If a complaint ever lands, the only question that matters is what you can show: when consent was given, through what mechanism, and to what wording. Most small businesses cannot answer any of the three, because the number was collected for something else entirely.
Not legal advice
This is the practical shape of the problem. Messaging law varies by country and by US state, and several states are stricter than the federal baseline. If you are sending at volume or in a regulated industry, have a lawyer review your flow. Broader context on the compliance page.
The four things you must store
| Field | Why it matters |
|---|---|
| Timestamp | Proves when. Consent has no expiry in most rules but staleness is a real defence problem. |
| Mechanism | Web form, in-person tablet, checkbox at checkout, verbal at reception. |
| Exact wording shown | Store the string, not a reference to it. Your website copy will change. |
| Scope | Transactional only, or promotional too. These are different permissions. |
That last row is the one that trips people. A customer who agreed to appointment reminders has not agreed to a Black Friday promotion, and treating those as one permission is the most common way a well-intentioned business ends up in trouble.
By collection point
Booking form on your website
The easiest to get right. An unticked checkbox next to specific wording, stored with the submission.
<label>
<input type="checkbox" name="sms_consent" value="yes" />
Text me appointment reminders and updates from Ridge Dental at this
number. Reply STOP any time. Message rates may apply.
</label>Unticked by default, specific about who and what, and the string itself gets stored alongside the record.
In person, at the counter
Hardest to do properly and where most small business consent actually originates. A tablet with the same checkbox is the defensible version. A verbal 'is it okay if we text you?' is better than nothing but you must log it — who asked, when, and what they said yes to.
Existing customers you have been serving for years
The awkward one. A number given in 2019 for a delivery is not consent to message in 2026. The clean fix is a one-time re-permission — but send that through a channel you already have permission for, usually email, rather than by texting people to ask whether you may text them.
Someone who texts you first
The strongest consent there is, for the conversation they started. It is not automatically consent for promotional messaging later — ask separately, in the thread, once.
What is never consent
- A purchased or rented list. Ever, under any framing.
- Numbers scraped from public listings or LinkedIn.
- A pre-ticked box, or consent buried in terms nobody read.
- Consent given to a business you acquired, unless the transfer was disclosed.
- A number given for two-factor authentication or delivery only.
Opt-out is part of opt-in
A consent record is only defensible if the exit works. In a conversational channel people do not type STOP — they type 'please stop texting me', or just 'no'. If a human reading the thread would understand it as a request to stop, your system has to as well.
And suppress in both places: the provider's list and your own CRM. Neither updates the other, and an opt-out that only lands in one of them will eventually send again. Implementation detail is in the automation walkthrough.
Audit your own flow
- Every collection point shows specific wording naming your business
- The wording string is stored per contact, not just a boolean
- Transactional and promotional scope are separate fields
- Opt-out catches plain English, not only keywords
- Suppression writes to your CRM and the provider
- You could produce a full consent record for any contact in under five minutes