SMS consent management: collect, store and honor opt-outs

Consent is what separates a welcome text from an unwanted one. It’s also the part of business texting that’s easiest to get wrong as a team grows: a checkbox that changed wording last spring, an opt-out that one rep saw but another didn’t, an automation that kept sending after someone replied “stop please.”

This guide covers SMS consent management end to end: the types of consent, how to collect it, what evidence to keep, how STOP, START and HELP should work, quiet hours and how to handle revocations. This is general information, not legal advice. Rules change and depend on your situation, so check with a lawyer for your specific use case. For a shorter overview of the basics, see TCPA-friendly texting.

The three levels of consent

The CTIA Messaging Principles and Best Practices (May 2023) are the wireless industry’s voluntary guidelines; individual carriers and providers may add their own requirements on top. They describe three types of business messages and the consent each calls for (CTIA):

Type	Example	Consent level	How it’s given
Conversational	A lead texts “Do you do gutter guards?” and you reply	Implied	The consumer started the exchange and you only respond with relevant information
Informational	Appointment reminders, “your quote is ready”	Express consent	Over text, on a form, on a website or verbally
Promotional	“Spring aeration slots are open, book this week”	Express written consent	Signing a form, checking a box online or otherwise agreeing in writing

CTIA also says senders are expected to get consent to receive messages generally, get express written consent specifically for marketing messages, and make sure people can revoke consent.

What the FCC means by written consent

For telemarketing, FCC rules define prior express written consent as an agreement in writing, bearing the signature of the person, that clearly authorizes the seller to deliver advertisements. The agreement must include a clear and conspicuous disclosure, and the person “is not required to sign the agreement (directly or indirectly)” as a condition of purchasing any property, goods or services (47 CFR § 64.1200). The rule says a signature can include an electronic or digital form of signature, to the extent it’s recognized as valid under applicable federal law or state contract law, and CTIA’s examples of written consent include checking a box online.

How to collect consent

Most small businesses collect SMS consent in one of four places. Each needs a slightly different approach.

Web forms. Add a separate SMS consent checkbox, unchecked by default and not required to submit. Put the disclosure right next to it, not in your terms. CTIA says a call-to-action should make people aware of the program description, the number texts come from, who is sending, opt-in terms and any fees, and other terms like how to opt out and the privacy policy. The web forms guide covers form design.

Inbound texts. When someone texts you first, replying to their question is conversational. If you want to add them to recurring texts, ask and get a clear yes.

Phone calls. Verbal consent can support informational texts. Note it on the record right away, with who took it and what was said.

In person. A sign-up sheet or tablet at a job site, open house or trade show. Keep the paper or the record.

A sample disclosure for a form:

Yes, text me about my request, including scheduling updates and reminders, from Greenline Lawn Care. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. Consent is not a condition of purchase.

Use a separate checkbox if you also want permission for promotional texts.

Confirm recurring programs

For recurring messages, CTIA recommends a confirmation text before anything else, including the program name, customer care contact or HELP instructions, how to opt out, that messages are recurring and how often, and any fees.

What evidence to store

If a consumer, carrier or court ever asks, you need to show who agreed, to what, when and how. CTIA says senders should retain, where applicable:

• the timestamp of consent,
• how it was collected (web form, paper sign-up, SMS keyword and so on),
• the experience used to get consent (the exact language and the action taken),
• the specific campaign the opt-in was for,
• the IP address used,
• the phone number consent covers, and
• who consented (a name or other identifier such as a session ID).

Two habits make this evidence trustworthy:

1. Version your consent wording. When you change the checkbox text, keep the old version and record which version each person saw.
2. Store consent per channel. Agreeing to email doesn’t mean agreeing to texts, and texting consent doesn’t cover WhatsApp.

CTIA also says an opt-in “should not be transferable or assignable” and applies only to the sender and campaign it was obtained for, and that senders should not use rented, sold or shared opt-in lists.

STOP, START and HELP

Keywords are how most people manage their consent by text.

STOP and other opt-out words

The FCC’s 2024 order on revoking consent says that using “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel” or “unsubscribe” in a reply text is a per se reasonable means to revoke consent (FCC). Other wording counts too if a reasonable person would understand it as a request to stop, so “please don’t text me anymore” is an opt-out even though it’s not a keyword. CTIA likewise says normal-language requests should be read and acted on, and that capitalization and punctuation shouldn’t matter.

The confirmation message

FCC rules allow one confirmation text that “merely confirms” the revocation and contains no marketing. If it’s sent within five minutes of the request, it’s presumed to fall within the person’s prior consent; later than that, the sender has to show the delay was reasonable (47 CFR § 64.1200). After that, stop.

Example: “Greenline Lawn Care: You’re unsubscribed and won’t receive more texts. Reply START to resubscribe.”

HELP

HELP should return who you are and how to get support or opt out. Texting providers ask for your opt-in, opt-out and help messages as part of 10DLC campaign registration. Twilio’s registration fields, for example, include an opt-out message that acknowledges the request and confirms no further messages will be sent, and a help message (Twilio). See the 10DLC registration guide.

START

A resubscribe keyword such as START lets someone opt back in after STOP. Record the new opt-in with its own timestamp, just like the first one.

Honoring revocations everywhere

Under FCC rules, people may revoke consent “using any reasonable method,” revocations must be honored “within a reasonable time not to exceed ten business days,” and senders “may not designate an exclusive means” to revoke (47 CFR § 64.1200). CTIA adds that senders should support opt-out by phone call, email or text.

What that means operationally:

• An opt-out anywhere updates the record. A rep who hears “stop texting me” on a call updates SMS consent before hanging up.
• Every send checks consent. Manual messages, templates, bulk sends and automations alike.
• Opt-outs beat assignments. If a lead is reassigned, the new rep inherits the opt-out.
• Keep the history. Don’t delete opted-out contacts; you need the record that they said no.
• Clean your numbers. CTIA recommends processing phone-number deactivation files regularly and removing deactivated numbers from opt-in lists.

Quiet hours

FCC rules bar telephone solicitations to residential subscribers before 8 a.m. or after 9 p.m. local time at the called party’s location (47 CFR § 64.1200), and some states are stricter. Configure quiet hours in the recipient’s time zone, not yours, and let automated messages wait rather than send at 6 a.m.

How Exa helps

Exa stores consent per channel (email, SMS, WhatsApp and calls) with its source and evidence. Exa’s lead capture forms include per-channel consent checkboxes and store the evidence when someone submits, along with the page URL and referrer.

STOP, START and HELP replies update consent automatically, and opted-out numbers are blocked server-side, so neither a rep nor an automation can text someone who opted out. Quiet hours are applied in the recipient’s time zone, and automated messages wait for the window to open. Audit logs record creates, updates and deletes with old and new values, the user, IP and user agent, which helps when you need to show what changed and when.

Final thoughts

Good consent management is mostly good record-keeping plus automatic enforcement. Ask clearly, store the evidence, check consent before every send, and stop the moment someone says so, however they say it.

If you do one thing this week, look at your lead form. Make sure the SMS checkbox is optional, unchecked, specific about what you’ll send, and that your system stores exactly what each person agreed to.