Skip to content
imessageapi

Getting consent right before you text a single customer

Messaging is a permission channel. The rules are not optional, the penalties are per-message, and the fix is boring paperwork you do once.

8 min readUpdated August 5, 2026Compliance

Nothing on this page is legal advice — talk to a lawyer about your specific situation. What follows is the operational shape of the problem, so you know what to ask about.

Consent has levels

  • Express written consent — required in the US for marketing texts. The customer actively agreed, in writing, to receive marketing messages at that number, and you can prove it.
  • Express consent — sufficient for transactional messages the customer is expecting: an order confirmation, an appointment reminder, a delivery notice.
  • An existing business relationship is not consent. Neither is a phone number collected for a different purpose. A number on an invoice is not permission to run a campaign.

The buried-checkbox trap

Consent to marketing texts cannot be a condition of buying something, and it cannot be pre-ticked or hidden in a terms link. It needs its own unticked checkbox with clear language next to it. This is the single most common way small businesses end up out of compliance without meaning to.

Log it like you will have to prove it

Because one day you might. For every number on your list, store the timestamp, the exact wording shown at the moment of consent, the source (which form, which page), the IP or staff member who captured it, and every subsequent status change.

consent record
{
  "phone": "+15551234567",
  "status": "opted_in",
  "scope": "marketing",
  "captured_at": "2026-03-11T15:04:22Z",
  "source": "checkout_form_v3",
  "disclosure_text": "Yes, text me offers and updates. Msg & data rates may apply. Reply STOP to opt out.",
  "ip": "203.0.113.44",
  "history": [
    { "at": "2026-03-11T15:04:22Z", "event": "opt_in", "channel": "web" }
  ]
}

Honour STOP instantly and automatically

STOP, UNSUBSCRIBE, CANCEL, END, and QUIT must all work, and they must work without a human in the loop. Send one confirmation of the opt-out, then never message that number again unless they opt back in. Wire this into your inbound webhook before your first campaign, not after your first complaint.

inbound handler
const STOP_WORDS = new Set([
  "stop", "stopall", "unsubscribe", "cancel", "end", "quit", "revoke", "optout",
]);
 
export async function handleInbound(from: string, text: string) {
  const first = text.trim().toLowerCase().split(/\s+/)[0];
 
  if (STOP_WORDS.has(first)) {
    await optOut(from);                       // update before you reply
    await send(from, "You're unsubscribed. No more messages from Acme.");
    return;
  }
 
  if (first === "help") {
    await send(from, "Acme support: (555) 010-0000. Reply STOP to unsubscribe.");
    return;
  }
 
  await routeToInbox(from, text);
}

Keep the opt-out list outside your provider

If your opt-out state lives only in a vendor dashboard, switching providers will resurrect people who unsubscribed. Own that table. Choosing your stack has the schema.

Identify yourself and respect the clock

  • Say who you are in the first message of any new conversation. An unidentified text is a deleted text.
  • Include opt-out instructions in marketing messages.
  • Send during local business hours for the recipient's time zone — see quiet hours.
  • Keep marketing and transactional consent separate. Someone who wants delivery updates has not agreed to a coupon blast.

The compliance dividend

Every rule here also happens to be good practice. Clean lists get better engagement, fewer spam reports, and healthier sender reputation. Teams that do this properly get better numbers, not just safer ones.

Next step

Generate a tagged link for whatever you send next with the UTM builder, see what this looks like in your industry, or compare the services that can send it on the providers page.

Keep reading

All 61 guides