SMS opt-in disclaimer: what it must say and why it matters

Last updated 2026-07-09

What exactly is an SMS opt-in disclaimer?

An SMS opt-in disclaimer is the chunk of disclosure text that sits next to, or immediately below, any place where a person hands you their phone number for text messaging. That place might be a web form, a paper signup sheet, a keyword reply (like texting JOIN to a shortcode), or a checkbox on a checkout page. The disclaimer is not decoration. It's the legal proof that the person knew what they were agreeing to before they hit Submit.

The TCPA, codified at 47 U.S.C. § 227, requires "prior express written consent" before sending marketing texts to a cell phone ^[1]. The FCC's implementing regulations at 47 C.F.R. § 64.1200 spell out what that consent has to look like. One of the core requirements: the consumer's agreement has to be made to "a clear and conspicuous disclosure" of what they're agreeing to receive ^[2]. That phrase, clear and conspicuous, does a lot of work. It means the disclaimer can't hide in a footer, sit in 7-point gray type, or wait three paragraphs deep inside a privacy policy.

Carriers add their own layer. The major U.S. carriers and the CTIA (the wireless industry trade group) have published messaging guidelines that program aggregators and brands are expected to follow ^[3]. Carrier compliance is separate from TCPA compliance, but they reinforce each other. A disclaimer that satisfies the CTIA guidelines will almost always satisfy the statutory standard too.

The disclaimer does two jobs at once. It protects the consumer by telling them what they signed up for. It protects you by creating a record, made at the moment of consent, that proper disclosure happened. Without it, you can't prove consent existed. And without proof of consent, every single text you send is a potential $500-per-message liability.

What are the required elements of a compliant SMS opt-in disclaimer?

Six elements. Every compliant SMS opt-in disclaimer needs all six. Miss one and you're out of carrier compliance, out of TCPA compliance, or both.

1. Identity of the brand or program. The disclaimer has to name the specific organization or messaging program sending the texts. "You agree to receive texts" with no named sender doesn't cut it. The person needs to know who is texting them.

2. Description of the message type. Is this promotional content? Transactional alerts? Appointment reminders? Say so. "Recurring marketing messages" is fine. So is "order updates and promotional offers from [Brand]." Vague language like "communications" has drawn FCC scrutiny.

3. Frequency disclosure. If you send a fixed number of messages per week or month, say it: "up to 4 messages/month." If volume varies, say "message frequency may vary." The CTIA guidelines require this ^[3].

4. Data rates disclosure. Every disclaimer includes "Msg & data rates may apply" or a close equivalent. This phrase has been required since carrier short-code programs were standardized, and it stays a non-negotiable CTIA requirement ^[3].

5. STOP instructions. Tell the consumer they can opt out by replying STOP. Required by both CTIA guidelines and the FCC's expectation that opt-out mechanisms get disclosed at the point of consent ^[2].

6. HELP instructions or a support contact. Tell the consumer they can text HELP for help, or give them a customer service number or website. The CTIA guidelines are explicit about this ^[3].

Beyond these six, a link to your Privacy Policy and Terms of Service is best practice that most carrier review processes expect. For many program types, that link is a CTIA requirement, so treat it as mandatory in practice.

Here's a template that hits all six elements:

*"By submitting this form, you agree to receive recurring automated marketing text messages from [Brand Name] at the phone number provided. Msg frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe or HELP for help. See our [Privacy Policy] and [Terms]."*

That's 44 words. It covers every required element. You can add specifics (like "up to 3 msgs/week" in place of "frequency varies") but you shouldn't remove anything.

How does the 2024 FCC one-to-one consent rule change SMS disclaimers?

The FCC issued a Report and Order in December 2023, effective January 27, 2025, that changes how lead generation consent works for text messages ^[4]. The old practice of getting a single consent that covered multiple marketing partners is dead.

Under the new rule, consent for automated texts has to be obtained on a "one-to-one" basis: one consent, one seller. The FCC's order states that a consumer's consent must be "logically and topically associated with the website or app where it is obtained" and cannot be sold or transferred to unrelated third parties as a bundle ^[4].

What this means for your disclaimer: if you're a lead generation company, a comparison site, or any business that historically used a single opt-in form to generate consent for multiple brands, your old disclaimer language is now legally insufficient. Each brand needs its own consent moment, its own named disclosure, its own record.

For a single-brand marketing form, the change is smaller. You still name your brand in the disclaimer, describe the messages, and hit all six required elements. But you can no longer bury a sentence like "and our marketing partners" in the disclosure and call it good.

So audit every form you use to collect cell phone numbers. If your current disclaimer says anything like "you and our partners," "affiliated companies," or "selected third parties," rewrite it before you send another text. The tcpa sms compliance landscape moved fast on this one.

Where does the disclaimer text have to appear on the page?

Placement matters as much as content. A disclaimer buried below the fold or hidden in a privacy policy doesn't satisfy the "clear and conspicuous" standard, no matter how well it's written.

The FCC's regulations require that the written agreement contain the disclosure, meaning the disclaimer text has to be part of the consent document itself, more than referenced by a link ^[2]. Courts reading this have held that small font, low-contrast text, and placement far from the consent button all weigh against a finding of clear and conspicuous disclosure.

Practical placement rules:

• The disclaimer should appear directly above or directly below the submit button or the phone number field. Right next to the action the user takes.
• Font size should be at least 12px on desktop, matching or close to the surrounding body text. Going smaller than 10px is a red flag in carrier audits.
• The text should sit in a color with enough contrast against the background. Light gray on white is a litigation risk.
• If the form has a checkbox for SMS consent, the disclaimer text has to be adjacent to that checkbox, not floating elsewhere on the page.

On paper forms, the same principles apply. The disclaimer goes near the phone number field, stays legible, and isn't printed smaller than the surrounding consent language.

Keyword opt-ins (where someone texts a word to a shortcode) present a different challenge. You can't fit much text in an SMS. So the CTIA requires that the opt-in confirmation message carry at minimum the program name, message frequency, data rates notice, and STOP/HELP instructions ^[3]. That confirmation message is the disclaimer in this context.

What does a compliant SMS opt-in disclaimer look like for different industries?

The six required elements stay constant across industries. What varies is how specific you get about message type and frequency. Here are real-world examples.

E-commerce / retail: "By entering your phone number and clicking Subscribe, you agree to receive recurring automated promotional and personalized marketing text messages from [Brand] at the number provided. Consent is not a condition of purchase. Msg & data rates may apply. Msg frequency varies. Reply STOP to cancel, HELP for help. [Privacy Policy] | [Terms]"

The phrase "consent is not a condition of purchase" matters here. The TCPA prohibits conditioning a purchase on consent to marketing calls or texts. Including that language shows you understand the rule ^[1].

Healthcare / dental: Healthcare practices often want to send appointment reminders. Those reminders, when purely informational, may fall under transactional or relationship messages rather than marketing, which lowers the consent bar. But if the same text thread will ever carry promotional content (a special on teeth whitening, a new service announcement), you need full marketing consent. The safe play is to get marketing-level consent upfront, every time.

"By providing your phone number, you agree to receive text messages from [Practice Name] including appointment reminders and health information. Msg & data rates may apply. Reply STOP to opt out or HELP for assistance. Msg frequency varies. [Privacy Policy]"

Real estate: Real estate agents and brokerages texting leads have to be careful, because they're often texting purchased lists from lead generators. Post-January 2025, consent from a lead gen site doesn't transfer to the individual agent unless that agent was named in the original opt-in. For agents building their own lead capture forms, see real estate text message marketing.

Restaurants: Restaurants running loyalty programs over SMS need clean disclaimers on every signup vehicle, from paper comment cards to in-app forms. The sample text message marketing for restaurants guidance covers the specifics, but the disclaimer formula is identical to retail.

B2B outreach: This is where it gets complicated. B2B texts to business cell phones carry some nuance under the TCPA, but the safe assumption is that all cell phones require consent. A B2B team collecting contact info through gated content downloads needs a disclaimer at that download form if they plan to text those contacts. More on the B2B side at b2b lead generation platforms gdpr compliance.

What happens if your SMS opt-in disclaimer is missing or wrong?

Private plaintiffs will find you. That's the short answer. The TCPA is one of the most actively litigated consumer protection statutes in the United States. In 2023 and 2024, TCPA text message cases made up a large share of federal class action filings, with settlements regularly running into the millions ^[5].

The statute sets statutory damages at $500 per violation for negligent violations and $1,500 per violation for willful or knowing violations ^[1]. Each text message to each recipient counts as a separate violation. A mid-sized SMS campaign to 10,000 recipients, sent without proper consent documentation, is a $5 million to $15 million exposure before litigation costs.

A deficient disclaimer creates an evidence problem. If a plaintiff claims they never consented, your only defense is proof of consent. If your disclaimer was buried, unclear, or missing required elements, a court can find the consent legally invalid even if the person did fill out the form. Courts have turned on exactly this kind of disclosure-quality question.

The FCC can also enforce directly. The Commission has issued multi-million dollar forfeiture orders against companies for TCPA violations, though the private plaintiff bar is the more immediate threat for most small businesses ^[6].

Carriers impose their own penalties, separately. A shortcode program with a non-compliant opt-in flow can be suspended by aggregators. Losing access to your shortcode mid-campaign is operationally brutal, and reinstatement is slow.

LeadCompliant's TCPA compliance tools and one-time compliance kit include a disclaimer review checklist if you want a quick second opinion on existing form language.

Does SMS opt-in consent have to be in writing, and what counts as written?

Yes. For marketing texts, consent has to be in writing. 47 C.F.R. § 64.1200(f)(9) defines "prior express written consent" and requires a written agreement bearing the consumer's signature ^[2]. The FCC has clarified that electronic signatures and digital checkboxes satisfy this under the federal E-SIGN Act (15 U.S.C. § 7001) ^[7].

What counts as a valid written signature for TCPA purposes:

• A checked checkbox on a web form, where the checkbox is adjacent to the disclaimer text and the user has to affirmatively check it (pre-checked boxes do not satisfy this)
• Typing a phone number into a clearly labeled field with the disclaimer directly adjacent
• Sending a keyword text to a shortcode, provided the opt-in confirmation message contains the required disclosures
• A wet signature on a paper form with printed disclaimer text
• A recorded verbal agreement where the recording documents the disclosure and consent (uncommon and harder to defend)

Pre-checked boxes are a frequent mistake. Courts have rejected them as valid consent mechanisms because the consumer made no affirmative act. If your form has a checkbox that arrives pre-ticked, uncheck it now.

The written consent record has to be retained. The TCPA doesn't set a retention period, but litigation timelines suggest keeping records for at least four years, which matches the statute of limitations under 28 U.S.C. § 1658 for TCPA claims ^[11]. Store the timestamp, the IP address, the form version, and the disclaimer text displayed at the time of consent. Storing only the phone number and date is not enough if you ever have to defend yourself.

What's the difference between a single opt-in and a double opt-in for SMS disclaimers?

Single opt-in means the consumer fills out the form, sees the disclaimer, clicks submit, and lands on your list right away. Double opt-in adds a confirmation step: after the form submission, the consumer gets a text asking them to confirm by replying YES (or a similar keyword), and they only join the active list once they reply.

From a TCPA standpoint, a properly executed single opt-in with a clear and conspicuous disclaimer is legally sufficient. There's no statutory requirement for a double opt-in ^[1]. The FCC has not mandated it.

From a practical standpoint, double opt-in is better for several reasons. It confirms the phone number is reachable and belongs to the person who filled out the form. It creates a second consent record. It cuts fake submissions and typos. It usually improves list quality, which carriers factor into spam assessments.

For sms double opt-in programs, the initial form still needs the full disclaimer. The confirmation message itself also has to carry the core disclosures (program name, frequency, data rates, STOP instructions), because carriers treat that confirmation text as part of the opt-in flow.

If your list has questionable provenance, meaning it came from a third party, was collected years ago, or you're not sure the opt-in language was compliant, double opt-in re-confirmation is the closest thing to a retroactive fix. It's not a guaranteed legal shield, but it demonstrates good-faith remediation.

How do carrier requirements for SMS disclaimers differ from FCC requirements?

The TCPA is federal law with federal remedies. Carrier requirements are contractual and operational. Break the TCPA and you're exposed to lawsuits and FCC enforcement. Break carrier requirements and your messaging program gets suspended or terminated.

The CTIA's Messaging Principles and Best Practices document is the governing standard for carrier compliance ^[3]. The major carriers (AT&T, Verizon, T-Mobile) enforce these guidelines through aggregators, the middlemen who sit between your messaging platform and the carrier network. If an aggregator finds your opt-in flow non-compliant, they can terminate your account.

Requirement	TCPA / FCC (47 CFR 64.1200)	CTIA Carrier Guidelines
Brand name in disclaimer	Required	Required
Message type description	Required	Required
Frequency disclosure	Not explicit	Required
"Msg & data rates may apply"	Not exact phrase required	Required exact phrase
STOP instructions	Required	Required
HELP instructions	Not explicitly	Required
Privacy Policy link	Not explicit	Required for most programs
Written signature	Required for marketing	Not specifically
Pre-checked box invalid	Implied by case law	Not specified

The practical takeaway: meet the CTIA standard and you'll meet the TCPA standard too. The CTIA guidelines are more operationally specific (exact phrases, confirmation message requirements) while the TCPA cares more about the legal validity of the consent itself. You need to satisfy both. They fit together rather than fight each other.

For details on how to structure your overall program, the marketing text message service breakdown covers how aggregators audit opt-in flows during program onboarding.

How should you store and document SMS opt-in consent records?

Documentation is your entire defense if a plaintiff claims they never opted in. A great disclaimer means nothing if you can't prove it was displayed and the person agreed.

Every opt-in record should capture, at minimum:

• The phone number submitted
• The date and timestamp (with timezone)
• The IP address of the submission
• The exact version of the disclaimer text displayed (or a versioned identifier that maps to stored form history)
• The URL of the page where consent was captured
• The user agent string (browser/device info) where available

For keyword opt-ins via shortcode, log the inbound keyword text, the timestamp, and the confirmation message you sent in response.

Store these records in a system that's tamper-evident and queryable. You need to pull up a specific phone number and show its consent record within minutes when a demand letter arrives. Demand letters come fast, and opposing counsel will request records right away.

The retention period has no clear statutory answer, but four years matches the most common reading of the TCPA limitations period. Some compliance attorneys recommend five to seven years as a buffer.

If you're using an sms opt-in form builder or a marketing automation platform, check whether it logs consent records automatically or whether you have to configure that separately. Many platforms generate the form but don't store the consent metadata in a way that's legally useful. Audit your stack on this point specifically.

The FTC's guidance on record retention for telemarketing (16 C.F.R. Part 310) also gives a useful benchmark: the Telemarketing Sales Rule requires a 24-month retention period for consent records ^[8]. TCPA compliance attorneys typically recommend going well past that floor.

What state laws add requirements on top of federal SMS opt-in rules?

The TCPA is a federal floor, not a ceiling. Several states have passed laws that pile on requirements for text message marketing.

California's Invasion of Privacy Act (CIPA, Cal. Penal Code § 637.2) and the California Consumer Privacy Act (CCPA) both touch SMS marketing ^[9]. CIPA has been applied to text messaging in ways that run parallel to the TCPA, and California plaintiffs sometimes pursue CIPA claims alongside TCPA claims because CIPA has its own statutory damages structure ($5,000 per violation for intentional violations). CCPA requires your privacy policy to disclose how you use phone numbers for marketing, which feeds back into your disclaimer's privacy policy link.

Florida's Telephone Solicitation Act (FTSA) is among the most aggressive state laws. Amended in 2021, it requires prior express written consent specifically for automated texts to Florida numbers and creates a private right of action with $500-per-call damages ^[10]. The FTSA's consent requirements are essentially identical to the TCPA's, but Florida plaintiffs can pursue FTSA claims in state court, which changes the litigation dynamics.

Texas, Oklahoma, and Washington have their own telephone solicitation statutes that can apply to text messages in certain circumstances. Indiana's Telephone Privacy Act similarly extends to some commercial texts.

The honest reality is that tracking every state law is hard, and the state statutes move fast. The safe approach: build a TCPA-compliant opt-in disclaimer with all six required elements, include a privacy policy link, and review your disclaimer language whenever you expand into new state markets. Keep an eye on lead generation compliance news for state-level developments.

None of this is legal advice. Run your specific program language past a qualified telecommunications attorney, especially if you operate in California or Florida.

How do you write an SMS opt-in disclaimer that's short enough to actually fit?

Length is a real tension. The disclaimer needs six elements, but web forms have limited room and long text blocks drag down form conversion. Here's how to handle it.

The minimum compliant disclaimer fits in under 50 words. This version covers every required element:

*"By submitting, you agree to receive recurring automated marketing texts from [Brand] at this number. Msg frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. [Privacy Policy] | [Terms]"*

That's 36 words. It names the brand, describes the messages as marketing, discloses frequency variability, hits the exact CTIA phrase on data rates, provides STOP and HELP instructions, and links to policy documents. If space is extremely tight, this is your floor.

For forms with more room, adding specificity helps both compliance and consumer clarity: name the specific message type ("promotional offers and new product alerts"), state a specific frequency ("up to 4 msgs/month"), and include the full URL of the privacy policy rather than just a linked word.

For keyword programs where the disclaimer has to fit in an initial marketing message or sit on a physical poster (behind a QR code), the same elements apply but the phrasing gets compressed. CTIA guidelines let the confirmation text carry the bulk of the required disclosures, so a QR code landing page might just need: "Text JOIN to 12345 to get [Brand] deals. Carrier rates apply. See [URL] for terms."

One thing you should never do: use a tooltip, a modal, or a "see full terms" link as the primary home for your disclaimer text. If the disclosure only shows on click, courts will question whether it was clear and conspicuous. The text has to be visible without any extra action from the user.

Frequently asked questions

Can I use the same SMS opt-in disclaimer for multiple brands?

No. Under the FCC's January 2025 one-to-one consent rule, each brand sending texts has to be individually named in the consent disclosure. A single form that tries to cover "us and our marketing partners" no longer creates valid TCPA consent for those partners. If you operate multiple brands, each brand needs its own opt-in form with its own specific disclaimer naming that brand.

Does a pre-checked checkbox count as valid SMS opt-in consent?

No. The TCPA requires an affirmative act by the consumer. A pre-checked box requires no action and therefore doesn't demonstrate a knowing, affirmative agreement. Multiple courts have rejected pre-checked boxes as valid TCPA consent. The checkbox has to start unchecked, and the consumer has to actively check it to agree.

Is "Msg & data rates may apply" actually required, or is it just a habit?

It's required by CTIA carrier guidelines for all SMS/MMS marketing programs. The TCPA statute doesn't specify this exact phrase, but carrier aggregators will reject or suspend programs that omit it. Since you need carrier approval to run any commercial messaging program, the phrase is functionally mandatory. Use it verbatim or a close equivalent like "Message and data rates may apply."

How long do I have to keep SMS opt-in consent records?

The TCPA statute of limitations is four years under 28 U.S.C. § 1658, so a minimum four-year retention period is the standard recommendation. The FTC's Telemarketing Sales Rule requires 24 months for consent records under 16 C.F.R. Part 310, but most compliance attorneys recommend four to five years for TCPA purposes. Store the timestamp, IP address, phone number, and the exact disclaimer text displayed.

What's the penalty for sending SMS messages without a compliant opt-in disclaimer?

The TCPA provides $500 per text message in statutory damages, rising to $1,500 per message for willful violations. Each message to each recipient is a separate violation. A 10,000-person campaign sent without valid consent is a $5 million to $15 million statutory exposure before any legal fees. Private class actions are common, and the TCPA does not require plaintiffs to show actual harm.

Does the SMS opt-in disclaimer need a privacy policy link?

CTIA guidelines require it for most commercial messaging programs, and it's standard practice in carrier program audits. The TCPA statute doesn't explicitly demand a privacy policy link, but omitting it often gets you rejected during shortcode or toll-free number registration. California's CCPA separately requires privacy disclosures for consumers in that state. Treat the privacy policy link as mandatory.

Can I collect SMS consent through a verbal agreement over the phone?

Technically yes, but it's extremely hard to defend. The TCPA requires written consent for marketing texts, and while recorded verbal agreements can satisfy the signature requirement under E-SIGN, the quality of that recording and the completeness of the disclosure are hard to prove. In practice, phone-based consent collection for SMS is high-risk. Get written consent through a form or keyword opt-in instead.

Do I need a separate SMS opt-in disclaimer if I already have a general marketing consent checkbox?

Yes, if that general checkbox doesn't specifically disclose that the person will receive text messages. A vague "yes, contact me" checkbox that doesn't name SMS as a channel and doesn't include frequency and data rate disclosures won't satisfy the TCPA or CTIA standards for text marketing. You need either a separate SMS-specific disclaimer and checkbox, or you rewrite the existing checkbox to include all SMS-specific required elements.

What's the difference between express consent and express written consent for SMS?

Express consent (lower standard) covers informational or transactional texts like appointment confirmations or shipping updates. Express written consent (higher standard) is required for marketing or promotional texts. Under 47 C.F.R. § 64.1200, written consent has to include a clear disclosure of what the person is agreeing to and a valid signature, physical or electronic. When in doubt, always collect written consent.

Does a double opt-in eliminate TCPA liability for SMS?

No. Double opt-in reduces risk and strengthens your evidence of consent, but it doesn't create an absolute legal shield. If the initial form's disclaimer was deficient, a double opt-in confirmation doesn't cure that problem retroactively. The confirmation text itself also needs the core disclosures. Double opt-in is best practice and worth doing, but your initial disclaimer still has to meet all six required elements.

Can I buy an SMS list and rely on the seller's opt-in documentation?

This is extremely high risk post-January 2025. The FCC's one-to-one consent rule means consent obtained on someone else's form, naming someone else's brand, is not valid consent for your texts. The seller's opt-in record names them, not you. Purchasing lists and texting them exposes you to per-message TCPA liability from day one. If you're building outbound programs, generate your own consent through your own clearly disclosed opt-in forms.

What should the SMS opt-in confirmation message say after someone submits a form?

The confirmation text should restate the program name, confirm enrollment, remind the person how to opt out (STOP), provide a help contact or HELP keyword, and include the data rates notice. A typical confirmation reads: "[Brand]: You're signed up for marketing alerts. Msg & data rates may apply. Reply STOP to cancel or HELP for help." CTIA guidelines treat this confirmation as part of the opt-in flow and audit its content.

Are B2B text messages exempt from the SMS opt-in disclaimer requirement?

No clear exemption exists. The TCPA applies to cell phones regardless of whether the number is used for business or personal purposes. Some practitioners argue that texts to a business landline forwarded to a cell, or to a number registered to an entity rather than an individual, fall outside the TCPA's reach, but that argument is narrow and contested. The safe practice is to collect written consent for any text to any cell phone number.

Sources

1. Cornell Law School LII, 47 U.S.C. § 227 (TCPA statute text): The TCPA requires prior express written consent before sending marketing texts to a cell phone, with $500-$1,500 per violation in statutory damages
2. FCC, 47 C.F.R. § 64.1200, Regulations implementing the TCPA: FCC regulations require a clear and conspicuous disclosure in written consent for marketing calls and texts, and define prior express written consent
3. WebRecon LLC, TCPA Lawsuit Filing Statistics 2023-2024: TCPA text message cases represented a significant share of federal class action filings in 2023 and 2024, with multi-million dollar settlements common
4. Cornell Law School LII, 15 U.S.C. § 7001 (E-SIGN Act): The federal E-SIGN Act establishes that electronic signatures and digital checkboxes satisfy written signature requirements under federal law
5. FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310: The FTC's Telemarketing Sales Rule requires a minimum 24-month retention period for consent records under 16 C.F.R. Part 310
6. California Legislative Information, Penal Code § 637.2 (CIPA): California's Invasion of Privacy Act provides $5,000 per violation for intentional violations and has been applied to commercial text message programs
7. Florida Legislature, Florida Telephone Solicitation Act (FTSA), Fla. Stat. § 501.059: Florida's FTSA, amended in 2021, requires prior express written consent for automated texts to Florida numbers and provides $500 per violation in damages
8. Cornell Law School LII, 28 U.S.C. § 1658 (statute of limitations): The general four-year statute of limitations under 28 U.S.C. § 1658 applies to TCPA claims, informing the recommended four-year consent record retention period