Clear SMS consent should tell shoppers who will text them, what they’ll receive, how often, and how to stop. Shoppers must make an active choice, separate from providing a phone number for delivery updates.
For mobile shoppers, that choice needs to stay readable beside the signup action, not disappear into tiny terms. Keep promotional permission separate from order updates.
Key Takeaways
- Separate promotional SMS permission from order updates, email subscriptions, and purchase terms.
- Show your business name, message purpose, frequency, rate disclosure, and STOP/HELP instructions before submission.
- Keep checkboxes unchecked, make disclosures readable on mobile, and record exactly what the customer accepted.
- Apply frequency limits across campaigns and automations, then suppress opted-out numbers promptly.
Set SMS Signup Consent Rules by Market
These are general compliance principles, not legal advice. Your recipients’ locations and messaging methods affect the rules.
United States: obtain written permission for covered marketing texts
The TCPA’s automated-messaging restrictions apply to covered marketing texts sent as automated text messages. Those texts require prior express written consent.
Electronic agreements can qualify, but the agreement must clearly authorize the sender. Consent under the TCPA can’t be a condition of purchase.
The FCC’s delivery restrictions under the TCPA address consent and revocation. A checkout phone field alone doesn’t establish promotional permission.
The TCPA’s statutory damages provisions allow $500 per violation, or actual losses if greater, potentially increasing to $1,500 for willful or knowing violations. The separate $10,000 criminal fine concerns the statute’s caller-ID provisions.
UK and EU: make consent specific and freely given
Under UK GDPR and PECR, consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes are invalid. Separate SMS permission from email marketing and unrelated purposes.
The ICO’s electronic marketing guidance explains the UK soft opt-in: collect details during a sale or sales negotiation, promote your own similar products, and offer an opt-out at collection and in every message.
In January 2024, the ICO fined HelloFresh £140,000 over more than 80 million marketing messages. Its consent wording omitted SMS and bundled marketing with age confirmation.
EU GDPR uses the same consent standard, while national electronic-marketing laws govern local requirements. Don’t assume the UK exception applies everywhere.
Design a Mobile Signup Form That Preserves Choice
A shopper should understand the exchange without opening another page. Privacy and terms links provide supporting detail; they shouldn’t carry the entire consent request.
Build the form in this order:
- Explain the offer and request the phone number with a persistent label and appropriate telephone autofill.
- Add a separate, unchecked SMS marketing checkbox. Place its disclosure above the submit button.
- Use a descriptive action such as “Subscribe to texts,” then show whether signup succeeded or confirmation remains pending.
At checkout, require a separate, affirmative choice for SMS opt-in consent, and keep the purchase button usable when marketing consent remains unchecked. Leave the SMS marketing checkbox unchecked by default, and keep it for promotional messages, separate from transactional messages such as shipping notifications.
For readability, start with 16-pixel body copy and generous spacing. Avoid pale gray disclosures, cramped line heights, and text hidden behind a tooltip. Let shoppers enlarge text without horizontal scrolling.
Make the checkbox label tappable and provide visible keyboard focus. Keep privacy links independently operable rather than letting a link tap accidentally toggle consent.
Also test the form with the mobile keyboard open. Sticky discounts and chat controls shouldn’t cover disclosures or errors. Preserve valid entries after validation failures, identify errors in text, and announce submission status to screen readers.
Write Signup Disclosures Customers Can Understand
Website and checkout wording
Keep the sender’s actual business name directly beside the consent wording. State the text message marketing purpose plainly, rather than using a vague label such as “Stay connected.”
These examples provide a starting point for the affirmative choice, alongside the named sender. They don’t guarantee compliance.
| Market | Example consent wording |
|---|---|
| US | “I agree to receive recurring automated promotional texts at the number provided. Consent isn’t a condition of purchase.” |
| UK | “I’d like SMS offers and product news from this business. I can withdraw consent at any time.” |
| EU | “I consent to SMS marketing about offers and product news from this business. I can withdraw consent at any time.” |
Pair the choice with a visible disclosure:
Up to 5 messages per week. Message and data rates may apply. Reply STOP to unsubscribe. Reply HELP for help.
Add accessible terms and privacy policy links nearby. These elements support clear expectations and messaging-program requirements; they aren’t all verbatim TCPA wording requirements.
Only promise five messages if your systems enforce that limit.
Text-to-join and QR signup patterns
Text-to-join lets shoppers send a keyword to a shortcode. The call to action must identify the business and explain the subscription before they send it.
Display the keyword, shortcode, promotional purpose, frequency, message and data rates, and opt-out instructions, including STOP/HELP details, together. A lone “Text JOIN” instruction doesn’t explain the agreement.
For QR codes, place essential context beside the code and repeat the complete disclosure on the destination form. Scanning a code isn’t consent.
Make Message Frequency an Operational Promise
“Message frequency varies” gives shoppers little sense of what they’re accepting. When possible, use a limit such as “Up to 5 messages per week” and define which messages count.
Your cap should cover promotional campaigns and triggered automations together. Otherwise, a welcome series, abandoned-checkout flow, and weekend sale can exceed the stated limit.
Coordinate channels too. A shopper shouldn’t receive email, SMS, and push notifications within the same hour for one price drop.
For product-specific subscriptions, explain whether you’re sending one alert or a short series. Our price drop alert signup guidance recommends keeping the request near the product decision and preserving the selected variant.
Keep that narrow permission separate from ongoing promotions. An alert for a saved size doesn’t authorize unrelated sale announcements.
Finally, carry the same frequency promise into the welcome message and preference center. If the program changes materially, obtain any fresh permission the change requires before expanding sends.
Keep a Consent Record You Can Explain
A subscriber status of “active” doesn’t explain how permission arose. Keep an audit trail of the signup journey, including the evidence behind that status and the disclosure version the customer saw.
Use this plain-English record structure.
| Record field | What to retain |
|---|---|
| Number and sender | The subscribed number and business authorized to text it |
| Date and time | The signup timestamp, including timezone |
| Collection method | Checkout checkbox, popup, keyword, or another specific route |
| Consent wording | Exact disclosure, frequency promise, and terms version shown |
| Affirmative action | Checkbox submission, inbound keyword, or confirmation reply |
| Online context | Source page, form version, and IP address where appropriate |
| Subsequent changes | Confirmation, preference updates, and opt-out timestamps |
The exact wording and affirmative action provide proof of consent. Retain a screenshot or saved form version alongside the text to show where the disclosure appeared and whether shoppers could see it before submitting.
Treat IP addresses as personal data, with controlled access and a defined retention policy. They’re useful supporting evidence, not a universal legal requirement.
When importing subscribers, preserve their original evidence. An import date records a database action, not the customer’s consent.
Make Opt-Out Work Across Every Sending System
Process STOP promptly and prevent queued campaigns or automations from sending further promotions. Recognize other clear withdrawal requests through supported channels rather than forcing customers to remember one exact word.
HELP should return a useful support route and identify the sender. An unsubscribe shouldn’t require an account login or a conversation with sales.
The FTC’s CAN-SPAM guidance allows 10 business days for email opt-outs. That email deadline doesn’t establish an SMS grace period. Under GDPR, honor marketing objections without delay and stop processing data for that purpose.
Keep marketing opt-out, subscription cancellation, and data deletion distinct. Our customer data deletion workflow explains how to preserve that distinction without redirecting shoppers away from their original request.
Keep suppression status consistent across your SMS platform, customer database, support tools, and imports by syncing them with one suppression list.
Frequently Asked Questions
How do single and double opt-in differ?
Single opt-in records one affirmative signup action. Double opt-in adds a confirmation text and a second action, such as replying YES.
That extra double opt-in step helps verify control of the number and filters mistyped entries. However, it also creates another point where interested shoppers may drop out.
With double opt-in, keep unconfirmed numbers out of promotional sends. Show “Confirmation pending” rather than “You’re subscribed” until the customer completes the process, and retain both actions in the consent record.
Can order-update numbers receive promotional texts?
A number provided only for delivery or order updates doesn’t, by itself, establish marketing permission.
Offer a separate promotional choice during checkout or through another permitted interaction. For older lists without adequate evidence, exclude unsupported records from promotional sends.
Don’t send an unsolicited marketing text asking people to grant permission for more marketing texts. Where an exception such as the UK soft opt-in applies, document the conditions supporting it.
Which signup metrics should teams watch?
Track confirmed subscribers alongside first-week opt-outs, complaints, and delivery failures. A higher signup rate can conceal unclear expectations.
Compare performance by form, placement, and disclosure version. Also inspect whether each route produces a complete consent record. Growth that depends on hidden terms or accidental selections creates a poor-quality list.
Build the Experience Around the Promise
Good SMS signup consent connects a clear customer choice to reliable sending controls. The disclosure, confirmation, frequency cap, and opt-out handling should describe the same program.
Start with one complete mobile journey, including errors and withdrawal. When shoppers understand the commitment and your systems honor it, signup becomes a dependable agreement rather than a source of surprises.
