Consent Architecture for 10DLC, TCPA and EU Opt-In

A consent record is six fields: Timestamp with timezone. The exact wording the person saw at capture, stored as versioned text rather than a link to a page that will change. The channels that consent covers, named individually. The capture surface. The IP or device identifier. And the complete revocation history, not the current state. Most stacks we inherit store a boolean and a date, which tells a regulator or a plaintiff's counsel nothing and cannot be defended. Rebuilding that record across an existing database is the largest part of this work and the reason it takes weeks rather than days. United States, 10DLC and TCPA: Brand registration through the Campaign Registry with an EIN matching the legal entity exactly, campaign vetting per use case, and throughput set by your brand vetting score rather than your budget: T-Mobile applies daily brand tiers, AT&T a per-campaign message-per-second limit. The revocation rule in force since 11 April 2025 requires opt-outs honoured within ten business days, by any reasonable means the consumer chooses, and treats one opt-out as covering your marketing messages unless the consumer narrows it. The one-to-one lead consent rule was vacated in January 2025, which changed the regulation and not the litigation exposure, and the Florida, Oklahoma and Maryland statutes are untouched by it. Europe and the Nordics: Prior consent under ePrivacy, with the soft opt-in read narrowly: existing customer, your own similar goods, and an opt-out in every single message. Swedish marketing law adds its own requirements for individuals. German recipients expect a logged double opt-in confirmation, so a Nordic file with German contacts needs two capture paths and two evidence formats rather than one compromise. Meta's opt-in requirement for WhatsApp sits on top of all of it and is audited separately, by Meta, on its own schedule. Regulated inbound: A conversational channel run for a pharma or medtech client is an adverse event intake surface whether it was designed as one or not. Anything inbound describing a suspected reaction has to reach pharmacovigilance and be reportable inside the expedited window, fifteen days for serious cases under EU good pharmacovigilance practice. So we build keyword and classifier routing into a monitored queue with a named owner and a response clock, no auto-close, no bot resolution, and a recall test with seeded messages to prove the routing still works after someone edits a flow. What you receive: The consent schema and its migration, channel-aware suppression that a single opt-out propagates across correctly, opt-out keyword handling per channel and per language, an evidence export that produces the full record for one contact on request, and the registration work itself. Working plumbing, not a policy document. Boundaries: We are not your counsel and nothing here is legal advice; we work alongside yours and expect them to sign. We do not write your privacy policy. We will not register a brand under an EIN that does not match the entity, and we will not build a single unlabelled checkbox covering email and SMS together, which is the most common request we turn down. Not the right buyer: Anyone who wants a document to show a board rather than changes to a database. Anyone unwilling to suppress the portion of their file that has no defensible record, which in the audits we run averages between a tenth and a third of contacts and is always the conversation that decides whether the engagement continues.