What Is SMS Consent? Express vs Written Consent

SMS consent is a recipient's permission to receive text messages from your organization. Under the Telephone Consumer Protection Act (TCPA, 47 U.S.C. 227) and the FCC's implementing rules at 47 CFR 64.1200, that permission comes in two distinct tiers: prior express consent and prior express written consent. Which tier you need depends on what your messages say.

Getting the tier wrong is one of the most common and most expensive compliance mistakes in texting, because the TCPA allows private lawsuits with statutory damages of 500 dollars per violation, and up to 1,500 dollars for willful or knowing violations (47 U.S.C. 227(b)(3)). This guide defines both tiers plainly and shows exactly what each requires.

The Two Tiers, Defined

Prior express consent is permission a person gives to be contacted at their number. For informational, non-marketing messages, the FCC has treated a person's voluntary provision of their phone number for a purpose as consent to be contacted about that purpose. Examples: a patient gives a clinic their cell number for appointment matters; a parent provides a number on a school enrollment form.

Prior express written consent is the higher tier required for marketing. The FCC defines it at 47 CFR 64.1200(f) as a written agreement, bearing the signature of the person called, that clearly authorizes the seller to deliver advertisements or telemarketing messages using an automatic telephone dialing system or artificial or prerecorded voice, to a designated number. The definition includes two mandatory disclosures: the agreement must state that consent is not a condition of purchasing any goods or services, and the person must not be required to sign as a condition of purchase.

"Written" and "signature" include electronic forms: under the E-SIGN Act (15 U.S.C. 7001), a checkbox, web form submission, or reply text can constitute a valid electronic signature.

Which Tier Do You Need?

The dividing line is whether the message constitutes advertising or telemarketing: content that promotes the commercial availability or quality of property, goods, or services. A message that mixes informational content with promotion is treated as marketing, so a single promotional sentence can raise the required consent tier for the whole message.

What Valid Written Consent Must Contain

To satisfy 47 CFR 64.1200(f), a marketing opt-in should capture, in the disclosure the person agrees to:

1. Who will be texting (your organization's name)
2. What they are agreeing to receive (the program description, such as recurring marketing or fundraising texts)
3. The number they designate to receive messages
4. Autodialed nature of the messages, where applicable
5. The no-purchase-condition statement: consent is not a condition of any purchase
6. A signature, which can be electronic: a checkbox they actively tick, a form they submit, or a keyword they text in

Best practice, drawn from the CTIA Messaging Principles and FCC rules, adds message frequency, the phrase "message and data rates may apply", and references to HELP and STOP. Ready-to-adapt language is in our SMS opt-in message examples library.

Documenting Consent: If You Cannot Prove It, You Do Not Have It

In a TCPA dispute, the sender bears the practical burden of demonstrating consent. Your records should preserve, for every subscriber:

• The exact consent language displayed at the time of opt-in
• The date, time, and phone number
• The method (web form, paper form, keyword text-in) and source
• Any subsequent revocation and when it was honored

Keep records for the life of the subscription and beyond, aligned to the statute of limitations for TCPA claims. Screenshots of your form as it existed on each date matter, because forms change and disputes arrive years later. Healthcare organizations have an additional documentation layer; our guide to HIPAA texting consent covers how TCPA consent and HIPAA authorization interact.

Revocation: Consent Can Be Withdrawn at Any Time

Under the FCC's rules, consumers may revoke consent in any reasonable manner, and senders cannot designate an exclusive channel for revocation. The FCC's 2024 order in CG Docket No. 02-278 strengthened this: standard revocation words like STOP, QUIT, END, CANCEL, UNSUBSCRIBE sent by reply must be honored, and revocations must be processed within ten business days. Every message program must support reply-based opt-out, and the full mechanics are covered in our guide to opt-in and opt-out requirements.

Common Consent Mistakes

• Treating a purchased or rented list as consented. Consent is personal to your organization and program; it does not transfer with a list. Texting bought lists is the classic TCPA class action fact pattern.
• Stretching informational consent to cover marketing. A patient's number given for appointment reminders is not written consent for promotional messages.
• Pre-checked boxes. A pre-ticked checkbox undermines the claim that the person actively signed. Require an affirmative action.
• Losing the proof. Switching platforms without exporting consent records leaves you unable to defend past opt-ins.
• Burying the disclosure. The consent language must be clear and conspicuous, not hidden in dense terms.

Consent Architecture: Designing Programs by Tier

The two-tier structure suggests a program design principle: separate your message streams by the consent that supports them.

• Transactional stream. Reminders, confirmations, alerts, and two-way conversations run on prior express consent, collected at the point the person provides their number. Keep this stream strictly free of promotion so its consent basis stays clean.
• Marketing stream. Appeals, promotions, and campaigns run only on prior express written consent, with the full disclosure set, captured through a dedicated opt-in.
• One person, two records. A supporter can be in both streams; the records stay distinct, and an opt-out from one stream is honored for that stream at minimum, with conservative programs suppressing both.

This separation pays off in three places: it prevents the mixed-content trap, where one promotional sentence contaminates an informational message; it makes audits legible, because each stream's consent basis is uniform; and it localizes damage, because a defect discovered in one stream's opt-in flow does not poison the other. Organizations handling sensitive data have extra reasons to keep streams distinct, and the records themselves deserve the same protection as any compliance data; our security page describes how FRANSiS safeguards them.

A Worked Example

Concrete beats abstract, so trace one supporter through both tiers. Maria fills out a clinic intake form and writes her cell number in the phone field. That act supports prior express consent for messages about her care: appointment reminders, scheduling changes, follow-up logistics. The clinic later wants to text her about a paid wellness program it promotes. That message advertises a service, so it needs the higher tier: Maria must be shown a disclosure naming the clinic, describing the promotional program, stating that consent is not a condition of receiving care, and she must take an affirmative signing action, checking an unchecked box on the portal, for example. Two records now exist, each supporting its own stream. When Maria replies STOP to a promotional text, the marketing stream suppresses immediately; whether the clinic conservatively suppresses reminders too is a policy choice, but the safest reading of a bare STOP is broad. Every element of this story, the two captures, the two records, the revocation, should be reconstructable from your platform's logs years later. That reconstructability is the whole game.

Frequently Asked Questions

Is a verbal opt-in ever enough for texting?

For informational messages, providing a number voluntarily, including verbally in an intake conversation, can establish prior express consent if documented. For marketing messages, no: the TCPA requires a signed written agreement, though the signature can be electronic under the E-SIGN Act.

Does texting a keyword like JOIN count as written consent?

It can. A keyword opt-in is an electronic signature when the call-to-action the person responded to contained the required disclosures: program description, frequency, the no-purchase-condition statement, and rate notice. The disclosure lives in the advertisement showing the keyword, so document that creative.

Do nonprofits need written consent for fundraising texts?

Nonprofits enjoy certain TCPA exemptions for calls, but texting programs should not lean on them casually: state mini-TCPA statutes, carrier rules, and the marketing character of donation appeals all push toward collecting written consent for fundraising messages. It is also simply better list hygiene.

Does consent expire?

The TCPA does not set an expiration date on consent; it lasts until revoked. But long-dormant lists carry practical risk: numbers get reassigned to new owners who never consented. Checking numbers against the FCC's Reassigned Numbers Database before re-engaging an old list addresses this.

Can I ask someone who opted out to opt back in?

A single message confirming opt-out is permitted, but ongoing contact after revocation is not. A person who opted out can always choose to opt back in on their own initiative, through your website or by texting your opt-in keyword, and that new consent starts a fresh record.

Build Consent In, Not On

FRANSiS captures consent tier, timestamp, source, and exact language for every subscriber automatically, honors STOP instantly, and keeps the records that win disputes. Contact us to see how compliant consent collection works in practice.