What is the single most important field in a consent record?

The notice version is the one most often missing and most often decisive. Without it, you can show a choice was recorded but not what wording, purposes, or vendors the choice referred to, which weakens the record badly in a dispute.

How long should consent records be retained?

Tie the period to the relationship length plus the applicable limitation period for claims in your markets, write it into a retention schedule, and apply deletion across every copy, including warehouse exports and backups, when the period ends.

Does a consent banner log prove tags behaved?

No. The log proves the choice as recorded. Proving behaviour needs a production check that tags fired or stayed silent according to that state. Keep evidence of both, and repeat the behaviour check after tag manager changes.

Should rejected consent be stored with the same care as accepted?

Yes. A recorded refusal, with timestamp and version, is what stops a team from re prompting aggressively or accidentally enabling a purpose later. It also demonstrates that refusal was honoured, which regulators treat as part of valid consent design.

Consent for SMS Signup Flows: The Banner Is Not the Whole Record

October 30, 2026

SMS consent is collected in popups, checkout checkboxes, and keyword texts, often by different tools. What a defensible record needs beyond a ticked box.

Text marketing consent lives in more places than the cookie banner team looks. A popup offers ten percent off for a phone number, checkout adds a pre formatted checkbox, a keyword on a postcard invites people to text in. Each tool collects its own version of consent, writes it to its own list, and the store ends up with three partial records and no single account of who agreed to what, in which words.

In the United States, marketing texts sit under the TCPA, which turns on prior express written consent for automated marketing messages. The practical question in any dispute is evidentiary: can you produce the disclosure the person saw and the moment they agreed to it?

The disclosure at the point of collection

Consent has to attach to words. The signup point should state, in text that is actually readable, that the person is agreeing to automated marketing texts, how often they can expect them, that consent is not a condition of buying, and how to stop. If the popup says join the list and the terms live in a linked page nobody opened, your record is weaker than the form suggests.

Watch the design tricks. A phone field that doubles as both order updates and marketing signup, without separating the two, collects ambiguity, not consent. Transactional messages about a delivery and promotional messages are different permissions, and conflating them in one unticked or, worse, pre ticked box is how lists get built that cannot be defended.

One record, wherever it was collected

Consolidate. Whatever tool collects the number, the record that matters has the same fields: the number, the timestamp, the source, the exact disclosure version shown, and the confirmation, ideally the double opt in reply where you use one. Version the disclosure text. When the wording changes in a redesign, the old records still point at the old words, and you can prove what each person actually agreed to.

Honour stops globally and fast. A stop reply to any tool must suppress the number everywhere, including the flow that collected it at checkout six months ago. Suppression that depends on syncing lists by hand is suppression that will eventually fail in public.

Audit the entry points quarterly

List every place a phone number can enter your marketing system, including the ones marketing did not build: checkout, post purchase offers, in store signage keywords, giveaways run by partners. For each, capture the disclosure as a screenshot with a date, test the stop path with your own number, and check the record that lands in the system.

Entry points appear constantly and quietly. The audit is boring, quarterly, and the only way the consent record stays a record instead of an assumption.

Frequently asked questions

What consent do marketing texts require in the US?

Automated marketing texts generally require prior express written consent under the TCPA: a clear disclosure, agreed to by the person, stating they will receive automated marketing messages and that consent is not a condition of purchase.

Is a checkout checkbox enough for SMS marketing consent?

Only if the checkbox carries clear marketing disclosure and is a genuine, separate agreement, not a pre ticked box that mixes order updates with marketing. The record must show the words and the timestamp.

What should a consent record contain?

The phone number, timestamp, collection source, the exact disclosure version shown, and the confirmation step where used. Consolidated in one system regardless of which tool collected it.

How quickly must a stop be honoured?

Promptly and everywhere. A stop to any entry point must suppress the number across all flows and tools, and the suppression path itself should be tested regularly.