SMS consent on Shopify: how to collect it the right way

This is general information, not legal advice. If you're unsure about your setup, talk to a lawyer who works on marketing compliance.

What does SMS consent actually mean?

In the US, marketing texts sent by an automated system need what the TCPA calls "prior express written consent," which names the specific seller. In plain words: the person agreed, in writing (a checkbox or form counts), to get marketing texts from you specifically.

Klaviyo puts it simply: "Individuals must explicitly agree to receive SMS messages." It also says consent doesn't carry across brands, and purchased, affiliate and lead-gen lists don't count.

I treat SMS as a more acute form of marketing than email. It's timely, it's urgent, and it doesn't carry much brand awareness. That's exactly why commitment to the list matters, and why I'm stricter with it than with email.

Where should I collect SMS consent?

Two places, and they work together.

1. A two-step signup form

Klaviyo calls multi-step forms "the best option for collecting both email and SMS consent." Step one asks for the email. Step two asks for the phone number, with SMS consent language right above the button.

Klaviyo only recommends a single-step form for both when double opt-in is on and SMS is clearly optional. A two-step form is cleaner, and it doesn't put the phone field in the way of the email signup.

For how to get more people through the form in the first place, see signup form conversion rate.

2. The SMS checkbox at Shopify checkout

In Shopify, go to Settings, then Checkout. Under Customer information, make the phone number optional or required. Under Marketing opt-in, set SMS to "Checkout only," and save. Shopify also wants terms of service and a privacy policy on your Policies page, and it suggests editing the checkbox text if you send abandoned cart texts.

Then connect it to Klaviyo. In Klaviyo, go to Integrations, then Shopify, then Sync settings, and on the "From Shopify" tab check the box to sync Shopify text message subscribers into an SMS list. Klaviyo's notes worth knowing:

• It syncs first-time SMS subscribers. People who subscribed before you turned it on need a separate process.
• Consent syncs once the customer checks the box and clicks "Continue to shipping," even if they never finish the order.
• Keep email and SMS on separate lists.
• Double opt-in is strongly recommended.

What disclosure language do I need?

Klaviyo's sample disclosure covers the pieces. Paraphrased, it says the person:

• Consents to receive informational and marketing texts from your company, including texts sent by autodialer.
• Understands "Consent is not a condition of purchase."
• Knows "Msg & data rates may apply. Msg frequency varies."
• Can unsubscribe by replying STOP, and can text HELP for help.
• Agrees to your privacy policy and terms, with links.

The CTIA, the wireless industry group whose messaging guidelines carriers follow, asks for the same things: name the program and the sender, disclose terms, fees and how to opt out, and don't use deceptive language. Standard STOP wording should be used, and END, UNSUBSCRIBE, CANCEL and QUIT should work too.

Put the disclosure above the checkbox or button, everywhere you collect consent. Not in a footer, not behind a link.

Should I use double opt-in for SMS?

Yes. This is one place I'm the opposite of my email advice.

For email, I set accounts to single opt-in. Someone who typed in their email wants to be on the list, and extra steps can stop a first order. I explain why in Klaviyo double opt-in.

For SMS, I want double opt-in. Klaviyo turns it on by default for SMS lists and says single opt-in "is not recommended for SMS." It also says double opt-in is required by some carriers and for abandoned cart texts in the US and Canada. If you want to send abandoned cart texts at all, you need it.

Can I text phone numbers I already have?

Only if those people agreed to marketing texts from you. A phone number from an order, a customer service ticket or a wholesale contact isn't SMS consent. Neither is a list from another brand, an affiliate or a vendor.

If you're moving subscribers from another SMS tool, Klaviyo's importer asks whether the contacts subscribed to messaging. Import the consent timestamps if you have them. Klaviyo says if someone opted out after the timestamp you import, it won't re-add their consent. Turn off welcome flows before you import, so you don't blast a welcome text to everyone at once.

If you can't show where and when a group of numbers opted in, my advice is simple: don't text them. Invite them to sign up again by email instead.

What are the rules once someone is subscribed?

A few that catch brands out:

• Opt-outs: under FCC rules in effect since April 11, 2025, people can revoke consent by any reasonable means, and replies like stop, quit, end, cancel or unsubscribe count automatically. You have to honor it within 10 business days at most. A broader "revoke-all" rule, where opting out of one kind of message covers unrelated ones, has been delayed to January 31, 2027.
• Quiet hours: Klaviyo's flows don't send texts before 8 AM or after 9 PM in the recipient's local time by default. Some states are stricter, like Florida (8 AM to 8 PM). Klaviyo has an optional state-level setting for these.
• Marketing vs transactional: Klaviyo tracks them separately. Marketing consent also covers transactional texts, but not the other way around. A STOP removes both.

You may also have heard about the FCC's "one-to-one consent" rule. It never took effect. A federal court vacated it in January 2025, and the FCC repealed it later that year.

How do I explain this to my team without scaring them off SMS?

Here's how I'd frame it: consent rules and good SMS marketing point the same direction. You want a small list of people who asked to hear from you, texts that are timely, and an easy way out.

Texts are reminders. Emails are branding and awareness. Use texts to point people back to the email, or to the one thing that's urgent right now, like a shipping cutoff. When you just turned SMS on, send your highest-leverage marketing and see what works. And in any automation, I'd include a discount after the first text.

If you're still deciding whether SMS is worth it, start with should I add SMS marketing. If you're choosing a tool, my comparison of Klaviyo SMS vs Postscript vs Attentive covers it.

What should I check first in my own setup?

1. Your signup form: is SMS on its own step, optional, with the full disclosure above the button?
2. Your SMS list settings: is double opt-in on?
3. Shopify checkout: is the SMS checkbox on, and is it syncing into a separate SMS list in Klaviyo?
4. Any imported numbers: do you know where and when they opted in?
5. Your terms and privacy policy: are they live and linked from the disclosure?

FAQ

WRITTEN BY Jack White

Founder of Bardown Digital, a Chicago-based Klaviyo email and retention agency for Shopify brands. He's worked with brands doing $500K to $100M a year, with $100M+ in email-attributed revenue across them.

Instagram @jackintheinbox LinkedIn