Opt-in, opt-out or double opt-in: which consent model applies to SMS?

A restock alert requested by a customer and an unrelated discount offer are different messages, even if they go to the same number. Begin with what the person agreed to receive, then check the rules that apply to the sender, recipient, content and destination.

What do opt-in, double opt-in and opt-out mean?

Opt-in records an affirmative agreement to receive a specified kind of message from an identified sender. A phone number in a customer record is not, by itself, proof of that agreement.

Double opt-in adds a confirmation step to an initial request. For example, a person submits a form and then confirms using a reply or another verified action. Keep both events and only admit the person to the programme after its required confirmation. This is different from an enrolment message that simply acknowledges an already completed opt-in.

Opt-out lets a person withdraw permission or object to further messages. You must support opt-outs even when your programme required opt-in first. A policy labelled opt_out does not mean consent is assumed or that an unsolicited first message is allowed.

Which rules apply?

Consider the recipient's jurisdiction, the sender's obligations, the message's purpose and the requirements of the carrier or provider carrying it. A sender registration approves a sender or use case; it does not establish each recipient's permission.

CTIA's Messaging Principles and Best Practices, section 5.1, distinguishes a response to a consumer-initiated conversation, requested informational messages and promotional messages. It expects express written consent for promotional traffic. An offer added to an informational message can put it in the promotional category. These are industry practices; applicable legal obligations need a separate assessment.

Obtain a Consumer’s express written consent to specifically receive marketing messages

Bird's SMS destinations directory summarises country requirements from a published data snapshot. Its consent labels and registration fields help plan a rollout. They do not resolve every audience, subnational rule, exception or content category, and they are not a real-time legal determination.

What evidence should a programme keep?

Keep enough information to explain why this person is included in this send:

• The recipient's number and the brand or programme they agreed to hear from.
• The exact disclosure and action used to give permission, including its purpose and scope.
• When and where the agreement occurred, and the confirmation event if one was required.
• Changes to preferences, withdrawals and the actions taken in response.

CTIA's guidance includes retaining the acquisition time, medium, disclosure, campaign and recipient information. It also limits an opt-in to the campaign and sender for which it was obtained. A purchased list or permission for another programme does not establish the permission your programme needs.

Timestamp of consent acquisition

Collecting SMS opt-ins connects that evidence to the form, confirmation and audience record. SMS marketing consent carries those records into campaign preparation.

How should an opt-out work?

Make the advertised exit easy to use and handle reasonable requests that arrive elsewhere. The FCC, the US communications regulator, defines a revocation rule at 47 CFR 64.1200(a)(10) for communications within its scope. That rule does not limit revocation to one exclusive method. Your process should route requests from replies, customer support and other supported channels to the relevant preferences.

may not designate an exclusive means to request revocation of consent.

A suppression blocks further sends from one sender to one subscriber. Bird's keyword handling can create that block where the keyword catalogue applies. This sender-specific block can be narrower than the person's request. Apply a withdrawal across every relevant sender or programme required by that request and the governing rules. Changing numbers is not a way to work around it.

A sender that cannot receive replies needs an appropriate alternative opt-out mechanism. Confirm that the route, disclosure and operational process work together before launching.

How does this connect to a send?

For a custom integration, record permission in the system that owns the audience and recheck eligibility when preparing the send. If the programme requires double opt-in, implement and verify its confirmation flow. A keyword labelled confirm does not by itself send an enrolment message or prove that the required agreement was completed.

Bird’s opt-out and keyword operations manage catalogue-based replies and sender-and-subscriber suppressions. A campaign launch review checks audience permission alongside the content, sender, destination and sending window. Registration and API acceptance do not establish recipient consent.

Which consent model should I use?

1. For a requested service message, establish the permission required for that purpose and recipient.
2. For a promotion, obtain the form of affirmative consent required by the applicable law and carrier policy.
3. When the programme requires double opt-in, admit recipients only after the confirmation step is complete.
4. For every model, retain the evidence and apply withdrawals across the scope of the person’s request.