Every compliant messaging program stands on a concrete opt-in flow: the actual form, keyword, or script through which a human agreed to receive your texts. Campaign reviewers ask you to describe it and then go looking for it. This guide gives working patterns per channel; for the underlying legal/carrier rules, see our consent requirements guide.
The elements every flow needs
- A clear disclosure at the point of collection: who will text, what kind of messages, how often (or "recurring"), "message and data rates may apply", and how to opt out.
- An affirmative act: an unchecked checkbox ticked, a button pressed, a keyword sent. Pre-checked boxes are non-compliant.
- Optionality: consent to marketing texts cannot be a condition of purchase or of receiving the service.
- A privacy policy link nearby, and that policy must cover SMS data properly.
- A record: store what was agreed to, when, and from where (timestamp, IP, form version).
Pattern 1: Website form / newsletter signup
Below the phone field, an unchecked checkbox:
☐ I agree to receive recurring marketing text messages from Trailhead Outfitters at the number provided. Consent is not a condition of purchase. Msg frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe, HELP for help. See our Privacy Policy and Terms.
Keep the checkbox separate from the email/newsletter consent, because bundled consent is not valid SMS consent.
Pattern 2: E-commerce checkout
Same disclosure pattern, placed with the phone number field at checkout (visibly, not buried in linked terms). The phone field itself can be required for delivery purposes; the marketing texts checkbox must remain optional and unchecked. Transactional order updates can rest on the purchase relationship; promotional texts need this separate checkbox.
Pattern 3: SMS keyword ("Text JOIN to …")
The subscriber initiates, which makes keywords the cleanest consent, but the advertisement of the keyword must carry the disclosure:
Text SAVE to (512) 555-0100 to get Trailhead deals by SMS. Recurring msgs. Msg & data rates may apply. Reply STOP to cancel, HELP for help. Terms & Privacy: trailheadoutfitters.com/sms
And the confirmation reply should restate it:
Trailhead Outfitters: You’re in! You’ll get up to 4 msgs/month with deals & alerts. Msg & data rates may apply. Reply STOP to cancel, HELP for help.
Will your website pass carrier review?
Paste your URL into our free AI scanner and get an instant PASS / WARN / FAIL compliance report. No signup needed.
Run a free compliance scanPattern 4: Paper forms and in-person
Intake forms, event sign-ups, loyalty cards: print the same disclosure next to the phone field with its own checkbox or initial line. Photograph/scan and retain the forms; they are your consent records. A phone number written on a form without SMS language is not consent to text it.
Pattern 5: Verbal / phone scripts
Verbal consent for informational texts is workable if scripted and logged:
"Would you like appointment reminders by text at this number? You can reply STOP anytime to cancel; message and data rates may apply." Log the yes with date/time and agent.
For marketing, written consent (web/paper/keyword) is the safe standard: TCPA requires prior express written consent for marketing to mobiles; a verbal yes does not satisfy it.
Describing the flow in your registration
In the campaign form, name the mechanism and where it lives: "Customers opt in via an unchecked checkbox at checkout (trailheadoutfitters.com/checkout) and via the SAVE keyword advertised in-store; disclosure language and privacy policy at trailheadoutfitters.com/sms." Specific, verifiable, consistent with your description: that is what passes. Then make sure it is actually visible on the site: our free scanner checks exactly that before a reviewer does.
Frequently asked questions
Is a pre-checked consent box ever acceptable?
No. Both TCR reviewers and TCPA case law expect an affirmative act: the subscriber must actively check the box, press the button, or send the keyword. Pre-checked boxes invalidate the consent.
Can I text people who gave me their number before I set up compliant opt-in?
Only if their original consent already met the standard for the message type. Legacy lists with unprovable or absent SMS consent should be re-permissioned through another channel (email: "click to receive our texts") before texting.
Do I need double opt-in?
It is not universally mandated, but a confirmation message (with program name, frequency, and STOP instructions) is standard practice, strongly recommended for marketing, and reviewers view it favorably. Some flows and providers require it.