In This Guide:
- Where SMS consent is required for outreach
- When your website needs opt-in language and when it does not
- What carriers and platforms verify before they approve business texting
The Simple Truth We Tell Clients
If you want to text people from a business number, you need consent, and you need proof.
The confusion arises because two overlapping systems are at play. There are the legal consent frameworks (TCPA and FCC rules), and carrier and platform standards (A2P 10DLC, vetting, and deliverability). They are related, but not identical.
Where SMS Consent Is Required for Outreach
Consent is required any time you initiate texts to someone’s mobile number, especially when the messages are automated or sent at scale.
In practice, the level of consent you need depends on what you are sending. Transactional and informational messages are treated differently from marketing messages, and the FCC is explicit that certain automated calls and texts require consent, with stricter standards for telemarketing.
Here is what that looks like in real life.
Transactional or conversational examples include appointment reminders, schedule changes, and replying to an inbound question. These usually rely on the customer giving you their number for that purpose, along with a clear opt-out path.
Marketing examples include promotions, offers, “we miss you” campaigns, and broadcast announcements. These are the ones that most often require written opt-in and the ones that trigger vetting questions during A2P 10DLC registration.
When Your Website Needs Opt-In Language and When It Does Not
You do not need an SMS consent checkbox on your website just because you text customers.
You need it when your website is one of the places where you collect phone numbers and treat that as permission to text. Carriers and messaging providers commonly require opt-in language wherever you collect mobile numbers for an SMS program, and they reject registrations that do not clearly explain what the user is opting into.
If your consent is collected somewhere else, your website does not have to pretend it is the opt-in source. You still need to show how consent is collected and documented, which can be via verbal consent captured in a CRM, paper intake forms, or a text-to-join flow, depending on your business.
What SMS opt-in usually includes:
- A clear statement that the user agrees to receive SMS messages from your business
- A short description of message types and a frequency statement (often “varies”)
- “Message and data rates may apply”
- STOP and HELP instructions, plus links to your Privacy Policy and Terms near the consent language
What SMS Outreach Is For
SMS is best when the message is expected, relevant, and tied to a real relationship.
That is why carriers care so much about consent and why consumers complain when businesses treat texting like email. A2P 10DLC exists largely to reduce spam and increase accountability in business messaging.
SMS outreach is for:
- Two-way support conversations (customers can reply and get help)
- Operational updates like reminders and scheduling confirmations
- Account or service notices tied to an existing customer relationship
- Marketing messages only when the customer explicitly opted in for marketing
What Carriers and Platforms Actually Verify Before You Text Customers
Even if you think your legal footing is fine, your texts can still get blocked, or your registration can get rejected.
Most business texting programs now use A2P 10DLC vetting, and providers often review your consent method, sample messages, and public policy pages. If your consent flow is vague, the opt-out is unclear, or your website does not match what you claimed during registration, approval becomes harder.
This is also where the “do I need it in my footer” advice comes from. It is often framed as a legal requirement, but more commonly, it is a practical best practice tied to carrier review and frictionless compliance.
What we verify before you text customers:
- Your opt-in source is real and can be evidenced (web form, text-to-join, intake form, documented verbal consent)
- Your STOP and HELP flows work and are described clearly in your message program
- Your website policy pages exist and match your claimed use case
- Your messaging content matches your use case and is not vague or misleading
- Your recordkeeping can show when and how the person opted in
What to Put in Your Privacy Policy
A privacy policy is not just a checkbox for the footer. It is one of the main artifacts, and providers look at it when deciding whether your program is trustworthy.
If you collect phone numbers and text, your privacy policy should state what you collect, how you use it, and with whom you share it. Providers and compliance checklists also commonly require clear language stating that SMS consent is not sold or shared for marketing purposes.
A clean, plain line that usually satisfies reviews is:
“SMS consent is not shared with third parties or affiliates for marketing purposes.”
Common Questions, Answered Clearly
Do we need SMS consent language on every page of the site?
No. If the website is not collecting SMS consent, you do not need checkbox language everywhere. But your privacy policy should still be easy to find, and if you do collect consent on a form, the consent language should live next to that form.
If someone gives us their number, can we text them?
Sometimes, for transactional and conversational messages tied to the reason they gave you the number. If you are sending marketing messages, treat them as a separate permission and collect explicit opt-ins.
What if we only text from a single local business number?
That still counts. Local 10-digit numbers are exactly what A2P 10DLC is designed to regulate for business texting.
Is “Reply STOP to opt out” actually required?
For most business texting programs, yes. Carrier best practices emphasize opt-out support, and providers routinely require STOP and HELP instructions as part of the call-to-action and message flow.
FAQ
What counts as “marketing” SMS?
Marketing is any text meant to sell, promote, or advertise, including promotions and announcements. Informational texts are about an existing transaction or relationship, like a reminder or an update.
Do we need “message frequency varies” and “msg and data rates may apply”?
Most carrier-aligned best practices and provider templates include both disclosures, and they commonly appear in approval requirements. They reduce complaints and make opt-in more explicit.
Can our opt-in be verbal?
It can be, but it is harder to defend if you cannot prove it. CTIA-aligned best practices emphasize documenting consent with timestamps, the medium used, and the language shown or spoken.
Do we need separate “SMS Terms” on the website?
Not always, but it often helps approvals because it gives carriers and providers a single place to see STOP, HELP, message types, and program basics. Many platform checklists treat it as a practical requirement even when the law does not.
What is A2P 10DLC in one sentence?
It is the US carrier standard for business texting over local 10-digit numbers, designed to reduce spam by requiring brand and campaign registration and clear opt-in and opt-out behavior.
