Why Having a Phone Number Isn’t Enough for Marketing Texts

Many businesses assume that collecting a phone number during a transaction gives them permission to send marketing texts. It does not.

Under the Telephone Consumer Protection Act, prior express written consent is a legal prerequisite for marketing SMS in the United States. Simply having a number on file from checkout, invoicing, or a past appointment does not meet that standard. RG Digital Marketing states plainly that "they gave us their phone number at checkout" is not the same as documented consent for marketing texts. The distinction is enforceable and the penalties for ignoring it are real.

Consent must be channel-specific. A customer who agreed to receive email updates has not automatically agreed to receive texts. Modern compliance systems store consent at the contact-point level — separately for each email address and phone number — and verify it in real time before every send. Bloomreach Engagement, for example, checks for a distinct "SMS consent" flag before queuing any follow-up message, and only triggers that text if the customer did not already engage with the preceding email. Their reactivation logic also caps email frequency at one per 30 days and suppresses contacts after three to five touches with no response.

• Possessing a phone number ≠ documented consent for marketing texts
• Consent is channel-specific: email consent does not cover SMS
• Real-time verification at send time is the emerging standard
• Suppression after 3–5 non-responsive touches protects deliverability

This is why reactivation sequences should lead with email, using a clear unsubscribe mechanism, and layer in SMS only for contacts with documented SMS consent who have already re-engaged. RG Digital Marketing recommends keeping SMS off the table entirely for any contact where that consent cannot be documented. CallMyCustomers applies this principle in every campaign: we review each list up front, segment by consent status, and run outreach only through channels where permission is documented — so every message stays compliant and every reply routes back to a booked appointment.

How Top Platforms Capture and Verify Consent in Practice

Consent requirements only become real when a platform has to enforce them at the moment a message goes out. The best way to understand expressed written consent in practice is to look at how leading marketing systems actually capture, store, and verify it before every send.

Microsoft Dynamics 365 Customer Insights - Journeys takes a granular approach. As Microsoft's compliance documentation explains, "consent is captured and stored at the contact point level," where a contact point is the actual destination for a message, such as an email address or phone number. This means one email address can consent to commercial communications while another email or phone number for the same person might not.

Bloomreach Engagement demonstrates the same discipline in its reactivation workflows. Its system defines a lapsing customer as someone with no purchase in 3–15 months and no email engagement in the last 180 days, then checks whether the customer still has emailing consent before anything is sent, according to Bloomreach's campaign documentation. Consent is verified in real time at execution, not assumed from an old opt-in timestamp.

The most important pattern across both platforms is channel-specific consent. Bloomreach's SMS follow-up is only triggered if a customer has explicit "SMS consent" and didn't engage with the initial email, which is sent first with a five-day gap before any text attempt. Email and SMS permissions are tracked separately, so consent for one channel never carries over to another.

This reflects the legal reality of the TCPA. As reactivation marketing guidance puts it, "they gave us their phone number at checkout is not the same as documented consent for marketing texts." The recommended sequence is email first, with SMS layered in only where documented consent exists.

The best practices that emerge are consistent across platforms:

• Store consent per channel and per contact point, not per customer record
• Verify current consent status in real time before every send
• Sequence email first, holding SMS back for contacts with documented consent
• Cap frequency — Bloomreach limits its reactivation campaign to a maximum of 2 emails per 30-day window

For a done-for-you service like CallMyCustomers, these same principles shape how reactivation outreach runs: every message is owner-approved before it's sent, opt-outs are honored immediately, and consent for each channel is treated as its own permission rather than an inherited one. The result is outreach that feels useful rather than pushy — and stays on the right side of the rules that govern it.

How CallMyCustomers Ensures Expressed Written Consent in Every Campaign

How CallMyCustomers Ensures Expressed Written Consent in Every Campaign

CallMyCustomers builds expressed written consent into every step of their reactivation process, starting with the client's approval of all outreach materials before any message is sent. This permission-based model ensures that every communication reflects the business's voice while meeting TCPA requirements for documented consent. Industry research confirms that merely having a phone number on file does not constitute valid consent for marketing texts, making this upfront approval critical.

Their process sequences contact by initiating with email first, only layering in SMS follow-ups for contacts who have demonstrated engagement and where documented SMS consent exists. Best practices show that SMS should only be sent if a customer has specific SMS consent and did not engage with the initial email, preventing unauthorized messaging. This approach aligns with reactivation sequences that typically run 3 to 5 touches over 2 to 4 weeks, ensuring compliance while maximizing response rates.

Consent is managed through real-time verification and channel-specific tracking, mirroring systems that store consent per contact point and check current status before sending. Technical frameworks emphasize that consent must be tracked separately for email and SMS channels, a standard CallMyCustomers honors by verifying opt-in status at execution. Lists are reviewed and segmented upfront, with opt-outs honored immediately and suppression applied after 3 to 5 non-responsive touches, maintaining list hygiene and respecting customer preferences throughout the campaign lifecycle.