Opting in means a person has clearly agreed to receive text messages from a specific business, usually by checking a box, submitting a form or texting a keyword. Opting out means they have withdrawn that agreement, most often by replying STOP, and the business has to stop texting them. That is the short opt in meaning. Everything below covers the parts that decide whether your texts are legal, deliverable and defensible.
The difference between "they gave us their number" and "they opted in" is where most SMS compliance trouble starts. A phone number on an invoice, a lead list or a CRM import is contact information. It is not permission to text. The rest of this post covers what real consent looks like, how people give it, how they take it back and what you need to keep as proof.
Opt in meaning: what consent actually is
In the US, the rules come mainly from the Telephone Consumer Protection Act (TCPA) and the carrier requirements attached to A2P 10DLC registration. They recognize two levels of consent, and which one you need depends on what you send.
- Prior express consent covers informational and transactional texts, such as appointment reminders, order updates and account alerts. A customer who gives you their number for a specific purpose has generally consented to texts about that purpose.
- Prior express written consent covers marketing texts, such as promos, discounts, new product announcements and "come back" offers. This is the stricter standard. It needs a clear, signed agreement, and an electronic signature counts: a checked box, a submitted form or a keyword text all qualify.
"Written" doesn't mean paper. It means the person took a clear, affirmative action that you can show later, after seeing a disclosure that explained what they were signing up for.
What a valid opt-in disclosure includes
A consent request that holds up with carriers and courts usually names or includes:
- Your business name, so the person knows who will text them
- What kind of messages they will get (marketing, reminders, alerts)
- Message frequency, for example "up to 4 msgs/month" or "msg frequency varies"
- "Msg & data rates may apply"
- How to opt out (reply STOP) and how to get help (reply HELP)
- That consent isn't a condition of purchase, for marketing consent
- A link to your privacy policy and terms
If any of these is missing, carriers often reject the 10DLC campaign during registration. That happens before a single text goes out. Our post on opt-in wording that clears registration on the first submission has copy you can adapt.
How a customer opts in: the three common methods
Each method creates consent in a different place, which matters later when you need to prove it.
| Method | What the person does | Where the proof lives | Watch out for |
|---|---|---|---|
| Web form | Enters their number and submits | Your form tool or database: timestamp, page URL, the disclosure text shown, IP address | A pre-checked box doesn't count as an affirmative action |
| Checkbox at checkout or signup | Ticks an unchecked SMS box next to the disclosure | Your store or app database | Bundling SMS consent into "I agree to the terms" weakens it |
| Keyword | Texts a word like JOIN to your number | Your message log: the inbound text, its timestamp and your confirmation reply | The advertised keyword needs the full disclosure next to it, wherever you show it |
Double opt-in
Many senders add a confirmation step. The person submits a form, then gets a text such as "Reply YES to confirm marketing texts from Acme Coffee. Up to 4 msgs/mo. Msg & data rates may apply. Reply STOP to cancel." They are subscribed only after they reply YES.
Double opt-in isn't legally required for most US senders. It does three useful things:
- It catches typos and fake numbers before you pay to text them.
- It gives you a second timestamped record of consent.
- It shows carriers you take consent seriously, which helps during registration review.
The cost is that some people never reply, so your list grows more slowly. For marketing lists, most teams accept that tradeoff.
What isn't opt-in
- A purchased or rented list
- Numbers scraped from websites or directories
- A customer who gave their number for delivery and never saw an SMS disclosure, if you then send them promos
- Someone who texted you a question once (you can answer them, but that doesn't sign them up for your campaigns)
Cold outreach belongs on the phone or in the mail. SMS goes to people who opted in or who started the conversation themselves.
What opt out means and the STOP rule
Opting out is the person withdrawing consent. Once they do, you stop texting them, on every campaign and from every number you text them from.
The keywords
The standard opt-out keywords are STOP, STOPALL, UNSUBSCRIBE, CANCEL, END and QUIT. Carriers expect all of them to work. Under current FCC rules, people can also opt out "by any reasonable means." That means a reply like "please stop texting me" or "remove me" counts too, even though it isn't a single keyword. Our post on opt-out variants carriers don't catch covers how to handle those replies.
What you're allowed to send after STOP
You can send one confirmation text that confirms the opt-out, for example: "You're unsubscribed from Acme Coffee texts. No more messages will be sent. Reply START to resubscribe." The confirmation can't include a promo, a "are you sure?" pitch or a link to a sale.
After that, nothing more goes out unless the person opts back in, usually by texting START or UNSTOP.
Timing
FCC rules currently give you no more than 10 business days to honor an opt-out. In practice, an opt-out should take effect immediately. Any text sent after STOP is the kind of message that turns into a complaint, a carrier flag or a TCPA claim. TCPA statutory damages run $500 to $1,500 per text, so a scheduled campaign that slips past an opt-out can get expensive fast.
What a business has to keep as proof
If a consent dispute comes up, "they signed up on our website" isn't enough. You need a record for each contact that shows:
- The phone number that opted in
- When they opted in (date and time)
- Where they opted in (page URL, checkout flow, keyword, paper form ID)
- The exact wording of the disclosure they saw at that moment, not today's version
- How they opted in (checkbox, form submit, keyword reply), plus IP address or the inbound message where you have it
- Any opt-out and when it happened
Keep consent records at least as long as you text the person, and for a few years after. TCPA claims can be filed years after the text was sent. Version your disclosure copy, because if you change the wording in June, someone who signed up in March agreed to the March wording.
The full checklist is in how to document SMS consent so it holds up.
How Ready records consent and handles opt-outs
We make Ready, so here is exactly what the platform does and doesn't do on consent. Being precise here matters more than sounding complete.
What Ready records: your attestation
Ready records your attestation on every bulk send and on every API send that sets the consent_attested field:
POST https://api.tryready.com/v1/messages
X-API-Key: <key>
Idempotency-Key: <a new UUID for each text>
{
"to": "+12125550199",
"body": "Acme Coffee: your order #1042 is ready for pickup. Reply STOP to opt out.",
"consent_attested": true
}Ready logs who sent, to how many recipients and when. This gives you an audit trail of your attestations across every send. Full field reference: docs.tryready.com/api/messages.
What Ready doesn't record: per-contact consent
The attestation is your promise that consent exists. It is not the consent record itself. Ready doesn't store each recipient's opt-in time, the disclosure wording they saw or the page URL. A keyword reply to your number doesn't create a consent record in Ready either. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)
That per-contact evidence lives with you: in your form tool, your store's checkout database or your app. Keep it there, and keep it versioned.
Opt-outs are automatic
When a contact replies STOP, UNSUBSCRIBE or another standard keyword, Ready honors it and applies the opt-out across your campaigns. That contact can't be texted again from your account, whichever campaign or number a later send comes from.
Ready refuses texts to opted-out numbers up front and doesn't charge for them. If a later bulk send or API call includes someone who opted out, that text is simply not sent. GET /v1/opt-outs lists this account's opted-out contacts. It isn't a complete suppression list, so before you text a number from another tool, check it with GET /v1/opt-outs/:phone.
For running STOP across many numbers, see SMS opt-out management.
The rest of the stack
Consent is one part of compliance. These sit next to it:
- Quiet hours. Ready holds texts outside permitted local hours, based on the recipient's area, and sends them later. You're only charged when a held text actually sends. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.
- TCPA litigator and DNC scrub. This checks numbers against known TCPA-litigator and DNC-complainer lists. It costs $0.005 per contact as a standalone scrub, or $0.003 extra per segment when you switch it on for an account. It's off by default.
- 10DLC registration handled in-app. This is where your opt-in flow gets reviewed in the first place. Most approvals take 2 to 7 days.
None of this makes a sender immune to lawsuits. Collecting real consent, and keeping proof of it, stays your responsibility. These tools reduce the ways a mistake turns into a sent text.
The practical takeaway
Consent is a specific, provable act. A number in your database isn't consent. Ask clearly, with the full disclosure. Keep a dated record of what each person agreed to. Treat STOP, and anything that means STOP, as final the moment it arrives.
If your opt-in flow is solid and you want the opt-out side handled automatically, you can sign up for Ready and send your first 20 one-to-one texts free before you register. The send pricing is $0.0075/segment plus a $0.0045 carrier fee, shown on the pricing page. The compliance surcharge is separate.
FAQ
What does opt in mean in a text message?
It means you agreed to receive texts from that business, usually by submitting a form, checking a box or texting a keyword. The business can then text you about what you agreed to, until you opt out.
Is replying YES or texting a keyword legally valid consent?
Generally yes. An electronic action such as a keyword text or a YES reply can count as written consent, provided the person saw a clear disclosure first: who is texting, what kind of messages, how often, that rates may apply and how to opt out. The business should keep a record of that exchange.
Do I need consent for appointment reminders, or only for marketing?
You need consent for both, at different levels. Transactional texts like reminders need prior express consent, which a customer often gives when they share their number for that purpose. Marketing texts need prior express written consent.
What happens when someone texts STOP?
The business may send one confirmation that the person is unsubscribed, then must stop all texts to that number. On Ready, the opt-out is applied automatically across campaigns, and later sends to that number are refused without charge.
Does Ready store proof that each contact opted in?
Only in one case. For sends, Ready records your consent attestation, not each contact's consent. If a contact opts in on Ready's hosted opt-in page, Ready keeps that opt-in record (time, wording, IP address and browser) for you. For every other signup, the per-contact proof (opt-in time, disclosure wording and page URL) stays in your own form, store or app records, and you should keep it there.