Email, SMS and tracking
SMS marketing consent rules and opt-outs in Canada, the US and UK
Published by Zubair Afzal, responsible editor
First published Updated 7 min readWe check this page every three months. Next check: .
Why this is different
Why a marketing text needs its own consent record
A text arrives differently from an email. It carries a notification, sits among messages from people the recipient knows, and has no promotions tab to soften it. That is why every major consent regime treats SMS as its own category.
There is no single global "SMS law". Canada’s Anti-Spam Legislation, the US Telephone Consumer Protection Act with carrier requirements published by CTIA, and the UK’s Privacy and Electronic Communications Regulations were written separately, for different reasons. They overlap on intent and diverge on detail, and the detail is what a business has to build against.
The most damaging mistake is assuming permission collected for one channel or country travels to another. A newsletter subscriber hasn’t agreed to a text. A customer in one country hasn’t agreed under another country’s standard just because your platform sends to both from one list.
Below: what each regime calls consent, the one exemption each allows, and how an opt-out has to work. None of it replaces advice from a lawyer who knows your business and markets. Confirm your position with counsel before a first send into any of these markets.
CASL, the TCPA and PECR compared on SMS consent
What each asks for before a marketing text can go out, based on the official guidance linked below the table.
| Dimension | Canada (CASL) | US (TCPA and carrier rules) | UK (PECR) |
|---|---|---|---|
| Default standard | Express consent, or implied consent in narrower, time-limited cases. | Prior express written consent for automated marketing messages. | Opt-in consent for direct marketing by electronic means, including text. |
| The main exemption | Implied consent from an existing business relationship: roughly two years from a purchase, about six months from an enquiry. | No general implied-consent exemption for marketing texts sent through an automated system. | The soft opt-in, for existing customers buying a similar product who were offered an opt-out at collection and in every message since. |
| Message requirements | Identify the sender, give contact details, and provide a working unsubscribe mechanism. | Clear disclosure at sign-up, sender identity, and support for HELP as well as STOP. | Sender identity must not be disguised, and a valid address for opt-out requests must be given. |
| Opt-out handling | Mechanism must work for at least 60 days after sending, requests processed within 10 business days. | STOP honoured immediately at the platform level, enforced through carrier rules. | Opt-out request acted on promptly, no fixed statutory number of days for SMS specifically. |
| Where to check the detail | Government of Canada’s anti-spam legislation guidance. | 47 CFR § 64.1200 and CTIA’s messaging principles. | ICO guidance on direct marketing and PECR. |
The one thing every regime agrees on
What a working SMS opt-out needs
The three regimes disagree on plenty. They converge on this: an opt-out has to work, without a person in the loop, every time.
- STOP, and common variants of it, recognised automatically by the sending platform, not by a person reading replies.
- The unsubscribe applied across every list and every automation the number is on, not just the campaign the reply came from.
- A HELP keyword that returns clear information about who is sending and how to stop, on the same channel.
- A dated record of when each opt-out was received and actioned, kept separately from the general contact record.
- The opt-out route kept working for a minimum period after the last message, per CASL’s 60-day requirement, even for numbers already suppressed.
- A quiet-hours rule enforced by the platform against the recipient’s own time zone, not the sender’s.
- Transactional messages, such as a delivery update, kept on a separate track from marketing so an opt-out from one doesn’t silently affect the other.
Where this goes wrong
SMS consent mistakes that show up after the first complaint
Most come from treating a text list the way an email list has always been treated, the assumption every regime here rejects.
- A checkbox arrives already ticked
- Pre-ticked consent isn’t consent under any of the three regimes. It has to be an active choice by the person whose number it is, at the point of collection.
- A single purchase is treated as permanent permission
- CASL’s implied consent from a transaction has a clock on it. Treating a two-year-old sale as an ongoing licence to text is how a compliant list quietly becomes a non-compliant one.
- One list serves every country a business sells into
- A single send to a mixed list means the strictest applicable regime governs the whole send. Segment by the country the consent was collected in.
- Transactional and marketing messages share a suppression list
- An opt-out from marketing texts shouldn’t block a delivery confirmation, and a delivery confirmation shouldn’t be a workaround for a promotional message. Separate tracks avoid both problems.
- Nobody can produce the record of consent on request
- A regulator or a complaint doesn’t ask whether consent was probably given. It asks for the record: the date, the method and the exact wording shown at collection. A list without that record is a liability, however reasonable the sends were.
What this page can tell you, and what only a lawyer can
What this page does
- States what CASL, the TCPA with CTIA’s rules, and PECR each ask for, based on the official sources linked above.
- Names the one exemption each regime allows, and how narrow it is in practice.
- Sets out what a working opt-out has to do, since that’s where the three regimes agree.
- Points to the primary source for each claim, so it can be checked instead of taken on trust.
What it can’t do
- Tell you whether your specific consent flow, list or message wording is compliant. This isn’t legal advice.
- Cover every jurisdiction. Businesses sending outside Canada, the US and the UK need to check the rules where their recipients are.
- Stay current forever. Guidance is updated on its own schedule, so check the linked sources for the latest version.
Questions
Common questions about SMS consent and opt-outs
Does an email opt-in cover text messages too?
No, in all three countries. CASL, the US rules and PECR each treat a text as needing its own permission, even where the same law covers both channels. An SMS list has to be built on its own consent record, not inherited from an email list.
The safest rule is a separate yes for every channel, recorded separately, even when one platform stores both.
What counts as consent under CASL?
CASL recognises two kinds. Express consent is a clear, specific yes to receiving commercial messages, saying who is asking and what they’ll send. Implied consent exists in narrower cases, such as an existing business relationship, and it expires. Under the government’s guidance, a purchase implies consent for roughly two years from the transaction, and an enquiry for about six months.
Implied consent is the one most misused. A list built on it needs a plan for when each entry expires.
Do we need written consent for every marketing text sent in the US?
For messages sent using an automated system, the TCPA’s standard is prior express written consent, a higher bar than a simple opt-in checkbox. Carrier rules, published through CTIA, add clear disclosure at sign-up, honouring STOP immediately, and supporting HELP.
A number collected for another purpose, such as order confirmations, doesn’t carry consent for marketing texts sent later.
What is the UK’s soft opt-in, and does it cover texts?
PECR generally requires opt-in consent for direct marketing by text. There’s a narrow soft opt-in exception for existing customers: someone who bought a similar product or service, was given a clear chance to opt out of marketing at the time, and is given that chance in every message since.
It’s narrower than it sounds. It applies to similar products bought from you directly, not to a list built by other means. Check the ICO’s guidance before relying on it.
How quickly do we have to act on a STOP reply?
Immediately, in practice. CASL sets an outer limit of ten business days for processing an unsubscribe request, and the mechanism must keep working for at least sixty days after a message is sent. US carrier rules expect STOP to be honoured straight away, at the platform level, not by a person reading a reply.
If an opt-out depends on someone noticing a text in a shared inbox, it will fail on a day nobody was watching. That draws complaints and carrier attention faster than an imperfect consent record.
Can we text a customer for a review without marketing consent?
Often yes, depending on how the message is framed and which regime applies. A review request tied to a recent purchase sits closer to a service message than a promotional one in most guidance, and the UK’s soft opt-in was built for cases like it. It still needs a working opt-out, and it isn’t a licence to send anything else to the same number.
Treat it as its own category with its own rule, not part of the general marketing list.
References
Sources for SMS marketing consent rules
The official documents and research this page is based on. Platform rules change, so check the source before you act on a detail.
- Government of Canada: Understand Canada’s anti-spam legislation
- Government of Canada: Protect your business and comply with Canada’s anti-spam legislation
- eCFR: 47 CFR § 64.1200, telephone solicitations and telemarketing (TCPA rules)
- CTIA: Messaging Principles and Best Practices
- ICO: direct marketing and PECR guidance
Related
Keep reading on SMS marketing consent rules
Start here
Get SMS consent and opt-outs built properly
Our specialists build the consent capture, records and suppression logic so an opt-out is honoured everywhere at once, and confirm your compliance position with your own counsel before the first send.
Rather check it yourself? Try our free SEO tools