Most people who build their own SMS opt-out handling write one line of logic: if message == "STOP", unsubscribe. It looks complete. It passes a manual test. And it quietly fails carrier compliance on the first contact who texts back "cancel" instead.
STOP is the headline keyword, but it's one of a set the carriers require you to honor — and the failure mode isn't a warning email. It's a contact who told you to stop, kept getting texts because your regex didn't catch their exact word, and now has a screenshot. That's the TCPA exposure zone: roughly $500 to $1,500 per message in statutory damages, per text, after they asked you to stop.
Full disclosure: I work for Ready, and one of the reasons we handle this automatically is that I've watched too many DIY setups get the keyword list 80% right and treat that as done. Here's the other 20%.
The carrier-mandated keyword set, in full
The CTIA guidelines and the major carriers (AT&T, T-Mobile, Verizon) all require your sender to recognize a standard set of opt-out and help keywords. These aren't optional courtesies — on registered 10DLC traffic they're part of what keeps you in good standing.
Opt-out keywords (all must unsubscribe the contact):
| Keyword | What trips people up |
|---|---|
| STOP | The obvious one — everyone catches this |
| STOPALL | Easy to miss; opts out of all campaigns from the brand |
| UNSUBSCRIBE | Longer word, often typed with a typo |
| CANCEL | Frequently the word non-technical recipients reach for |
| END | Short, gets missed in substring matching |
| QUIT | Same problem as END |
Help keywords (must return a HELP response with brand name + contact info):
| Keyword | Required behavior |
|---|---|
| HELP | Reply with who you are and how to reach you |
| INFO | Same treatment as HELP |
Opt-back-in keyword:
| Keyword | Required behavior |
|---|---|
| START | Re-subscribes a contact who previously opted out |
| UNSTOP | Same as START |
| YES | Frequently used as a resubscribe confirmation |
That's a dozen keywords across three behaviors, not one. And carriers can and do add to this list, which is the deeper problem with hard-coding it yourself.
What actually breaks when you match manually
DIY keyword handling fails in three specific, repeatable ways.
1. Substring vs. exact match
Someone builds if "stop" in message.lower() and ships it. Now the contact who texts "please stop texting me the wrong size, I ordered a medium" gets silently unsubscribed mid-conversation. Meanwhile the person who texts "STOP." with a period slips through a naive exact-match check that didn't strip punctuation.
The correct behavior — trim whitespace, strip trailing punctuation, case-fold, then match against the full keyword set as standalone tokens — is more code than most teams write on the first pass. It's the kind of thing that looks trivial and eats an afternoon of edge cases.
2. Opt-outs that don't propagate across campaigns
This is the expensive one. Say you run three campaigns off the same brand: an order-notifications campaign, a promo campaign, and an appointment-reminder campaign. A contact texts STOP to a promo message. Your handler correctly suppresses them — in that campaign's list.
Two weeks later your appointment-reminder workflow texts them anyway, because it reads from a different list that never got the opt-out. From the carrier's and the recipient's point of view, you ignored a STOP. The fact that it was "a different campaign" is not a defense.
A compliant setup treats opt-out as a brand-level or contact-level flag, not a per-list one. Once someone opts out, they're suppressed everywhere you could message them.
3. No HELP response, or the wrong one
HELP isn't a suppression keyword — it's a response obligation. When someone texts HELP or INFO, the carriers expect an automatic reply identifying your brand and giving a contact method. Skip it and you're out of spec. Send a generic "how can we help?" with no brand name and you're technically non-compliant even though you replied.
Why this connects directly to deliverability, not just legal risk
It's tempting to file keyword handling under "legal, deal with it later." That framing costs you delivery.
Carriers monitor opt-out compliance as a trust signal on your 10DLC registration. Ignored STOPs generate spam complaints. Complaint rate feeds directly into filtering decisions — the same machinery that decides whether your legit messages land. Get sloppy with opt-outs and you don't just risk a lawsuit; you watch your delivery rate erode on the exact carriers that police it hardest. If you've read why your texts fly on AT&T and crawl on T-Mobile, it's the same underlying trust-scoring at work.
The opt-out list is also one of the three separate lists compliance teams keep confusing — your internal do-not-contact list is distinct from the federal DNC and from litigator lists, and the STOP keyword feeds the first one. Getting the keyword handling right is what keeps that internal list honest.
The AI-reply wrinkle nobody plans for
If you've added any kind of automated or AI-assisted replies to your inbound conversations, the keyword problem gets sharper. An AI agent that's optimizing for engagement can — without meaning to — talk a contact past a soft opt-out signal. Someone types "stop messaging me about this," the model reads it as a topic complaint rather than an unsubscribe, and keeps the thread going.
The guardrail is that opt-out detection has to run before any reply logic, AI or otherwise. STOP is checked, honored, and closes the conversation — no model gets a vote. We wrote up how that boundary should be enforced in the AI reply agent consent guardrail, because "the bot kept talking after STOP" is a genuinely bad look in a courtroom.
How Ready handles the whole set automatically
Here's the part where handling it yourself stops being worth the engineering time.
Ready's automatic STOP/opt-out handling recognizes the full carrier-mandated keyword set — STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT and the rest — with the normalization (whitespace, punctuation, case) already handled. When an inbound opt-out lands:
- The contact is suppressed and the opt-out propagates so they can't be messaged again across your campaigns — not just the one they replied to.
- HELP/INFO trigger the required brand-identifying auto-response.
- START/resubscribe keywords re-enable messaging for a contact who chose to come back.
- For connected GoHighLevel accounts, the opt-out syncs back so your CRM and your automations see the same suppression state — which is what stops a stray workflow from texting someone who already said stop.
None of this makes you immune to a lawsuit — compliance is ultimately the sender's responsibility, and you still need clean consent on the way in and quiet-hours discipline on the way out. What automatic keyword handling does is remove the single most common, most avoidable failure: honoring STOP but not CANCEL, or honoring it in one campaign but not the next.
The practical takeaway
If you're running SMS at any real volume, audit your opt-out logic against three questions:
- Does it catch the full keyword set — STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT — with punctuation and casing normalized, matched as whole tokens?
- Does an opt-out propagate everywhere you could message that contact, or just the campaign they replied to?
- Do HELP and START behave correctly — brand-identifying reply, and a clean resubscribe path?
If you can't answer yes to all three, you have a gap that's both a legal exposure and a slow leak in your deliverability. You can close it with a careful engineering pass — or let the platform own it.
If you'd rather not build and maintain keyword-handling logic yourself, Ready handles the full opt-out and HELP set automatically, and you can start with 2,500 free credits to see how the inbound handling behaves before you commit a list to it.