The Opt-In & CTA Design Guide for 2026

Last updated July 21, 2026

When a reviewer evaluates your campaign, the first question is always the same: can I see exactly how a consumer consents, and does it disclose everything it must? Reviewers open your opt-in page in a real browser, read the form, and compare it word-for-word against what your registration claims. An opt-in they can't see, can't verify, or can't match to your message flow fails — no matter how good the rest of the submission is.

That makes opt-in design the highest-leverage hour you'll spend on messaging compliance: get the point of consent right and the rest of the registration mostly writes itself.

For a narrative take on the same standards — the disclosures, placement, and privacy-policy language reviewers require — see Designing an Opt-In That Passes Review.

• Your brand name — matching the registered brand or DBA, so the consumer knows exactly who will be texting.
• What they're signing up for — name the program content in some form: "appointment reminders and account notifications," not just "messages from us."
• Message frequency — "Msg frequency varies" or a stated cadence like "up to 4 msgs/month."
• "Message and data rates may apply." — the carrier-mandated cost disclosure, verbatim.
• How to opt out — "Reply STOP to unsubscribe at any time."
• How to get help — "Text HELP for support" or a customer-care contact.
• Terms & privacy the consumer can reach — linked SMS terms and privacy policy near the opt-in (never in a pop-up), or the required commitments stated in the opt-in language itself, including that mobile data will not be shared with third parties for marketing purposes.

• No pre-checked boxes. Every consent control starts unselected, and the form must submit without it — consent that's required to proceed reads as forced.
• Marketing gets its own checkbox. Marketing consent can't ride along inside a general agreement or a multi-channel bundle. Operational, non-marketing consent may combine texts with calls or email in one clearly-worded disclosure.
• Phone field optional for marketing. A mandatory phone number on a marketing form reads as forced opt-in. For operational forms that require the number, pair it with clear consent language or a note that the number won't be used for texting without opt-in.
• Say it's not a condition of purchase — in the marketing consent language itself.
• Keep terms and privacy links beside the opt-in — visible on the page, not behind a pop-up.

Keyword opt-ins have their own rule: state the exact keyword and the number consumers text it to, and show where consumers learn the keyword (the ad, poster, or page). Verbal opt-ins need the word-for-word script your staff uses. Consumer-initiated programs — where the customer texts first — should name the website or listing where your number is published, so a reviewer can verify it.

These patterns pass review when the bracketed pieces are filled in honestly and the live page matches. For informational programs:

For marketing programs:

When the opt-in itself carries the privacy commitment instead of a linked policy, include: "No mobile data will be shared with third parties for marketing or promotional purposes." And if your privacy policy discusses sharing or selling data, it must expressly exclude text-messaging opt-in data and consent from that sharing — reviewers check the live policy.

The opt-in is step one of a compliant conversation. Every recurring program also needs:

• A confirmation message, sent immediately — containing the brand name, what the program sends, HELP and STOP instructions, frequency, and "Msg & data rates may apply": "[Company]: You've opted in to receive [program] messages. Text HELP for support or STOP to unsubscribe. Msg frequency varies. Msg & data rates may apply."
• A HELP response with real contact info — brand name plus a support email, phone number, or site.
• A STOP response that actually ends it — brand name, confirmation of the opt-out, and a statement that no further messages will be sent. Since April 2025, FCC rules require honoring revocation made by any reasonable means — including natural-language replies — within 10 business days.

A perfect opt-in you can't prove is a weak position in a dispute. For every opt-in, retain the timestamp, the method, the exact language the consumer saw, the phone number, the campaign it enrolled them in, and the IP address where applicable. CTIA guidance says keep records until at least six months after opt-out; Tychron recommends four years after the last message. Process carrier deactivation data so recycled numbers drop off your lists — texting a number's new owner on the old owner's consent is a classic TCPA trap.