Blog / Marketing
SMS marketing consent: what you need before you send anything
Having someone's phone number is not permission to market to them. That single sentence is the thing most first-time senders get wrong, and it is the one that carries actual financial risk.
Under the US TCPA, non-compliant marketing texts can run to $500 to $1,500 per message in statutory damages. Per message. A single careless blast to 2,000 people is not a slap on the wrist, it's an existential number for a small business. The FCC's own summary is worth twenty minutes of your time.
What counts as opt-in
Express written consent, obtained before the first marketing message, where the person understood they were agreeing to receive marketing texts. A tick box on a signup form that says so. A keyword they texted to your number. A checkout field that is not pre-ticked.
What does not count: a number collected for a delivery notification, a business card handed over at a conference, a number scraped from a public listing, or a number already in your phone because you did business together in 2022.
Keep the receipt
Record what they agreed to, when, and through which form. If a complaint lands two years later, that record is your defence and nothing else will do. Most SMS platforms store this for you if you collect consent through their widgets. If you collect it elsewhere, you are on the hook for keeping it.
Europe is stricter, not looser
GDPR plus PECR in the UK and EU means consent must be freely given, specific, informed and unambiguous, and you must be able to demonstrate it. Soft opt-in exists for existing customers buying similar products, but it is narrower than people assume and it still requires an opt-out in every message.
Carrier rules sit on top of the law
Even with perfect legal consent, carriers run their own filtering. In the US, A2P 10DLC registration is now effectively mandatory for business texting on standard numbers. Unregistered traffic gets throttled or blocked outright, and you often will not get a clear error, just a quiet drop in delivery rates.
Segment by country, because the rules change at the border
A list that spans three countries is three different compliance regimes. Canada's CASL, the EU's GDPR, and the US TCPA do not agree on what consent looks like or how long it lasts. Sending one undifferentiated blast to all of them means you are compliant with whichever regime happens to be loosest, which is to say none of them.
Splitting the list first makes each campaign governable. If your contacts live on an iPhone, grouping them by country happens during export rather than afterwards in a spreadsheet.
Opt-out has to actually work
Every marketing message needs a clear opt-out, and STOP needs to be honoured immediately and permanently. Most platforms maintain the suppression list for you. The failure mode is importing a fresh CSV that re-adds someone who opted out in a previous campaign.
If you export from your phone each time rather than maintaining a list inside the platform, this will happen. Keep the platform as the source of truth for suppression, and let it filter your uploads.
Quiet hours are law in some places
The TCPA restricts marketing calls and texts to between 8am and 9pm in the recipient's local time. Several US states set tighter windows. The recipient's time zone, not yours, is what counts, which is another argument for splitting an international or multi-state list before scheduling.
Buying a list is not a shortcut
Purchased lists come with no consent you can evidence, and the seller's assurance is not a defence. Every serious SMS platform prohibits them in its terms, and getting caught means losing the account along with the numbers.
Get Pluck for iPhone
Pluck does the steps in this guide on your iPhone, with no server, no account, and no analytics. Group your contacts by country, find duplicates the iOS tool misses, and export to CSV, Excel, TXT, or vCard.