Understanding the compliance landscape
Navigating SMS regulations can feel overwhelming at first, but it centers on one goal: protecting consumers from unwanted messages.
The regulatory framework
Three main bodies oversee your messaging in the United States:
The TCPA (Telephone Consumer Protection Act): Federal law that sets the foundation for consent. It protects consumers from unwanted messages and establishes strict penalties for businesses that text without permission. Violations cost $500 to $1,500 per text message.
The CTIA (Cellular Telecommunications Industry Association): Industry body that sets guidelines for message content and business practices. Carriers follow these standards when deciding whether to deliver your texts.
Mobile Carriers: Networks like Verizon and AT&T have their own requirements to prevent spam. They require business verification through 10DLC registration to ensure your messages reach customers.
Why this matters for retail stores
Capital One paid $75 million in a TCPA settlement in 2014. Papa John's paid $16.5 million in 2016. Even small stores face class-action lawsuits if they skip these steps.
Send a promotional text to 1,000 people without proper consent and you're looking at $500,000 to $1,500,000 in potential fines.
The good news: These rules are straightforward. Once you set up compliant opt-in methods, everything runs smoothly. Text-Em-All handles opt-outs automatically, tracks consent, and keeps you protected.
The three pillars of compliance
1. Explicit consent is mandatory
Simply having a customer's phone number in your POS system or loyalty database does not give you legal permission to text them. You must have a clear record of them specifically saying "yes" to SMS marketing.
Email consent doesn't count. Customers who signed up for your email list haven't given you permission to text them. You need separate, written consent specifically for text messages.
2. Clear identification and disclosures
Every message must clearly state who is sending it. Your opt-in form must include:
- They'll receive text messages from [Your Store Name]
- How often you'll text them (2-3 times per week, for example)
- "Message and data rates may apply"
- "Reply STOP to opt out"
3. The right to opt out
You must provide a clear, easy way for customers to stop receiving messages at any time. When someone texts STOP, they're off your list. Process it immediately. You have 10 business days maximum, but sooner is better.
Understanding consent types
Prior Express Consent (PEC)
- Required for: Informational messages only (order confirmations, delivery updates)
- How to get it: Customer provides their phone number during a transaction
- Example: Customer places an online order and enters their phone number
Prior Express Written Consent (PEWC)
- Required for: All marketing and promotional messages
- How to get it: Customer signs a form or checks a box agreeing to receive marketing texts
- Example: Customer fills out a signup form that clearly states they'll receive promotional texts
For retail stores running promotions (weekend sales, flash deals, new product alerts), you need PEWC. This guide focuses on getting PEWC the right way.
Additional requirements you must follow
Sending hour restrictions: You can only send marketing texts between 8 AM and 9 PM in the recipient's local time zone. If you're in California and your customer is in New York, send based on New York time. Text-Em-All handles this automatically.
Opt-out processing: As of April 2025, you must honor opt-out requests made through "any reasonable means." This includes variations like "stop texts," "no more," "remove me," or even phone calls and emails requesting removal. Not just the keyword STOP.
National Do Not Call Registry: While primarily for voice calls, some states apply DNC protections to text messages. Text-Em-All helps you manage this compliance.
7 approved opt-in methods for retail stores
Pick the methods that fit your operation. You can use multiple approaches at once.
Method 1: POS verbal consent scripts
Your cashier asks customers at checkout if they'd like to receive text alerts for weekly specials. If the customer says yes, the cashier enters their phone number into your POS system with proper consent logging.
Required elements:
- Verbal script that includes all disclosure elements
- POS system that logs consent (date, time, phone number, confirmation that disclosures were made)
- Training for all checkout staff
Script example:
"Would you like to receive our weekly specials texted to your phone? We send about 2-3 messages per week with the best deals. Standard message rates apply, and you can text STOP anytime to opt out."
ECRS Catapult note: We're confirming whether automated POS opt-ins will be supported at launch. Check with your Text-Em-All rep for the latest on this integration feature.
Why this works: Customers are already interacting with your staff, making it a natural conversation. High conversion rates when staff are trained well.
Potential pitfall: If your POS doesn't properly log consent with all required elements, you're not compliant. Make sure your system records everything.
Method 2: In-store signage with keyword campaigns
Post signs throughout your store inviting customers to text a keyword to your Text-Em-All number.
Example sign:
Get our weekend specials texted to you every Thursday
Text DEALS to 555-0100
2-3 messages per week. Message and data rates may apply. Reply STOP to opt out.
Where to place signs:
- Near checkout lanes (eye level while waiting)
- On shopping carts (small waterproof stickers)
- In produce section (where people spend time)
- Deli counter (while waiting for orders)
- Customer service desk
Required elements on every sign:
- Keyword to text
- Phone number or short code
- Message frequency
- "Message and data rates may apply"
- "Reply STOP to opt out"
Why this works: When customers text your keyword, they're giving written consent automatically. The system captures their number and sends a confirmation. You're compliant without touching any paperwork.
Design tip: Include a QR code option. Generate free QR codes from our QR code generator.
Method 3: Receipt messages
Add an opt-in prompt to your printed or digital receipts.
Example:
"Never miss a deal! Text SAVE to 555-0100 for exclusive offers sent right to your phone. Standard message rates apply."
Important: The receipt message itself isn't consent. Customers must text the keyword to opt in. Don't assume consent just because they have the receipt.
Why this works: Every customer gets a receipt, so every transaction is a chance to promote your text list. Low pressure, high visibility.
Method 4: Website and app opt-in forms
Add a text opt-in form to your website or mobile app.
Required form elements:
- Phone number field (with validation)
- Unchecked checkbox (cannot be pre-checked)
- Clear disclosure: "I agree to receive promotional texts from [Store Name]. Frequency varies. Message and data rates may apply. Reply STOP to opt out."
- Link to your full terms and conditions
- Submit button
Best practices:
- Place the form on your homepage, contact page, and checkout flow
- Offer an incentive ("$10 off your next visit when you sign up")
- Keep the form simple
- Send immediate confirmation text after signup
- Test the form on mobile devices
Technical integration: If you're using the ECRS Catapult integration, Text-Em-All can auto-sync web form signups with your POS system.
Method 5: Paper sign-up sheets
Put a simple sign-up sheet at your checkout counter or customer service desk.
What the form must include:
- Customer's full name
- Mobile phone number (clearly marked)
- Checkbox they must physically check
- Clear statement: "By providing my mobile number and checking this box, I agree to receive promotional text messages from [Store Name]. Messages sent 2-3 times per week. Message and data rates may apply. Reply STOP to opt out."
- Date
- Customer signature
How to digitize: Enter phone numbers into Text-Em-All within 24 hours. Store the original forms for at least 4 years in a secure location.
Training tip: Train cashiers to mention it casually: "We text our best deals. Want to sign up for weekend specials?" Don't pressure anyone.
Why this works: Paper forms provide the clearest documentation of consent. If anyone questions your compliance, you have physical signatures.
Method 6: Social media campaigns
Run campaigns on Facebook, Instagram, or other platforms directing people to text a keyword.
Example post:
"Our followers get first access to weekend deals! Text FRESH to 555-0100 to join our VIP list. Standard rates apply."
Requirements for organic posts:
- Include the keyword and phone number
- State message frequency
- Note that standard rates apply
Requirements for paid ads:
- All of the above, plus
- Link to full terms and conditions
- Compliance with platform advertising policies
Best practice: Use this to promote specific campaigns (holiday deals, grand reopening) rather than generic signups.
Method 7: Loyalty program integration
Add text opt-in to your existing loyalty program signup process.
Implementation:
- When customers sign up for your loyalty card, include a separate opt-in for text messages
- Make it optional (can't be required to get loyalty benefits)
- Use clear consent language
- Track opt-ins separately from loyalty signups
- Consider offering bonus points for text opt-in
Form language example:
"☐ Yes, text me exclusive member deals (2-3x per week, reply STOP to opt out, standard rates apply)"
ECRS Catapult integration: Once the integration is live, loyalty program members who opt in for texts will sync automatically between systems.
Why this works: Loyalty customers are your most engaged shoppers. They're already sharing information with you, so adding texts is a natural next step.
Compliance note: Keep loyalty signups and text opt-ins as two separate actions. Don't make text opt-in mandatory to get loyalty benefits.
What NOT to do - common violations to avoid
These mistakes cause TCPA violations. Avoid them completely.
Never buy or rent phone lists
Purchased lists don't come with proper consent. Every number on those lists is a potential $500-$1,500 violation.
The vendor might claim "the numbers are opt-in" or "these people agreed to receive offers." That consent wasn't for your store specifically.
Build your own list from scratch using the approved methods in this guide.
Never assume email consent equals text consent
Just because someone signed up for your emails doesn't mean you can text them. You need separate, explicit permission for SMS.
This is the most common mistake retail stores make. Email and SMS are different channels with different regulations. Treat them separately.
Never pre-check the opt-in box
On web forms, the checkbox for text opt-in must start unchecked. Pre-checked boxes don't count as consent under TCPA.
The customer must take an affirmative action to opt in. That means actively checking a box, not unchecking a pre-selected option.
Never add people based on verbal consent only
Verbal consent at checkout doesn't work by itself. You need written documentation.
If someone says "sure, text me deals," you need to either:
- Get them to fill out a paper form
- Have them text your keyword
- Enter them in your POS with proper consent logging that includes all required disclosures
A cashier's memory of a conversation isn't documentation.
Never continue texting after someone opts out
When someone texts STOP, they're done. Don't text them again to confirm. Don't text them "one last offer." Don't text them to ask why they left.
Just remove them immediately and send the confirmation message: "You have been unsubscribed from [Store Name]. You will not receive future texts."
Text-Em-All handles this automatically.
Never send texts outside 8 AM to 9 PM local time
This applies to every timezone your customers are in, not just yours.
A 10 PM text to an East Coast customer violates TCPA even if it's only 7 PM in your California store.
Never hide the opt-out instructions
Every marketing text must include clear opt-out language.
"Reply STOP to opt out" works. Hiding it or making it complicated doesn't.
Never require a purchase to opt in
Text opt-ins must be free and optional. You can't say "buy something to get on our text list."
You can say "text subscribers get exclusive deals." That's an incentive, not a requirement.
Never transfer consent between businesses
If you acquire another store or merge with a competitor, you can't automatically text their customers. New business = new consent required.
The consent they gave to the previous owner doesn't transfer to you.
This also applies if you:
- Rebrand your store
- Change ownership
- Split into separate locations
State-specific requirements
Fifteen states have additional text messaging laws beyond federal TCPA requirements. If you operate in these states, pay attention to the extra rules.
Bottom line: If you follow federal TCPA rules and the opt-in methods in this guide, you'll be compliant in all states. The state laws mostly reinforce what TCPA already requires.
States with additional SMS marketing laws
- California
-
- Must have express written consent
- Must honor state DNC registry
- Business name and contact info required in first message
- CCPA privacy requirements apply
- Connecticut
-
- Express written consent required
- Must maintain do-not-call list for 5 years
- Florida
-
- Express written consent required
- May require telemarketer registration
- New York
-
- Express consent required
- Cannot send between 8 PM and 8 AM (more restrictive than federal 9 PM rule)
- Washington
-
- Express consent required
- Must provide opt-out in every message
- Heavy penalties for violations
- Other states with requirements
-
Arizona, Colorado, Indiana, New Jersey, North Dakota, Oklahoma, Rhode Island, Texas, Utah, Virginia, Wisconsin
All require express consent and clear opt-out mechanisms.
Pro tip for multi-state operations
Follow the most restrictive rules across all states:
- Get written consent (covers all states)
- Include business name in your first message
- Make opt-out easy and honor it immediately
- Send only between 8 AM and 8 PM (9 PM in most states, but 8 PM in New York)
Text-Em-All's platform handles the technical compliance automatically.
Opt-out handling and record-keeping requirements
How to handle opt-outs correctly
When someone wants to stop receiving your texts, you must honor it immediately. As of April 2025, you must honor opt-out requests made through "any reasonable means."
Accepted opt-out methods
Standard keyword opt-outs:
- STOP
- UNSUBSCRIBE
- CANCEL
- END
- QUIT
Reasonable variations (required as of April 2025):
- "Stop texts"
- "No more"
- "Remove me"
- "Unsubscribe me"
- "Take me off this list"
The key: If a customer's intent is clear, you must honor it even if they don't use the exact keyword.
Other opt-out channels you must accept:
- Phone call to your business
- Email request to your business email
- In-person request at your store
- Reply to any marketing text
What you must do
- Process the opt-out within 10 business days maximum (immediately is better)
- Stop sending them texts
- Keep a record of the opt-out request
- Send a confirmation: "You have been unsubscribed from [Store Name]. You will not receive future texts."
What you cannot do
- Ask them to confirm the opt-out
- Try to convince them to stay subscribed
- Send them to a website to unsubscribe
- Add them to a different list
- Text them again for any reason (except the one-time confirmation)
Text-Em-All handles this automatically
Our platform:
- Processes STOP requests instantly
- Recognizes variations and reasonable opt-out language
- Maintains your opt-out list permanently
- Sends compliant confirmation messages
- Logs all opt-out requests with timestamps
- Prevents you from accidentally texting opted-out numbers
Record-keeping requirements
Keep these records for at least 4 years (some lawyers recommend 7 years):
Consent records:
- Who opted in (name and phone number)
- When they opted in (date and time)
- How they opted in (paper form, keyword text, web form, POS)
- Copy of the consent language they saw
- Any paper forms they signed
Opt-out records:
- Who opted out
- When they opted out
- How they opted out (STOP text, phone call, email, in-person)
- When you processed the request
- Confirmation that you sent them the unsubscribe message
Message records:
- What messages you sent
- When you sent them
- Who received them
- Delivery confirmations
Why record-keeping matters
If someone files a TCPA complaint or lawsuit, your records are your defense. You need to prove:
- You had proper consent to text them
- You honored their opt-out request promptly
- You followed all disclosure requirements
Without records, you have no defense.
Text-Em-All stores all of this automatically
You can export reports anytime showing:
- Complete consent history for any number
- Opt-out request logs
- Message delivery reports
- Subscriber list snapshots from any date
If you need to show compliance during an audit or legal proceeding, all your documentation is ready.
Your compliance checklist
Use this checklist before launching your text program and quarterly thereafter.
Before collecting any numbers
- ☐ Choose your opt-in methods from the 7 approved options
- ☐ Create consent forms with all required disclosures
- ☐ Set up your Text-Em-All account and keyword campaigns
- ☐ Train staff on how to explain the program to customers
- ☐ Generate QR codes for in-store signage
- ☐ Write your first 3-5 messages
- ☐ Decide on message frequency
Your consent language includes
- ☐ Your store name clearly stated
- ☐ Explicit agreement to receive promotional texts
- ☐ Message frequency (2-3 per week, for example)
- ☐ "Message and data rates may apply"
- ☐ "Reply STOP to opt out"
- ☐ Link to terms and conditions (for web forms)
- ☐ No pre-checked boxes on web forms
Before sending your first text
- ☐ All phone numbers have written consent on file
- ☐ Consent records are dated and stored securely
- ☐ Text-Em-All account is configured with your business name
- ☐ First message is scheduled between 8 AM-9 PM in recipient time zones
- ☐ Message includes clear opt-out instructions
- ☐ You've tested the opt-out process
Ongoing compliance practices
- ☐ Check for new opt-ins daily or weekly
- ☐ Process opt-outs immediately (Text-Em-All does this automatically)
- ☐ Avoid prohibited content (SHAFT: Sex, Hate, Alcohol, Firearms, Tobacco)
- ☐ Keep consent and opt-out records backed up
- ☐ Monitor campaigns for delivery issues
- ☐ Update team on any procedure changes
Monthly compliance review
- ☐ Review total subscriber count and growth rate
- ☐ Check opt-out rate (should be under 2-3% monthly)
- ☐ Review any customer complaints
- ☐ Confirm staff are following procedures
- ☐ Verify message frequency matches what you promised
Quarterly audit checklist
- ☐ Review current subscriber list for accuracy
- ☐ Verify subscribers have consent records on file (spot check 20-30)
- ☐ Confirm opt-out process is working correctly
- ☐ Test sending during allowed hours
- ☐ Review any delivery issues or blocked numbers
- ☐ Update staff training if procedures changed
- ☐ Check for TCPA law updates
- ☐ Export and archive reports from Text-Em-All
Red flags that indicate compliance problems
- Opt-out rate above 5% per campaign
- Multiple complaints about unwanted texts
- Low delivery rates (under 90%)
- Staff confusion about procedures
- Missing consent records
- Texts sending outside allowed hours
If you see any of these, stop sending and fix the problem before continuing.
Ready to start?
Once you've checked these boxes, you're prepared to launch a compliant text marketing program. Text-Em-All handles the technical compliance automatically so you can focus on growing your store.
Next steps
- Choose 2-3 opt-in methods to start
- Create your consent forms using the templates in this guide
- Set up your Text-Em-All account and keywords
- Train your team
- Start collecting opt-ins
- Send your first text within 24 hours of someone opting in
Need help?
Call 877-226-3080 or email support@text-em-all.com. Our team has helped thousands of retail stores launch successful, compliant text programs.
Free resources:
- QR code generator: text-em-all.com/sms-sign-up-form-qr-code-generator
- Sample consent forms: Available from your Text-Em-All rep
- ECRS Catapult integration documentation: Coming soon
A note on regulatory changes
TCPA regulations have been in flux recently, with proposed rule changes being delayed, modified, or struck down by courts. The fundamentals in this guide remain stable: get written consent, be clear about what customers are signing up for, and honor opt-outs promptly. These core requirements haven't changed since 1991.
Text-Em-All stays current on regulatory developments and updates our platform to maintain compliance automatically. You focus on building your list, we handle the technical compliance.