Last updated 2026-07-11
TL;DR
The TCPA requires prior express written consent before you send marketing texts, but it never mandates double opt-in. Single opt-in is legally enough if you document it right. Double opt-in builds a second layer of proof, and courts treat that reply from the actual phone as stronger evidence of consent. For high-volume programs, double opt-in is almost always worth the small conversion hit.
What does the TCPA actually require for SMS consent?
The short answer: prior express written consent. That is the standard under 47 U.S.C. § 227(b)(1)(A) for any autodialed or prerecorded text sent to a mobile phone. [1] The statute does not say "double opt-in." It does not say "single opt-in." It says the recipient has to agree, in writing, to get such messages from you, and that agreement has to clearly disclose that they are consenting to autodialed texts.
The FCC defined what "prior express written consent" means in its 2012 Report and Order (FCC 12-21), which took effect on October 16, 2013. The agency called it "an agreement, in writing, bearing the signature of the person called, that clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice." [2] An electronic signature counts.
So the TCPA picks no winner between single and double opt-in. It sets a floor on consent quality. Then litigation, FCC enforcement, and private class actions decide how easy it is to prove you cleared that floor. That is where the real gap between the two methods shows up.
If you are new to the broader law, the TCPA overview is a good place to get oriented before you go further here.
What is single opt-in SMS, exactly?
Single opt-in means a person submits their phone number, agrees to receive texts, and you start sending right away. One step, done. A web form with a checkbox saying "I agree to receive promotional texts from [Company] at the number provided, including via autodialer. Consent is not a condition of purchase. Reply STOP to opt out" is a classic single opt-in capture. [3]
The person clicked submit. You have a server log of the IP address, a timestamp, and (ideally) the exact form language they saw. That is your consent record. If someone disputes consent later, you pull those records and show them.
The weakness is obvious. Anyone can type in someone else's phone number. A competitor, an annoyed ex, a teenager who fat-fingers a digit. You have a log showing a form was submitted from an IP address. You have no confirmation that the person who owns that number actually did anything. That gap is where plaintiffs' attorneys live.
What is double opt-in SMS, and how does it work?
Double opt-in adds one step. After someone submits their number, your system sends a confirmation text asking them to reply (usually "Y" or "YES") before you send any marketing. Only when that reply lands do you add them to your active list and start messaging. [3]
That reply is the second layer. It proves the person who owns and physically holds the phone agreed, because they answered from the device itself. An IP log shows a form was submitted. A reply from the number proves the number's owner took part.
The confirmation text itself has to stay inside the lines. Under FCC guidance and the CTIA's industry standards, that first message should be limited to naming your company, explaining what the subscriber signed up for, stating message frequency, noting that message and data rates may apply, and giving STOP and HELP instructions. No promotional content. Treat it as a handshake, not a pitch. [4]
Conversion rates do drop. In most programs, somewhere between 60% and 80% of people who submit a number finish the confirmation reply. Nobody has precise industry-wide data on this. That range comes from figures various SMS platform providers have published, and it swings hard by industry and by how well your confirmation message is written.
How much more TCPA protection does double opt-in actually give you?
More. Meaningfully more. But it is not a full shield, and pretending otherwise does you no favors.
The core question in most TCPA class actions is consent: did the plaintiff agree to the texts? Double opt-in hands you two independent pieces of evidence instead of one. You have the form submission record, and you have the reply from the phone number itself. That second record is much harder to credibly dispute, because it shows the device in the plaintiff's pocket sent a message.
Courts have generally looked on this well. In Berman v. Freedom Financial Network (9th Cir. 2021), the court held that consent has to be "unambiguously" given and scrutinized whether the consent language was clear enough. [5] A double opt-in reply is itself evidence that the consumer understood and actively confirmed, which goes straight at the ambiguity problem.
That said, double opt-in does not fix bad disclosure language. If your confirmation text does not clearly say what the person is agreeing to, or your program description hides in terms no one would ever read, you can still lose on consent grounds with a reply on record. The protection comes from pairing a clear disclosure with the double confirmation, not from the confirmation by itself.
For a sense of real exposure, the cash app TCPA class action settlement and the credit one TCPA settlement show what companies pay when consent documentation breaks down. The numbers are sobering.
Is double opt-in required by FCC rules or the TCPA?
No. Neither 47 U.S.C. § 227 nor any FCC order mandates double opt-in for SMS marketing programs. [1][2]
The CTIA, the wireless industry trade group, publishes messaging guidelines that recommend double opt-in for marketing programs, and mobile carriers increasingly enforce those guidelines when they decide whether to pass your traffic. [4] Carrier enforcement is not federal law. Getting your campaign blocked by a carrier is a real business problem. It is not a TCPA violation on its own.
The FCC's 2024 one-to-one consent rule, set to take effect in January 2025 before it was vacated, would have required consent to be specific to a single seller, obtained separately rather than bundled through lead generators. [6] The 11th Circuit struck it down in January 2025 in Insurance Marketing Coalition Ltd. v. FCC. But the pressure it reflected, toward more explicit and specific consent, has not gone away. The FCC has signaled continued interest in tightening consent standards. It is reasonable to build your program today as if stricter rules are coming.
The practical question is bigger than what is required. It is what you can prove in court if someone sues you. A statutory minimum and a litigation-defensible posture are not always the same thing.
What does proper consent documentation look like for each method?
For single opt-in, capture and store the exact text of the disclosure the person saw, the timestamp of the submission, the IP address of the submitting device, the phone number submitted, and ideally a session or transaction ID that ties the record together. [3] If you capture consent through a third-party lead form, confirm that the disclosure language on that form names your company and your texting program by name, not a generic "partners may contact you" clause.
That last point is where a huge share of TCPA cases start. A consumer fills out a form on a lead aggregator's site, checks a box that vaguely mentions "third-party partners," and then gets texts from a company they never heard of. Courts have been skeptical of that consent chain for years, and the FCC's now-vacated 2024 rule tried to close it entirely.
For double opt-in, store everything above plus the inbound reply from the subscriber's phone number, with its timestamp. Keep these records for at least four years, which matches the TCPA's statute of limitations. [1][9] Some attorneys say five years, given the tolling arguments plaintiffs sometimes float.
LeadCompliant's free consent-record checker can tell you whether the fields you capture are likely to hold up if a plaintiff demands discovery. It is not a substitute for legal counsel. It gives you a fast gap assessment before you build or audit a program.
For text message marketing programs that run off purchased lists rather than organic opt-ins, the documentation burden is higher, because the original consent chain is usually harder to reconstruct.
Which industries benefit most from double opt-in?
Any industry that is already a litigation target. Finance, insurance, home services, education, and healthcare sit at the top, because plaintiffs' attorneys know those defendants have money and those cases have class action potential.
High-volume texters gain more than low-volume ones. Send 500 texts a month to warm inbound leads and your lawsuit risk is lower simply because the exposure is smaller. Send 50,000 texts a month sourced partly through affiliates or co-registration, and double opt-in stops being optional as a practical matter.
Companies that run on lead generation networks, where the consumer filled out a form on someone else's website, should be the most careful. The consent chain is longer. Each link is a spot where the disclosure language might have been vague, missing, or quietly modified since. A double opt-in confirmation from the consumer's own device helps close that gap, because it creates a direct record between you and that specific phone number.
Small teams with fully organic lists, where every subscriber signed up directly through your own web form or in-store signup, get less marginal benefit, because their consent records are already clean. Their bigger risk is usually sloppy documentation, not a bad opt-in method.
Can single opt-in be made litigation-proof?
Not literally proof against any lawsuit. Anyone can file a TCPA claim, and the economics of the statute (up to $500 per message for negligent violations, up to $1,500 per message for willful ones) make it attractive to plaintiffs' attorneys even when the underlying facts are thin. [1] But you can build single opt-in records that are very hard to prosecute successfully.
What you need: a disclosure that is conspicuous (not buried in fine print three scrolls below the fold), specific (naming your company and describing the type and approximate frequency of messages), and accurate (matching what you actually send). You also need records that are complete, timestamped, and tied to the specific transaction in a way you can produce in discovery.
The FTC's guidance on digital advertising disclosure says disclosures have to be "clear and conspicuous," and courts apply a similar standard to TCPA consent language. [7] A checkbox below a 400-word terms block, in 8-point gray text, has been found insufficient in more than one case.
Matching the submitted phone number against a third-party validation service, one that confirms the number ties to the name and address the consumer gave, helps too. It does not replace good disclosure. It does help establish that the person who submitted the form and the person who owns the phone are probably the same.
How do TCPA damages work if consent is disputed?
The TCPA creates a private right of action and sets statutory damages at $500 per violation, with treble damages up to $1,500 per violation for willful or knowing violations. [1] Each text message is a separate violation. That math gets frightening fast.
A company that sends 10,000 texts to people who did not validly consent faces potential exposure of $5 million at $500 per text, or $15 million if the court finds the violations willful. Class actions aggregate those individual claims, which is why even small programs generate multi-million-dollar settlement demands.
The table below shows the exposure math across common program sizes:
| Messages sent | Per-message exposure ($500) | If willful ($1,500) |
|---|---|---|
| 1,000 | $500,000 | $1,500,000 |
| 10,000 | $5,000,000 | $15,000,000 |
| 50,000 | $25,000,000 | $75,000,000 |
| 100,000 | $50,000,000 | $150,000,000 |
These are statutory maximums, not what cases actually settle for. Most class actions settle for far less. But the statutory ceiling is what drives plaintiffs to file and defendants to settle rather than fight. Double opt-in does not change the math directly. It changes how hard it is for a plaintiff to prove the underlying consent failure.
Check your subscribers against the do not call list and the mobile phone do not call list separately from consent, because DNC violations can stack right on top of TCPA consent claims.
What about the FCC's 2024 one-to-one consent rule?
In December 2023, the FCC adopted a rule that would have required prior express written consent for telemarketing calls and texts to be obtained on a one-to-one basis, one consumer to one seller, not bundled through a lead generator's blanket consent form. [6] The rule was scheduled to take effect January 27, 2025.
The 11th Circuit vacated it in January 2025 in Insurance Marketing Coalition Ltd. v. FCC, finding the FCC had exceeded its statutory authority under the TCPA. The court's reasoning drew on the Supreme Court's Loper Bright decision, which overturned Chevron deference. [6]
So the one-to-one rule is gone, for now. The FCC still has authority to try another rulemaking on a different legal footing, and Congress could codify one-to-one consent directly. Designing your consent capture to be one-to-one, even without a rule requiring it, is good practice. It removes a category of risk, and it makes your program more defensible if the rules tighten again.
Here is the practical read for double opt-in. Even if the FCC rule came back, a properly built double opt-in (where the confirmation text names your company specifically and the consumer replies affirmatively) already satisfies a one-to-one standard. Single opt-in through a third-party lead form does not, and never really did.
What does a compliant double opt-in confirmation text look like?
The CTIA's Messaging Principles and Best Practices set out what belongs in a confirmation text. [4] A compliant confirmation message for a marketing program generally reads like this:
"[Brand]: Reply YES to confirm you want to receive up to 4 promotional texts/month about [product]. Msg & data rates may apply. Reply STOP to cancel, HELP for help. This is not a condition of purchase."
Only after the consumer replies YES do you send your welcome message and start the program.
What not to do: do not slip a promotional offer into the confirmation text. Carriers increasingly filter these, and it undercuts the argument that the consumer confirmed consent free of inducement. Do not make the reply step feel mandatory for some other service the person already uses. And do not bury the opt-in disclosure in a separate linked document most people will never open.
One more thing. Honor STOP requests immediately and permanently, no matter the opt-in method. If someone texts STOP and you keep messaging them, that is a separate TCPA violation layered on top of whatever consent issues you already have. The FCC and courts treat post-revocation messages as willful, which means the $1,500-per-message exposure applies. [8]
Should you switch from single to double opt-in?
Probably yes, if you are running any real volume of marketing texts. The conversion hit is real but usually manageable, and the consent documentation you get is much better.
Here is how I would think about it. If a plaintiff's attorney subpoenaed your consent records today, could you produce a clear, complete record for every person on your list, one that holds up in front of a judge who is skeptical of your industry? If the honest answer is "mostly yes but there are gaps," those gaps are your actual litigation risk. Double opt-in does not fix past records. It closes the gap going forward.
The one case where I would not push hard for double opt-in is a very small, fully inbound program where every contact explicitly asked to hear from you, your documentation is clean, and your volume is low. The marginal protection there is real but small, and the conversion loss on a 200-person list is not worth engineering around.
For everyone else, especially teams sourcing any leads through affiliates, co-registration, or purchased lists, the calculus is not close. Implementing double opt-in costs a few hours of development time. A mid-sized TCPA class action, even one that settles quickly, starts in the hundreds of thousands of dollars and climbs from there.
LeadCompliant's one-time compliance kit walks through the documentation requirements for both methods and includes template disclosure language you can adapt. Use it as a starting checklist before you finalize your opt-in flow, then run the result by a TCPA attorney if your volume is significant.
For broader context on how cold calling and cold call rules interact with SMS, the overlap runs deeper than most teams realize, especially around cell phone restrictions and the ATDS definition.
Frequently asked questions
Does the TCPA require double opt-in for text messages?
No. The TCPA requires prior express written consent, but it does not specify double opt-in as the method for obtaining it. Single opt-in with a clear, properly documented disclosure is legally sufficient under 47 U.S.C. § 227. Double opt-in is a best practice that makes consent easier to prove in court, not a statutory requirement.
What happens if I use single opt-in and someone disputes consent?
You produce your consent records: the exact disclosure language the consumer saw, a timestamp, the IP address, and any transaction ID tying the record to that submission. If your records are clean and the disclosure was conspicuous, you have a strong defense. If the disclosure was buried, vague, or your records are incomplete, you are in a much harder position, whatever the opt-in method.
Can I face TCPA liability even with double opt-in?
Yes. Double opt-in is evidence of consent, not a guarantee against claims. If your disclosure language was unclear about what the consumer agreed to, if you sent messages beyond the described scope or frequency, or if you ignored STOP requests, you can still face liability. Double opt-in strengthens your consent defense specifically. It does not fix other compliance failures.
How long do I need to keep SMS consent records?
Keep them for at least four years, which matches the general federal statute of limitations under 28 U.S.C. § 1658. Some TCPA attorneys recommend five years because plaintiffs sometimes argue for tolling, which extends the window. Records should include the consent text, timestamp, phone number, IP address, and, for double opt-in, the confirmation reply.
Does a web form checkbox count as written consent under the TCPA?
Yes, if it meets the requirements. The FCC's 2012 Report and Order (FCC 12-21) confirmed that electronic signatures satisfy the TCPA's written consent requirement. The checkbox needs disclosure language that clearly identifies the sender, the nature of the messages (autodialed marketing texts), and an acknowledgment that consent is not a condition of purchase.
What does the FCC say is the minimum consent disclosure language for SMS?
The FCC's 2012 order requires that consent clearly authorize the specific seller to send autodialed advertisements or telemarketing messages. CTIA industry standards add that the disclosure should state the brand name, message frequency, that message and data rates may apply, and STOP and HELP instructions. The phrase "consent is not a condition of purchase" is not required by statute but is strongly recommended.
Is single opt-in through a lead generator risky?
Very. When a consumer fills out a form on a third-party site, the disclosure may not name your company, may be too vague to be valid consent, or may have changed since the consumer submitted it. Courts have repeatedly scrutinized third-party consent chains. If you buy leads and text them, you are responsible for confirming that the consent you received covers your specific messages.
What is the CTIA's position on double opt-in for SMS marketing?
The CTIA's Messaging Principles and Best Practices recommend double opt-in for standard-rate marketing programs. Carriers use CTIA guidelines as a filter for SMS traffic, so programs that ignore them risk message filtering or blocking. CTIA guidance is not law, but it reflects carrier-level enforcement standards that can decide whether your messages get delivered at all.
How does single vs double opt-in affect a TCPA class action defense?
In a class action, the defendant has to show each class member consented. Double opt-in creates a device-level confirmation record for each subscriber, which is much harder for a class to collectively dispute than a server log of form submissions. Plaintiffs can still argue the disclosure was inadequate, but challenging every individual confirmation reply is hard to do on a class-wide basis.
What TCPA damages are possible if my opt-in records are found insufficient?
The TCPA sets statutory damages at $500 per violation and up to $1,500 per willful violation, with each text counting as a separate violation. A campaign sending 10,000 texts to people without valid consent faces up to $5 million at the base rate, or $15 million if the violations are willful. Most cases settle for less, but the statutory ceiling drives settlement pressure.
Does the FCC's one-to-one consent rule change which opt-in method to use?
The FCC's 2024 one-to-one consent rule was vacated by the 11th Circuit in January 2025. It is not currently in effect, but it reflected regulatory pressure toward more specific, per-sender consent. A properly built double opt-in already satisfies a one-to-one standard. Single opt-in through a shared lead form does not, and the underlying FCC concern has not disappeared.
Do I need to include STOP and HELP instructions in my initial opt-in message?
For double opt-in, CTIA guidelines say the confirmation message should include STOP and HELP instructions. For single opt-in, the first message you send should include opt-out instructions. Failing to give a clear opt-out mechanism can create liability on its own, and the FCC requires that STOP requests be honored immediately and permanently across the TCPA framework.
Can I convert a single opt-in list to double opt-in retroactively?
You can send a one-time re-confirmation message to an existing single-opt-in list asking subscribers to confirm they want to keep receiving messages. Subscribers who reply to confirm become double opt-in going forward. Those who do not reply should be suppressed, not because the law requires it in every case, but because texting non-responsive contacts is where your consent exposure is highest.
What is the difference between express consent and express written consent under the TCPA?
The TCPA distinguishes the two. Express written consent is required for marketing and promotional messages sent via autodialer or prerecorded voice to a cell phone. Express consent, without the written requirement, is enough for purely informational, non-marketing calls and texts. Most outbound sales and marketing SMS programs require the higher express written consent standard.
Sources
- U.S. House of Representatives, Office of the Law Revision Counsel, 47 U.S.C. § 227 (Telephone Consumer Protection Act): The TCPA sets statutory damages at $500 per violation, up to $1,500 for willful violations, and requires prior express written consent for autodialed marketing texts to cell phones.
- Federal Communications Commission, Report and Order FCC 12-21 (2012 TCPA Rules defining prior express written consent): The FCC's 2012 order defined prior express written consent as a written agreement bearing the person's signature clearly authorizing autodialed or prerecorded advertising messages, and confirmed electronic signatures satisfy the requirement.
- FTC, Complying with the Telemarketing Sales Rule (Business Guidance): Consent capture for autodialed marketing texts requires a clear disclosure, including the sender's identity and the nature of the messages, at the point of opt-in.
- U.S. Court of Appeals for the Ninth Circuit, Berman v. Freedom Financial Network (2021): The 9th Circuit held that TCPA consent must be unambiguously obtained and scrutinized whether consent language was sufficiently clear and conspicuous to the consumer.
- U.S. Court of Appeals for the Eleventh Circuit, Insurance Marketing Coalition Ltd. v. FCC (2025 vacatur of the FCC one-to-one consent rule): The FCC adopted a one-to-one consent rule in December 2023, effective January 27, 2025, that was subsequently vacated by the 11th Circuit in January 2025 on grounds the FCC exceeded its statutory authority.
- FTC, .com Disclosures: How to Make Effective Disclosures in Digital Advertising: The FTC requires that disclosures in digital contexts be clear and conspicuous, a standard courts apply analogously to TCPA consent disclosure language.
- Federal Communications Commission, Declaratory Ruling and Order on Revocation of Consent (FCC 15-72, 2015): The FCC ruled that consumers may revoke prior express consent through any reasonable means, and that STOP requests must be honored immediately and permanently.
- U.S. House of Representatives, Office of the Law Revision Counsel, 28 U.S.C. § 1658 (federal civil statute of limitations): The four-year general federal statute of limitations applies to TCPA claims, setting the minimum period for which consent records should be retained.
- Federal Trade Commission, National Do Not Call Registry and Unwanted Calls Guidance: The FTC and FCC receive complaints about unwanted texts and calls and coordinate on TCPA and Telemarketing Sales Rule enforcement against non-compliant campaigns.