Text messaging is the fastest way to reach a customer and one of the easiest ways for a business to land in legal trouble. Claims over unwanted texts are common, the penalties are counted per message, and “the software sent it automatically” has never been a defence.
This guide to GoHighLevel SMS compliance explains the rules in plain English — consent, opt-in wording, quiet hours and opt-outs — and shows which settings to configure in each sub-account. It covers United States rules in general terms and is not legal advice. Laws vary by state and change often, so have a lawyer review your own process.
The rules that apply
- The TCPA — the federal law governing calls and texts to mobile phones, enforced by the FCC and through private lawsuits.
- State laws — several states have their own, stricter rules on hours, frequency and consent.
- The Do Not Call Registry — relevant to marketing messages sent without prior consent or an existing relationship.
- Carrier and industry requirements — the standards behind A2P 10DLC registration and message filtering. They are not law, but breaking them gets messages blocked.
Registration and compliance are different things. Registering a brand and campaign allows messages to be delivered; it does not make an individual message lawful. Our A2P 10DLC guide covers registration. This article covers what you are allowed to send, and to whom.
Consent: the foundation
The type of consent you need depends on the message.
| Message type | Examples | Consent generally needed |
|---|---|---|
| Conversational | Replying to a customer who texted first | Implied by their message |
| Informational | Appointment reminders, delivery updates | Express consent — they gave the number for that purpose |
| Marketing | Offers, promotions, re-engagement | Express written consent |
Three principles apply throughout:
- Consent must be clear. The person has to know they are agreeing to receive texts from your business.
- Consent cannot be a condition of purchase for marketing messages.
- Consent does not transfer. Permission given to one company is not permission for another. This is why bought lists are so dangerous.
Opt-in wording that works
Good consent language on a form contains the same elements every time:
- the name of the business sending the messages;
- what kind of messages will be sent;
- roughly how often;
- that message and data rates may apply;
- how to stop and how to get help;
- links to the privacy policy and terms.
An example for a marketing checkbox:
I agree to receive marketing text messages from Smith Dental at the number provided. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help. Consent is not a condition of purchase. See our Privacy Policy and Terms.
Practical points for forms in GoHighLevel:
- Use a checkbox that is not ticked by default.
- Use separate checkboxes for marketing messages and for service messages such as reminders. Reviewers increasingly expect this.
- Do not make the marketing checkbox a required field.
- Place the wording next to the phone number field, not hidden in a footer.
- State in the privacy policy that mobile numbers and SMS consent are not shared with third parties for marketing.
See our forms and surveys guide for building the form itself.
Quiet hours
Federal telemarketing rules restrict contact to between 8 a.m. and 9 p.m. in the recipient’s local time. Some states set narrower windows, restrict Sundays and holidays, or limit how many messages may be sent in a day. If you text nationally, follow the strictest rule that applies to your recipients.
In GoHighLevel, use the workflow timing settings so that actions run only within set hours and days. A lead who opts in at midnight should receive the first text the next morning. Check that contacts’ time zones are recorded, because a 9 a.m. send on the east coast is 6 a.m. on the west.
Opt-outs
- Honour every reasonable request to stop, not only the word STOP. “Please remove me” and “wrong number” count too.
- Act promptly. Stop sending as soon as the request is received.
- Do not send further marketing after an opt-out, beyond a single confirmation.
- Never override the status. GoHighLevel marks a contact as do-not-disturb for SMS when they reply STOP. Avoid workflows or imports that switch it back.
- Train the team to mark a contact as do-not-disturb when a customer asks by phone or email.
Settings to check in every sub-account
- A2P 10DLC registration or toll-free verification is approved for the sending number. See our toll-free verification guide if you use a toll-free line.
- Every form with a phone field has compliant, unticked consent checkboxes.
- Consent is stored on the contact record with the date and source.
- Marketing workflows filter on the consent field, so only opted-in contacts enter.
- Workflow time windows are set.
- The first message in any sequence names the business.
- Promotional messages include opt-out wording.
- Imported lists are checked for consent before any message is sent.
Common mistakes
- Texting leads bought from a list vendor.
- Treating a customer of five years ago as opted in.
- Using one pre-ticked box for “all communications”.
- Sending promotions from a campaign registered for reminders.
- Continuing a sequence after someone asked to stop in their own words.
- Assuming an agency’s registration covers its clients.
State rules can be stricter
Federal law sets a floor, not a ceiling. Several states have passed their own telemarketing laws that go further — shorter permitted hours, limits on how many marketing messages may be sent to one person in a day, broader definitions of automated systems, and in some cases a private right to sue. A business that texts customers across state lines has to respect the rules where the recipient is, not where the business is based.
The practical approach for most small businesses is to adopt the strictest common standard everywhere: daytime sending only, a low message frequency, clear written consent and immediate opt-outs. That keeps you inside nearly every state rule without tracking each one separately. Businesses running high-volume campaigns should take specific legal advice.
What agencies should put in writing
- The client confirms that every contact it supplies has consented to receive texts.
- The client is responsible for the accuracy of its business details in any registration.
- The agency will not send to purchased or scraped lists.
- Who writes and approves message content.
- How opt-outs received by phone, email or in person are passed on and recorded.
- That the agency may pause sending if it believes a campaign is non-compliant.
A short clause covering these points protects both sides and sets expectations before the first campaign.
Frequently asked questions
Can I text someone who filled in a contact form?
You can generally reply about their enquiry. Ongoing marketing texts need clear consent, which is why the form should collect it.
Do appointment reminders need consent?
The customer should have given their number for that purpose. Reminders are treated more leniently than promotions, but a reminder that includes an offer becomes marketing.
How long should I keep consent records?
Keep them for as long as you message the contact and for several years afterwards. Your lawyer can advise on the period for your state.
Does this apply outside the United States?
Other countries have their own laws, such as CASL in Canada and privacy and electronic marketing rules in the UK and EU. The principle of clear consent is common to all of them.
Who is liable: the agency or the client?
Potentially both. The business sending the message is responsible, and an agency that designs or sends campaigns can be drawn in. Put responsibilities in writing.
This guide is part of our GoHighLevel Setup Guides series — setup guides covering the whole topic.
