Consent Architecture for SMS and Email: TCPA and 10DLC

Ask us for the consent record of one named recipient and you should have it inside an hour: the timestamp, the source URL, a rendered snapshot of the disclosure exactly as that person saw it, the IP address, and the campaign it was collected for. Most SMS programmes we inherit can produce a boolean. A boolean is worth nothing against a claim carrying 500 dollars per message, and 1,500 where a court finds the violation willful, with no requirement on the plaintiff to show harm. We set the standard at the strictest jurisdiction you send into rather than the federal floor. The Eleventh Circuit vacated the FCC one-to-one consent rule in January 2025, which returned federal lead-generation consent to roughly where it had been; Florida, Oklahoma, Washington and Maryland did not move. If one number in your file sits in one of those states, the whole file is built to that state, because segmenting a consent standard by geography is how the exception becomes the send. What gets rebuilt: The capture surface first, because nothing downstream repairs a bad checkbox. Marketing consent is separated from terms acceptance, one control per purpose, neither pre-ticked. The SMS disclosure carries programme name, message frequency, the message-and-data-rates line, the STOP instruction and the HELP instruction, in text the person reads before submitting rather than behind a link. We snapshot the rendered disclosure at every material change and version it, so consent obtained in March is defended with March's wording instead of today's. The 10DLC filing: Brand registration with The Campaign Registry, external vetting, and campaign use cases registered for what you actually send rather than the widest option on the form. Filing as mixed to keep options open costs you at review and hands a carrier a reason to compare filed content against live content later. Throughput follows from the outcome: T-Mobile meters daily volume at brand level by trust tier, AT&T meters per campaign per minute, and a launch calendar written without both numbers will queue behind itself on your largest day. We do that arithmetic before you commit to a date. Revocation is one spine, not two: Opt-out is stored against the person, not the channel. An email unsubscribe suppresses SMS marketing to the same person and the reverse. Shops keep the two separate because it preserves volume; it also produces the complaint that costs you the sending domain. Since the FCC revocation rules took effect in April 2025, a request in any reasonable form counts, so free-text replies route to a queue a human clears rather than a keyword matcher. STOP, QUIT, END, CANCEL, UNSUBSCRIBE and REVOKE all resolve to the same suppression, and our target is 24 hours against a ten-business-day legal limit. Where your sector changes the build: In pharma and medtech, inbound replies are screened for adverse-event language and routed to pharmacovigilance intake the same business day, with the reply channel treated as reportable rather than as a marketing asset. In recruiting, an applicant has not consented to marketing, and those databases are split physically rather than by flag. In marketplaces, the transactional-versus-commercial test is applied template by template, because one promotional line inside a listing alert converts it into a commercial message carrying every obligation attached to one. Not included: Legal advice or sign-off; your counsel reviews what we build and we expect them to. Privacy policy drafting. Litigation support or expert testimony. Carrier appeals for a brand already suspended over content violations, which is a remediation job with a different owner and we will say so rather than take it. Who should not buy this: Anyone who wants the registration filed and the acquisition funnel left untouched. If the answer to where the numbers came from is a vendor feed nobody can audit, the filing is the smallest of your problems, and we would rather decline than certify a brand we cannot evidence.