The Complete Guide to SMS Opt-In and Opt-Out

SMS is the most direct channel a brand can use to reach a customer. 95% of messages are read within three minutes of delivery, on the same screen as messages from family and banking alerts, without a spam folder or an algorithm deciding who sees what.

That directness is exactly why the rules around it are strict.

Sending a promotional SMS to someone who did not explicitly ask to receive it is not just poor practice. In most markets it is illegal, and the fines are significant. The framework that governs this is built around two concepts: opt-in, the moment a customer gives documented consent to receive marketing messages, and opt-out, the moment they withdraw it.

Getting both right is not complicated, but it requires a deliberate process. This guide covers what that process looks like, what the law requires, and how to automate it so compliance is built into the system rather than dependent on someone remembering to update a spreadsheet.

What Is SMS Opt-In and Why Does Compliance Matter?

An SMS opt-in is the documented moment at which a customer gives explicit consent to receive marketing messages from a brand via text. Explicit means active: the customer took a deliberate action to sign up. It does not mean passive: a phone number collected at checkout for order confirmation purposes, or buried in a terms and conditions checkbox, does not constitute marketing consent.

This distinction matters because regulators in every major market have made it the central test. The question in any compliance audit is not whether the brand has a phone number. It is whether the person who owns that number knowingly agreed to receive marketing messages, and whether the brand can prove it.

The two regulatory frameworks most retail and e-commerce marketers need to understand are:

TCPA (United States)

The Telephone Consumer Protection Act requires prior express written consent before any promotional SMS is sent. It prohibits sending outside permitted hours (8am to 9pm in the recipient's local time zone), requires an immediate opt-out mechanism, and carries per-message fines of $500 to $1,500 for violations. At scale, those fines accumulate into material legal exposure.

GDPR (European Union and United Kingdom)

The General Data Protection Regulation requires that consent be freely given, specific, informed, and unambiguous. A pre-checked box on a purchase form does not meet this standard. Consent must be a separate, active act. Brands must be able to demonstrate what was consented to, when, and through which mechanism.

Three practices apply regardless of jurisdiction:

• Explicit consent only. No pre-checked boxes, no consent buried in purchase terms, no assumed permission from an existing customer relationship. The customer must actively choose to receive marketing SMS.
• Clear disclosure at sign-up. The customer must know what they are signing up for before they do it: the type of messages they will receive, the approximate frequency, and how to stop.
• Timestamped consent records. Every opt-in should generate a record showing who consented, when, through which channel, and to what. That record is the brand's defence in the event of a complaint or audit.

Single vs. Double Opt-In SMS: What Is the Difference?

Both mechanisms add a contact to an SMS database. They differ in what they verify and what they protect against.

Single opt-in

The customer enters their phone number into a form and is immediately added to the list. No confirmation step. No verification that the number belongs to them or that they consciously intended to sign up for marketing messages.

Single opt-in is faster and produces a larger list in less time. It is appropriate in controlled settings where the quality of the contact is confirmed by the circumstances: a direct sales conversation, a closed event, a situation where a team member is present and confirms the contact firsthand.

In an open online environment, single opt-in introduces risk. Anyone can enter any number into a form. The resulting database may contain typos, numbers belonging to people who did not consent, and contacts who will report the first message as spam.

Double opt-in

The customer enters their number and immediately receives an SMS containing a verification code. The number is only added to the database once that code is entered.

This single additional step produces three outcomes that single opt-in cannot:

• Every number in the database is confirmed active and reachable at the moment of sign-up
• Every contact has taken a deliberate two-step action, which documents intent and consent more strongly than a single form submission
• No one can be added to the list without the owner of the number actively participating

Around 95% of users who enter their number complete the verification step. The contacts that drop off at this stage are typically invalid numbers or entries made without the owner's knowledge. Removing them before they enter the database costs almost nothing in list volume and prevents them from degrading campaign performance and creating compliance exposure.

Double opt-in is the standard that 2way applies across all sign-up channels, online and offline. It is the format that holds up under GDPR audit and meets TCPA's prior express written consent requirement.

What opt-in messages look like in practice

The verification message a customer receives should be brief, clear, and contain only what is necessary:

Single opt-in welcome:
"Welcome to [Brand]. You're now subscribed to our SMS updates. Reply STOP to unsubscribe. Msg & data rates may apply."

Double opt-in verification:
"Your [Brand] verification code is 847291. Enter this code to confirm your sign-up and receive your discount."

Double opt-in welcome (sent after confirmation):
"You're in. Here's your 15% discount code: WELCOME15. Valid for 7 days. Reply STOP at any time to unsubscribe."

The welcome message delivers the promised incentive in the first line, confirms what the subscriber has signed up for, and includes the opt-out instruction. All three elements are present before any promotional content is sent.

Best Practices for Growing Your SMS Subscriber List

A phone number is more personal than an email address. Most people have one primary number, and they use it for everything that matters. When someone leaves their number with a brand, they are making a considered decision. That means the brand needs to give them a clear reason to make it.

Offer a high-value incentive

The incentive must have concrete, immediate value. A percentage discount delivered by SMS within seconds of sign-up is the most effective format because the reward arrives at the moment of highest motivation, before the customer has moved on to something else.

What works:

• A unique discount code sent immediately after verification, valid for a defined period
• Early access to a sale or new collection, available to SMS subscribers before the general public
• Free shipping on the next order, activated by the sign-up code

What does not work:

• Vague promises ("exclusive updates", "be the first to know") with no concrete value attached
• Rewards delivered by email rather than SMS, which defeats the immediacy of the channel
• Generic codes available to everyone, which remove the sense of personal reward

Set clear expectations before sign-up

The customer should know, before they enter their number, what they are agreeing to receive. Frequency, content type, and opt-out method should all be stated at the point of sign-up, not revealed after the first message arrives.

A simple disclosure beneath the sign-up form covers this: "You'll receive up to 4 SMS messages per month with offers and updates. Reply STOP at any time to unsubscribe. Message and data rates may apply."

Collect contacts across online and offline channels simultaneously

The most effective SMS list-building strategies use multiple entry points feeding the same database:

• Online: A mobile teaser at the bottom of the screen for smartphone visitors, a desktop pop-up triggered by scroll depth or exit intent, a dedicated sign-up landing page linked from social media and email campaigns
• Offline: QR stickers at checkout counters, fitting rooms, and product displays; NFC tags for tap-to-sign-up at retail locations; package inserts with a code directing customers to a sign-up page

Each channel carries a unique identifier in 2way, so the brand can see which source generates the most contacts and which produces the highest downstream conversion.

Deliver the promised reward in the first message

The welcome message is the most important SMS a brand sends. It sets the tone for the entire relationship. It should:

• Deliver the promised incentive in the first line, before anything else
• Confirm what the subscriber has signed up for
• Include the opt-out instruction
• Be sent within seconds of verification, not hours later

A subscriber who waits for their discount code and receives it the next morning has already formed a negative first impression of the channel.

What Is SMS Opt-Out and How Does It Work?

An opt-out is the moment a subscriber withdraws their consent to receive marketing messages. From that moment, no further marketing SMS may be sent to that number. This is a legal requirement under both TCPA and GDPR, and failure to honour it promptly is one of the most common sources of regulatory complaints and fines in SMS marketing.

The standard mechanism is a keyword reply. When a subscriber sends any of the following words, the system must immediately remove them from the active sending list and send a single confirmation message:

• STOP
• UNSUBSCRIBE
• CANCEL
• QUIT
• END

The confirmation message must not contain any promotional content. Its only purpose is to confirm that the opt-out has been processed:

"You've been unsubscribed from [Brand] SMS. You won't receive any further messages. Text JOIN to re-subscribe at any time."

Three practices govern opt-out management:

Include opt-out instructions in every message

The first message a subscriber receives must include opt-out instructions. Best practice is to include a brief reminder in every campaign: "Reply STOP to unsubscribe." This is a legal requirement in the US and a GDPR best practice in Europe.

Process opt-outs immediately

A subscriber who sends STOP must not receive another marketing message. Immediate processing means within seconds, not within the next batch send. Any message that goes out after an opt-out request has been received is a violation.

Handle HELP requests

When a subscriber replies HELP, the system should respond with basic information: the brand name, a customer service contact, and a reminder of how to opt out. This is a required response under TCPA.

Re-opt-in campaigns

An opt-out is not always permanent. A subscriber who unsubscribes may return to the brand later and choose to re-subscribe. The confirmation message can include re-subscription instructions, such as "Text JOIN to re-subscribe at any time." This keeps the door open without pressuring the contact or violating the opt-out.

Automating the SMS Opt-In and Opt-Out Process

Managing subscriber consent manually is both operationally unsustainable and legally risky. A spreadsheet updated by a team member works for a list of 50 contacts. It does not work for a list of 50,000, and at any scale it introduces the possibility of human error: a STOP request missed, a contact added twice, a consent record not saved with a timestamp.

The consequences of those errors are not administrative inconveniences. Under TCPA, a single non-compliant message sent after an opt-out request can trigger a fine. A missing consent record in a GDPR audit can result in enforcement action. The risk scales with the size of the database.

Modern SMS platforms handle this automatically. In 2way, the entire consent management process runs without manual intervention:

• When a contact signs up through any channel, whether a website pop-up, a QR sticker in a store, an NFC tag, or a landing page, the system immediately sends a verification SMS with a one-time code. The number is only added to the database after that code is confirmed. The consent record, including timestamp, channel, and verification method, is stored automatically.
• When a contact sends STOP, UNSUBSCRIBE, CANCEL, QUIT, or END, the system processes the opt-out in real time and blocks all further marketing sends to that number. No manual step is required. No message can be sent in error during a batch campaign. The confirmation message goes out automatically.
• When a contact sends HELP, the system responds with the configured support information automatically.
• Duplicate numbers are detected and removed at sign-up, keeping the database clean without manual review.

The practical benefit is not just compliance. A database where opt-outs are processed instantly and consent records are stored automatically is a cleaner, more accurate list. Campaign metrics reflect the audience the brand actually has. Delivery rates are higher because the list contains only active, consenting contacts. And the brand has a complete, exportable audit trail available at any point, without needing to reconstruct it from multiple systems.

2way also integrates Delivery Health monitoring, which checks contact-level reachability before each campaign sends. Combined with a verified, well-maintained opt-in database, this means campaigns reach the contacts who are both willing and able to receive them, which is what produces the open rates and click-through rates that make SMS the highest-ROI channel in the retail marketing mix.

Conclusion: Compliance Is the Foundation, Not the Ceiling

The rules around SMS opt-in and opt-out are not obstacles to effective marketing. They are the conditions that make it work. A database built on explicit, verified consent contains contacts who chose to be there. Messages sent to that database reach people who are expecting them. The open rates, click-through rates, and revenue outcomes that make SMS the strongest-performing channel in retail are the direct result of the consent framework, not something achieved despite it.

The practical move is to automate the compliance layer entirely, so the marketing team can focus on what drives results: the offer, the timing, the segmentation, and the follow-up. When opt-ins are verified at sign-up and opt-outs are processed in real time, the database maintains itself. The brand communicates with confidence, and the customer relationship is built on a foundation of genuine, documented consent.

That is what turns an SMS list into a long-term marketing asset.