SMS is the most intrusive channel a store has. It arrives on the same screen as messages from family, it is read within minutes, and there is no promotions tab to file it in. That is exactly why it works, and exactly why the rules around it are stricter than for email.
Most stores treat consent as a compliance step to get past. It is more useful to treat it as the thing that determines whether the channel works. A number given deliberately, by someone who understood what they were agreeing to, produces a subscriber who reads the messages. A number swept up in a checkout field or imported from an old spreadsheet produces complaints, opt outs and carrier problems that damage delivery for everyone on the list.
So the standard we would apply is simple. For every number on your list, you should be able to show what the person was told, when they agreed, and where. If you cannot, the number should not be there.
Consent is a record, not a checkbox
The tick box is the interface. The consent is the record behind it, and the record needs several fields to be worth anything.
What was shown. The exact wording next to the box or the keyword, including what the person was agreeing to receive and how often.
When. A timestamp, not a month.
Where. The specific form, page or keyword campaign, so you can trace a batch of numbers back to how they were collected.
What kind of consent. Marketing messages are a different thing from transactional ones about an order, and consenting to one is not consenting to the other.
And any confirmation, such as the reply that confirmed the subscription.
Good platforms store all of this if you set them up to. The failure is usually not the technology, it is a form built quickly for a launch that captures the number without capturing the context. When someone later asks how a number was obtained, and eventually someone does, a stored record is the difference between a two minute answer and a problem.
Treat consent as a record you could show someone, not a box someone ticked.
Keep it separate from email and from the order
Bundling is where most stores go wrong, usually without meaning to.
A single tick box that signs someone up for email and SMS together is not consent for both, because the person cannot agree to one and decline the other. Separate boxes, separately labelled.
A phone number collected for delivery notifications is not a marketing list. The customer gave it so their parcel could arrive. Using it to send a promotion is a different purpose than the one they agreed to, and it produces the complaints you would expect.
Consent should also never be a condition of purchase. If someone cannot complete an order without agreeing to marketing messages, the agreement is not freely given, and it will show in how those subscribers behave.
The same applies to competitions and giveaways. Entering should not require accepting marketing unless that is stated plainly and the person can choose.
The practical version: every place a phone number enters your systems should have a clear, single purpose, and the marketing opt in should be a distinct, unticked choice with its own wording.
What the sign-up point has to say
The wording next to the opt in is doing legal work and expectation setting at once, so it is worth writing carefully rather than copying from a template.
It should identify who is sending. Your store name, as the customer knows it.
It should say what will be sent. Marketing messages, offers, restock alerts, whatever it actually is.
It should say roughly how often. A vague promise leads to an opt out at the third message.
It should note that message and data rates may apply, and that consent is not a condition of purchase.
It should explain how to stop and how to get help, in the standard way people expect.
And it should link to the terms and the privacy policy, which should genuinely describe what you do with the number.
All of that fits in a short paragraph. Its presence is the difference between a subscriber who knows what they signed up for and one who feels ambushed by the first message. It also gives you the record described above, since the wording shown is part of what gets stored.
Confirming the number is worth the shrinkage
Asking a new subscriber to reply to confirm reduces the list, and it improves nearly everything else.
It removes mistyped numbers, which would otherwise message a stranger. It removes numbers entered to get past a form. It creates a clear, timestamped confirmation attached to the record. And it starts the relationship with an interaction, which is a better beginning than a promotion arriving unannounced.
The shrinkage is real and it is concentrated in the subscribers who were never going to engage, which is the group that produces opt outs and complaints. Those two numbers matter more in SMS than in email, because carriers and platforms respond to them and the response affects whether your messages are delivered at all.
There is a second reason to prefer a smaller, confirmed list. SMS costs money per message. A list padded with numbers that never respond is a recurring cost with no return, and unlike email, the waste is visible on an invoice.
So the question is not how large the list is. It is how many people on it want the messages, and confirmation is the cheapest way to find out.
Honour stop instantly, and keep the trail
Opting out has to be immediate, complete and effortless, and this is not only a legal position, it is basic respect for someone who told you to stop.
That means the standard stop keywords work, in the language your customers use, and the removal takes effect at once rather than at the next sync. It means the removal applies across every flow and campaign, not just the one they replied to. And it means an opt out is honoured even when the number was later re imported from another source, which is a common way stores end up messaging someone who left months ago.
Keep the record of the opt out with the same care as the record of the opt in. Date, channel, and what was suppressed.
Also watch for the quiet version of an opt out, which is silence. Someone who has not opened, clicked or bought across many sends is telling you something even if they never replied. Suppressing them protects the health of the rest of the list and stops you paying to be ignored.
What good consent does to the numbers, and who should check your wording
The commercial argument for doing this properly is straightforward. Lists built from deliberate, confirmed consent produce higher engagement, fewer opt outs, fewer complaints and better delivery. Since delivery problems affect every message you send, the health of the list is upstream of every campaign result.
It also changes what you can send. Subscribers who chose to be there tolerate useful messages that are not offers: a restock, a shipping update they asked for, a reminder before a consumable runs out. That is where the durable revenue in SMS sits, rather than in another discount broadcast.
One caution to finish on. The rules governing this differ by country and by state or province, they cover things like timing, identification and record keeping, and they change. This piece describes the practice we would follow, not legal advice.
So have your wording and your process reviewed by someone qualified in the markets you message, and keep the records that would let you answer a question about any number on your list. That is a small ongoing discipline, and it protects a channel that is difficult to rebuild once it has been damaged.