Skip to main content
Carriers require specific disclosures at the point of SMS opt-in. This page lists what’s required, where to put it, and templates you can adapt for common use cases.

​
The three required disclosures

Every SMS opt-in point must display:
  1. Message frequency: e.g., “Message frequency varies” or “You’ll receive up to 4 messages per month”
  2. Cost notice: exactly “Msg&data rates may apply” or “Msg&data rates apply”
  3. Opt-out instructions: exactly “Reply STOP to opt out” (STOP is the required keyword)
  4. Help instructions: exactly “Reply HELP for help”
In addition to the above, the following are required as well:
  • Identify the business responsible for the messages
  • Explain the purpose of the messages (e.g. account notifications, promotional messages, etc.)
  • Link to privacy policy
  • Link to terms of service

​
Where to put disclosures

Disclosures must appear at the point of opt-in: next to or immediately below the phone number field and consent checkbox. They should be readable without scrolling. Burying them in a terms of service page or a footer is insufficient. The font size should be legible (not 8px gray text). Where possible, reviewers visit your actual website, not just screenshots.

​
Canonical compliance message

When you send a first message to a new subscriber, include the full opt-in confirmation:
“You are now opted in to messages from Acme Corp. Frequency varies. Msg&data rates apply. Reply STOP to opt out.”
Replace “Acme Corp” with your actual brand name, not a placeholder.

​
Templates by use case

​
Marketing

Opt-in checkbox label:
“I agree to receive promotional text messages from Acme Corp”
Disclosure text beneath the checkbox:
“Message frequency varies. Msg&data rates apply. Reply STOP to opt out. View our Privacy Policy.”
Confirmation message:
“Acme Corp: You’re in! Expect exclusive deals and updates. Msg freq varies. Msg&data rates apply. Reply STOP to opt out.”
Example web form with separate unchecked checkboxes for transactional and marketing text messages

​
Transactional (account notifications, order updates)

Opt-in checkbox label:
“Send me text message updates about my orders and account”
Disclosure:
“You may receive messages about order status, shipping, and account activity. Message frequency varies. Msg&data rates apply. Reply STOP to opt out.”
Confirmation message:
“Acme Corp: You’ll now receive order and account updates by text. Reply STOP to opt out. Msg&data rates apply.”
Example dedicated web form for SMS account notifications, with consent granted by submitting the form
Example web form where SMS signup shares a form with other fields, using an explicit unchecked checkbox

​
Two-factor authentication

Opt-in checkbox label:
“Use my phone number to receive one-time verification codes”
Disclosure:
“We’ll send a verification code each time you sign in. Message frequency: one per login. Msg&data rates apply. Reply STOP to opt out.”
Example dedicated web form for phone verification codes
Note: For security-only OTP (where the user only receives verification codes, not marketing), some of these disclosures are less critical, but including them is still best practice.

​
Customer care

Opt-in at ticket submission:
“Text me updates about my support request”
Disclosure:
“You’ll receive updates about your support case by text. Frequency depends on case activity. Msg&data rates apply. Reply STOP to opt out.”

​
Platform vs direct customer templates

If you’re a SaaS platform registering on behalf of clients, the brand name in every message should be the client’s brand, not your platform’s brand. The opt-in checkbox label, disclosure text, and confirmation message should all name the client.
“I agree to receive text messages from Smith Realty”
— not —
“I agree to receive text messages from YourPlatform on behalf of Smith Realty”
Reviewers flag brand-in-disclosure mismatches. The message recipient should see one consistent brand name throughout: on the website where they opted in, in the SMS messages they receive, and in the registration you submitted.
Example platform-branded web form for account notifications, with 'Powered by PLATFORM' attribution
Example platform-branded web form with separate checkboxes for account notifications and marketing
Example platform-branded web form for customer care text messages
Example platform-branded web form for customer care with an additional marketing checkbox

​
Privacy policy requirements

Your privacy policy should ideally state that you collect phone numbers for SMS communication and describe how you use them. The first section should not imply that agreeing to the policy constitutes SMS consent — that’s a common rejection cause. The main thing the carriers look for in the privacy policy is making sure that SMS consent won’t be shared with third parties for things like lead generation and affiliate marketing. Whenever any data will be shared with third parties, we recommend adding the following line to the privacy policy to guarantee this: “All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.” Minimum language to include in your privacy policy:
“We collect your phone number to send you [describe use cases]. You may opt out at any time by replying STOP to any text message from us.”

​
Sample privacy policy template

This is the SMS consent privacy policy template Surge provides to customers as a starting point. Customize it to fit your needs and make sure it accurately reflects your business practices. You can also have it live as a separate “SMS Privacy Policy” that links from your primary policy, so the SMS-specific language is easy for reviewers to find.