Opt-In Beats Opt-Out: Designing Consent That Actually Protects You

Most businesses treat messaging consent as a legal checkbox: get something on record, keep it somewhere, hope it never gets tested.

That framing gets the incentive wrong. Consent is not only what protects you in a dispute — it is the single strongest predictor of whether your messages keep arriving at all. The same practice that satisfies the TCPA is the practice that keeps your number out of spam classifiers.

Design for deliverability and you get compliance as a side effect. The reverse is not true.

The two kinds of consent

Express written consent — the person affirmatively agreed to receive messages, and you can show what they agreed to and when. Required for marketing.

Implied consent — they gave you their number in a transactional context and a message is a reasonable consequence. Covers order updates, appointment confirmations, delivery notifications. Does not cover marketing.

The gap between them is where most trouble lives. A number collected for a delivery notification is not a marketing list, and treating it as one is both a TCPA exposure and a reliable way to earn spam reports from people who genuinely did not sign up.

Why the checkbox is the weakest form

A pre-ticked box, a phone field in a form with fine print underneath, consent buried in terms of service — these are technically defensible in some jurisdictions and practically worthless.

Not because they fail legally. Because the recipient does not remember agreeing. And the recipient's memory, not your database, determines whether they hit "Report Junk."

Consent that satisfies a lawyer but not a human protects you in a dispute you will only have after your number is already dead.

The strongest form of consent

The person texts you first.

There is no clearer record than an inbound message. They initiated, in their own words, from their own device, at a moment they chose. No checkbox, no fine print, no dispute about what they were shown.

And it produces the behaviour you want everywhere else:

• The complaint affordance is not sitting next to a conversation they started
• Your send-to-receive ratio is healthy by construction
• The recipient's spam classifier sees an existing thread, not an unknown sender
• Nothing you send afterwards resembles cold outreach, because it is not

This is why senderZ enforces it structurally rather than recommending it: an iMessage line only messages numbers that have messaged it first. Not as a compliance feature — as the thing that keeps the channel working.

Making inbound-first practical

The objection is obvious: you cannot make people text you.

You can make it easy and give them a reason, which turns out to be enough.

Put the ask where they already are. A QR on the receipt, the counter, the packaging, the vehicle. Physical placement converts best because the phone is already in their hand.

Give a reason with a benefit. "Text us to reschedule — no phone tag" beats "Sign up for updates," because it promises something faster than the alternative.

Use the transactional moment. Order confirmations and booking confirmations have high attention. That is where the link belongs.

Convert an existing list once, over SMS. If you already hold numbers, send a single SMS with the link and a reason. One round of SMS to convert a list is a completely different proposition from sending cold SMS forever.

What still has to be handled

Inbound-first removes most of the risk. It does not remove the obligations.

STOP must always work. Immediately, on every keyword variant — STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT — regardless of how consent was obtained. Someone who texted you first can still opt out, and it must be honoured instantly.

Quiet hours still apply to marketing. 8pm to 8am local time, based on the recipient's timezone, not yours.

Keep the consent record anyway. The inbound message is the strongest evidence you can have, but log timestamps and context regardless. Free to keep, expensive to lack.

Scope matters on shared numbers. If several businesses share a sending number, an opt-out should apply line-wide, not just to the account that triggered the send. A recipient who said stop meant stop, and does not care about your account boundaries.

The stricter reading is usually the cheaper one

When it is genuinely ambiguous whether consent covers a message, the stricter reading is almost always the better business decision.

The cost of not sending an ambiguous message is one message. The cost of sending it is a report, and reports compound into filtering, and filtering ends with a number that no longer reaches anyone.

There is no volume of marketing that pays for losing the channel.