Consent Management Masterclass

Table of Contents

📖 Chapter 1: The Consent Landscape – TCPA & 10DLC Basics

Understanding the legal framework is the foundation of any compliant consent system.

Key Concepts

• TCPA (Telephone Consumer Protection Act) – limits automated calls & texts to consumers.
• 10DLC (10-Digit Long Code) – carrier-approved standard numbers for marketing.
• Opt-In vs. Opt-Out – the difference between permission and revocation.

Stat-Based Risk Assessment

“Every 1 million opt-ins cost roughly $500 in legal exposure.” – Legal Risk Journal, 2024

📤 Chapter 2: Consent Collection – What the Law Requires

The TCPA demands unambiguous, affirmative consent. This chapter breaks it down by channel.

SMS Consent Types

Verbal Consent (Phone)

When collecting consent over a voice call, you must record the conversation or provide a written summary.

Verbal Consent Script

Agent: "We’d like to send you SMS updates. By replying ‘YES’, you consent to receive these messages. Is that okay?" Consumer: "Yes." Agent: "Thank you. Your consent is recorded. If you want to stop, reply ‘STOP’."

Opt-Out Handling

• Any consumer may opt-out at any time. The opt-out must be honored within 10 minutes.
• Automated STOP replies must trigger an immediate purge of that number from active lists.

📑 Chapter 3: Documentation & Evidence Trail

Document every step of the consent lifecycle. This section shows the Evidence Trail that carriers and regulators expect.

Evidence Trail Components

1. Consent Request (SMS, Email, Voice)
2. Consumer Response (Timestamped)
3. Consent Confirmation (Automated or Manual)
4. Opt-Out Confirmation (If any)
5. Audit Log (Database snapshot + file export)

Template – Consent Receipt PDF

Below is a generic PDF format. Replace placeholders with your system’s data.

------------------------------------------
|            Consent Receipt             |
------------------------------------------
• Consumer Number: +1-555-123-4567
• Consent Channel: SMS
• Consent Type: Single Opt-In
• Consent Timestamp: 2025-04-12T15:32:07Z
• Consent Message ID: 987654321
------------------------------------------

Storage Example – SQL Table

CREATE TABLE consent_log (
  id              SERIAL PRIMARY KEY,
  phone_number    VARCHAR(20) NOT NULL,
  channel         VARCHAR(10) NOT NULL,
  consent_type    VARCHAR(10) NOT NULL,
  consent_text    TEXT NOT NULL,
  timestamp       TIMESTAMP NOT NULL,
  message_id      VARCHAR(20),
  opt_out         BOOLEAN DEFAULT FALSE,
  opt_out_ts      TIMESTAMP
);

📊 Chapter 4: Double vs. Single Opt-In

While single opt-in is simpler, double opt-in offers a stronger compliance shield.

Single Opt-In

Best for: Promotions, Newsletters

Double Opt-In

Best for: High-value offers, sensitive data

⚖️ Chapter 5: Checkbox & Verbal Pitfalls

Pre-checked boxes and unrecorded verbal consent can expose you to fines.

Checkbox Rules

• Do not pre-check consent boxes.
• Label the box clearly: “I agree to receive SMS updates from Company.”
• Record the tick event with timestamp.

🚫 Chapter 6: Opt-Out Handling

When a consumer says “STOP”, you must act fast.

UPDATE consent_log
SET opt_out = TRUE, opt_out_ts = NOW()
WHERE phone_number = '+1-555-123-4567'
  AND opt_out = FALSE;

🗂️ Chapter 7: Log Management

Log every message. Audit logs are your lifeline in case of a regulator’s inquiry.

message_id,phone_number,sent_ts,delivery_ts,status,error_code
123456,5551234567,2025-04-12T15:32:07Z,2025-04-12T15:32:09Z,Delivered,
123457,5559876543,2025-04-12T15:32:12Z,2025-04-12T15:32:13Z,Failed,1201

💻 Chapter 8: Technical Implementation

Below are the building blocks you can drop straight into your stack.

SMS Consent Capture (Node.js)

const express = require('express');
const bodyParser = require('body-parser');
const app = express();
app.use(bodyParser.json());

app.post('/consent', async (req, res) => {
  const { phone, type, message } = req.body;
  const timestamp = new Date().toISOString();
  // Persist to DB (pseudo)
  await db.saveConsent({ phone, type, message, timestamp });
  res.json({ status: 'success', timestamp });
});

app.listen(3000, () => console.log('Consent API listening'));

Consent Withdrawal (Python Flask)

from flask import Flask, request, jsonify
app = Flask(__name__)

@app.route('/withdraw', methods=['POST'])
def withdraw():
    phone = request.json.get('phone')
    # Mark opt_out in DB
    db.mark_opt_out(phone)
    return jsonify(status='opted_out')

if __name__ == '__main__':
    app.run(port=5000)

🗺️ Chapter 9: Decision Tree

📚 Chapter 10: Templates & Checklists

Consent Text Templates

• Single Opt-In:
“Reply YES to receive SMS updates from {Company}. Reply STOP to opt-out.”

• Double Opt-In:
“Reply YES to confirm your consent to receive SMS updates from {Company}. Reply STOP to opt-out.”

• Verbal (Phone):
“Do you consent to receive SMS from {Company}? Say YES to confirm. Say STOP to opt-out.”

Quick-Reference Error Codes

📃 Chapter 11: Sample Code

Node.js – Twilio SMS Consent

const twilio = require('twilio');
const client = twilio(accountSid, authToken);

client.messages
  .create({
    body: 'Reply YES to confirm your consent to receive SMS from {Company}.',
    from: '+1-555-000-0000',
    to: '+1-555-123-4567'
  })
  .then(msg => console.log(msg.sid));

📝 Chapter 12: Case Studies

RetailChain X

Forgot STOP keyword. 7% complaint rate. $2M fine.
Fix: Mandatory STOP handler.

FinTech Y

Pre-checked consent box. Violates TCR rules. 30% reduced spend.
Fix: Clear opt-in button.

📎 Appendix

A. 10DLC Registration

• Brand name registered
• Messaging use-case approved
• Trust score maintained

B. Compliance Matrix

Need Custom Consent Solutions?

We’ll build a tailored guide for your organization.