Dispensary SMS Consent: Opt-In Records and Opt-Outs

Keep the permission and its history.

A dispensary SMS consent record should show who agreed, which sender and purpose they agreed to, what disclosure they saw, when and how they acted, and whether that permission is still current. A phone number, purchase or loyalty profile alone does not answer those questions.

For a provider change, the migration checklist keeps permission history and current suppression in view. Review Blackleaf’s messaging review framework alongside the requirements for your actual program.

This guide focuses on permission evidence, withdrawal and migration. It complements the broader messaging compliance framework and SMS opt-in overview. Clear records help the team make a defensible send-or-hold decision; they do not guarantee legal compliance, carrier acceptance or delivery.

Scope: U.S. federal sources and industry/provider distinctions reviewed October 15, 2026. State communications, cannabis advertising and privacy rules may add requirements. Other countries need separate analysis. Use qualified counsel for your actual program and confirm provider support before enabling outreach.

Separate the rules before choosing a setting.

Law: 47 CFR §64.1200 requires prior express written consent for covered automated telemarketing. Its written-consent definition addresses authorization, a signature, the number and a disclosure that consent is not a purchase condition. Electronic signatures can qualify under applicable law. Applicability depends on the actual technology and communication; a vendor setting is not a legal determination.

Industry guidance: CTIA’s May 2023 principles distinguish conversational, informational and promotional messaging and recommend consent documentation and consumer choice. These are voluntary industry guidelines, separate from statute and each provider’s contract.

Provider acceptance: a lawful business or documented signup can still be unsupported. Twilio prohibits cannabis/CBD business SMS and MMS in the U.S. and Canada regardless of content. This is a Twilio-specific example; it is not evidence that Blackleaf uses that route. Confirm the permitted business, use case, sender and destination for your proposed setup. Neutral wording, an age gate or registration does not override a provider prohibition.

Platform configuration: a checkbox, imported flag or automatic enrollment option records or acts on data. It does not establish that the underlying permission is valid. Review TCPA context and the real signup experience before changing a setting.

Make the choice understandable at signup.

Design the experience around what the customer is choosing. Keep the identity of the sender and the actual message purpose clear at the point of action. An order-update request should not quietly become enrollment in recurring offers.

• Separate optional promotional messaging from checkout, receipts, loyalty membership and unrelated email choices. Use an affirmative, unambiguous action.
• Review the actual sender, purpose, recurring or automated behavior, frequency expectations, charges, help, withdrawal, terms and privacy information for the proposed program. Match the disclosure to what the system will do.
• Check that the customer can read the disclosure on the actual mobile form or counter device before submitting. Preserve that version and the action; a current screenshot cannot prove what an older customer saw.
• If confirmation is required by the supported enrollment flow, keep the record pending until the required step is complete. A request sent, delivered or ignored is not a completed confirmation.

Do not use a generic disclaimer as universal approved language. The disclaimer examples are starting points for review, not permission to use an unsupported route or message purpose.

Save enough evidence to explain the decision.

Use a stable event history with a current status, rather than overwriting everything with a single yes/no field. The following is an operational record design to adapt with your legal and provider requirements.

Restrict access and define retention with counsel. Keep the appropriate age-control method/result where required, but do not copy identity documents into a marketing audit merely because a store checked them.

A consent record with a later withdrawal.

The sequence illustrates the evidence to preserve, not a universal requirement for a particular reply or a claim that every check is automatic. In a real deployment, verify the permitted confirmation route and observed processing results.

Make withdrawal work beyond one keyword.

The FCC rule recognizes reasonable methods of revocation, including clear plain-language replies. Build an operational process that handles standard keywords and requests a person can understand. Assign requests arriving through replies, support or other reasonable channels to a responsible owner.

1. Record the request and current recipient match. Hold affected outreach promptly while the scope is resolved.
2. Apply and reconcile suppression in campaigns, queued automations, employee tools and connected systems using that permission. Test delayed feeds and duplicate profiles.
3. Keep any permitted opt-out confirmation non-promotional and within the supported legal/provider procedure. Do not add an offer or an enrollment request.
4. Require appropriate fresh permission before affected messaging resumes. A new purchase, staff toggle or old import must not silently undo withdrawal.

Current federal scope note: the FCC’s January 6, 2026 order, DA 26-12, delays until January 31, 2027 the requirement to apply revocation from one informational message type to unrelated matters. It expressly leaves other prior revocation rules and rulings unchanged. This narrow waiver is not permission to ignore STOP or restart marketing. Resolve uncertain scope with counsel and the provider; avoid describing every message category as legally identical.

Use a staffed reply workflow and test the actual automation stops. A configured rule is not proof that pending work stopped everywhere.

Move the evidence with the audience.

A migration changes software, not what the customer originally agreed to. Preserve the source export and extraction time, map stable IDs and keep the event sequence. Treat permission that is missing, conflicting or outside the intended sender/purpose as unresolved.

• Reconcile permission evidence and suppression separately from customer counts. Include withdrawn contacts in the suppression handoff so an old list cannot reintroduce them.
• Compare event time with import time. A late historical opt-in must not overwrite a more recent withdrawal.
• Confirm which connector fields exist, their meaning, direction and update timing. A field named “subscribed” may represent loyalty or email rather than this SMS program.
• Test pending confirmations, changed numbers, merged profiles and withdrawals during cutover. Define the active sending system and the owner of final changes.
• Review sender/brand or purpose changes separately. Do not assume permission is transferable to another business.

Blackleaf texting can complement supported existing POS systems without adopting Blackleaf POS. Review actual integration scope. Do not text an unknown list merely to ask whether the people want texts.

Test the records that should hold a send.

Choose representative records from each source and trace them through the actual approved process. Use authorized test recipients and a permitted route for any message test. Record observed results, not just intended settings.

Track unresolved evidence, suppression processing gaps, accidental re-enrollment and exceptions by source. Message delivery is a different outcome; use the deliverability guide for accepted, delivered, failed and unknown states.

Keep a dated source checklist.

Record the source, version or publication date, date reviewed, relevant jurisdiction and the person responsible for applying it. Recheck before a new route, sender, enrollment design or material policy change.

• 47 CFR §64.1200: federal consent and revocation rules; reviewed October 15, 2026.
• FCC DA 26-12: January 6, 2026 narrow revocation waiver; reviewed October 15, 2026.
• CTIA principles: May 2023 industry guidance; reviewed October 15, 2026.
• Twilio error 30860: provider-specific cannabis/CBD restriction, not a statement of every provider’s scope; reviewed October 15, 2026.

Keep your actual provider agreement and jurisdiction-specific legal review alongside this checklist. Platform help documentation explains configuration; it is not a substitute for the underlying law or contract.

Consent questions, answered.

Bring the record, not just the list.

Bring Blackleaf your current system, signup sources, disclosure versions, permission events and suppression process. We can review the supported data and messaging setup while your legal team determines the requirements for the actual program.

Review your texting setup Explore Blackleaf texting