SMS Compliance

The Airship Service provides customers with a platform for building successful SMS marketing programs by supporting compliance with laws and industry best practices as summarized in this document. These guidelines represent our current understanding of common compliance requirements generally applicable to Airship and our customers and do not constitute legal advice.

Some Background on SMS Regulation

Meeting regulatory requirements and maintaining best practices to support customer relationships are critical for brands that use SMS in their marketing strategy. Regulations such as the US Telephone Consumer Protection Act of 1991 (TCPA), the Canadian Anti-Spam Law (CASL), the General Data Protection Regulation (GDPR), the Directive on Privacy and Electronic Communications (the EU’s ePrivacy Directive), and a variety of local US state laws and individual EU countries’ regulations include strict requirements for sending SMS marketing messages.

In addition to country- and state-specific laws and regulations that govern SMS messaging, wireless industry groups publish best practice guidelines for companies engaged in SMS marketing. These include key standards from the wireless industry association CTIA:

• CTIA Messaging Principles and Best Practices 
• CTIA Short Code Monitoring Handbook 

Certain telecommunications providers may also have their own Code of Conduct to govern traffic through their services, such as T-Mobile’s Code of Conduct and Mobile Marketing Association’s Consumer Best Practices for Messaging .

General Requirements

You must obtain consent and provide disclosure.

Prior Express Written Consent

TCPA in the US, and other applicable laws around the world, a business must provide clear and conspicuous information about its practices and get the recipient’s express written consent to receive text messages before sending an automated message. Brands should never send messages to opt-in lists that have been shared or sold. Also, brands should check for the legal age of consent and the types of disclosures required based on their use case and where the recipient is located. In addition, brands should verify their use cases and numbers against local Do Not Call (DNC) registries to ensure no other restrictions may apply. Because considerations regarding DNC registries are highly specific to each use case, Airship cannot apply number filtering or automated channel uninstall for mobile numbers that appear on a DNC, in the US or any other known DNC.

Clear and Conspicuous Disclosure

Brands must be clear, concise and upfront in the call to action that prompts the consumer to opt in to receive SMS messages:

• Identify the business to whom consent is being provided
• Identify the consumer’s phone number
• Include a description of the recurring text messaging program and types of messages the consumer will receive (e.g., account alerts, news alerts, promotional alerts, coupons, reminders, etc.)
• Disclose that texts will be sent using automated technology
• Disclose that the consumer is not required to provide consent as a condition of a purchase
• Disclose specific message frequency or that “message frequency varies”
• Disclose that message and data rates may apply
• Provide Customer Care and Opt-Out instructions
• Provide links to applicable Terms of Use and Privacy Policy.
• Terms of Use should include a section that details the SMS program, including program description and opt-in, opt-out, and help information
• Privacy Policy must explicitly state that mobile opt-in data will not be shared or sold

Text JOIN to 22255 to receive recurring autodialed
offers and information from {BRAND NAME} Terms and
Privacy Policy at [brand.com/sms-terms]. Message
frequency varies with use. No purchase required.
Reply HELP for help, STOP to end, Msg&data rates
may apply.

Written Consent (Opt-In)

Brands may obtain digital consent via text message, email, website form, voice recording, etc. with the following requirements:

• Cannot use a pre-checked box

• Cannot require consent to receive SMS messages as a condition of sale

• Should keep records of consent for at least four years (the statute of limitation for TCPA claims is four years)

• Double opt-in, while not strictly required, is supported and recommended by Airship as a best practice

• With single or double opt-in, the first text message should be a compliance message confirming opt-in and reiterating important information:

  • Identifying the brand
  • Message frequency, if not already provided
  • What types of messages
  • Message and data rates may apply
  • Customer Care and Opt-Out instructions
  • Provide links to terms and privacy policy, if not already provided

  Some jurisdictions may have additional consent requirements, including requirements around obtaining express written consent, which may need to include the consumer’s phone number, express authorization to receive the message, and other notifications. Brands should check with their legal or regulatory compliance teams for the types of disclosures required based on their use case and where the recipient is located.

{BRAND NAME}: You've subscribed to receive recurring
promotional msgs. Reply HELP for help, STOP to end.
Msg&data rates may apply.

Time of Day Guidelines

Brands should schedule their SMS notifications to account for carrier delivery delays, especially in locations with time of day requirements, including those required under TCPA and local state laws, which may be more restrictive.

The TCPA prohibits telephone solicitation (including text messages) before 8 AM and after 9 PM in the recipient’s time zone. A best practice is to send SMS notifications between 9 AM and 8 PM in the recipient’s time zone. Local restrictions may be more stringent than the 8 AM to 9 PM TCPA standard. Brands should confirm time of day requirements for each location of operation. If brands have recipients in different time zones, then multiple time zones should be taken into consideration.

In addition, if brands are targeting large audiences, scheduling further in advance of the prohibited period is advisable. Otherwise, the volume of messages may cause additional delivery delays.

Customer Care and Opt-Out Instructions

SMS programs should promote customer care contact and opt-out instructions in initial SMS program disclosures and then with every recurring message or at least once per month.

Reply HELP for help, STOP to end

Opt-In Methods

Airship SMS supports two opt-in methods. Based on local regulatory requirements, additional consents may be needed as described above. Brands should check with their legal or regulatory compliance teams for the types of disclosures required based on their use case and where the recipient is located to complement the Airship Service configuration.

Mobile-Originated Opt-In

In response to a call to action from the brand, a consumer texts JOIN from their mobile device or responds through another form — i.e., a website, app, or any means other than sending a text with an opt-in keyword. This triggers the Airship SMS channel to send a double opt-in request (example message below, customizable for your brand):

{BRAND NAME}: Reply Y to agree to receive recurring
autodialed {type of messages/alerts} and to our Terms
of Service [insert TOS hyperlink] and Privacy Policy
[insert PP hyperlink]. No purchase rqd. Message
frequency varies. Reply HELP for help, STOP to end.
Msg&data rates may apply.

In the Airship SMS channel, the consumer will not get added to the opt-in list until they reply with the keyword Y. Once added to the list, Airship SMS sends an automatic confirmation alert:

{BRAND NAME}: You've subscribed to receive
recurring {type of messages/alerts}. Message
frequency varies. Reply HELP for help, STOP
to end. Msg&data rates may apply.

Brand-Managed Opt-In

Opt-in owned by the brand and uploaded to Airship SMS via API or CSV file

The consumer uses the brand’s website, app, paper form or other means to opt in to receiving SMS messages. The phone number and opt-in date/ time are then passed to Airship by the brand via the Airship API or uploaded via the Airship platform, and Airship SMS tracks the opt-in date/time in our database along with the phone number.

If the number is not already in the Airship opt-in database for that brand, the number is automatically added to that opt-in database. If uploading via CSV, any number on the uploaded list that does not include an opt-in date/time is not added to the opt-in database and no message is sent to that number.

Brands must make sure that the call to action for the opt-in clearly provides all necessary information under applicable law and that the consent meets applicable legal requirements.

Transactional messages

Transactional messages are messages that are directly related to the service being provided, such as delivery updates for a package or appointment reminders. Once the consumer provides the brand with legally appropriate consent to receive transactional messages, the brand triggers the sending of the transactional message by providing the phone number and opt-in date to Airship SMS via our API as described above.

It is important to note that consent to receive a transactional SMS notification cannot be used for sending any marketing SMS messages. Each opt-in database for a brand will have the same scope of messages, such as promotional alerts or account update alerts.

A separate code will be required to add another type of campaign. Brands should make sure that written consents from legacy or existing customers include all legally required elements of a consent, and if in doubt, obtain new consents from existing consumers covering any missing requirements.

Opt-Out Methods

Under the TCPA in the US, and other applicable laws around the world, a consumer may revoke consent through any reasonable method, including verbal communication or, in the context of text messaging with keyword such as STOP. The brand should confirm that it is able to process requests received (1) via text, using words other than STOP (i.e., unsubscribe, cancel, etc.), and (2) via other channels, for example if a customer contacts customer support and asks to be opted-out of text messages. The business should unsubscribe that consumer out of all recurring text messaging programs and cease text messaging to that consumer, unless that consumer subsequently opts-in.

Mobile-Originated Opt-Out

When a consumer texts the brand with a keyword like STOP (or any of the other opt-out keywords specified by law or best practices), Airship SMS automatically responds with a confirmation and adds an opt-out date/time to our database (example message below, marketers can tailor the content of this opt-out confirmation message to fit their workflow and brand requirements):

{BRAND NAME}: You have opted-out and will no longer
receive messages. Reply HELP for help

Airship does not send messages to any numbers that have opt-out dates associated with them. If the consumer decides to opt in again, the Double Opt-In or Brand Managed Opt-In methods described above will register a new opt-in date.

Website- or App-Originated Opt-Out

If a consumer changes their preferences in a Preference Center—or in some other way via the brand’s website or app—the brand must pass the opt-out information to the Airship platform using the Airship API. Airship then adds the opt-out date/time to our database.

Carrier Deactivation

Mobile network operators in the USA (like AT&T, Verizon, etc.) provide Airship with a list of deactivated phone numbers on a daily basis (i.e., consumers who have disconnected service with that operator). Airship SMS automatically uninstalls these numbers (removes them from our database entirely) so that the brands don’t inadvertently message the wrong person if that number gets reassigned.

National Do Not Call Registry (DNC)

Airship does not apply number filtering or automated channel uninstall for mobile numbers that appear on a DNC, in the US or any other known DNC registry.

Reporting and Records

Airship SMS reports give brands the ability to view opt-in and opt-out status for consumers who have provided consent to receive SMS messages from the brand.

Brands should also maintain all consent records that provide relevant details. Various locations will have different requirements for how long a brand should maintain opt-in and opt-out records for SMS. Airship retains opt-in date/time records and opt-out date/time records for a mobile phone number in our database for four years. Airship customers can download their full channel listing via the Channel Listing API, which includes channel created-on date, the MSISDNThe mobile phone number of an individual in your Airship audience. Each MSISDN represents an individual mobile device., associated Sender IDAn originating phone number or string identifier used to indicate who an SMS message comes from. Members of your audience subscribe (opt in) to each sender ID they want to receive messages from. (short code or long code), current opt-in or opt-out status, and opt-in or opt-out date for all SMS channels. You can also send opt-in and opt-out events into other business systems via Real-Time Data StreamingA service that delivers engagement events in real time via the Data Streaming API or an Airship partner integration..

Mobile numbers that are uninstalled through Carrier Deactivation numbers will have their SMS message history purged from Airship.