consent or disclosure rules that go beyond federal baselines.

The practical fix: design your opt-in flow to meet the strictest applicable state standard, then apply that flow nationwide. Building fifty different consent processes for fifty states isn’t realistic for most businesses, but building one process that survives the toughest state review protects you everywhere else automatically. Keep a standing habit of checking state attorney general guidance and legislative updates each quarter, because this is an area where the ground shifts often.

Practical implementation for small venues and appointment businesses (Riddlio example)

A booking platform sits right at the point where this all gets tested in practice.

  • The opt-in disclosure sits directly in the booking checkout flow, not hidden behind a separate settings page.
  • Consent evidence, timestamp, disclosure version, and phone number, is stored and exportable, so venues can produce proof on demand.
  • STOP requests are processed automatically and logged, with the suppression applied across both reminder and marketing lists.

Pro Tip: If you run a venue and handle bookings manually today, check whether your current system separates informational and marketing sends at all. Many don’t, and that’s precisely where non-compliant blanket texts creep in.

Common pitfalls, red flags and a short quarterly audit checklist

Most compliance failures aren’t dramatic. They’re small process gaps that compound over months until a complaint or a legal notice forces a reckoning.

Frequent failures include pre-checked consent boxes, purchased contact lists with no company-specific opt-in, disclosure language that’s missing frequency or rate information, and inconsistent STOP handling across different message types. Watch for operational red flags too: a sudden spike in spam complaints, carrier rejections on your campaigns, or a rise in manual opt-out requests, all suggest something upstream has broken.

Run this quarterly:

  1. Pull a random sample of ten consent records and verify each one has a complete disclosure trail.
  2. Scrub your active list against the DNC registry and confirm the scrub actually ran.
  3. Check that disclosure language matches across every channel, web, keyword, and paper.
  4. Review your STOP handling logs for gaps or delays over the past quarter.

Why compliance protects deliverability and revenue

The businesses that treat SMS consent as a formality are the same ones that end up throttled by carriers or named in a demand letter. Conservative, documented consent isn’t friction. It’s what keeps complaint rates low enough that carriers keep delivering your messages at all.

Every dollar spent building proper consent capture and record retention is an insurance premium against a much larger loss, either in TCPA statutory damages or in a carrier quietly deprioritising your traffic. Audit your current opt-in flow this week, not next quarter.

— Iosif Beraru

Automate compliant reminders without losing the paper trail

Riddlio gives escape room operators a way to run SMS reminders that stay separated from marketing sends by design, so you’re never guessing which consent standard applies to which message. The platform captures opt-in disclosures directly inside the booking checkout flow, timestamps every consent event, and keeps an exportable record you can hand over if a customer or regulator ever asks for proof.

Riddlio

Automated SMS reminders reduce no-shows without forcing your team to manually track who opted in for what. STOP requests get processed and logged automatically, and consent records export cleanly if you ever need to change vendors. None of this replaces your own legal judgement, compliance remains the sender’s responsibility no matter what software you run, but it does remove the manual guesswork from the operational side. Check your booking flow’s opt-in setup against Riddlio’s SMS reminder feature this week and see where the gaps sit.

Sources

The FCC’s Second Report and Order (FCC 23-107) sets out the one-to-one consent standard in full. The Federal Register summary walks through the revised written-consent definition and recordkeeping expectations. FCC TCPA rule guidance explains the statutory basis. CTIA’s short-code handbook covers carrier-side operational rules, and the National Do-Not-Call Registry confirms how DNC protections apply to text messages.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

← Back to all posts