CampaignBuddyHQVisit Website →
← Back to blog

Avoid $500–$1,500 Per Text: SMS Opt In Rules for U.S. Businesses

September 6, 2026
Avoid $500–$1,500 Per Text: SMS Opt In Rules for U.S. Businesses

Sending promotional text messages to U.S. mobile numbers requires prior express written consent that names the specific sender, under the TCPA and FCC rules that took effect January 27, 2025. Informational or transactional texts need a lighter standard called prior express consent. Either way, you need a written disclosure the recipient agreed to, a working opt-out, and a record proving all of it happened.

TL;DR:

  • Only specific sender names and clear disclosures are acceptable, with opt-in proximity and visible font size, especially for marketing texts, to ensure enforceability.
  • Marking a message as informational or transactional lowers consent standards, but mixing content may inflate compliance risk and require higher consent levels.
  • Maintaining thorough records, including exact disclosure texts, timestamps, and opt-out logs, for at least five years is essential for legal defense.
  • Violating TCPA rules by sending unsolicited marketing texts or ignoring opt-out requests can lead to damages up to $1,500 per violation, risking millions on large campaigns.
  • Industry filters by carriers and CTIA enforce stricter deliverability standards, emphasizing honest opt-in language, honest frequency disclosures, and speedy opt-out handling to prevent blocking.

Table of Contents

What laws and agencies actually control SMS opt-in rules

The Telephone Consumer Protection Act, codified at 47 U.S.C. §227, is the backbone of every SMS opt-in requirement in the country. It restricts automated calls and texts to mobile numbers unless the recipient gave consent first, and the Federal Communications Commission writes the rules that spell out what "consent" actually means in practice.

The biggest recent shift came from the FCC's one-to-one consent order. Before it, a single checkbox on a lead-gen site could authorize dozens of unrelated companies to text the same person, all riding on one vague opt-in. That model is dead. The FCC's implementation of the rule requires consent to name one specific seller per opt-in, closing the loophole lead aggregators had used for years.

The FTC doesn't enforce the TCPA directly, but it polices deceptive marketing practices and publishes disclosure guidance that overlaps heavily with SMS compliance, including its CAN-SPAM guidance on clear and conspicuous disclosures. State attorneys general have also gotten aggressive, filing their own suits under mini-TCPA statutes in states like Florida and Washington. Meanwhile, CTIA, the wireless industry's trade group, sets the practical rules carriers use to filter traffic. You can be perfectly legal under the TCPA and still get blocked if you ignore CTIA's expectations. DoNotCall.gov mainly governs telemarketing calls, but many compliance teams check it anyway when building suppression logic across channels, since a number on the national registry is a signal worth respecting even outside its strict legal scope.

What laws and agencies actually control SMS opt-in rules — overview diagram

Not every text needs the same level of permission, and mixing this up is one of the fastest ways to get sued.

Prior express written consent is required for any message with marketing or advertising content sent using an autodialer or prerecorded voice technology, which courts read broadly to include most bulk SMS platforms. This standard demands a signed agreement, physical or electronic, that clearly authorizes the specific sender to send marketing texts, discloses that consent isn't a condition of any purchase, and doesn't require a signature for anything else. A checkbox with clear language next to a "Sign Up" button counts, as long as it isn't pre-checked.

Comparison of written and express SMS consent

Prior express consent covers informational and transactional messages: appointment reminders, shipping notifications, fraud alerts, account updates. This bar is lower. Simply giving a business your number in the context of a transaction can qualify, without a separate signed disclosure. According to TermsFeed's breakdown of TCPA consent standards, the distinction hinges entirely on content, not on how the recipient feels about the message.

Mixed-content messages are where teams get careless. A shipping update that ends with "and don't forget our sale this weekend" just became a marketing message, and now it needs the higher consent standard. When in doubt, default to written consent. It covers both categories, and the lesser standard doesn't cover you the other way.

Disclosure language and three opt-in templates you can use today

A compliant opt-in disclosure needs several specific elements sitting together, not scattered across a page or buried in a terms link.

  • The name of the specific business sending the texts, not a generic brand umbrella
  • A clear description of what the program does (deals, alerts, reminders, appointment confirmations)
  • Message frequency, clearly stated to inform recipients of how often they might receive messages
  • The phrase "Msg & data rates may apply"
  • A link to your privacy policy and terms of service
  • Opt-out instructions ("Text STOP to cancel") and a note that HELP gets support
  • A statement that consent isn't required to make a purchase

Here are three templates built around those elements.

Web form checkbox: "By checking this box, I agree to receive marketing text messages from [Business Name] at the number provided. Consent is not a condition of purchase. Msg & data rates may apply. Msg frequency varies. Reply STOP to cancel, HELP for help. View our [Privacy Policy] and [Terms]."

Text-to-join promo copy: "Text JOIN to 55555 for [Business Name] deals. By texting JOIN, you agree to receive recurring marketing texts. Msg & data rates may apply. Message frequency varies. Reply STOP to cancel, HELP for help."

Point-of-sale receipt text: "Get exclusive offers from [Business Name]! Text SAVE to 55555. Msg & data rates may apply, recurring msgs, consent not required for purchase. Text STOP anytime."

Placement matters as much as wording. The disclosure has to sit near the phone number field or the opt-in action itself, in a font size and color a normal person would actually notice, not in six-point gray text under the submit button.

Every channel that captures a phone number needs its own defensible process, and they don't all work the same way.

  1. Web forms should log the exact disclosure text shown at the moment of signup, since that copy might change later and you need proof of what the person actually saw.
  2. Keyword or text-to-join campaigns need the carrier's short code or long code documented, along with the exact autoresponder flow triggered.
  3. QR codes at events or storefronts should route to a mobile-optimized form with the same disclosure standard as any other web form.
  4. Checkout and point-of-sale opt-ins need a timestamp tied to the transaction and a record of the exact screen or receipt language the customer saw.
  5. Paper forms or e-signature capture should be scanned or stored digitally with the signature date, since paper alone is easy to lose and hard to search under pressure.
  6. Social lead ads need the ad creative and landing page archived together, because platforms change ad formats and you'll need to reconstruct exactly what the user agreed to.

For every method, capture the timestamp, source channel, IP address where applicable, the exact form copy displayed, and the checkbox state at submission. Store confirmation message logs alongside the original opt-in record, not in a separate system nobody checks.

Pro Tip: Screenshot every version of your opt-in form the day you launch it, and again after every edit. Consent disputes often happen a year or more later, and "the form probably said something like that" is not a defense.

Confirmation messages and when double opt-in makes sense

A confirmation message has to be boring on purpose. No sale mentions, no product photos, no urgency language. It should restate the program name, remind the recipient of frequency, include "Msg & data rates may apply," and give STOP and HELP instructions. That's it.

A basic flow looks like this: the customer texts JOIN. Your system replies, "Thanks for joining [Business Name] alerts! Msg frequency varies. Msg & data rates may apply. Reply STOP to cancel, HELP for help." That reply is the confirmation, not a second ask.

Double opt-in adds a step: after the initial signup, the recipient gets a message asking them to reply YES or JOIN again before messages start flowing. It isn't legally required, but Mailchimp's guidance on SMS consent frames it as a strong operational safeguard, since it filters out mistyped numbers and gives you a second timestamped record if a consent dispute ever surfaces. It's especially worth the friction on purchased or rented lists, high-volume lead-gen funnels, and political or advocacy lists where consent quality varies wildly by source, a point echoed in Campaign Buddy HQ's own analysis of texting versus calling for voter contact.

Opt-out handling: keywords, HELP, and suppression logic

Opt-outs have to work instantly, every time, with no exceptions for "but they still owe us money" or "this is a different list." Carriers and courts treat a delayed or ignored STOP as a serious violation on its own, separate from any consent issue.

  • Recognize STOP, END, CANCEL, UNSUBSCRIBE, and QUIT as valid opt-out keywords, regardless of capitalization or punctuation.
  • Suppress the number immediately across that program, not on a nightly batch job that runs hours later.
  • HELP replies must include the program name, a customer service contact (phone, email, or short code), and repeated opt-out instructions.
  • Keep opt-out logs timestamped and separate from your general activity logs, so you can prove exactly when suppression happened.

The trickiest part is program-level versus global suppression. If someone texts STOP to your promotional list, that shouldn't automatically silence your separate appointment-reminder system, and vice versa, unless your disclosure said otherwise. But if you run multiple campaigns off one number pool, build in a check that prevents a suppressed number from getting accidentally re-imported into a new list next quarter. This happens constantly with merged spreadsheets, and it's one of the more preventable ways businesses end up back in the same list they just got kicked off of, according to CTIA's messaging best practices.

What records to keep and for how long

If a consent dispute ever reaches a courtroom, your records are the whole case. Keep:

  • The exact opt-in disclosure text shown, with a timestamp
  • Channel metadata (form URL, short code, QR destination, POS terminal)
  • Confirmation message logs
  • Opt-out requests and suppression timestamps
  • Any revocation or re-subscription history for that number

Retention guidance from compliance specialists generally points toward keeping these records for at least five years, since TCPA claims can surface well after the original text was sent. Export logs in a searchable format, not a scanned PDF pile, so legal counsel can pull a specific number's history in minutes instead of days.

Pro Tip: Build a simple naming convention for your consent records now, before you need it under deadline pressure from a demand letter.

Penalties, enforcement risk, and the mistakes that cause them

TCPA violations carry statutory damages of $500 per text, rising to $1,500 per text if the violation is found willful or knowing. Multiply that across a list of ten thousand numbers and a single bad campaign turns into a seven-figure exposure fast, which is exactly why plaintiffs' firms actively hunt for class-action-ready fact patterns.

The mistakes that create that exposure are almost always the same handful. Aggregated consent from third-party lead lists, where nobody can prove the recipient agreed to hear from you specifically. Pre-checked opt-in boxes, which several courts have already rejected as invalid consent. Continuing to send after a STOP request, sometimes because two systems weren't synced. Vague disclosures that never actually named the sender or described the program.

The fix is an honest audit: pull your current lists, verify each number has documented named-sender consent, test your STOP-word handling end to end, and rewrite any disclosure language that hedges on frequency or sender identity.

CTIA and carrier rules that affect deliverability

Being legally compliant and being deliverable are two different problems. Carriers run their own filtering on top of whatever the law requires, and CTIA's Messaging Principles and Best Practices is the document they build that filtering around.

Short codes get more scrutiny during registration but generally support higher volume once approved. Long codes (10DLC) are cheaper and faster to set up but face stricter throughput limits and closer monitoring for spam-like patterns. Carriers watch complaint rates, opt-out ratios, and content patterns in real time, and a program that's technically legal can still get throttled or blocked if its complaint rate creeps up. Keeping that rate low means clean opt-in language, honest frequency disclosures, and fast opt-out processing, the same fundamentals that keep you out of court also keep your messages actually landing.

A compliance checklist for political campaigns and advocacy groups

Campaign texting has its own wrinkles the FCC's general framework doesn't spell out cleanly. Donation asks are marketing messages, full stop, and need written consent naming the campaign or committee. GOTV reminders often qualify as informational, but the moment one includes "chip in $5 before midnight," it's crossed into promotional territory, a distinction Campaign Buddy HQ's field guide on voter contact treats as a constant judgment call rather than a fixed rule.

Build separate opt-in flows for donors, volunteers, and general supporters, since each group's consent needs to name the specific committee texting them. Store proof the same way any business would: timestamp, form copy, and channel, ideally alongside your supporter list organization system. Set a firm internal policy that vendors and volunteer sign-up sheets can't feed numbers into your texting program without documented consent attached, and audit purchased or merged lists before every cycle rather than after a complaint arrives.

Why conservative compliance pays off in the long run

Campaigns treat consent capture as paperwork until the first wave of complaints hits a carrier's filter and half the list stops getting delivered. That's usually when the "we'll clean it up later" list actually costs someone their volunteer texting program mid-cycle.

The honest lesson from watching campaigns operate is that tight consent isn't just legal insurance, it's a deliverability strategy. Lists built on real, documented opt-ins generate fewer complaints, which keeps carriers from throttling your sends right when you need volume most, during the final GOTV push. Treat your consent infrastructure with the same seriousness you'd give your voter file. Audit it before the cycle heats up, not after a demand letter shows up.

— Billy

How Campaign Buddy HQ keeps your outreach compliant by default

This platform is built around the exact workflow this article just described, so your team isn't reconstructing consent proof from memory after the fact. This platform logs outreach activity, including texts, alongside supporter records, which means the timestamp, channel, and message content tied to each contact live in one searchable place instead of scattered across spreadsheets and old phone exports.

Campaignbuddyhq

That matters most during a tight GOTV window, when a mislabeled donation ask or a missed STOP request can quietly throttle your entire texting program right when you need it working. Daily and weekly planning tools also help organizers separate donor asks, volunteer outreach, and GOTV reminders into distinct workflows, which makes it far easier to apply the right consent standard to each one rather than treating every list the same way. Pair that with the supporter list building guidance and the campaign compliance checklist already on the blog, and you've got a real operational system instead of a folder of screenshots. Start a 7-day free trial with no credit card required and see how your current outreach data maps into it.

Sources