4.3.2.1 - SMS/WhatsApp Consent & Compliance (TCPA/PECR/GDPR) (Difficulty: Advanced | Path: Scale)

Lesson Summary

SMS/WhatsApp Consent & Compliance (TCPA/PECR/GDPR)

What is it?

These are the sets of laws that govern how you can legally send commercial text messages. Key laws include the TCPA (Telephone Consumer Protection Act) in the US, PECR (Privacy and Electronic Communications Regulations) in the UK, and GDPR (General Data Protection Regulation) in the EU. They all boil down to one core principle: you MUST have explicit, informed, and unambiguous consent from a user before sending them a single marketing text.

Why is it important?

This is not optional, and the penalties are severe. TCPA fines, for example, can be $500 to $1,500 *per text message*. Unlike email (which can be more lenient), SMS compliance is extremely strict. You cannot 'imply' consent.

Key Compliance Rules You MUST Follow:

• Explicit Opt-in: The customer must *actively* take an action to subscribe, like checking a box or texting a keyword. You can NEVER use pre-checked boxes.
• Clear Language: Your opt-in form (pop-up or checkout) MUST include clear legal language stating that they agree to receive 'recurring automated marketing messages' and that 'consent is not a condition of purchase'. You must also link to your Terms & Privacy Policy.
• 'STOP' to Unsubscribe: You must include 'Reply STOP to unsubscribe' (or similar) in your welcome message and periodically in campaigns. Your platform must automatically handle these opt-outs.
• Quiet Hours: You are legally restricted from sending messages during certain times (e.g., before 9 AM or after 8 PM in the user's local time zone). A good SMS platform will manage this 'quiet hours' setting for you.

⚠️ The Single Biggest Pitfall

Thinking that a customer who enters their phone number at checkout for *shipping updates* has also consented to *marketing*. They have NOT. These are two separate things and must have two separate, clear opt-ins. Confusing them is a massive legal violation.