SMS opt-in language: what to write and where to put it

Last updated 2026-07-10

What does TCPA-compliant SMS opt-in language actually require?

Compliant SMS opt-in language needs seven things: your business name, the message type, frequency, a 'message and data rates may apply' warning, STOP and HELP instructions, and a link to your privacy policy and terms. All of it has to be visible before the consumer opts in. Skip any element and your consent gets weaker in court.

The Telephone Consumer Protection Act, 47 U.S.C. § 227, prohibits sending autodialed or prerecorded text messages to a cell phone without prior express written consent ^[1]. The FCC's 2012 order tightened that rule and spelled out what 'prior express written consent' means in practice ^[5]. For SMS marketing, consent must be written (a web form, a paper form, or a keyword text all count), and the consumer must see a clear disclosure before they give it.

CTIA and carrier guidelines turned those legal requirements into a short checklist that every opt-in flow needs ^[3]:

1. The name of the business or program sending the messages 2. The nature of the messages (promotions, alerts, appointment reminders, etc.) 3. Message frequency, or the phrase 'Message frequency varies' 4. 'Message and data rates may apply' 5. How to opt out (typically: 'Reply STOP to unsubscribe') 6. How to get help (typically: 'Reply HELP for help') 7. A link to your privacy policy and terms of service

That list is not optional. Carriers block or filter messages from shortcodes or 10-digit long codes (10DLCs) that fail to register a compliant opt-in flow, and plaintiffs' attorneys use missing disclosures as evidence that consent was never valid ^[4].

One thing people miss. The FCC's 2023 order on one-to-one consent, effective January 2025, kills the old 'lead gen' workaround where a single checkbox on a partner site granted consent to a whole list of companies ^[2]. Consent now has to name the specific seller who will contact the consumer. If you buy leads, the consent language on the source form must name you, or you have no valid consent.

What is the exact wording for SMS opt-in language on a web form?

Here's a template that covers every required element. Fill in the bracketed parts with your real details.

---

Short form (under the phone field on a contact or lead form):

"By checking this box, you agree to receive recurring automated marketing text messages from [Business Name] at the phone number provided. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe, HELP for help. See our [Privacy Policy] and [Terms of Service]."

---

Longer form (standalone opt-in page or modal):

"By submitting this form, you consent to receive text messages from [Business Name] (or on behalf of [Business Name]) regarding [describe: promotions, order updates, appointment reminders, etc.]. You can expect approximately [X] messages per month. Message and data rates may apply. Consent is not a condition of purchase. Reply STOP at any time to cancel. Reply HELP for assistance. View our full [Privacy Policy] at [URL] and [Terms of Service] at [URL]."

---

A few things to notice. 'Consent is not a condition of purchase' matters most on checkout pages, where the FCC and class action plaintiffs have argued that bundling consent with a purchase is coercive ^[1]. You don't legally need that sentence on every page, but it's cheap protection and courts have looked at it favorably.

The phrase 'recurring automated' does real work. It tells the consumer they're agreeing to an autodialer, which is what triggers TCPA coverage. Dropping the word 'automated' from your disclosure doesn't mean you dodge TCPA. It just means your disclosure was incomplete.

Don't bury consent in your general terms of service behind a checkbox that says 'I agree to the terms.' Courts have rejected that. The opt-in disclosure has to sit next to the phone number field, visible without scrolling, and clearly labeled ^[5].

Does opt-in language for SMS contact forms need to follow a specific placement rule?

Yes, and placement is where companies trip even when the wording itself is correct. The disclosure has to be visible at the moment the consumer acts. Directly below the phone field, above the submit button, in text you can read on a phone. Not the footer. Not a tooltip. Not a link.

The FCC and courts use the phrase 'clear and conspicuous' to describe where and how a consent disclosure must appear ^[2]. No agency has defined it in pixels, but case law paints a practical picture: the disclosure must be in front of the consumer when they submit the form, click the button, or send the keyword. If a user has to scroll down, click 'more,' or read fine print to find the consent language, you have a problem.

The safest placement is directly below the phone number field, above the submit button. Right there, before the action that triggers consent.

For web forms specifically:

• Font size should match the surrounding body text, not shrink to 8px fine print.
• The opt-in checkbox (if you use one) must be unchecked by default. Pre-checked boxes do not count as prior express written consent under TCPA ^[5].
• The submit button label matters. If it says 'Get My Free Quote,' the consent disclosure right above it should make plain that submitting also enrolls them in texts. Courts have looked at whether the button action and the consent disclosure are logically linked.

If you're using a multi-step form where the phone field is on step 1 and the submit button is on step 3, put the disclosure on the step where the phone number is entered, and again near the final submit. One disclosure buried three steps back is a gamble.

How do you add SMS opt-in language to a Shopify contact form or checkout?

Shopify has had a native SMS marketing consent field in checkout since 2022, but the default wording is thin and you should audit it ^[6]. The built-in field usually reads something like 'Text me with news and offers' plus a note about frequency. That's not enough. Shopify Plus merchants can edit checkout.liquid to add fuller disclosure language.

For non-Plus stores, or for contact forms and pop-ups outside checkout, most people use a third-party SMS app (Klaviyo, Postscript, Attentive, SMSBump/Yotpo) that drops a compliant opt-in checkbox or disclosure below the phone field. These apps keep their own compliance templates and update them when carrier or FCC rules change, which is one reason they're worth the cost for volume senders.

If you're adding the disclosure manually to a Shopify contact form via theme editing:

1. Open the theme editor, find the contact form section. 2. Add a text block or custom HTML block directly below the phone input field. 3. Paste your disclosure language (see the templates above). 4. Add an unchecked checkbox input if you want explicit opt-in rather than implied consent on submit. 5. Make sure your form's back end captures and timestamps the consent record, including which version of the disclosure was shown.

That last point gets skipped, and it's the one that decides litigation. TCPA plaintiffs can text in, get added to your list, then claim they never consented. If you can't show a timestamped record of the form submission with the disclosure language that was live at that moment, you're arguing from memory against a plaintiff's attorney who has screenshots.

On Shopify, apps like Postscript store consent records with timestamps and disclosure version history. If you're past a few hundred opted-in contacts, that record-keeping alone justifies the app cost.

What opt-in language is required for SMS keyword campaigns?

A keyword campaign is when you tell someone to text a word (like 'JOIN' or 'DEALS') to a shortcode or 10DLC number. They send the keyword, they're opted in. This is one of the cleanest consent methods under TCPA because you get a timestamped inbound text as evidence.

You still need disclosures, just in two places instead of one.

Where you advertise the keyword (a flyer, social post, in-store sign, website): This is the 'call to action,' or CTA. It must carry all the required disclosure elements: program name, message type, frequency or 'message frequency varies,' 'message and data rates may apply,' how to stop, how to get help, and your privacy policy link.

Sample CTA: "Text JOIN to 55555 to receive [Business Name] promotions. Message frequency varies. Message and data rates may apply. Reply STOP to cancel, HELP for help. [Privacy Policy URL]"

The auto-reply the consumer gets after texting the keyword: This is the confirmation message, and carriers require it. It must restate the program name, confirm enrollment, explain what they signed up for, remind them they can STOP, and say 'message and data rates may apply.'

Sample confirmation: "[Business Name]: You're in! You'll get [X] msgs/month with exclusive deals. Msg & data rates may apply. Reply STOP to cancel, HELP for help."

Carriers call it the 'double opt-in' flow when you add a second step asking the consumer to confirm by replying YES. SMS double opt-in isn't legally required under TCPA, but it builds stronger consent evidence and cuts spam complaints, which protects your deliverability.

If your keyword runs offline (a radio ad, a store receipt), you hit a practical wall: you can't hyperlink a privacy policy on a receipt. The FCC hasn't issued definitive guidance here, but the industry standard is to print the full URL in text and make sure the disclosure lives on your website at that URL.

What are the TCPA penalties for using bad SMS opt-in language?

The statute sets damages at $500 per message for negligent violations and $1,500 per message for willful ones ^[1]. There's no cap. A marketing blast to 10,000 people with defective consent language is a $5,000,000 exposure at the floor rate if none of them validly consented.

That math is why TCPA litigation is its own cottage industry. Plaintiffs' attorneys file on contingency, and recipients of violating texts can recover statutory damages without proving any actual harm. The FTC tracks TCPA and related enforcement, and settlements have run into hundreds of millions in aggregate over the past decade ^[4]. The FCC's 2023 order was partly a response to the volume of consumer complaints about unwanted texts ^[2].

Some real outcomes to show the scale:

• Papa John's settled a TCPA text message class action for $16.5 million in 2021 ^[4].
• Jiffy Lube settled for $47 million in 2019 over text message campaigns ^[4].

Neither company set out to text people without consent. In most of these cases the opt-in language or process had a defect: a bundled checkbox, a pre-checked box, missing disclosures, or consent collected by a third-party lead generator whose form never named the defendant.

For small outbound teams, the realistic risk isn't a $50M class action. It's a demand letter from a serial plaintiff (sometimes called a 'professional plaintiff') who opted into your list to set up a claim, found a defect in your opt-in, and wants $5,000 to $50,000 to go away. That range is common enough to have its own slang in compliance circles. Good opt-in language is the cheapest insurance against it.

See our TCPA SMS compliance guide for a deeper breakdown of what triggers suits versus what gets dismissed.

Does the FCC's 2024 one-to-one consent rule change what opt-in language needs to say?

Yes, and heavily, especially for lead generation businesses and anyone buying or selling leads. Consent now has to name a single seller. The old 'our partners and affiliates' checkbox is dead.

The FCC's December 2023 order, effective January 27, 2025, requires that consent for marketing calls and texts identify 'a single seller' ^[2]. The model where a consumer checked one box consenting to be contacted by a whole roster of buyers, and that consent got sold across dozens of companies, no longer produces valid consent.

What this means for your opt-in language:

If you collect your own leads: Not much changes. Your opt-in language should already name your business specifically. Confirm it does.

If you run a lead gen form and sell leads to multiple buyers: Each buyer must now be named, or the form has to give the consumer a clear way to pick which sellers they consent to hear from. The FCC called out the 'comparison shopping website' category by name in the order. If you run one, this hits you directly.

If you buy leads from a third party: Audit the source form. If it didn't name your business specifically, you don't have valid consent under the new rule. Using those leads for SMS after January 27, 2025 is an unforced TCPA violation.

The FCC's stated concern is confusion about who is contacting the consumer and why, which is why the order ties consent to a single identified seller ^[2]. That's the agency's rationale for scrapping the multi-seller model.

For teams using marketing text message services to send at scale, the one-to-one rule is the compliance headache of 2025. Audit your lead sources now, before a demand letter audits them for you.

What is the right opt-in language for real estate SMS marketing?

Real estate has a wrinkle: agents often collect phone numbers in person (open houses, door knocking, yard sign calls) and then want those contacts in text campaigns. That's a different consent scenario than a web form, but the rules are identical even when the logistics differ.

For web-based collection (IDX pages, home valuation tools, contact forms):

"By submitting your information, you consent to receive text messages from [Agent/Brokerage Name] regarding real estate listings, market updates, and related services. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe, HELP for help. [Privacy Policy] [Terms]"

For in-person collection (sign-in sheets, business cards):

The disclosure still has to happen at the point of collection. A sign-in sheet should have the opt-in disclosure printed on it, and the person should sign or initial next to their phone number. A business card swap is not TCPA consent. Texting someone who handed you a card at an open house without express written consent is a violation.

For yard sign or property sign keywords ('Text HOME to 55555 for listing info'):

That's a keyword campaign, so use the keyword language above. The auto-reply should name your brokerage, more than a generic 'thanks for texting.' 10DLC registration requires you to declare the use case, and real estate is a supported category.

Real estate teams sending listing alerts or drip campaigns should read real estate text message marketing for use-case-specific examples.

One thing worth saying plainly: many real estate CRMs (Follow Up Boss, LionDesk, Sierra Interactive) have SMS built in, and some of their default opt-in flows are thin. Don't assume the vendor's default language is legally sufficient. Read it yourself against the checklist at the top of this article.

How do you document and store SMS consent records?

Good opt-in language is half the battle. Proving you had consent when a plaintiff demands it is the other half. Keep timestamped records for at least four years, including the exact disclosure text that was live when each person opted in.

The FCC directs you to retain consent records for at least 4 years ^[2]. TCPA claims run on a four-year federal statute of limitations under 28 U.S.C. § 1658 ^[8], so your records need to survive that window.

What a consent record should contain:

• Timestamp (date and time, with timezone)
• IP address of the form submission
• Phone number that was submitted
• The exact disclosure language that was live on the form at that moment (not 'we had a disclosure,' but what it actually said)
• How the person opted in (form name, URL, keyword, etc.)
• Whether a confirmation message was sent, and when

The 'exact disclosure language' point is the one most small teams miss. If you update your opt-in language in month 6, you need to know which version each contact saw. Version-control your consent disclosures.

For most small teams, the simplest approach is:

1. Screenshot and date-stamp your opt-in form every time you change it. 2. Store form submissions in a CRM field that includes the opt-in source and timestamp. 3. If you use a third-party SMS platform, confirm it stores consent records and that you can export them.

LeadCompliant's free consent record templates can help you set up a basic consent log without paying a compliance attorney to build one from scratch. That's not legal advice, and for high-volume or high-risk programs, actual counsel is worth it.

For the end-to-end process, including double opt-in flows and record-keeping systems, the SMS opt-in guide covers the mechanics.

What opt-in language do SMS platforms and carriers actually check for?

When you register a 10DLC campaign (now required for most A2P business texting in the US) ^[7], the carrier vetting process reviews your opt-in flow. They're not parsing fine legal points. They're checking for the same required elements listed at the top of this article: program name, message type, frequency, rates warning, STOP and HELP, and a privacy policy link.

The Campaign Registry (TCR), the central database for 10DLC registration, requires you to submit ^[7]:

• A description of how opt-in is obtained
• A sample opt-in message or screenshot of the opt-in flow
• Your privacy policy URL

Carriers (AT&T, T-Mobile, Verizon) can reject or suspend campaigns where the opt-in description doesn't match industry standards ^[3]. T-Mobile's publicly posted code of conduct lists the required disclosure elements and states that campaigns failing to meet them get blocked.

Rejection is common for weak opt-in documentation. Nobody publishes current, audited rejection rates, so treat any single number with caution. The practical takeaway holds regardless: writing good opt-in language is more than a legal exercise. It's also what gets your shortcode or 10DLC approved and keeps your messages delivering.

For teams evaluating text message marketing software, carrier registration support and opt-in template libraries are worth asking about specifically. Some platforms handle 10DLC registration for you. Others leave it entirely to you.

The SMS opt-in form guide goes deeper on the technical setup if you're building a form from scratch or auditing an existing one.

Are there different SMS opt-in language rules for B2B versus B2C?

This is a real gray area, and nobody should tell you B2B SMS is categorically exempt from TCPA. TCPA applies to messages sent to cell phones, period. The question is consent, not B2B versus B2C status.

A cell phone is a cell phone whether the owner is receiving a business or personal message. Text a business owner's cell and TCPA applies.

There's an argument that some B2B texts fall under an 'established business relationship,' or that business cell numbers are used in ways that imply some consent to business contact. Courts have been inconsistent. The safer position is to treat B2B SMS the same as B2C: collect express written consent, use the same disclosure language, keep the same records.

The one real distinction: if you text a landline or a VoIP number that can't receive SMS, TCPA doesn't apply the same way (the recipient can't actually get the text, so there's no injury). But most business contacts now hand over mobile numbers, so this exception is narrower than it sounds.

For B2B lead generation specifically, the one-to-one consent rule and the named-seller requirement apply exactly as they do for B2C. If you're buying B2B leads and the source form didn't name you, you don't have valid consent.

See B2B lead generation platforms GDPR compliance if your contacts are in the EU, where the rules sit apart from TCPA and in some ways run stricter.

What should the first text message say after someone opts in?

The first message after opt-in is the 'welcome' or 'confirmation' message, and it carries its own required content separate from the opt-in disclosure. Send it immediately after opt-in, before any marketing message.

CTIA guidelines and carrier standards require the confirmation message to include ^[3]:

• Your business name or program name
• Confirmation that enrollment was successful
• Message frequency (or 'message frequency varies')
• 'Message and data rates may apply'
• How to stop (STOP)
• How to get help (HELP)

Sample: "[Business Name]: Thanks for signing up! You'll receive [X] msgs/month with [deal type/updates]. Msg & data rates may apply. Reply STOP to cancel, HELP for help."

Send this before any marketing message. If your first text is a promotion, the consumer never got the required confirmation, and that's a compliance gap.

After the confirmation, follow-up marketing messages should still carry an opt-out reminder periodically. CTIA recommends including 'Reply STOP to unsubscribe' in every promotional message, or at minimum every 30 days ^[10]. Some platforms add it automatically. Check yours.

Opt-out processing is required too. When someone replies STOP, you must stop texting them right away. TCPA doesn't set a limit in hours, but carriers require STOP commands to be processed within a very short window, effectively immediately ^[9]. Sending even one message after a STOP reply is a clean violation.

Frequently asked questions

Does TCPA require a checkbox for SMS opt-in, or is a form submission enough?

A checkbox isn't legally required, but it creates stronger evidence of consent. Form submission can count as consent if the disclosure is clear, conspicuous, and proximate to the submit button, and the consumer actively took an action to submit. Pre-checked boxes do not count. If you use a checkbox, it must be unchecked by default. Courts have accepted both flows, but checkbox records are harder to challenge.

Can I copy and paste generic SMS opt-in language from a template?

A template gives you the required elements, but you have to fill in the specifics: your actual business name, the real message type, and an honest frequency. Generic language that says 'your messages' or leaves brackets unfilled is a red flag to carriers and plaintiffs alike. Audit any template against the required disclosure checklist before you publish. If your lawyer drafted it, have them confirm it covers the FCC's 2023 one-to-one consent rule.

What does 'message and data rates may apply' actually mean, and do I have to say it?

It means the recipient's wireless carrier may charge them for receiving or sending SMS, depending on their plan. You're required to disclose it under CTIA guidelines and carrier standards for 10DLC campaigns. In practice most US consumers have unlimited texting, so it rarely affects anyone, but omitting the phrase can trigger carrier filtering or strengthen a plaintiff's claim that your disclosure was incomplete.

How long do I need to keep SMS consent records?

The FCC directs you to retain consent records for at least 4 years, which matches the general federal statute of limitations for TCPA claims under 28 U.S.C. § 1658. Store the timestamp, IP address, phone number, and the exact disclosure text that was live at the time of opt-in. If you update your opt-in language, preserve old versions and which contacts saw each version.

Is 'consent is not a condition of purchase' required in SMS opt-in language?

The FCC and TCPA don't require that exact phrase. But the underlying rule is real: consent can't be conditioned on a purchase or service. The phrase is standard on checkout pages because bundling consent with a transaction is a common litigation target. Including it costs nothing and removes an easy argument for plaintiffs. On non-purchase forms it's less critical, but never harmful.

Can I add SMS opt-in language to a Shopify checkout page?

Yes. Shopify has a built-in SMS marketing consent field in checkout that standard merchants can enable in Settings then Notifications. For more control over the wording, Shopify Plus merchants can edit checkout.liquid. Non-Plus merchants typically use a third-party SMS app like Postscript or Klaviyo, which injects compliant opt-in language and stores timestamped consent records. Review whatever default language Shopify or your app uses. Don't assume it meets current FCC standards.

What happens if someone opts out and I text them again by mistake?

That's a TCPA violation. Sending a message after a STOP reply is one of the cleanest wins for a plaintiff because there's no dispute about consent: the person revoked it explicitly. Statutory damages run $500 to $1,500 per message. The FCC requires opt-out processing to be immediate. If a contact replies STOP and your system lags in honoring it, fix that. Even transactional messages are restricted after a STOP in most cases.

Do I need different SMS opt-in language for transactional messages versus marketing messages?

Yes. Transactional messages (order confirmations, shipping alerts, appointment reminders) require consent, but the bar is lower: express consent is enough, not prior express written consent. Marketing messages require prior express written consent with the full set of disclosures. Many businesses collect written consent for both at once, which is the cleanest approach. If you start sending promotions to a transactional-only opt-in list, you're misusing that consent.

Does the FCC's 2023 one-to-one consent rule apply to my existing opt-in list?

It applies to consent collected on or after January 27, 2025, the effective date. Contacts who opted in before that date under prior rules are generally grandfathered, though legal opinions vary and some attorneys recommend re-consenting lists built on broad multi-seller language. For new leads after that date, the source form must name your business specifically. Buying leads where the form named a different company, or no specific company, is a clear violation.

What is the difference between a shortcode opt-in and a 10DLC opt-in for compliance purposes?

The required disclosure language is the same for both. The difference is registration: shortcodes require carrier vetting and come shared or dedicated; 10DLC numbers require Campaign Registry registration and carrier approval of your use case and opt-in flow. Both require a documented opt-in method and compliant disclosure. 10DLC has become the standard for most business SMS because shortcodes cost more (roughly $500 to $1,000 per month versus $15 to $20 per month for 10DLC).

Can I use SMS opt-in language on a pop-up or exit-intent form?

Yes, and pop-ups are common for e-commerce list building. The placement and clarity rules still apply: the disclosure must be visible before the consumer submits, the checkbox must be unchecked by default, and the language must carry all required elements. Pop-ups that auto-check an SMS box, or hide the disclosure in small grey text on a white background, are litigation bait. Test your pop-up on a mobile device, since that's where most users see it.

What opt-in language should restaurants use for SMS marketing?

Restaurants usually collect opt-ins via loyalty sign-ups, reservation confirmations, or in-store QR codes. The language follows the same template: business name, message type (promotions, specials, loyalty rewards), frequency, 'message and data rates may apply,' STOP and HELP instructions, and a privacy policy link. For loyalty programs, specify that opting into texts is separate from joining the program and isn't required to earn points.

If I collect a phone number on a contact form without any SMS disclosure, can I still text that person?

No. Collecting a phone number without an SMS opt-in disclosure is not prior express written consent for marketing texts. The FCC is explicit that consent requires disclosure of who's contacting, what type of messages, and how to opt out, all before the consumer hands over the number. Texting someone whose number you collected through a no-disclosure form is a TCPA violation from the first message.

Sources

1. Cornell Law School LII, 47 U.S.C. § 227 (TCPA text): TCPA prohibits autodialed or prerecorded texts to cell phones without prior express written consent; sets damages at $500 per violation, up to $1,500 for willful violations
2. FCC, Report and Order on the Telephone Consumer Protection Act (FCC 23-107, December 2023): FCC's December 2023 order requires one-to-one consent identifying a single named seller, effective January 27, 2025; the agency directs at least 4-year retention of consent records
3. CTIA, Messaging Principles and Best Practices: CTIA guidelines require program name, message type, frequency, 'message and data rates may apply,' STOP/HELP instructions, and privacy policy link in SMS opt-in disclosures and confirmation messages
4. Federal Trade Commission, Enforcement actions overview: TCPA class action settlements have reached hundreds of millions in aggregate; Papa John's settled for $16.5M in 2021, Jiffy Lube for $47M in 2019
5. FCC, In the Matter of Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991 (2012 TCPA Order, FCC 12-21): FCC 2012 order specifies prior express written consent requirements, including that pre-checked boxes do not satisfy the written consent requirement and that consent must be clear and conspicuous
6. Shopify Help Center, SMS marketing consent at checkout: Shopify introduced a dedicated SMS marketing consent checkbox in checkout in 2022; Shopify Plus merchants can customize checkout.liquid for additional disclosure language
7. The Campaign Registry (TCR), 10DLC campaign registration requirements: TCR requires submission of opt-in method description, sample opt-in message or screenshot, and privacy policy URL for all 10DLC campaign registrations
8. 28 U.S.C. § 1658, federal general statute of limitations (Cornell LII): Four-year statute of limitations applies to federal civil claims including TCPA actions, establishing the minimum record retention period for consent documentation
9. FCC Consumer Guide, Stop Unwanted Robocalls and Texts: FCC guidance confirms marketing texts require prior express written consent and that consumers can revoke consent at any time, requiring prompt cessation of messages
10. CTIA, Short Code Monitoring Handbook: CTIA Short Code Monitoring Handbook specifies confirmation message requirements after keyword opt-in, including program name, frequency, STOP and HELP instructions, and periodic opt-out reminders