How to grow an SMS subscriber list without breaking consent rules

Collecting phone numbers is easy. Collecting them so that every number on your list has a consent record you could hand to a lawyer or a carrier reviewer is harder. TCPA exposure runs roughly $500 to $1,500 per text, and carriers filter traffic that looks like it was sent to people who never asked for it. A list built carelessly costs you twice: once in deliverability and once in risk.

This guide covers the placements that work: popups, checkout, QR codes, keyword joins and incentives. For each one we cover what the disclosure needs to say, where teams usually slip, and what record you should keep. We make Ready, so we also explain what our platform handles for you and what it doesn't. Some of it stays your job no matter which tool you use.

The three things every opt-in needs

Every sign-up point needs the same three things, whatever the format.

1. Clear disclosure at the point of capture. The person should see who will text them, that the texts are recurring marketing, roughly how often, that message and data rates may apply, and how to get help or stop. Link your terms and privacy policy.
2. An affirmative action. They type their number and tap a button, tick an unchecked box, or text a keyword. A pre-checked box is not consent. Neither is a number pulled from a contact form that was about something else.
3. A record you keep. Store the phone number, the timestamp, the exact disclosure wording they saw, and the page or source. This is your evidence.

A typical disclosure looks like this:

By entering your number, you agree to receive recurring automated marketing texts from Northside Coffee at the number provided. Consent is not a condition of purchase. Msg frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel. Terms / Privacy.

For more wording variations by form type, see our opt-in language examples. The legal background is covered in our plain-English overview of SMS marketing laws.

What Ready records and what it doesn't

Here is where the platform's job ends and yours begins. When you send through Ready, in bulk or through the API, we record your opt-in attestation for that send: who sent it, to how many people, and when. In the API, that is the consent_attested field. That builds an audit trail of your sends.

It is not a per-contact consent record. Ready does not store the recipient's opt-in time, the wording they saw, or the page URL, and a keyword reply does not create that record. The one exception is a sign-up on a Ready-hosted opt-in page: Ready stores its time, IP address and exact wording. Your form tool, store or CRM has to keep that evidence. Plan for it before you launch the popup, not after a complaint.

Website popups

Popups are usually the biggest source of new subscribers for ecommerce and content sites. The format that tends to work well is the two-step popup: email first, then phone on the second screen. People who give an email are already warmed up.

What to get right:

• The disclosure goes next to the submit button, in readable type. Gray 8-point text under a giant "GET 15% OFF" button is the kind of thing that looks bad in a dispute.
• Keep the email and SMS consents separate. Agreeing to emails is not agreeing to texts.
• Store the form version. If you change the disclosure wording in March, you need to know which subscribers saw which version.

Checkout

Checkout is high intent, but it is also where consent gets bundled by accident. The phone field at checkout exists for order updates. That doesn't make it marketing consent.

The clean pattern:

• A separate, unchecked box: "Text me offers and updates from Northside Coffee", with the disclosure beneath it.
• Order and shipping texts go to people who gave a phone number for the order. Marketing texts go only to people who ticked the box.
• Tag the source as checkout in your store so you can tell these subscribers apart later.

If you also send abandoned-cart texts, the consent question gets sharper. Those only go to people who opted in to marketing before they abandoned.

QR codes and in-person signage

QR codes work well on table tents, receipts, packaging and event booths. The usual setup is a QR code that opens the phone's messaging app with a keyword already typed in, such as "JOIN", addressed to your number.

Two things trip people up:

• The sign is the disclosure. The person scanning sees your printed card, not a web form. The card itself needs the brand name, "recurring marketing texts", frequency, rates, and HELP/STOP. Fine print is fine. Leaving it off is not.
• Scanning isn't the opt-in; sending is. The person still has to hit send on the prefilled text. That inbound message is their affirmative action. Respond with a confirmation that repeats the key terms.

Keyword join

Keyword join ("Text JOIN to 555-0123") works on radio, podcasts, print and anywhere a link is awkward. The flow is: inbound keyword, then a confirmation text, then the welcome.

Many teams add a confirm step: "Reply Y to confirm." It adds friction, and some sign-ups drop off. It also cuts wrong-number and prank sign-ups, and those are the people who report you as spam. We cover the carrier-level case in why single opt-in costs you at the carrier level.

Remember that a keyword reply in Ready doesn't create a consent record on its own. Log the inbound message, its timestamp and the ad or sign it came from in your own system.

Incentives without strings that break consent

Discounts, free shipping, early access and loyalty points all work as incentives. A few rules keep them clean:

• Consent can't be a condition of purchase. You can offer 15% off for signing up. You can't require SMS sign-up to complete an order.
• Deliver what you promised, right away. If the popup says "15% off", the welcome text should contain the code. A delayed or missing code produces STOP replies and complaints.
• Sweepstakes get extra scrutiny. "Text to win" contests come with their own state rules. Get the official rules written before you run one.
• Never import a list you didn't collect. That includes purchased lists, event attendee spreadsheets and your email list. Cold contact belongs to phone and mail. SMS goes to people who opted in or who texted you first.

Placement comparison

The welcome text, and what it costs

Your first outbound message confirms the sign-up and restates the terms. Keep it under 160 characters so it fits in a single segment:

Northside Coffee: You're in! Reply Y to confirm recurring marketing texts (about 4/mo). Msg & data rates may apply. Reply HELP for help, STOP to cancel.

That message is 153 characters of plain GSM-7 text, so it bills as 1 segment. Add one 🎉 and the whole message switches to unicode. The limit drops to 70 characters, or 67 per part when split, so the same text becomes 3 segments. Ready swaps curly quotes and long dashes for plain ones before sending, so those won't push you over. Emoji will.

Worked example: 1,000 keyword sign-ups a month

Here are our assumptions. Each subscriber sends "JOIN", gets the confirm text, replies "Y", and gets a one-segment welcome with a discount code. On Ready, inbound replies are billed like sent texts, so the flow is 4 segments per subscriber.

• 1,000 × 4 = 4,000 segments
• Ready Standard rate: 4,000 × $0.0075 = $30
• Plus 4,000 × $0.0045 in carrier fees, itemized separately on your bill

Now put an emoji in both outbound texts, and assume each one runs about 150 characters. Each outbound text becomes 3 segments. The flow grows to 8 segments per subscriber: 2 inbound plus 6 outbound. That is 8,000 segments and $60 at the Standard rate, plus carrier fees. One emoji doubled the cost of onboarding.

A popup sign-up skips the inbound JOIN, which saves a segment per person. These figures exclude the compliance surcharge. If you switch on DNC/litigator scrubbing or landline validation, each adds $0.003 per segment, and both are off by default. Current rates are on our pricing page.

If you send through the API, the welcome text looks like this:

POST https://api.tryready.com/v1/messages
X-API-Key: <your key>
Idempotency-Key: 6f1c2a9e-4b7d-4e2a-9c1f-0d3e5a7b8c21

{"to": "+12125550199", "body": "Northside Coffee: You're in! Reply Y to confirm...", "consent_attested": true}

The Idempotency-Key header means a retried request won't text a new subscriber twice. Full details are in the messages API docs.

What the platform handles once they're on the list

After someone joins, a few safeguards in Ready reduce the chance of a mistake:

• STOP handling. An inbound STOP or UNSUBSCRIBE is honored, and the opt-out applies across every campaign. Sends to opted-out numbers are refused up front and not charged.
• Quiet hours. Texts are held outside permitted local hours, based on the recipient's area. A held text is charged only when it actually sends. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.
• Scrubbing. You can screen known TCPA litigators and DNC numbers before you send. The standalone scrub is $0.005 per contact.
• Registration. Carriers check that your 10DLC campaign's opt-in description matches how you actually collect numbers. Registration is $25/mo, and $2 per number, with $25 charged at submit for the first month. Most approvals take 2 to 7 days.

None of this makes you lawsuit-proof. Consent is the sender's responsibility, and these tools reduce risk. They don't replace a clean opt-in.

The practical takeaway

Pick one or two placements that fit where your customers already are. That could be a popup and checkout box for a store, or a QR code and keyword for a physical business. Write the disclosure once, store the consent evidence in your own system, and keep the welcome text under 160 plain characters. Then plan what happens next using our welcome series examples.

If you want to test the flow, sign up with a card on file. Your first 20 texts are free one-to-one sends, so use them to text yourself the confirm and welcome messages before you register. The quickstart walks through the rest.