SMS consent records: what to keep, and for how long
What a defensible text marketing consent record contains, how long to retain it, how to handle opt-outs and re-subscribes, and what auditors and plaintiffs actually ask for.
·5 min read
Consent is only worth what you can prove. In any dispute — a complaint, an audit, a demand letter — the question is not whether someone agreed, but whether you can show it.
This is a general overview rather than legal advice, but the shape of a good record is consistent across most situations.
What a record should contain
Enough to reconstruct the moment of consent without relying on anyone's memory. That means the number, the timestamp, the method, and critically the exact disclosure language the person saw at the time.
That last element is the one most often missing. Disclosure wording changes over the years, and a record that says only opted in via website is nearly worthless if you cannot show what the website said that day.
- ✓Phone number and the timestamp of consent
- ✓Method: web form, keyword, QR, in person, checkout
- ✓The exact disclosure text displayed at that time, versioned
- ✓Where it happened — URL, location or event
- ✓IP address or inbound message record, depending on method
- ✓Every subsequent opt-out, and any later re-subscribe
Retention and opt-outs
Keep consent records well beyond the life of the subscription. Claims can arrive long after someone stopped hearing from you, and deleting the record when they unsubscribe removes exactly the evidence you would need.
Keep opt-out records permanently, and suppress across every list and system rather than just the one they replied to. Opting out of one programme and then receiving another from the same business is a common and entirely avoidable complaint.
Vendors and inherited lists
If a lead vendor supplies numbers, require that they can produce the consent record for each one, and keep a copy yourself. A vendor's assurance is not evidence, and if they disappear so does your defence.
Treat any list you cannot document as unusable. The economics of a purchased list never survive a single serious complaint.
Key takeaways
- →Record the exact disclosure wording, versioned — not just that consent happened.
- →Retain consent records well past the end of the subscription.
- →Keep opt-outs permanently and suppress across every list.
- →Get and keep vendor consent records yourself; assurances are not evidence.
Put this into practice with Text2Sale
Upload your leads, automate fast first-touch texts and follow-ups, stay 10DLC and TCPA compliant, and manage every conversation in one inbox.
Frequently asked questions
What should an SMS consent record include?
The number, timestamp, opt-in method, where it happened, and the exact disclosure wording shown at that moment. The disclosure text is the element most often missing and the one that matters most, since wording changes over time.
How long should you keep SMS consent records?
Well beyond the life of the subscription, because claims can arrive long after contact stopped. Deleting the record when someone unsubscribes removes the evidence you would need to defend the messages you already sent.
Can you rely on a lead vendor's consent?
Only if the vendor can produce the actual record per number and you keep your own copy. An assurance is not evidence, and a list you cannot document should be treated as unusable.