Consent & Opt-In: The Compliant CTA

Marketing SMS in the US requires Prior Express Written Consent (PEWC) — the highest consent standard under the TCPA . In practice that means a documented, affirmative opt-in captured through a compliant Call-to-Action (CTA) . This is also the single most-scrutinized item in 10DLC campaign review: the CTA, your sample messages, and your message flow all have to tell the same story, or the campaign is rejected (see rejection reasons and the campaign rejection table).

The nine required CTA elements

A compliant opt-in Call-to-Action must contain all of the following. Missing any one is a top rejection cause and a TCPA exposure.

1. Brand / business identity by name — who is sending.
2. Program or message-type description — marketing vs. transactional; what the recipient is signing up for.
3. Message frequency disclosure — e.g. “up to 4 msgs/month” or “message frequency varies”.
4. “Msg & data rates may apply” — the carrier-cost disclaimer, verbatim or equivalent.
5. Opt-out instructions — “Reply STOP to cancel”.
6. Help instructions — “Reply HELP for help”.
7. Links to Terms of Service and Privacy Policy — both, as separate working links.
8. A clear statement that consent is NOT a condition of purchase.
9. An affirmative action by the consumer — an unchecked checkbox the user ticks, a signed/submitted e-form, or texting a keyword to your number.

A compliant CTA, written out

Everything above, in one block a reviewer can read at a glance:

Text JOIN to 12345 to get weekly deals from [Brand]. Up to 4 msgs/mo.
Msg & data rates may apply. Reply STOP to cancel, HELP for help.
Consent is not a condition of purchase.
Terms: [terms-url]   Privacy: [privacy-url]

If consent is collected on a web form instead of a keyword, the same disclosures go next to the checkbox, and the checkbox label states the program clearly:

[ ] (unchecked) Yes, text me deals & updates from [Brand]. Up to 4 msgs/mo.
    Msg & data rates may apply. Consent is not a condition of purchase.
    Reply STOP to cancel, HELP for help. Terms: [url]  Privacy: [url]

Generate a ready-to-paste version with all nine elements filled in from your brand details using the Opt-in CTA Generator.

Single vs. double opt-in

Double opt-in is not required by the TCPA, but it materially strengthens your proof-of-consent and is worth it for any high-volume marketing program.

The required welcome / confirmation message

Regardless of which opt-in method you use, every recurring campaign must send an opt-in confirmation (welcome) message as the first message. It restates the brand, frequency, the rates disclaimer, and STOP/HELP. This is both a CTIA requirement and a campaign-review checkpoint.

Thanks for joining [Brand]! You'll get up to 4 msgs/mo. Reply STOP to
unsubscribe, HELP for help. Msg & data rates may apply.

For double opt-in, the welcome message is sent after the user confirms — and the confirmation request itself (“Reply YES to confirm”) counts as a transactional message, not the start of the program.

Proof of consent — what to retain

Consent you can’t prove is consent you don’t have. Retain, per opt-in:

• Date and time of the opt-in.
• Channel / source — which form, page, or keyword captured it.
• The exact CTA wording shown to the consumer at that time.
• The consumer’s response / the affirmative action taken (checkbox ticked, keyword sent, YES reply).

Next

• Opt-out, STOP & HELP — the mandatory keywords and the 2025 “any reasonable means” revocation rule.
• Privacy policy requirements — the public policy and the “no sharing/selling SMS data” clause your CTA links to.
• TCPA basics — why PEWC exists and what the damages are.