Keeping a consent record for texting: what to store and for how long

A consent record shows that a specific person agreed to receive a specific kind of text from your business at a specific number, and what they saw when they agreed. It needs the number, the wording shown, the purpose (reminders, marketing), the date and time, the source, and any identifier available (an IP address for a web form, a signature for paper). Opt-outs are recorded the same way. Keep it for as long as you might need to prove it, which in practice means years. This is a description of good practice, not legal advice.

Why the record matters more than the consent

Consent that you cannot prove is, in a dispute, consent you do not have. Complaints under the TCPA arrive months or years after the message, and the question is always the same: show me that this person agreed. A system that recorded the checkbox tick with its wording and timestamp answers in a minute. A system that just has "opted in: yes" on a contact does not.

What each record contains

1. The phone number as consented, in a standard format.
2. The purpose. Reminders and replies, or marketing, or both, as separate records.
3. The exact wording the person saw or heard. Not a reference to "the current consent text"; the text as it was at that moment, because you will change it.
4. The date and time, with timezone.
5. The source. Which form, which page, which conversation, which paper form, which staff member at the desk.
6. An identifier where available. IP address and user agent for web; the message ID for a texted YES; a scan of the signed form.
7. The business and number the consent was given to, if you have more than one.

Where the record comes from, by source

Web form: the form submission with the checkbox state, wording, timestamp and IP, written to the contact automatically.

Booking flow: the same, captured at the consent step.

Text conversation: the question the system asked ("Reply YES to receive reminders") and the reply, with message IDs and timestamps. A YES to a clear question is a usable record for reminders.

Phone or desk: a note on the record by the staff member, with the date and what was said. Weaker than the others; for marketing consent, use a written form instead.

Paper form: scanned and attached, with the wording, signature and date.

Opt-outs

Every STOP, every "please stop texting me", every request at the desk, recorded with the number, the date and time, the channel and what was said. Opt-outs apply immediately and across every purpose from that number. Re-consent needs a new, explicit record; a later booking is not one.

How long to keep it

For as long as a claim could be brought, plus margin. Statutes of limitation for the relevant claims run to several years. The practical rule is: keep consent and opt-out records for the life of the contact plus several years, and do not purge them when a contact is deleted; keep the consent history even if the personal details are removed.

What the system should do for you

Write the record automatically at every consent point. Store the wording as it was. Show, on any contact, what they consented to, when, and from where. Export the whole history for a number on request. Never let a message send to a purpose with no record. And never let anyone edit a consent record; corrections are new records.

Frequently asked questions

We have been texting customers for years without records. What now?

Start recording from today, and consider asking existing customers to confirm at their next visit or in their next reminder ("Reply YES to keep receiving reminders"). Do not send marketing to numbers with no marketing record.

Does a screenshot of the form count?

Better than nothing, but a screenshot shows the form, not that this person saw it at that time. Automatic records per submission are what you want.

Should the record include the customer's name?

Yes, as given at the time, along with anything else they entered. The number is the key; the name helps.

What Frontiva does here

In Frontiva, reminder consent is an unticked checkbox at booking, and the exact wording the customer agreed to is saved onto their contact. Every outbound message passes a send check that reads that consent and the opt-out state, and a STOP is recorded against the number, so it covers every conversation, including ones opened later. The bookings page explains the reminder rule. See SMS opt-in language that holds up for what the wording should say.