Privacy Policy and SMS Compliance Checklist

Before launching OneText, carriers review three things to approve your SMS program and verify your toll-free number: your Privacy Policy, your Terms of Service, and your text message sign-up form. Missing or conflicting language in any of them is the most common reason verifications are delayed or rejected.

Make the updates below before we submit. Getting them right up front prevents delays and rejections.

Part 1: Privacy Policy

Add an SMS/Text Messaging section

Add an SMS/Text Messaging section immediately after "How We Use Your Personal Information." This section covers the required disclosures, including message frequency and rates, STOP/HELP instructions, support contact information, and SMS opt-in data privacy.

Suggested verbiage:

SMS/Text Messaging

If you opt in to receive text messages from [Brand Name], we collect your mobile phone number to send you recurring automated marketing messages (such as promotions and new product announcements) and informational messages (such as order updates). Consent to receive text messages is not a condition of any purchase. Message frequency varies. Message and data rates may apply. Reply STOP at any time to unsubscribe, or HELP for help. You can also reach us at [brand email or phone number].

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.

Add an SMS opt-out line

Add the following to the end of your communication preferences section:

You may opt out of text messages at any time by replying STOP to any message we send.

Other things to check

• Make sure your Privacy Policy doesn't contain conflicting statements about selling or sharing SMS opt-in data or consent.

• Make sure your Privacy Policy and Terms of Service are live, accessible, and clearly linked on your brand's website. A broken link, redirect error, or missing page will delay or prevent approval.

Part 2: Terms of Service

Add an SMS/Text Messaging section to your Terms of Service covering the required disclosures, including the business name, types of messages, message frequency and rates, STOP/HELP instructions, support contact information, and a carrier liability statement.

Suggested verbiage:

SMS/Text Messaging Terms

By providing your mobile phone number and opting in, you agree to receive recurring automated marketing and informational text messages (such as offers and order updates) from [Brand Name]. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help. For additional assistance, contact [email or phone number]. Wireless carriers are not liable for delayed or undelivered messages. Participation is subject to our Privacy Policy and Terms of Service.

Part 3: Opt-In Form or Pop-Up

Branding and phone number field

Clearly display your brand name or logo as the primary branding, with any platform branding kept secondary. Include a clearly labeled phone number field, such as "Mobile number" or "Get texts from [Brand Name]."

Display your DBA and legal business name

Carriers compare the business name on your sign-up form to the name on your verification request. If you operate under a brand name (DBA) that's different from your registered legal business name, show both on the form so reviewers can match them. Carriers compare the business name on your sign-up form to the name on your verification request. If you operate under a brand name (DBA) that's different from your registered legal business name, show both on the form so reviewers can match them.

Lead with your DBA, since that's the name your customers know, and follow it with your legal business name. The easiest place to do this is in the SMS consent disclosure, for example: Lead with your DBA, since that's the name your customers know, and follow it with your legal business name. The easiest place to do this is in the SMS consent disclosure, for example:

...from [DBA Name] ([Legal Business Name]) at the number provided...from [DBA Name] ([Legal Business Name]) at the number provided.

Use both names exactly as they appear on your verification request, including punctuation and entity type (such as LLC or Inc.). If your DBA and legal name are the same, you only need to show it once. Use both names exactly as they appear on your verification request, including punctuation and entity type (such as LLC or Inc.). If your DBA and legal name are the same, you only need to show it once.

SMS consent and disclosure

Include a separate SMS consent checkbox that is unchecked by default and isn't combined with email consent. Place the disclosure directly below the phone field and beside the checkbox, using readable text and sufficient contrast. Include a separate SMS consent checkbox that is unchecked by default and isn't combined with email consent. Place the disclosure directly below the phone field and beside the checkbox, using readable text and sufficient contrast.

Example SMS consent disclosure:

By checking this box and submitting this form, I agree to receive recurring automated marketing text messages (such as offers, cart reminders, and order updates) from [DBA Name] ([Legal Business Name]) at the number provided. Consent is not a condition of purchase. Message frequency varies. Message & data rates may apply. Reply HELP for help or STOP to unsubscribe at any time. View our Terms and Privacy Policy.

"Terms" and "Privacy Policy" must be clickable links within the disclosure displayed in the pop-up.

Separate consent for different messaging use cases

Make sure your consent language accurately reflects the types of messages you intend to send. Consent to receive transactional messages (such as order updates) does not automatically authorize marketing messages, and vice versa. Obtain separate consent for distinct messaging use cases where required.

Suggested SMS consent disclosure:

By checking this box and submitting this form, I agree to receive recurring automated marketing text messages (such as offers, cart reminders, and order updates) from [DBA Name] ([Legal Business Name]) at the number provided. Consent is not a condition of purchase. Message frequency varies. Message & data rates may apply. Reply HELP for help or STOP to unsubscribe at any time. View our Terms and Privacy Policy.

"Terms" and "Privacy Policy" must be clickable links within the disclosure displayed in the pop-up.

Separate consent for different messaging use cases

Make sure your consent language accurately reflects the types of messages you intend to send. Consent to receive transactional messages (such as order updates) does not automatically authorize marketing messages, and vice versa. Obtain separate consent for distinct messaging use cases where required.

Optional consent and separate email signup

SMS consent must not be required to complete a purchase, proceed through checkout, or create an account. If your pop-up also collects email addresses, provide separate fields and consent for email and SMS, so customers can subscribe to email without providing a phone number or consenting to texts. If the phone field appears alongside an email field, clearly indicate that it's optional.

Example: compliant vs. non-compliant form

Don't have a Privacy Policy or Terms of Service?

We recommend using Shopify's policy generator. Shopify's standard templates don't include the SMS language carriers require, so add the sections in Parts 1 and 2 above, then publish both pages on your website.

Other Potential Blockers to Phone Provisioning

Brand falls under SHAFT category

If your brand falls under the SHAFT category, meaning it is related to Sex, Hate, Alcohol, Firearms, or Tobacco, carriers impose stricter requirements. These include a fully functional CTA (not a mockup) accompanied by a robust age gate. The age gate must require users to input their full date of birth. Simple yes/no confirmations are not compliant and will block approval.

Support email doesn't match brand domain

The support email provided must be a domain-based address that matches the brand, for example support@brandname.com. Personal email addresses such as Gmail, Yahoo, or Outlook are not permitted, and neither are ISV or marketing agency emails. These will result in delays or rejections during provisioning. The email must be from the public facing brand.

Brand must establish credibility before provisioning

If a brand is not yet live, the website should clearly indicate when it will launch. At minimum, carriers expect basic information about the business, such as an "About Us" page, product details, or social links, to verify legitimacy.

If the brand has no web presence, no social proof, and cannot be found via search, it may be flagged as untrustworthy and denied approval. Provisioning requires a clear understanding of who the brand is, what it sells, and how it operates.

Including all of the above from the start ensures a smooth provisioning process and avoids delays that can prevent your SMS program from going live on time.