SMS opt-in language that passes carrier review names the sending brand, describes the type of messages, states message frequency, says "Message and data rates may apply," explains how to text STOP to opt out and HELP for help, and links to a privacy policy and terms. Marketing consent should also say consent is not a condition of purchase.
What must SMS opt-in language include?
Carriers expect the disclosure at the point of opt-in to identify the brand, describe the messages, state frequency, mention message and data rates, explain STOP and HELP, and link to your privacy policy and terms. Missing any of these is a common reason for 10DLC campaign rejection.
| Element | Example wording | Why reviewers look for it |
|---|---|---|
| Brand name | "from Acme Outdoor" | Consent must be specific to the sender |
| Message type | "order updates and promotional offers" | Consent covers only what is described |
| Frequency | "Msg frequency varies" or "up to 4 msgs/month" | CTIA guidance requires it |
| Rates | "Msg and data rates may apply." | Standard carrier disclosure |
| Opt-out | "Reply STOP to opt out." | Consumers must know how to leave |
| Help | "Reply HELP for help." | Support path required |
| Policy links | Links to privacy policy and terms | Reviewers open and read them |
Source: Bandwidth 10DLC campaign vetting guidance (updated April 2026) and the CTIA Messaging Principles and Best Practices (May 2023).
What does a compliant base template look like?
A web-form checkbox with a full disclosure next to it works for most businesses. Replace the bracketed fields and keep the structure.
[ ] By checking this box, I agree to receive [type of messages, e.g. appointment reminders and promotional offers] by text from [Brand Name] at the number provided. Consent is not a condition of purchase. Msg frequency varies. Msg and data rates may apply. Reply STOP to opt out, HELP for help. See our Privacy Policy and Terms: [links].
For keyword opt-in ("Text JOIN to 555-555-0100"), the advertisement that shows the keyword needs the same disclosures, and the first reply should be a confirmation message.
How should opt-in language change by use case?
Change the message-type description and frequency to match the program; keep every other element. The consent covers only what you describe, so describe everything you plan to send.
Marketing and promotions
I agree to receive recurring marketing texts from [Brand], including offers and product news, at the number provided. Consent is not a condition of purchase. Up to [N] msgs/month. Msg and data rates may apply. Reply STOP to cancel, HELP for help. Privacy Policy and Terms: [links].
Account and service notifications
I agree to receive account and service texts from [Brand], such as order confirmations and delivery updates. Msg frequency varies. Msg and data rates may apply. Reply STOP to opt out, HELP for help. Privacy Policy and Terms: [links].
Appointment reminders
I agree to receive appointment confirmations and reminders by text from [Brand]. Msg frequency varies. Msg and data rates may apply. Reply STOP to opt out, HELP for help. Privacy Policy and Terms: [links].
Financial services inquiries
I agree to receive texts from [Brand] about my application, including status updates and document requests. Consent is not a condition of any service. Msg frequency varies. Msg and data rates may apply. Reply STOP to opt out, HELP for help. Privacy Policy and Terms: [links].
Notice what the financial template leaves out: any mention of "partners", "affiliates", or "lenders in our network" contacting the consumer. Carriers require 10DLC opt-in that is one-to-one and not shared with third parties (Bandwidth, April 2026), and third-party lead generation is a disallowed campaign type (Twilio). Earlier versions of this guide included a partner clause; it should not be used.
Is one-to-one consent still required after the FCC rule was vacated?
For carrier approval, effectively yes. The FCC's one-to-one consent rule was vacated by the Eleventh Circuit on January 24, 2025, and the FCC removed it, but carriers still require consent that is specific to the sending brand for 10DLC.
The court decision changed federal TCPA law, not carrier policy. Multi-seller consent forms may be lawful under the TCPA in some cases, but they will not pass 10DLC review. Write consent for one brand.
What mistakes get opt-in language rejected?
Reviewers reject disclosures that are vague, hidden, bundled, or that permit sharing. Each has a straightforward fix.
- No brand name. "You agree to receive texts" does not say from whom.
- Pre-checked or required box. SMS consent must be an unchecked, optional checkbox, separate from terms acceptance.
- Bundled channels. One checkbox for email, calls, and SMS. Use a separate SMS checkbox.
- Buried text. Disclosure placed far from the checkbox or in low-contrast fine print.
- STOP missing on transactional forms. Every program needs opt-out instructions, not just marketing.
- Dead or generic policy links. Reviewers open them; they must load and mention SMS.
- Sharing language. "We may share your information with partners" in the consent or privacy policy.
What should your privacy policy say about SMS?
Your privacy policy needs an SMS section that explains how phone numbers are used and states that mobile information is not shared with third parties or affiliates for marketing or promotional purposes. Reviewers look for this sentence specifically.
SMS communications: We use the mobile number you provide to send the text messages you opted in to receive. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Opt-in data and consent are not shared with any third party. You can opt out at any time by replying STOP.
Your terms should repeat the program details: program name, message types, frequency, rates, STOP and HELP instructions, and a support contact.
What happens after someone opts in or out?
Send one confirmation message immediately after opt-in, and honor opt-outs made in any reasonable way. Both are checked during review and enforced afterward.
A typical confirmation: "[Brand]: You're subscribed to [program]. Msg frequency varies. Msg and data rates may apply. Reply HELP for help, STOP to cancel."
Under FCC rules effective April 11, 2025, consumers can revoke consent by any reasonable means, including words such as stop, quit, cancel, unsubscribe, end, revoke, and opt out, and you must honor it within 10 business days. The separate requirement to apply one opt-out to all message types from the sender has been delayed to January 31, 2027 (FCC DA 26-12). Keep a record of each consent: timestamp, source page, IP address, and the exact disclosure text shown.
How do you check your opt-in form before submitting?
Compare the live form against the element table above, open every link, and confirm the brand name matches your registration exactly. Then submit screenshots of the form with your campaign.
The free Landing Page QA tool scans a page for 10DLC and TCPA consent signals. Full Percent's 10DLC-compliant website ships with the privacy policy, terms, SMS consent pages, and contact forms with compliant consent language already in place, delivered within one business day. For consent-form design details, see building a website consent form for SMS.
Frequently asked questions
What should an SMS opt-in checkbox say?
It should name your brand, describe the messages, state frequency, say message and data rates may apply, explain that replying STOP opts out and HELP gets help, and link to your privacy policy and terms. For marketing, add that consent is not a condition of purchase. The box must be unchecked by default.
Can I pre-check the SMS consent box on my form?
No. SMS consent must be an affirmative action by the consumer. Carriers reject campaigns with pre-checked boxes, and consent tied to accepting general terms or combined with email and phone consent is also treated as invalid. Use a separate, unchecked, optional SMS checkbox.
Can my SMS consent cover partners or affiliates?
Not for 10DLC. Carriers require opt-in that is specific to the sending brand and not shared with third parties, and third-party lead generation is disallowed. Even though the FCC's one-to-one consent rule was vacated in January 2025, partner or affiliate language will still get a campaign rejected.
Do I need a privacy policy for SMS marketing?
Yes. Carrier reviewers open your privacy policy and look for an SMS section stating that mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. A missing policy or one that allows sharing phone numbers is a common rejection reason.
Do customers have to text STOP to unsubscribe?
No. Under FCC rules effective April 11, 2025, consumers may revoke consent by any reasonable means, including replies such as quit, cancel, end, or unsubscribe, and you must honor it within 10 business days. Your disclosure should still tell people they can reply STOP.
Do I need to send a confirmation text after someone opts in?
Yes. CTIA guidance calls for a single confirmation message right after opt-in that identifies the program and explains how to opt out and get help. Carrier reviewers usually ask for this message text during 10DLC campaign registration.
Sources
- Bandwidth — 10DLC campaign vetting tips and tricks (updated Apr 20, 2026)
- CTIA — Messaging Principles and Best Practices (May 2023)
- Twilio — Error 30897: Campaign vetting rejection, disallowed content
- Womble Bond Dickinson — FCC repeals one-to-one consent rule following Eleventh Circuit decision
- FCC — DA 25-312, Order delaying revoke-all requirement (April 2025)
- FCC — DA 26-12, Order extending revoke-all waiver to Jan 31, 2027
Related
Need this done for you?
Full Percent builds compliant websites in 1 business day and sets up SMS, email and AI agent systems.
See the $350 compliant website
Stephen Ventura founded Full Percent in Boca Raton, Florida. He has built email systems since 1997 and SMS platforms since before the iPhone. stephenventura.com