Updated September 2020
Legalities, best practices, and possibilities of text message marketing
This article explains the major U.S. national regulations over text messaging communications, including both SMS and WhatsApp. It gives examples of best practices and how you can use Mogli in Salesforce to navigate this regulatory territory.
Be sure to read about Canada's (here) and the European Union (here) text messaging policies. We know our stuff when it comes to SMS and WhatsApp compliance, but we still strongly suggest running your opt-in method past your preferred legal counsel.
If there are so many text messaging regulations, why make it a pillar of digital communications?
Text messaging is a practical, relatively low-cost way to reach stakeholders across various industries, from financial services to education, and from commerce to nonprofits. Its efficacy comes not only from the convenience of a cell phone and being able to reach people anywhere they go, but from the variety of communications needs a text message can fulfill.
Mogli, for example, can:
- conduct branching surveys for feedback and data collection
- send personalized bulk (one-to-many) or one-to-one messages
- collect payments via a true text-to-pay solution called MogliPay
- run complex Salesforce Flow or Process Builder automations that create elegant workflows connecting teams and communications channels, and automated conversations
These texts of course can include alerts, transactional updates, and announcements of events like your brand’s sales, but the possibilities are so much more robust than a spray and pray text marketing.
Furthermore, text messaging is the preferred and most popular communication channel amongst consumers due to stringent regulatory requirements that save them from spam. These laws keep the channel clean and help preserve its advantages over other digital communications. Yet, companies who use text messaging must be diligent about compliance to avoid expensive penalties.
The legalities of SMS and WhatsApp compliance in the United States
Federal laws and regulations state that businesses cannot intentionally or unwittingly text unsolicited spam containing irrelevant marketing information, products, services, or other offers. Nor may businesses collect personal data for any purpose other than to engage and provide value to those recipients.
Below is an overview of the governing laws and the resource to align with best practices.
- The FCC (Federal Communications Commission) created The TCPA, Telephone Consumer Protection Act, in the 1990s, initially as protection against phone calls and robocall solicitations. It quickly evolved to include text messaging, as well. The TCPA is still the primary law in the USA. It sets limits on telephone solicitations and the use of automated equipment requiring businesses to obtain explicit documented written consent before sending text messages. Even if a company already has a relationship with (or the phone number of) an intended recipient, it may only text message if it has opt-in consent. The only exception is a real emergency.
So, before you send a text message to ask for opt-in, know that, too, is illegal. You can land fines between $500-$1500 for each infraction. This range depends on if you send the message knowingly, or to what extent you abused information. An unsolicited text or call (yes, each call or text message) counts as a violation of the law, which can quickly amount to millions of dollars in penalty fines. In 2013, Domino’s Pizza famously paid close to $10 million for unsolicited text messages.
- The other biggie is the CAN-SPAM Act. CAN-SPAM protects consumers from commercial text messages from companies with which you don’t already have a relationship. For example, if your car insurance company sends you a transactional text message, that could be fine. It’s illegal, however, for a car insurance company with which you don’t have any relationship to solicit one over text message without your explicit written consent, as discussed above. Nonprofits, public office candidates, and the like only have to obtain verbal consent.
Additionally, CAN-SPAM requires that any commercial message be readily identifiable as an advertisement by the text message recipient. Consumers must also be able to unsubscribe from receiving messages.
- The CTIA, Cellular Telecommunications and Internet Association, promotes the industry’s voluntary best practices while protecting consumers from unwanted messages. In addition to encouraging a clear call-to-action, requiring proper-opt in and double-opt-in, easily accessible placement of policies, and the ability to easily opt-out, the CTIA also urges one opt-in per campaign. This way, consumers don’t get added to irrelevant or too many text messaging campaigns. Similarly, the organization speaks to the downfalls of sharing or selling data.
- The California Consumer Privacy Act or CCPA, instated on July 1, 2020, provides California residents with more control over their personal information that businesses collect. The law governs both US-based and international countries, and includes the following new privacy rights:
The right to know what personal data is being collected and how it is used.
- The right to request businesses to delete personal data.
- The right to easily opt-out of the sale of personal data to other businesses, as well as request a full list of 3rd party data users.
- The right to non-discrimination because you have exercised your rights under CCPA.
- The right to sue companies if their data guidelines are violated.
As of August 14, 2020, there have been additional modifications to the CCPA. The changes provide a more concise description of the regulations and clarify the shorthand language previously used. The following summarizes the updates made:
- “Do Not Sell My Personal Info” shorthand removed.
- When presenting users with the option to opt-out of selling personal data, the correct language is “Do Not Sell My Personal Information” vs. “Do Not Sell My Info.”
- Obtaining explicit consent is no longer required.
- Businesses no longer have to provide consumers with an easy opt-out method with minimum steps.
- Simply put, you do not have to worry about having a straightforward opt-out method for your consumer. However, keep in mind that it is unclear whether multi-step opt-out processes will still be problematic.
- Modified requirements around “written permissions.”
- Businesses can now deny the request from a third party business to use personal data if they do not have the authorization to act on the consumer’s behalf.
Opt-in matters: how to obtain it
First, ask for consent. This consent to receive text messages on a mobile device can be collected wherever you gather information. Create TCPA-compliant paper, online, email, or website forms, or have your target audience text in a keyword to your organization over SMS or WhatsApp.
For any of these consent forms to be valid, organizations must clearly and prominently disclose with a few pieces of information:
- the number of messages recipients should expect to receive
- how to opt-out (a process that should be easy)
- how to get help
For example, one of your web forms could read, “Check this box to subscribe to text messages from us,” and provide hyperlinks to all the necessary disclosures. Additionally, if you plan on selling the personal data you have collected, CCPA requires that a separate opt-in checkbox is used titled “Check to permit sale of information”.
Inbound text message opt-in
Mogli highly recommends the keyword query form (or another data collection methodology) delivered over text message, as we’ve seen our clients ease administrative burdens and painfully low conversion rates of analog or online methods. Keyword queries are inbound marketing at its best. You can create a call to action on your website or other digital and traditional channels, including advertisements, inviting people to text in a keyword to your organization’s phone number.
For example, “Text in the word INFO to 555-555-5555 for more information about our loan / MBA / membership program.” When someone texts in, that’s the first opt-in. If you want to cover your bases (and we encourage you to) obtain double-opt-in by responding with something like, “We would like to send you one to four SMS messages from us per month. Is this okay with you? Please respond with YES or NO.”
If the person answers “YES,” this constitutes a double opt-in. Additionally, this active consent or relationship expires every 18 months. Use Mogli automations on Salesforce to regain opt-in 18 months from the initial day each user subscribes to your text messages.
What if the person doesn’t respond to your double opt-in request? Consider it an opt-out and read on.
What about opt-outs?
No matter how amazing your product, service, or marketing is, there will always be someone who doesn’t want to receive commercial text messages. If you offered an opt-in or double-opt-in and the customer hasn’t responded, consider that an opt-out. It’s safest not to reach out to customers unless they are expecting it.
Your recipients can also opt-out of receiving text messages from you at any time by texting in words “STOP,” “QUIT,” “UNSUBSCRIBE,” “OPT-OUT,” or “CANCEL.” It’s important to make opt-out easy. The message carrier will see these messages and should stop any messages from going out to that customer from then on.
Mogli has an opt-out backup using standard Salesforce automation. This automation checks a box on Contact, Lead, or any other Object Record called the Mogli Opt-Out Checkbox, effectively blocking any text messages in Salesforce from being sent to that Contact, Lead, or other Object. For a more in-depth explanation and step-by-step instructions of the Mogli Opt-out automation, see our User Guide.
What’s up with WhatsApp?
If your recipients live within the United States, just as with SMS, you need to be compliant with TCPA, CAN-SPAM, and state-specific laws. WhatsApp allows you to initiate text conversations only by sending transactional messages using pre-approved templates. If a recipient replies or starts a conversation with you, this “Customer Service Window” is a 24-hour window in which you may continue the conversation.
During this time, you’re able to deploy automated Mogli conversations you’ve configured within Salesforce. You still must clearly state how someone can access a human agent for further assistance. If 24 hours pass without receiving a text message from that recipient, you must return to your message templates to try to reopen communication.
Mogli helps clients with the template approval process and WhatsApp configurations, with the ability to customize automation that suits your Salesforce use case.
Where to start?
SMS compliance can be scary because mistakes can be expensive. Start with the basic checklist below, you’re sure to add value to your customers. For more tricks of the trade, please read Top Tips for Successful SMS Communication.
If you still have questions about compliance, feel free to reach out to us.
- Gain consent with opt-in via keyword query.
- Confirm consent with double-opt-in via automated Mogli conversation
- Allow people to easily opt-out with Mogli auto opt-out. Consider no response to an opt-in request or confirmation as a gesture to opt-out.
- Make it easy for recipients to get live help by configuring Mogli notifications, creating automation that escalates the chatbot conversation to a real agent.
- Maintain integrity and add value by only sending campaign and interest-specific messaging.
- Use Mogli to automatically ask for re-opt-in every 18 months.
- Never share or sell recipient data, unless the recipient has agreed to those terms.