SMS opt in: how to get consent for marketing texts and keep the proof

Two sets of rules apply to texting US phones. The TCPA is the law, and the FCC’s rules under it (47 CFR 64.1200) define prior express written consent: an agreement in writing, signed by the person, that authorizes the seller to send them marketing at a stated number. It must include a clear and conspicuous disclosure of what they are agreeing to, and must not make agreeing a condition of buying anything.

CTIA’s Messaging Principles and Best Practices are the US wireless industry’s guidelines for business texting. Whether or not the TCPA applies to a given text, CTIA expects senders to get consent for texts in general, express written consent for marketing texts, and to let people revoke it. Its principles say the call to action, the place where someone opts in, should make five things clear:

• what the program is: the texts they will get;
• the number or numbers the texts will come from;
• who is sending them: your business by name;
• clear opt-in language, and any fees or charges;
• the other terms: how to opt out, how to reach customer care, and your privacy policy.

In plain words: get a written yes for marketing, say what they will get from whom and how often, say rates may apply, explain STOP and HELP, never tie it to a purchase, and keep the record. Carriers check this: registering a number in Rasket asks for opt_in_url, the page where people agree to your texts, and the reviewers open it. Toll-free verification and 10DLC registration walk through both reviews.

Canada’s anti-spam law (CASL) requires consent for a commercial electronic message, and requires the message to identify the sender, say how to reach them and offer a way to unsubscribe. Rasket asks for the same express consent in Canada as in the US, and does not rely on the implied consent CASL allows, so one opt-in form serves both countries.

CTIA sorts business texts into three kinds, and the consent each needs follows from what the text does. Rasket uses two categories on every text: transactional and marketing.

The line moves with the content. CTIA notes that adding a call to action, such as a coupon code, to an informational text may make it promotional. “Your order has shipped” is informational; “Your order has shipped, and here is 15% off your next one” is marketing and needs marketing consent. When in doubt, send the second sentence as its own marketing text, to the people who agreed to them.

Marketing texts in Rasket also keep rules of their own: they go out between 8 am and 9 pm where each person is (or the shorter hours some states set), at most one to a phone in any 16 hours, each starting with your brand name and ending with “Reply STOP to opt out”. The 16 hours are Rasket’s own guard, not a legal limit; our SMS marketing guide covers frequency and timing.

Good SMS opt-in language is short and specific. Here is a checkbox for a sign-up or checkout form, with every item from the list above in it:

[ ] Text me offers from Acme at the number above. Up to 4 marketing texts a month.
    Msg & data rates may apply. Reply HELP for help, STOP to cancel.
    Consent is not a condition of purchase. Terms: acme.com/sms-terms · Privacy: acme.com/privacy

• Leave the box unticked. A box the person never touched is hard to call their agreement, and you may one day have to show that they ticked it.
• Give texts their own box, separate from the email newsletter. An email subscription is not consent to texts, and Rasket keeps the two apart.
• State a number for frequency (“up to 4 a month”) and keep to it, or say “Msg frequency varies” if it truly does.
• Let the order go through with the box empty. “Consent is not a condition of purchase” has to be true on the page, not only in the sentence.
• Link terms and privacy next to the box, not three clicks away. CTIA says opt-in details should not be buried in terms for something else.

Rasket’s own sign-up forms have a phone step whose consent wording the form’s owner cannot edit, so it cannot be worded into something weaker, and it can offer the reply-Y confirmation below. Rasket does not run join keywords: a text saying “JOIN” to your number arrives as an ordinary reply, so collect opt-ins on a form.

An SMS double opt in sends one text first and waits for the answer. It proves the phone belongs to the person who typed the number; CTIA points out that people mistype numbers, or give someone else’s. Rasket sends this confirmation for you:

Acme: Reply Y to confirm you want texts from us. Msg frequency varies. Msg&data rates may apply. Reply STOP to opt out.

The contact is pending until they reply Y, and subscribed from that moment. A pending contact gets no marketing texts: campaigns and automations skip them, and a request nobody answers within 30 days lapses. A form’s phone step offers it, and over the API you set double_opt_in when you record consent:

curl -X PATCH https://api.rasket.com/contacts/$CONTACT_ID/sms-consent \
  -H "Authorization: Bearer $RASKET_API_KEY" \
  -H "User-Agent: acme-shop/1.0" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "subscribed",
    "double_opt_in": true,
    "proof": {
      "method": "form",
      "occurred_at": "2026-10-19T18:02:11.000Z",
      "page_url": "https://acme.com/checkout",
      "disclosure_text": "Text me offers from Acme at the number above. Up to 4 marketing texts a month. Msg & data rates may apply. Reply HELP for help, STOP to cancel. Consent is not a condition of purchase.",
      "ip": "203.0.113.7",
      "user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X)"
    }
  }'

proof is required when status is subscribed, and a write without it is refused with 422. ip and user_agent are the person’s, read from the request your form handled, not your server’s. The confirmation covers most of what CTIA asks a recurring program’s first text to say: your name, that the frequency varies, that rates may apply and how to stop; HELP then gives your contact details. If you send a welcome text, send it after the Y, not instead of the confirmation. The consent docs have every field.

The FCC’s rule lets people revoke consent by any reasonable means, and a sender may not insist on one. A text reply of STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE always revokes it, other words count when a reasonable person would read them as a request to stop, and the request must be honored within a reasonable time of at most ten business days. The FCC’s 2024 order also codified that one text confirming the opt-out is allowed, as long as it carries no marketing and is the only message that follows; one sent within five minutes is presumed to fall within the person’s consent. CTIA asks for the same: read normal language, send one final confirmation, then nothing more.

Rasket handles these replies for you:

Case and punctuation do not matter, and a short reply like “please stop” or “stop texting me” counts as STOP. An opt-out applies at once, not in ten days, to every text your team sends, and the person gets one confirmation:

Acme: You're unsubscribed and won't get more texts. Reply START to resubscribe.

And HELP is answered with your details:

Acme: Help at acme.com/help or help@acme.com. Msg frequency varies. Msg&data rates may apply. Reply STOP to opt out.

A STOP cannot be undone from the dashboard or the API: only the person can, by texting START. Your code hears about every opt-out through the contact.sms_unsubscribed webhook, however it happened.

CTIA lists what a sender should keep for each opt-in, and asks senders to keep every opt-in and opt-out on record. Each of its items maps to a field of Rasket’s consent record:

Every change is its own record: a subscribe, a confirmation, an unsubscribe and a STOP each write one, with where and how it happened. Rasket keeps them for five years from the change, even after the contact is erased, so a dispute about a text sent long ago can still be answered. Store the wording exactly as it appeared on the page that day. If you change the checkbox text, new consents carry the new words and old ones keep theirs.

CTIA’s principles say an opt-in belongs to the sender and campaign it was given for and is not transferable, and that senders should not use rented, sold or shared lists. So a list you bought, or one a partner collected for its own texts, needs a fresh opt-in to your brand. A list you collected yourself can come with you.

A contacts import can carry a phone column and an SMS consent column. The consent counts only when the person importing attests how it was collected and the wording people saw; a “yes” in the column then subscribes the phone, and the record’s method reads import. Without the attestation, the phones are stored but nobody is subscribed. An import never subscribes a phone that texted STOP or was unsubscribed.

If you cannot say where and when someone opted in, do not import them as subscribed. Email them a link to a form with the checkbox above, and let the new opt-in be the record.

• You collect opt-ins with a keyword, such as “Text JOIN to” on a poster. Rasket handles STOP, START, HELP and Y; any other word is an ordinary reply.
• You text outside the US and Canada. Those are the only two countries Rasket texts.
• You rely on implied consent in Canada. Rasket asks for express consent in both countries.

Otherwise, the next step is one checkbox: add it to your sign-up or checkout form with the wording above, turn on the reply-Y confirmation, and read what Rasket’s SMS does before your first campaign. For the email side of the same idea, see double opt-in email.