Three consent models turn up in SMS programmes, and they are usually presented as a choice you make about your own marketing. For a destination that regulates it, it is not a choice. The model is a property of where you are sending, and it is published rather than negotiated.
What do the three models mean?
They differ in what has to happen before the first message, and in what proof you hold afterwards.
- Opt-out. You may send, and you must stop when asked. The consent is assumed and the burden is on honouring the exit.
- Opt-in. The subscriber has to agree before the first message. CTIA's guidance states it as: "Message Senders should support opt-in mechanisms, and messages should be sent only after the Consumer has opted-in to receive them."
- Double opt-in. The subscriber agrees, and then confirms the agreement from the handset itself. The confirming reply is what ties the consent to the device rather than to a form.
Bird's country policy data carries the model as one field with exactly those three values, opt_in, opt_out or double_opt_in, and it also carries them as three independent booleans: opt_in_required, opt_out_required and double_opt_in_required. The pair is not redundant. The model is the headline, and the booleans let a destination require an opt-out obligation without requiring an opt-in, which is the ordinary case for transactional traffic.
Which value each destination carries is a live per-country fact, so it is rendered on that country's page under SMS destinations rather than listed here.
Who decides the model?
The destination's regulator, and the country's policy record names it in a regulatory_body field beside the consent model.
That is the reason a page like this one cannot answer the question it asks in the general case. Consent rules are set per jurisdiction, they are revised, and the answer that was true when a page was written outlives its accuracy quietly. The durable version of the question is "where do I read the answer for the countries I send to", and the answer is the destination page, which reads it live.
Two things travel with the model on the same record and are worth reading at the same time: required_elements, "message elements that must be present in every message (for example, opt-out instructions)", and restricted_categories, the message categories a destination restricts or prohibits. A consent model you satisfy does not help if the content is in a category the destination refuses.
What does an opt-out have to accept?
More than one word, and you do not get to pick which.
A regulated destination sets the floor, and the floor is wider than a keyword list. The clearest published example is the FCC's rule at 47 CFR 64.1200(a)(10), which names seven words that always count as revocation, requires any other reasonable method to be honoured too, forbids you from designating one exclusive channel for it, and puts a ten-business-day ceiling on acting. What is the TCPA quotes all four in the regulator's own words, and it carries one provision worth knowing if your sender cannot receive replies at all.
Industry guidance says the same thing about sloppiness in the reply. CTIA's Messaging Principles and Best Practices, section 5.1.3: "The validity of a Consumer opt-out should not be impacted by any de minimis variances in the Consumer opt-out response, such as capitalization, punctuation, or any letter-case sensitivities." What is CTIA covers where that document's force comes from, which is carriers rather than a statute.
Two consequences for how you build. Parsing exactly STOP and ignoring CANCEL is not a narrow implementation, it is a wrong one. And "we honour opt-outs on our next weekly export" is a schedule that outruns the deadline.
What does Bird do for me, and what is mine?
Bird handles the exit automatically where it has coverage. It does not handle the entrance.
Bird's half. Where a country is in the keyword catalog, an inbound stop keyword is recognised, a suppression is recorded, and the opt-out confirmation for that country is sent. A later send from that sender to that subscriber is refused at the API rather than sent and failed. The suppression is narrower than most people assume: it covers one sender and one subscriber, so someone who stops one of your numbers still hears from the others unless you mirror it. What is a STOP keyword is the full account, including what happens in a country the catalog does not cover, which is nothing.
Your half. The double opt-in confirmation is not sent for you. Bird's keyword vocabulary has an operation named confirm, described as marking "a double opt-in reply", and its own definition says it "sends nothing today, so answer it from your own handler". Bird holds those keywords so a custom rule cannot claim them; replying to them is yours.
So a double opt-in programme on Bird has a gap exactly where the model's distinguishing step is, and it is a gap you fill:
- Record the first agreement with what CTIA says to retain: the language and action used to secure consent, the campaign it was for, and the number it was granted for. Where the destination's regime defines what that agreement has to contain, meet the definition rather than the description; what is express written consent walks one such definition part by part.
- Answer the confirming reply yourself, in the
sms.receivedhandler, since nothing answers aconfirmkeyword for you. - Send the enrolment confirmation CTIA describes for recurring campaigns, which should carry the programme name, customer care contact information, how to opt out, the message frequency, and any fees.
- Keep the consent where it was given. CTIA: "A Consumer opt-in to receive messages should not be transferable or assignable. A Consumer opt-in should apply only to the campaign(s) and specific Message Sender for which it was intended or obtained."
- Mirror suppressions across your senders if your policy is that a stop means stop everywhere, because Bird's is per sender.
The three CTIA quotations above are from its Messaging Principles and Best Practices, sections 5.1.2, 5.1.3 and 5.1.2.2. Opt-outs and keywords covers the catalog, what applies to a given number, and how to replace a default reply with your own.