Text-to-Join and Double Opt-In: SMS Consent Records for TCPA Cases

A customer who texts JOIN to your short code can give prior express written consent, because the FCC accepts consent obtained under the E-SIGN Act, including “permission obtained via an email, website form, text message, telephone keypress, or voice recording,” per FCC 12-21. The keyword rarely carries the whole load, though. The disclosures have to reach the customer first, and the business has to prove it all later. A company that kept the inbound text, the disclosure, and its confirmation has better consent evidence than most.

Can a keyword text be prior express written consent?

Yes, if the customer saw the right disclosures before sending it. Prior express written consent is the signed, written agreement the FCC requires before a business sends marketing calls or texts to cell phones using an autodialer (equipment with the capacity to store or produce numbers using a random or sequential number generator and dial them) or an artificial or prerecorded voice, and before artificial or prerecorded marketing calls to home lines, subject to a few exceptions. Under 47 C.F.R. § 64.1200(f)(9), the agreement must authorize the seller to send those messages, identify the phone number, and “include a clear and conspicuous disclosure” that signing authorizes them and that the person isn’t required to agree “as a condition of purchasing any property, goods, or services.” The same paragraph, at § 64.1200(f)(9)(ii), says the term signature “shall include an electronic or digital form of signature, to the extent that such form of signature is recognized as a valid signature under applicable federal law or state contract law.”

The federal law that matters is the E-SIGN Act, which defines an electronic signature as “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record,” under 15 U.S.C. § 7006(5). In 2012 the FCC concluded that “consent obtained in compliance with the E-SIGN Act will satisfy the requirements of our revised rule,” according to FCC 12-21. In my view, a keyword sent in answer to an ad that carries the disclosures fits: the customer adopts a symbol with the intent to agree to what the ad says.

The FCC has quoted an example. Footnote 363 of its 2015 omnibus order reproduced a retailer’s text-program disclosure: “By texting COUPON from my mobile number, I agree to receive marketing text messages generated by an automated dialer from Macy’s to this number. I understand that consent is not required to make a purchase.” The order said its ruling “allows businesses to voluntarily provide these simple disclosures to consumers in a call-to-action before sending a single on-demand text in response to a consumer’s request,” per FCC 15-72. That’s the template I’d start from.

Two caveats. For texts, the written-consent rule reaches only marketing sent with an autodialer or an artificial or prerecorded voice. Whether a given texting platform qualifies is a separate fight, which I covered in our post on autodialer claims after Duguid. The signed record still earns its keep, because one way to market to a number on the National Do Not Call Registry (the federal list of numbers whose owners opted out of telemarketing) is permission “evidenced by a signed, written agreement between the consumer and seller which states that the consumer agrees to be contacted by this seller and includes the telephone number to which the calls may be placed,” under § 64.1200(c)(2)(ii). And the FCC’s declaratory rulings, including the 2015 on-demand ruling discussed below, interpret the statute. Since June, district courts in TCPA enforcement suits generally aren’t bound by such interpretations and must read the statute “under ordinary principles of statutory interpretation, affording appropriate respect to the agency’s interpretation,” per McLaughlin Chiropractic Associates, Inc. v. McKesson Corp. Those rulings get respect, not obedience, so I’d build consent that would satisfy a skeptical judge reading the statute fresh.

What do SoundBite and the 2015 order say about one reply text?

That a single, prompt reply that stays inside what the customer asked for is covered by the customer’s own request. The 2012 SoundBite ruling was about opt-outs, but its logic is where confirmation-text analysis starts. The FCC concluded that “a consumer’s prior express consent to receive text messages from an entity can be reasonably construed to include consent to receive a final, one-time text message confirming that such consent is being revoked at the request of that consumer,” according to FCC 12-143. The confirmation can’t market, must be the only extra message, and gets a timing presumption: “If the confirmation text is sent within five minutes, it will be presumed to fall within the consumer’s prior express consent.” That standard now sits in § 64.1200(a)(12).

In 2015 the FCC carried the same reasoning to the opt-in side, for a customer who texts a keyword like “discount” and gets a coupon back. It held that “a one-time text sent in response to a consumer’s request for information does not violate the TCPA or the Commission’s rules” if the consumer requested it, it went out once and immediately, and it held only the requested information, according to FCC 15-72. The limit is in footnote 363 of that order: “If the business sends more than a single text as a response to the consumer, however, our rules require prior express written consent with the specified disclosures.” Our post on sweepstakes and giveaway texts applies that limit to text-to-enter contests.

The Ninth Circuit reached a similar result under the statute’s consent requirement. In Moskowitz v. American Savings Bank (9th Cir. June 10, 2022), a non-customer texted a bank’s short code 11 times and got one automated reply to each. Affirming summary judgment for the bank, the court held: “By sending text messages to ASB’s short code, Moskowitz expressly consented to receive reply text messages.” That’s strong support for a first reply that only confirms and informs. It says nothing about the marketing that follows, which is where the disclosures and the double opt-in come in.

What should the confirmation or double opt-in text say?

It should restate the deal and ask for a yes, without selling anything. No federal rule requires a double opt-in, and I wouldn’t tell a client otherwise. I’d still use one for any marketing program, because it turns one inbound text into a two-step record made on the customer’s own phone.

A workable confirmation names the business and the program, says the messages are marketing texts sent with automated technology, says consent isn’t a condition of any purchase, gives the frequency, and explains how to stop and get help. Then it asks for a reply, such as YES, before any marketing goes out. I’d keep offers out of the confirmation. The on-demand ruling covers a single reply that “contains only the information requested by the consumer with no other marketing or advertising information,” per FCC 15-72, and footnote 363 says more than one reply needs written consent. That’s why I’d put the full disclosures in the keyword ad. Then, in my view, the coupon and a separate confirmation can both rest on that consent. Without the disclosures, the coupon alone fits the ruling. Adding a YES request to it goes beyond the ruling’s limit to the information requested, and the defense would rest on the FCC’s broader reasoning that a reply fulfilling the consumer’s request isn’t telemarketing.

The best reason for the second step is the identity problem. In Hall v. Smosh Dot Com, Inc. (9th Cir. June 30, 2023), the companies said a 13-year-old had opted in through a web form, but his mother alleged that she owned the phone and had put its number on the Do Not Call Registry. The court held she had standing and left consent for the merits, noting that “A telemarketer ordinarily does not know if consent to receive telephone messages comes from the subscriber of a particular number or some other user.” A YES reply might not have settled a dispute like that, since Hall alleged that her son used the phone “at times.” It does show that someone holding the phone agreed, which a typed-in number can’t show by itself.

Web form or keyword: which consent record holds up better?

In my view, the keyword usually wins on proof of the number, and the web form wins on proof of the disclosure. A text from the phone shows that someone holding it acted. A saved web form shows exactly what the page said, but anyone can type anyone’s number.

On web forms, put the disclosure beside the phone field and the submit button, and name your company. I’d be wary of forms that gather consent for a long list of marketing partners. The FCC’s one-to-one consent rule was vacated in Insurance Marketing Coalition Ltd. v. FCC (11th Cir. Jan. 24, 2025) and has been removed from the rules, but I think a partner list is still a thin record for any one company on it.

E-SIGN also has a retention condition. Where a law requires a writing, an electronic record’s legal effect, validity, or enforceability “may be denied if such electronic record is not in a form that is capable of being retained and accurately reproduced for later reference by all parties or persons who are entitled to retain the contract or other record,” under 15 U.S.C. § 7001(e). That covers every party entitled to the record, the customer included, which is another reason to put the disclosures in the confirmation text. The burden of proof, covered next, is a second reason to keep a reproducible copy.

What consent records should a business keep for each number?

Enough to prove consent without anyone’s memory, because the burden is the company’s. “Express consent is not an element of a plaintiff’s prima facie case but is an affirmative defense,” the Ninth Circuit held in Van Patten v. Vertical Fitness Group, LLC (9th Cir. Jan. 30, 2017), and the defendant bears the burden of proving it. For written consent, the FCC said “the seller will bear the burden of demonstrating that a clear and conspicuous disclosure was provided and that unambiguous consent was obtained,” according to FCC 12-21.

For a keyword program, keep the inbound message exactly as received, the number it came from, the short code or long code it reached, and the platform’s timestamp. Keep the disclosure the customer saw, as an image or PDF of each version of the ad, page, or sign, with the dates it ran. Keep the confirmation the system sent, the YES reply, and both timestamps. And note which program the consent covers, since consent to order alerts isn’t consent to promotions. Carrier rules add their own opt-in requirements, covered in our post on carrier texting rules and 10DLC.

Timestamps matter too. In SoundBite, the FCC said of opt-out confirmations that “The confirmation text will establish a clearer timeframe of events for this purpose,” per footnote 46 of FCC 12-143. A keyword logged at 2:14:07 p.m. and a confirmation at 2:14:09 p.m. answer questions a column marked “opted in: Y” can’t.

Opt-outs are their own subject, but since April 11, 2025, most of the revocation rules in § 64.1200(a)(10) have been in effect (an FCC bureau order, DA 25-312, delayed the piece that applies a revocation to unrelated messages until April 11, 2026), which means each number’s opt-in record should sit beside its opt-out history, so nobody texts a number that revoked. If your company also places telemarketing calls covered by the FTC’s Telemarketing Sales Rule, that rule sets its own consent-record requirements, which I walked through in our post on the Telemarketing Sales Rule and TCPA recordkeeping.

When a consent dispute turns into a claim

1. Put a litigation hold on the platform’s data for the number, including every message in both directions with its delivery data, plus the consent record behind the first marketing text.
2. Export the number’s opt-out and internal do-not-call history, with the date each request arrived and the date sending stopped.
3. Pull the National Do Not Call Registry scrub records for the campaigns that reached the number, including the Registry version used.
4. Collect the call-to-action versions the customer could have seen, the confirmation templates, and the platform and lead-source contracts.
5. Talk to a lawyer before you answer a demand letter, text the claimant, or offer anything to settle.

The firm’s page on TCPA litigation defense explains how claims involving marketing texts and disputed opt-in consent move from a demand letter to a lawsuit.

Questions businesses ask about SMS opt-in consent

Does the TCPA require double opt-in for marketing texts?

No. Neither the statute nor the FCC’s rules require a second confirmation step. For autodialed or prerecorded marketing, the rules require a signed written agreement with specific disclosures, and an electronic signature can satisfy it. Double opt-in is a way to prove that agreement and to show that the phone’s user gave it. I think it’s the cheapest consent evidence a business can collect.

Can we text a coupon right after someone texts our keyword?

Usually, if the coupon is what they asked for. The FCC’s 2015 order allows a one-time reply, sent immediately, that holds only the requested information. A second offer, or later promotions, takes the program outside that ruling and, where the rule applies, into the written-consent rule, so the call-to-action or the confirmation needs the required disclosures first.

What if a customer says they never texted the keyword?

The answer is the inbound message log, pulled from the platform itself. A summary sheet won’t do. Consent is the company’s burden to prove. A record showing the keyword arriving from the number, the confirmation going back, and a YES reply makes the denial hard to sustain. Where someone other than the subscriber gave the consent, as the companies claimed in Hall (through a web form), the dispute shifts to whose consent counts.

Does a keyword sign-up let us text a number on the Do Not Call Registry?

It can, with the right disclosure. The Registry rule allows messages to a listed number under a signed, written agreement naming the seller and the number. When the FCC adopted that rule, it said signed “shall include an electronic or digital form of signature, to the extent that such form of signature is recognized as a valid signature under applicable federal or state contract law,” per footnote 158 of FCC 03-153. I haven’t found an FCC ruling on keyword texts under this rule specifically, so the disclosure should name your company and say the customer agrees to be contacted.

If your company’s text consent is being challenged

If your company is accused of texting people without their consent, the inbound keyword messages and the disclosure each person saw often decide the consent defense. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving marketing texts and disputed opt-in consent. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on November 1, 2025. The E-SIGN Act provisions are 15 U.S.C. § 7001 and 15 U.S.C. § 7006. The FCC orders are the 2003 Do Not Call report and order, FCC 03-153, 18 FCC Rcd 14014 (2003), paragraph 44 and note 158; the 2012 written-consent report and order, FCC 12-21, 27 FCC Rcd 1830 (2012), paragraphs 32 to 34; the SoundBite declaratory ruling, FCC 12-143, 27 FCC Rcd 15391 (2012); and the 2015 omnibus declaratory ruling and order, FCC 15-72, 30 FCC Rcd 7961 (2015), paragraphs 103 to 106. The revocation waiver is the Consumer and Governmental Affairs Bureau’s order DA 25-312 (Apr. 7, 2025).

The court decisions are McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., No. 23-1226 (U.S. June 20, 2025); Moskowitz v. American Savings Bank, F.S.B., 37 F.4th 538 (9th Cir. 2022); Hall v. Smosh Dot Com, Inc., 72 F.4th 983 (9th Cir. 2023); Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017); and Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025).

This post is general information about the Telephone Consumer Protection Act and related laws as of November 1, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.