SMS opt-out management: keeping STOP working across every number

An opt-out belongs to the person, not to the phone number they replied to. If a contact texts STOP to one of your numbers, every number, campaign, teammate and tool that can text them has to stop too, and good opt-out management is the system that makes that happen automatically.

With one number and one tool, this is easy because the tool handles it. The trouble starts when a business has five local numbers, a sales team texting from a shared inbox, a marketing tool running campaigns, and maybe an older provider that still has a few drip campaigns running. Each of those systems keeps its own list of who said STOP. When the lists drift apart, someone who opted out last month gets a promo from a number they've never seen. That person is now annoyed and has a reason to complain, and in the US they may also have a TCPA claim.

This post covers why opt-outs leak in multi-number setups, which keywords count as an opt-out, how re-opt-in with START should work, and what your records should show if anyone asks.

How to opt out of SMS and MMS texts

To opt out of SMS or MMS texts from a business, reply STOP to the number that texted you. One STOP covers both text and picture messages, because the sender treats the number and your phone as one conversation, not as separate SMS and MMS lists.

If STOP doesn't work, forward the message to 7726 (SPAM) so your carrier can look at the sender, and keep a screenshot. A business that keeps sending after a clear STOP is the one that has an opt-out management problem, and that's what the rest of this post is about.

Why one STOP has to cover every number

Carriers and the TCPA both treat an opt-out as the recipient withdrawing consent from your business. They don't treat it as blocking a single phone number. The FCC's revocation rules say a consumer can revoke consent by any reasonable means, and the sender has to honor it within 10 business days. The rules say nothing about honoring it only on the number that received the STOP.

Multi-number setups create the gap. Some common ways it happens:

• Local presence. You send from the number closest to each contact's area code. A contact who moves, or whose area code maps to a different number after you add numbers, may get texted from a new line.
• Number rotation. Spreading new contacts across several numbers means the same person can be reached by more than one line over time.
• Team inboxes. A rep texts from their own number. The contact replies STOP to the marketing number. The rep's tool never hears about it.
• Separate tools. Your CRM, your campaign tool and your appointment reminder system may each send SMS through different providers.

Every one of these sends is a separate decision made by a separate system. Unless all of them check the same suppression list, one STOP stops one of them.

Where opt-outs leak: the common gaps

When opt-outs go missing, it's usually in one of a handful of places:

1. Two providers, two lists. Campaigns go through one platform and transactional texts through another. Neither knows what the other received.
2. Migration resets. You port numbers off an old provider and the STOP history stays behind. We covered the export that prevents this in port your number from Twilio and your STOP list doesn't come with it.
3. Re-imported lists. Someone exports contacts to a spreadsheet, cleans them up and re-imports them. The opt-out flag gets dropped on the way back in.
4. Non-standard replies. The contact writes "please stop texting me" or "remove me." Your system was only listening for the exact word STOP.
5. Other channels. The contact opts out of texts and keeps getting calls or emails. Whether that's legally required depends on context, but it's a common source of complaints. See why opt-out rarely crosses channels, and the fix.

Most of these are plumbing failures, not policy failures. Nearly every business agrees opted-out people shouldn't be texted. The problem is that their systems don't share one list.

Keyword variants beyond STOP

STOP is the word everyone tests. People don't always use it. The CTIA guidelines that carriers enforce list a set of standard opt-out keywords, and the FCC's "any reasonable means" standard goes further than any fixed list.

The free-text rows matter most. A keyword matcher won't catch "Please don't text this number again," but a court could still read it as a clear revocation. Someone, either a person working the inbox or a rule you've set up, needs to read those replies and add the number to your suppression list. We go deeper on this in someone replies 'Cancel' instead of 'STOP'.

Under the FCC rules you're allowed one confirmation text after an opt-out, sent promptly. It should confirm the opt-out and nothing else. "You're unsubscribed and won't receive more messages" is fine. "You're unsubscribed, but here's 20% off before you go" is a fresh marketing message to someone who just withdrew consent.

Re-opt-in with START: who can turn texts back on

Opting back in is where teams get creative, and creative is the wrong instinct here.

The conventional re-opt-in keywords are START, UNSTOP and sometimes YES. The rules that keep you safe:

• The contact has to initiate it. A START reply from the contact's own phone is a clear signal. A sales rep flipping a toggle because "they said on the phone it was fine" is not, unless you've documented that consent separately.
• It should come from the same phone number that opted out. A START from a different number re-subscribes a different person.
• Confirm it. Send one message restating what they're signing up for, how often, and how to stop again.
• A new web form opt-in after a STOP is murkier. If someone opted out by text and later fills in a form with SMS consent wording, many senders treat that as fresh consent. Keep the form record (timestamp, wording, page) so you can show the sequence. How to document SMS consent so it holds up covers what to capture.

Never re-subscribe someone in bulk. "We cleaned the list and removed the opt-out flags from 2023" is how old STOPs turn into new lawsuits.

Platforms differ in how they treat START. Some lift the block automatically, some require an explicit consent update. Check the behavior in your own setup before you assume it.

Opt-out management on Ready: what's automatic and what's yours

We make Ready, so here is exactly what it does and where your responsibility starts.

What's automatic:

• Inbound STOP, UNSUBSCRIBE and the other standard opt-out keywords are honored automatically. The opt-out propagates so the contact can't be messaged again across campaigns in that account. It doesn't matter which number they replied to or which campaign triggered the reply.
• The API refuses opted-out numbers up front. A POST /v1/messages or POST /v1/messages/bulk to an opted-out number isn't sent and isn't charged. Blocklisted numbers and known landlines are handled the same way.
• With local presence on, a contact keeps the number it already texts with. Number choice happens among your registered 10DLC numbers, and the opt-out sits above all of them.
• Quiet hours hold sends outside permitted local hours based on the recipient's area. This is separate from opt-outs, but it's part of the same "don't text people when you shouldn't" layer. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.

What's still yours:

• Other tools. If you also text through another provider, that provider doesn't know about Ready's opt-outs. Pull the list and push it across. You can read it with GET /v1/opt-outs, but it holds only opted-out contacts on this account (a STOP from a deleted contact, a dialer do-not-call entry and a family-account STOP are left out), so check a single number before a send from another system:

curl https://api.tryready.com/v1/opt-outs/+12125550199 \
  -H "X-API-Key: <your key>"

• Free-text revocations. Ready also opts out common plain-language replies such as "please stop", "stop texting me" and "remove me". Replies it can't read as a refusal, like "wrong number", and requests made by phone or email still need a person to add a suppression.
• Consent records. Ready records the sender's opt-in attestation for each bulk send and each API send that sets consent_attested: who sent it, to how many recipients, and when. That's an audit trail of your promise. It is not a per-contact consent record. The page, wording and timestamp where each person opted in live in your own store (your form tool, CRM or database).
• Sub-accounts. If you're a platform running many sub-accounts, decide whether an opt-out from one end customer's business should affect another's. Usually it shouldn't, because consent is given to a specific business. Make that a deliberate decision. On Ready, a STOP to any sub-account blocks that number for the parent account and every sub-account; check GET /v1/opt-outs/:phone for Ready's answer.

API details are in the opt-outs docs. If you're on GoHighLevel, inbound replies sync into GHL for connected accounts. Test one STOP end to end and confirm your GHL workflows stop too, rather than assuming they do.

Compliance is ultimately the sender's responsibility. Everything above reduces risk. It doesn't remove it.

What an audit trail should show

If a contact claims they opted out and kept getting texts, or claims they never consented, you need to reconstruct the timeline quickly. A useful record answers these questions:

1. When did they opt in, and how? The form, page URL, consent wording and timestamp. This lives in your consent store.
2. What did they send to opt out? The exact inbound message, which of your numbers it arrived on, and when. Your message history holds this. On Ready, GET /v1/messages returns it.
3. What did you send back? The confirmation text, if any, and its timestamp.
4. Did anything go out after that? Ideally nothing. If something was attempted, the record should show it was refused.
5. Did they opt back in? The START message or new consent record, from the same number, with a timestamp.
6. Who sent each campaign? The sender and recipient count for each campaign. This is where the per-send attestation helps.

If you can't produce items 1, 2 and 4 within an hour of being asked, fix that before you scale volume.

The cost math of a missed opt-out

Here's a worked example with stated assumptions.

Assumptions: a business sends a 1-segment promo to 5,000 contacts on Ready Standard at $0.0075/segment plus a $0.0045 carrier fee. 150 of those contacts opted out in earlier campaigns. A second, older tool also has the list and doesn't know about 40 of those opt-outs.

On Ready: the 150 opted-out numbers are refused before sending, so the send bills 4,850 × 1 × ($0.0075 + $0.0045). The 150 cost nothing, and nobody who opted out gets texted.

Ready's all-in prices per segment include the carrier fee but not screening: Scrub lists and Number validation, the two switches in Settings under Compliance, each add $0.003 per segment when switched on, shown as screening on your bill, and both are off by default. Unless you turn the opt-out footer off, the first text to each contact, and one again from time to time, also gets "Reply STOP to opt out" and your business name if the message does not already have them, so a text close to the segment limit can bill one more segment.

In the older tool: 40 people who said STOP get a promo. TCPA statutory damages run roughly $500 to $1,500 per text, so the exposure is 40 × $500 = $20,000 at the low end and 40 × $1,500 = $60,000 if a court finds the violations willful. That's for one campaign. Drip campaigns repeat it every week the gap stays open.

The texts themselves cost cents. The missed suppression is what costs real money. That's why syncing opt-outs across tools is worth an afternoon of engineering even if you only send a few thousand texts a month. A related figure: a standalone TCPA and DNC litigator scrub is $0.005 per contact. It's a different list from your own opt-outs, and the three separate lists compliance teams confuse explains why you need both.

The practical takeaway

Treat the opt-out list as one shared record that every sending system reads before it sends. Concretely:

• Catch every standard keyword, and have a human or rule review free-text revocations.
• Only re-subscribe on a START from the contact's own number or on fresh, documented consent.
• Sync opt-outs into every other tool that can text, and carry them with you when you migrate.
• Keep consent records in your own store, and confirm you can rebuild a timeline in under an hour.

If you want to see how this works on Ready, the first 20 one-to-one texts are free (a card on file is required to send). Test a STOP from your own phone, then try a send to that number. Sign up here or read the API docs first.

Frequently asked questions

Does an SMS opt-out apply to all my business phone numbers? Yes, you should treat an opt-out as applying to every number your business texts from. Consent is withdrawn from the business, not from one line, so a STOP to your marketing number also covers your sales and reminder numbers.

What words count as an SMS opt-out besides STOP? STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE and OPT OUT are the common keywords. The FCC also lets people revoke consent by any reasonable means, so replies like "stop texting me" or "remove me" should be treated as opt-outs too.

How fast do I have to honor an SMS opt-out? Under the FCC's revocation rules, you must honor an opt-out within 10 business days. Most platforms block further texts immediately, and that's the standard to aim for.

How do I opt out of SMS or MMS messages? Reply STOP to the number that texted you. It works the same for text and picture messages, and the sender has to stop texting you from every number it uses. If the texts keep coming, forward one to 7726 and keep a screenshot.

What is opt-out management? Opt-out management is the system that records every STOP, unsubscribe and plain-language refusal, then makes every number, campaign and tool check that list before it sends. Done well, one opt-out stops all of a business's texts to that person automatically.