Every business texting program rests on a simple question with a layered answer: did this person agree to receive this message? US law (TCPA and FCC rules), carrier policy (CTIA Messaging Principles and Best Practices), and registration regimes (10DLC, toll-free verification) all ask it, and they grade the answer on a sliding scale. Marketing needs the strongest form of consent; replying to a customer who texted first needs the weakest.
This article covers the operational layer: consent tiers as the industry treats them, opt-in construction, record-keeping, STOP and HELP mechanics, revocation timing, and quiet hours. It is a hygiene reference, not legal advice, and the underlying statute is covered separately in TCPA.
The three consent tiers
The industry converged on three practical tiers. They blend TCPA doctrine with CTIA best practice, and the boundaries matter: sending marketing on informational consent is the single most common compliance failure in small-business texting.
| Consent tier | What it permits | Example |
|---|---|---|
| Express written consent | Marketing and promotional messages. A signed or affirmatively checked agreement that names the sender, says marketing texts will arrive, and states that consent is not a condition of purchase. | A customer checks an unticked box on a checkout page reading “I agree to receive marketing texts from Acme at this number. Consent is not a condition of purchase. Msg&data rates may apply.” |
| Express consent | Informational and transactional messages to a number the customer knowingly provided for that purpose: appointment reminders, order updates, account alerts. | A patient gives a phone number when booking and is told the clinic texts appointment reminders to it. |
| Implied / conversational | Replying within a conversation the customer started, on the topic they raised, for a reasonable window. | A customer texts “are you open today?” and the business texts back the hours. That thread does not authorize next month’s promotion. |
What a compliant opt-in looks like
Carriers review opt-in flows during campaign registration, and a weak flow is a common rejection reason. A complete opt-in, whether a web form, a keyword, or a paper form, discloses the same set of facts:
- Program description: who is sending and what kind of messages (“Acme appointment reminders,” “Acme offers and updates”).
- Message frequency: a number (“up to 4 msgs/month”) or an honest characterization (“message frequency varies”).
- The phrase “message and data rates may apply.”
- HELP and STOP disclosure: “Reply HELP for help, STOP to cancel.”
- A link to the program’s terms and privacy policy, and the privacy policy should state that mobile opt-in data is not shared with third parties for their marketing.
For keyword opt-ins (“text JOIN to this number”), the same disclosures move into the call-to-action where the keyword is advertised and into the confirmation message the subscriber receives after texting in.
Proof and record-keeping
Consent that cannot be proven functions like consent that was never given. TCPA litigation and carrier audits both turn on records, and the sender bears the burden. For each subscriber, store when consent was captured (timestamp), where (the URL, form, keyword, or physical location), how (the exact language displayed at the time), and what number and IP or device were involved where applicable. Keep records for the life of the consent plus the statute-of-limitations window (four years federally for TCPA claims). When a form’s language changes, archive the old version with its date range: proving what a subscriber saw in 2024 requires the 2024 wording.
STOP and HELP mechanics
STOP is the universal opt-out keyword, and its handling depends on the number type. On toll-free numbers, STOP is typically processed at the carrier or aggregator level: the network itself blocks further messages from that number to that subscriber, and the sender may not be able to override it. On 10DLC long codes, keyword handling is done by the messaging platform, which must catch the keyword and suppress the subscriber. Either way, the sender’s own suppression list is mandatory; relying on network-level blocking alone leaves gaps.
- The full keyword family per CTIA: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT should all trigger opt-out. Case does not matter.
- Convention allows one final confirmation message (“You are unsubscribed from Acme alerts. No more messages will be sent. Reply HELP for help.”). Send it once; anything after it is a violation.
- HELP should return the program name, a support contact, and how to opt out.
- Opt-outs apply to the brand, not the wire: a customer who texts STOP to one of a brand’s numbers should be suppressed across all numbers sending the same program. Suppressing only the receiving number and continuing from another is the exact pattern regulators and carriers treat as evasion.
- Watch for non-keyword revocations in replies (“please stop texting me,” “wrong number”). Under current FCC rules these count.
The FCC revocation rule
In February 2024 the FCC adopted an order strengthening revocation rights, with the core requirements taking effect in April 2025. Consumers may revoke consent by any reasonable method: standard keywords, plain-language replies, or a message stating the request in any words a reasonable person would understand. Senders cannot require a designated word or channel. Revocations must be honored within a reasonable time, capped at ten business days from receipt, and a revocation of consent for one category of messages can extend to others depending on scope. Because effective dates and details were litigated and adjusted, treat the ten-business-day cap and the any-reasonable-method standard as the conservative operating assumptions and check current FCC guidance when building policy.
Quiet hours
Federal TCPA rules restrict solicitation calls and texts to between 8 a.m. and 9 p.m. in the recipient’s local time. Two operational traps follow. First, recipient local time is determined by where the person is, which is usually inferred from area code, and area code is an imperfect proxy for a ported or relocated number; conservative programs narrow the send window to hours safe across the continental US. Second, state mini-TCPAs impose stricter windows and additional limits: Florida’s Telephone Solicitation Act restricts solicitations to 8 a.m. to 8 p.m. and caps attempts per day, and Oklahoma adopted a similar regime. Programs sending nationally either track state rules per recipient or adopt the strictest common denominator.
Double opt-in, and where the rules actually live
Double opt-in (the subscriber signs up, then confirms by replying to a verification text) is best practice, not a universal legal requirement. It produces the strongest consent records, filters out typo’d and maliciously entered numbers, and is required by some platforms for specific program types, but a properly documented single opt-in is lawful for most use cases.
The reference document behind most of this article is the CTIA Messaging Principles and Best Practices. It is not a statute, and CTIA is not a regulator, but US carriers enforce it contractually through their codes of conduct and, in practice, through filtering: a program that ignores it loses deliverability long before it loses a lawsuit. TCPA and FCC rules set the legal floor; CTIA sets the operational standard the networks actually police.