HomeTCPA GuideSMS Consent

Guide

TCPA SMS consent requirements

"They gave us their number" is not consent. Here's what actually counts, and how to capture it so it holds up if you're ever challenged.

Last updated: July 2026 · ~6 min read · Educational, not legal advice.

Marketing vs. service messages

The standard depends on the message. For marketing texts (promotions, "we miss you," review requests that market), you need prior express written consent — the customer clearly agreed, in writing, to receive marketing texts, and that agreement wasn't a condition of purchase. For purely transactional service messages (an appointment your customer booked), a lower standard can apply — but you still must be able to show the customer provided the number for that purpose and you must honor opt-outs.

The safe, defensible rule: capture and store provable consent for every number you message, and treat opt-outs as sacred.

What "provable" means

A screenshot of a text thread won't survive scrutiny. A defensible consent record contains: who consented (customer ID / number), when (timestamp), to what (the exact wording they agreed to), and how (web form, voice script, SMS reply) — stored so it can't be altered after the fact.

Four steps to compliant consent

  1. Capture at intake. Add a clear opt-in to your web form, voice script or SMS reply that names what they'll get ("appointment and service updates by text").
  2. Sign the token. Cryptographically sign the customer ID + timestamp + consent wording so the record is tamper-evident.
  3. Verify before every send. Check for a valid signed record before a message leaves — and block it if there isn't one.
  4. Deliver proof on demand. Keep it in a searchable audit trail so you can produce it in seconds, not after a 30-minute hunt across tools.

Don't forget opt-out

Every message stream must honor STOP and equivalent requests immediately, and you should log the opt-out the same way you log consent. A customer who opted out and got another text is one of the most common — and most winnable — TCPA claims.

Grandeza's hardening engagement implements all four steps on the tools you already run, and the free scan tells you which of these you're missing today.

Educational and general; not legal advice. Consult your attorney about your specific situation.

Related guides

Is your consent provable?

Find out in 12 minutes — free, no code access.