SMS opt-in: consent rules for SMS marketing in the US

An SMS opt-in is the shopper's prior, recorded agreement to receive your marketing texts. In the US, carriers expect it before the first promotional message, the FCC's telemarketing rule defines how written consent and revocation work, and some states add their own rules. This guide explains what valid SMS consent looks like, what to record, how STOP works, the quiet hours, A2P 10DLC registration, and how to collect consent on a Shopify store.

The rules below come from the CTIA Messaging Principles and Best Practices, the FCC's rule at 47 CFR 64.1200 (eCFR, up to date as of October 15, 2026), the Florida Statutes and Twilio's A2P 10DLC documentation, all read on October 19, 2026. This is general information, not legal advice.

What is an SMS opt-in?

It is the action by which a person says yes to your texts. The CTIA Messaging Principles and Best Practices (May 2023), the reference document of the US wireless industry, list several ways a consumer can opt in:

• entering a phone number through a website
• clicking a button on a mobile page
• texting an advertising keyword to the business
• starting the text exchange, with the business replying only with the information asked for
• signing up at a point of sale
• opting in over the phone through an automated voice menu

The principle behind them is the same: CTIA says messages "should be sent only after the Consumer has opted-in to receive them".

In 1, the principles are voluntary best practices written by CTIA's member companies; in 2, one of their goals is protecting consumers from unwanted messages.

SMS opt-in requirements: what makes consent valid

A clear call to action. CTIA asks that the consumer be told, at the moment they sign up: the program or product, the number the texts will come from, the identity of the business, any fees, and the terms such as how to opt out and the privacy policy. Opt-in details should not be buried in terms and conditions.

One opt-in per program. CTIA says an opt-in applies only to the campaign and the sender it was given for. It cannot be transferred, and lists that were rented, sold or shared should not be used.

A confirmation text. For recurring programs, CTIA recommends a confirmation sent before any other message, stating the program name, customer care contact or HELP instructions, how to opt out, that messages are recurring and how often, and any fees.

TCPA SMS compliance: prior express written consent

The FCC's rule implementing the Telephone Consumer Protection Act, 47 CFR 64.1200, requires "prior express written consent" for telemarketing calls made with an automatic telephone dialing system or an artificial or prerecorded voice. It defines it as a written agreement, bearing the signature of the person called, that clearly authorizes the seller to send advertisements or telemarketing messages to a given number. The same section sets out how consumers revoke consent "to receive calls or text messages".

Whether a given text falls under the autodialer provisions depends on your sending setup: ask your counsel. For a store, the safe practice is the same either way: a clear, recorded opt-in for every marketing text.

State rules. Several states have their own telemarketing laws. Florida's, for example, defines a "telephonic sales call" as including a text message, accepts checking a box indicating consent as an act that demonstrates express consent, and requires a consumer to reply STOP and give the sender 15 days to stop before suing over text solicitations (Fla. Stat. 501.059).

SMS consent records to keep

CTIA lists what to retain where applicable:

SMS opt-out: STOP and the FCC revocation rule

The FCC rule says a consumer may revoke consent "using any reasonable method":

• Replies with the words stop, quit, end, revoke, opt out, cancel or unsubscribe are reasonable per se, and so is a website or phone number the sender designates for opt-outs.
• A reply in other words still counts if a reasonable person would understand it as a request to stop.
• Requests must be honored within a reasonable time, not exceeding ten business days, and the sender may not impose one exclusive way to opt out.
• A single confirmation text is allowed if it only confirms the request, carries no promotion and is the only message sent after it; sent within five minutes, it is presumed to fall within the consumer's prior consent.

CTIA asks senders to use the standard STOP wording in opt-out instructions while honoring normal language, whatever the capitalization or punctuation. In practice, end every marketing text with "Reply STOP to opt out" and make sure the opt-out reaches your customer profile so no other tool texts that person again.

SMS quiet hours: federal and state

Schedule campaigns in each recipient's time zone, not yours, and hold automated marketing texts that would land outside the window until the morning. Ask your counsel which state rules reach your texts.

A2P 10DLC registration

Consent is not the only gate: carriers also want to know who is sending. Twilio's A2P 10DLC documentation describes A2P 10DLC as the standard US carriers put in place so that SMS traffic to US users through 10-digit long code numbers is "verified and consensual". Anyone sending SMS or MMS from an application over a 10DLC number to the US must register; unregistered traffic pays additional carrier fees, and registration brings lower filtering and higher throughput. Toll-free numbers and short codes sit outside 10DLC and have their own processes. Our 10DLC registration guide covers the brand and campaign steps, the fees and the timelines.

Texting customers in the UK: PECR and the soft opt-in

UK rules work differently. The ICO's guidance on electronic mail marketing, read on October 19, 2026, says you must not send marketing texts to individuals without specific consent, for example a ticked opt-in box, with one exception, often called the "soft opt-in":

• the person is an existing customer who bought (or negotiated to buy) a similar product or service from you;
• you gave them a simple way to opt out when you collected their details, and in every message since.

The soft opt-in does not cover prospects or bought-in lists. In every text, you must not hide your identity, and you must give a valid way to opt out. There is no central do-not-text register in the UK, the ICO adds, because texts may only go to people who consented or were offered an opt-out.

Transactional vs promotional SMS: which texts need the opt-in?

Google's classification comes from its RCS agent use cases. For the cart reminder specifically, see our guide to abandoned cart SMS on Shopify.

How to collect SMS consent on Shopify

1. Turn on the SMS checkbox at checkout. In Settings > Checkout, Marketing opt-in section, select Checkout only under SMS. Shopify saves the preference once the customer submits the checkout (Shopify Help Center).
2. Rewrite the text next to the box. The default wording speaks of news and offers. Say who will text, what kind of messages (offers, cart reminders), how often, and how to stop. Shopify asks stores that send cart reminders to change this text.
3. Add a signup form that collects the phone number with its own unchecked consent box, for visitors who are not checking out yet.
4. Send a confirmation text to new subscribers with the program name, frequency, HELP and STOP instructions.

SMS marketing compliance checklist

• Every recipient has a recorded opt-in for marketing texts from your store.
• The signup wording names your brand, the type and frequency of texts, and how to stop.
• Each text starts with your brand name and ends with an opt-out line.
• STOP and its variants are processed within ten business days at most, and opt-outs sync to every tool that sends texts.
• Sends are scheduled inside federal and state quiet hours, in the recipient's time zone.
• Your 10DLC brand and campaign are registered, or you send from a verified toll-free number or a short code.
• No purchased, rented or shared lists.

Selling in Europe too? The EU's ePrivacy Directive allows direct marketing by electronic mail, which its recitals say includes SMS, only with prior consent, with an exception for existing customers and similar products. Our French guide covers the rules for France.

Where Kanal fits

Kanal is SMS marketing software for Shopify stores. Opt-ins and opt-outs sit on each customer's profile, so a campaign goes only to the people who said yes and an opt-out stays recorded. You send SMS campaigns to your store's segments and switch on automated texts for carts, orders and stock, with the orders and revenue of each send attributed to it.

In 1, consent comes before the first marketing text; in 2, the federal sending hours.

The same app sends WhatsApp and RCS messages from the same customer base. More than 500 brands use Kanal, installed in about five minutes from the Shopify App Store. Start with the SMS marketing software overview, or read how stores handle consent on WhatsApp in our WhatsApp opt-in guide.