SMS consent audit trail: the receipts that keep a text program legal
A text program without a consent trail is a lawsuit waiting for a plaintiff. The audit trail is the proof, and it has to exist before the dispute, not after it.
TCPA consent is not a feeling, it is a record. Prior express written consent, under 47 USC 227 and 47 CFR 64.1200, means a signed agreement that says what the customer agreed to receive. When a plaintiff's lawyer asks for proof, the answer is a timestamped record: when, where, how, and what version of the disclosure. If that record does not exist, the consent does not exist either.
What the record has to contain
A consent record is seven fields, and all seven matter. The timestamp, when the customer agreed. The IP address, where the agreement came from. The URL, the exact page where it happened. The disclosure version, because the words the customer saw are the words that bind you. The capture method, checkbox or form or keyword. The double opt-in time, if you run one. And the revocation time, if the customer later opted out.
Missing any one of these weakens the record. Missing the disclosure version is the worst gap, because the plaintiff's argument is that the customer never saw the disclosure at all, and without the version you cannot prove which words were on the page.
How long to keep it
Four years, at minimum, because the TCPA limitation period is four years. A record kept for three years and deleted is a record that does not exist when the lawsuit arrives in year four. Most programs keep consent records for the life of the number plus four years, because the cost of storage is nothing next to the cost of a missing record.
The same rule applies to revocations. A customer who opted out in 2023 and was texted in 2026 has a claim, and the defense is the revocation record. Keep that too, for the same four years.
The lead-generator trap
The FCC closed the lead-generator loophole in order 23-107, and the change matters for any brand that buys leads. Consent now has to be one-to-one: the customer agrees to be contacted by a specific seller, not by a category of sellers, and not by anyone the lead generator sells the number to. A lead that arrives with a generic consent is a lead you cannot text.
Check the consent that comes with every lead before the first message. If the lead generator cannot produce the one-to-one record, the lead is a liability, not an opportunity.
What to do when the trail has a gap
Stop texting the numbers with gaps, and rebuild consent before you text them again. A re-permission campaign is cheaper than a lawsuit, and it is the only honest fix. Document the gap, document the fix, and keep both records with the consent file. A regulator or a court will ask what you did when you found the problem, and the answer should be in writing.
Then fix the capture. If the gap came from a form that never stored the disclosure version, fix the form. If it came from a vendor that never sent the IP, fix the vendor. A gap that repeats is not a gap. It is a system.
Keep reading
Related guides on this site: the unsubscribe page that offers a downgrade first how zero-party data goes stale a playbook for collecting zero-party data More from Preference driven product discovery.
Frequently asked questions
What counts as prior express written consent?
A signed agreement, in writing, where the customer agrees to receive marketing texts at a specific number. The agreement must say what they agreed to receive, and the business must be able to produce it. A verbal yes, or a number collected without a disclosure, does not qualify.
How long must I keep consent records?
At least four years, because the TCPA limitation period is four years. A record deleted after three years is a record that does not exist when the lawsuit arrives in year four. Keep the full record: timestamp, IP, URL, disclosure version, capture method, double opt-in time, and revocation time.
Does a checkbox count as written consent?
It can, if the checkbox sits beside a clear disclosure and the customer checks it knowingly. A pre-checked box does not count. A checkbox buried in terms the customer never saw does not count. The test is whether the customer understood what they agreed to.
What happens if I cannot prove consent for one number?
Stop texting that number immediately, and rebuild consent before you text it again. One number without proof is a small problem. A list of numbers without proof is a class action, and the statutory damages run per message with no aggregate cap.