Skip to main content
A consent flow is the mechanism by which someone explicitly agrees to receive text messages from you. The TCPA and the carriers require documented, explicit consent before you send any SMS — not just marketing or promotional traffic. Getting this right is the most common source of campaign rejection.

​
Keep an audit trail

You’re responsible for proving consent if a carrier audits your campaign or you face a TCPA complaint. According to CTIA guidelines, for every phone number you message, retain:
  • Exact disclosure text they saw at the time of opt-in
  • Specific campaign for which consent was provided
  • Phone number for which consent was granted
  • Method of consent (web form, keyword, paper form, verbal)
  • Any identifiers for the individual who provided consent (username, email, etc)
  • Timestamp of when consent was given
Most platforms store this as a row per opt-in event in their own database. Surge does not store this for you. Carriers treat undocumented consent as no consent. Reviewers will only approve campaigns with a clear opt-in mechanism. After approval, high opt out rates and spam reports lead the carriers to doubt consent was received, and lead to heavy filtering of your messages. Good consent practices reduce spam complaints to keep your deliverability healthy.

​
Types of opt-in

A valid web form consent flow has three components:
  1. A phone number input: users enter the number they want messages sent to
  2. An explicit, unchecked checkbox: labeled something like “I agree to receive text messages from Acme Corp”
  3. Required disclosures shown near the checkbox (see Required Disclosures)
SMS consent must be separate from general terms acceptance. You cannot use “I agree to the terms of service” as your consent mechanism for text messages. Carriers require an explicit, optional opt-in.

​
”Optional” is non-negotiable

The opt-in must be genuinely optional: the user must be able to complete the form or flow without providing SMS consent. This is one of the most common causes of campaign rejection. What “optional” looks like in practice:
  • Unchecked checkbox on a signup form — the form submits whether the box is ticked or not
  • A secondary option alongside SMS, such as a “More options” button offering a phone call for verification codes instead of an SMS code
  • A “No thanks” button or close (×) on a dedicated SMS consent prompt
Anything that forces the user to consent to SMS in order to use your product (a required checkbox, a flow that won’t proceed without opt-in) will be rejected. The consent_flow field in your campaign registration is a plain-English description of your opt-in mechanism. It should be specific enough that a reviewer could find the opt-in on your website and verify it matches your description. What to include:
  • Where the opt-in happens (URL, form type)
  • The exact wording of the checkbox or prompt
  • Whether the checkbox is pre-checked or unchecked by default (must be unchecked)
  • What disclosures are shown and where
“Users opt in on our website” is acceptable only if you include a direct link to the page where the opt-in lives, and reviewers can find the opt-in mechanism on that page. If you provide a screenshot in place of a link, explain why — usually because the form sits behind authentication. A specific description like the example below passes review:
“Users enter their phone number and provide consent during the account signup process at acme.com/signup.”

​
Keyword opt-in

For keyword-based opt-ins, the consent flow description should explain where the keyword appears (physical sign, website, etc.) and what the keyword is. It can be helpful to include a photo or mockup of the sign or website where the phone number and keyword are advertised.
“Users consent by texting JOIN to +18015559876 after seeing our in-store signage. Signs look like this: https://drive.google.com/file/d/eXaMpLeFiLeId/view?usp=sharing”

​
Double opt-in

Some high-stakes use cases (medical, financial) benefit from double opt-in, where after the user submits their number, they receive a confirmation text asking them to reply YES. This creates an additional record of consent. It’s not required by TCR but can reduce disputes.

​
What happens when someone opts out

When a contact texts STOP, Surge records the opt-out and fires a contact.opted_out webhook event. Sending to an opted-out contact returns an opted_out error. You cannot legally re-subscribe someone who has opted out without their explicit new consent (typically by having them text START). The HELP and START keywords are handled automatically by Surge. When a contact texts HELP, they receive a help message configured on the phone number. When they text START, they’re re-subscribed.