A donor typed their phone number into your checkout form. They gave you money. Surely you can text them a thank-you, a receipt, maybe a gentle ask next quarter?
Two of those three are fine. One of them can put you on the wrong side of the TCPA. And the difference isn't the phone number — it's what you asked next to it.
Full disclosure: I work for Ready, an SMS platform. We handle opt-in capture and automatic STOP enforcement, so I have a stake in you getting consent right. But the mechanics below are the same no matter whose software you use, and I'd rather you understand them than trust a vendor blindly.
A phone number is data. Consent is a separate thing.
Collecting a phone number and having permission to send marketing texts to it are two unrelated events that happen to occur on the same form. The TCPA doesn't care that a donor voluntarily handed you the digits. It cares whether you obtained express written consent to send an automated marketing message to that specific number.
Here's the split that matters for nonprofits:
- Transactional messages — a donation receipt, a "your recurring gift processed" confirmation, a tax-deductibility note. These are generally lower-risk because they're tied to a transaction the donor initiated. A phone number entered for the purpose of getting a receipt can reasonably support a receipt text.
- Marketing / solicitation messages — "Giving Tuesday is coming, help us hit our goal," "we're $8K short on the shelter fund." These are appeals. They require express written consent, separately obtained.
The trap is treating the phone field as a blanket license for both. It isn't. A donor who wanted a receipt did not thereby agree to a year of fundraising blasts.
What "express written consent" actually requires
Express written consent under the TCPA has specific ingredients. It has to be:
- A written agreement the donor affirmatively takes (a checked box, a signature, a keyword reply).
- Clear about what they're agreeing to — that they'll receive automated marketing texts.
- Not a condition of the transaction. You cannot require the donor to accept marketing texts in order to complete their donation.
- Disclosed with the material terms — message frequency, that message and data rates may apply, and how to opt out.
That's the whole reason a naked phone field fails: it satisfies none of these. There's no affirmative agreement, no disclosure, and nothing separating the donation from the marketing consent.
The one checkbox that does the work
Add a single unchecked checkbox to your donation form, adjacent to the phone field, with language along these lines:
☐ Text me updates and appeals from [Org Name]. Msg frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. Consent isn't required to donate. See our Privacy Policy and Terms.
Four things make this checkbox count:
- It's unchecked by default. More on why in a second.
- It names marketing ("updates and appeals"), not just "notifications."
- It states consent isn't required to donate, which satisfies the not-a-condition rule.
- It carries the disclosures — frequency, rates, STOP/HELP, links.
The receipt text can go out under the transaction. The appeal only goes to donors who ticked that box.
Why the pre-checked box is a landmine
It's tempting to pre-check the box to boost opt-in rates. Don't. A pre-checked box isn't an affirmative act by the donor — it's your act, and courts have treated it that way. It undercuts the "express" in express written consent and hands a plaintiff's attorney the exact argument they want. You also lose it under most consent-management best practices and several state analogs to the TCPA.
Yes, an unchecked box captures fewer opt-ins. That's the point — the ones you get are real. It's the same tradeoff we walked through in double opt-in vs. conversion: a smaller, genuinely-consented list is worth more per contact and won't get you sued.
Keep the receipt lane and the appeal lane separate
The cleanest mental model is two lanes that never merge:
| Receipt / transactional | Marketing / appeal | |
|---|---|---|
| Trigger | Donor completes a gift | Donor checks the opt-in box |
| Example | "Thanks! Your $50 gift receipt: …" | "We're $8K from our goal — give today: …" |
| Consent basis | Transaction-tied | Express written consent |
| Can go to every donor? | Generally yes | Only opt-in checkers |
| Opt-out required? | Honor STOP anyway | Yes, mandatory |
The healthcare world has the exact same wall between a transactional reminder and a marketing "book your flu shot" nudge — we broke it down in the two-way vs. broadcast consent piece. The principle transfers directly: one opt-in does not authorize both sides of the wall. If you send an appeal off the back of a receipt-only phone capture, you've crossed it.
A practical tell: if a donor could reasonably be surprised to receive the message, it's probably marketing and needs the box.
Record the consent — the checkbox is only half of it
Capturing consent and being able to prove you captured it are different problems. If a donor disputes it two years later, "we had a checkbox" is not evidence. The timestamped record of that donor checking that box with that language is.
This is where your platform earns its keep. Ready records opt-in attestation for bulk and API sends, so each consented contact carries an audit trail — when they opted in and under what terms. That record is the thing you produce if a complaint ever surfaces.
Two more automated guardrails that reduce exposure without you thinking about them:
- Automatic STOP handling. When a donor replies STOP, the opt-out is honored and propagates so they can't be messaged again across campaigns — not just the one they replied to. Re-texting an opted-out donor is its own violation, and manual list-scrubbing misses it.
- Quiet-hours enforcement. Appeals held outside a recipient's permitted local hours. A midnight fundraising blast to a donor's phone is exactly the kind of thing that draws attention.
None of this makes you immune to anything. Consent is ultimately the sender's responsibility. But the difference between "we had a checkbox somewhere" and "here is the timestamped attestation, the STOP was honored in real time, and no message went out during quiet hours" is the difference between a defensible program and a nervous one.
What the exposure actually looks like
TCPA statutory damages run $500 to $1,500 per text. Not per campaign — per message. Send one non-consented appeal to a list of 2,000 donors and the math is theoretical-but-terrifying: 2,000 × $500 is a seven-figure number before a lawyer sharpens the pencil.
You will almost never see the worst case. But you don't have to. A single flagged donor who opted out, got re-texted, and knows a lawyer is enough to ruin a quarter. Wholesalers learned this the expensive way with cold texts to skip-traced numbers — nonprofits are not exempt just because the cause is good. The plaintiff's bar doesn't grade on intentions.
If you're building a big seasonal push — say a Giving Tuesday appeal — get the consent architecture right before you worry about send speed. We covered the throughput side of Giving Tuesday separately; throughput doesn't help if half the list shouldn't be getting the appeal at all.
The practical takeaway
- A phone field is data, not consent.
- Receipts can ride on the transaction. Appeals need express written consent.
- Add one unchecked box with marketing language, disclosures, and "consent isn't required to donate."
- Never pre-check it.
- Keep a timestamped record of the opt-in, honor STOP automatically, and respect quiet hours.
If your current donation form has a phone field and no separate opt-in checkbox, that's the one change to make this week — before your next appeal goes out. If you want to see how the consent capture, attestation, and STOP handling work in practice, you can look at Ready or start with 2,500 free credits and test it against a small opted-in segment first. Small, real, and provable beats big and shaky every time.