Managing SMS Compliance In Drip
This article is not legal advice, is not a contract, and does not create any legal rights or obligations. There is no substitute for obtaining your own legal advice. Drip is not your lawyer. You should not make decisions about engaging with customers through text message marketing without first obtaining the advice of your legal counsel regarding the laws and compliance obligations applicable to your marketing practices and the places you operate.
Drip is now offering SMS, which offers you a brand new channel to communicate with your people. SMS is a very powerful tool, but comes with some additional compliance responsibilities.
Here in the U.S., there are complex rules, regulations and risks associated with SMS marketing, including significant risks of legal action taken against companies if the rules aren’t followed. The most important rule to follow with SMS is to only send messages to people who have explicitly opted-in to receiving them.
In order to bring awareness to the SMS compliance regulations, we have outlined guidelines and standards on how to navigate the space to help you get started. We recommend that your SMS strategy be reviewed and approved by your company’s compliance stakeholders and legal counsel. Lastly, the guidelines that we provide assume that the text messages will be sent for telemarketing/commercial purposes.
What is TCPA?
The TCPA (Telephone Consumer Protection Act) is a federal statute put into law in 1991. It’s primarily designed to safeguard consumer marketing communication. TCPA impacts your marketing communications via voice calls, SMS texts, and fax. For Drip’s purposes, we’ll be focusing on SMS when it comes to TCPA. Your brand must be TCPA compliant, or risk significant federal fines and penalties. We’ve linked the TCPA rules here below for you to review.
What is CTIA?
CTIA is a trade association representing the wireless communications industry in the United States. They provide guidelines and principles for SMS-based communications that many brands leverage to reach their customers. Drip helps ensure that you are following CTIA guidelines, but lots of this work is left up to you in the way that you choose to market to your people. CTIA’s Messaging Principles and Best Practices are linked below for you to review.
What Does Drip Do For Me?
Drip has got your back when it comes to SMS legal compliance. Here’s what we do for you:
Ensure that you gather the proper compliance documentation from your people
- We have safeguards in place to ensure that your SMS campaigns and automations adhere to SMS quiet hours according to TCPA and CTIA regulations. This means that SMS sends can only occur between 8 am and 9 pm (in your subscriber’s local time zone).
Drip makes sure that if your subscribers reply “STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT” that they are opted out, protecting you from any spam accusations
Other keywords that Drip respects are START -- this will resubscribe a person
If a person replies “HELP” or “INFO” we will provide information about what they can do to unsubscribe
Keeps track of the marketing messages you've sent to each person
Drip provides examples of best-practice SMS terms of service so that your brand can update your own -- NOTE: This should still be reviewed with your legal counsel
SMS Quiet Hours
Drip has safeguards in place to ensure that your SMS campaigns and automations adhere to SMS quiet hours according to TCPA and CTIA regulations. This means that SMS sends can only occur between 8 am and 9 pm (in your subscriber’s local time zone).
If a user lands outside of the 8 am - 9 pm window, they will receive the message the next time they are within the sending window.
The only exceptions to quiet hours are:
If a user subscribes to (or unsubscribes from) your store during quiet hours, we will send opt-in or opt-out messages as required by federal law.
If a user triggers your SMS welcome workflow, we will send the first text message because users expect an SMS after signup and to avoid damaging your brand
There are industries we cannot allow to use SMS due to provider regulations. This includes sellers of cannabis and/or CBD products that encourage consumption, other drugs, as well as companies who send overtly sexual content.
What Should I be Doing?
With all that Drip does for you, that doesn’t mean you’re off the hook. Here’s what you need to be watching for and ensuring that you are compliant with:
Following CTIA guidelines for the content of your SMS marketing messages
Update your brand’s terms of service so that it includes proper SMS consent language
Review your brand’s terms of service with your legal team to ensure it’s compliant
Continually ensure that your forms that capture SMS on your websites have the proper language in them to acquire consent to send your shoppers SMS messages
Be clear in your opt-in messages by mentioning your brand name and what your shoppers have signed up to receive
Avoid over communication through SMS, remember that you still have Drip’s powerful email tools at your fingertips.
Building workflows that follow CTIA best practices for sending times (Drip handles the time zones for you!)
“Message and data rates may apply”
Confirmation that consent is not a condition of purchase
Clear description of the intended use of the recipient’s provided phone number (such as cart reminders or post-purchase follow-up)
Complete terms and conditions or a hyperlink to complete terms and conditions
Service delivery frequency or recurring message disclosure (e.g., “you will receive X messages per month”). If you don’t know the frequency, mention messages may come on a recurring basis
In no circumstance should consumers receive a marketing text message without first providing their permission to receive such messages. Even where the consumer has provided their phone number for other purposes, like in connection with a customer service call, the customer should not receive marketing text messages unless they have provided Prior Express Written Consent. Let’s break this down:
- Prior: The Consent must be provided before the recipient begins to receive SMS messages.
- Express: The recipient must take an express action to indicate their permission to receive SMS message. The permission cannot be implied from the fact the consumer provided their phone number for other purposes. For example, the consumer could check an empty checkbox to expressly show their Consent to receive marketing text messages.
- Written: The recipient’s Consent should be obtained through a physically or digitally signed agreement, which could include an online Consent form.
- Consent: The recipient affirmatively agrees to receive SMS messages. The Call to Action should appear when the consumer is asked to Consent so they can understand what they are agreeing to.
A record should be kept of the consumer’s Consent, such as a copy of the signed document or a timestamp of when the consumer checked a box during sign-up. Keep the consent on file for at least the statute of limitations under applicable SMS marketing laws (e.g., four years under the TCPA).
When you use a Drip form to obtain phone numbers, Drip stores the timestamp when a person consents, if/when that person removes consent, and the language they consented to. If you choose to import SMS phone numbers into Drip, you will be responsible for maintaining required consent information. For example, a Drip form:
This consent can be referenced in a specific person’s profile in the All Activity feed via the “Submitted SMS Number” event:
The consent obtained at opt-in is only applicable to one entity and program, and for the specific purpose or messaging campaign that the recipient agreed to. You should always message people related to the reason you asked for their number at opt-in in the first place. You should obtain Consent for each separate text messaging program, even if you are using the same shortcode.
Additionally, Consent cannot be bought or sold. Buying a list of phone numbers from a third party does not constitute proper Consent to receive SMS messages from you.
SMS Message Content
Always be clear about who the sender is and what your message is promoting when sending SMS messages. Messages should not be misleading or deceptive and should have a clear opt-out mechanism. Consider displaying opt-out information at regular intervals, reminding the consumer they can text ‘STOP’ to unsubscribe; text ‘HELP’ for help.
Drip’s system ensures you only send people messages from 8am-9pm in their local time—the window allowed by law. When using Drip forms, the person’s time zone is collected automatically. We recommend not inundating people with messages and recommend a maximum of three messages per week.
Opt-In Request Confirmation & Response Language
You should send one confirmation message immediately after the customer opts into SMS marketing. The confirmation message should explicitly state which program the recipient has enrolled in, including the program identification (i.e., brand) and product description, opt-out information, customer care contact information, product quantity and a recurring message disclosure. Opt-in confirmation messages should also include the “Message and data rates may apply” disclosure.
Drip currently sends the opt-in confirmation message automatically. The language for the confirmation message can be updated in the SMS Settings page.
Opt-Out Request Confirmation & Response Language
People must have a clear method of opting out of SMS messages. Drip automatically opts-out anyone who replies STOP, STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT to your SMS number.
Upon receiving an opt-out keyword, Drip sends a final message to confirm that the opt-out request was honored. See below for the message that is automatically sent to people who opt-out of SMS:
Consumers who have opted out will not receive any additional SMS messages from your brand unless the consumer provides their Prior Express Written Consent again. They can provide this consent again by replying START to your number, which will automatically opt the person back into SMS. They will also receive the message shown below:
In the U.S., the primary federal law covering text message marketing – the Telephone Consumer Privacy Act, or TCPA – gives consumers the ability to sue brands who have sent the consumer marketing text messages without Prior Express Written Consent. These cases can be filed as class actions that bring in the entire group of people who may have received marketing text messages without their authorization. The penalties for TCPA violations can be up to $500 per violation (i.e. accidental or negligent) or $1,500 for a willful (i.e. knowing) violation. What is a “violation,” you ask? A violation occurs for each marketing text message sent without Prior Express Written Consent. Most SMS messaging programs involve a lot of messages to a lot of people. The potential fines and penalties add up quickly where Consent is not properly obtained.
We recommend working with counsel to review your SMS marketing program. It is also worth training marketing staff and anyone responsible for consumer interaction about how to obtain and maintain proper consent, and what to do in the event a consumer requests to opt-out. Remember to also keep records of all actions taken in regard to consumer Consent, all SMS messages sent and all opt-outs received and your actions taken in response.
We hope this guide provided some insight on helping you develop and implement a compliance strategy that works for you. Reach out to our Support team at any time if you need help getting your SMS marketing strategy set up with Drip:
Drip Support: firstname.lastname@example.org