Your email list doesn't carry SMS marketing consent, and assuming it does will get you fined

Email consent and SMS consent are two different signatures

SMS gets switched on in Klaviyo on a quiet Tuesday, and by lunchtime every profile with a phone number on file has been mapped into a text segment. The first campaign goes out that afternoon: a discount code, sent to people who ticked a box for emails at checkout months ago. Nobody replied YES to anything. The number was already in the customer record, and somebody decided that was consent enough.

The two regulators that matter both disagree. In the UK, PECR treats a marketing text as its own channel needing its own clear, specific opt-in, and the ICO sets this out in its direct marketing guidance. In the US, the TCPA requires prior express written consent for marketing texts, and the FCC explains the rules in its guide to unwanted texts.

Tick keep me updated by email and you've agreed to email. Nothing more. Regulators don't read intent into a tick box, and they want a specific yes tied to a specific channel. An email opt-in on file gets you nowhere once the question is whether this person agreed to be texted.

Look at where the phone numbers actually came from

Most of the numbers in a Shopify account were typed in for delivery updates, or collected by a returns process, or entered into an optional checkout field. Somewhere along the way they stop being a contact detail tied to a purpose and start being treated as a channel waiting to be switched on. The purpose was order tracking, and nothing the customer has done since has widened it.

Read that capture form the way a regulator would. It asks for one email address, promises a discount and a recipe book, and says nothing anywhere about texts. Everyone who came through it consented to email marketing. Mapping those profiles into an SMS segment invents a permission the form never asked for.

What each capture route actually gave you permission to do

Before any first text goes out, list every source of phone numbers in the account and write down what the person was told at the moment they typed theirs in. That table is the audit, and the honest version is usually shorter than the SMS segment suggests.

Klaviyo's SMS double opt-in exists to produce that last row. Someone signs up through a pop-up, a checkout field or a keyword campaign, gets a confirmation text, and replies with the keyword to activate. No reply, no active subscriber. The reply itself is the proof: a timestamped, channel-specific action taken on the person's own phone.

We keep finding that confirmation step switched off on accounts we take over, because launch week looks better without it. Opt-in counts jump the moment you stop losing the people who never bother replying, and on a dashboard that reads as growth. In a regulator's file it reads as a list with no evidence behind it. The expensive kind.

Re-permission the numbers you already hold

The numbers already in the account aren't a ready-made SMS list. They're the audience for one specific campaign: a single, well-built invite asking people to opt in to texts. Only the people who reply get flipped to marketing-active, and everybody else stays exactly where they were, still on the email list and off this one. For the invite to count as consent instead of noise, it needs a few specific things.

• Name the business in the message, so it doesn't arrive as an anonymous text from a short code
• Use plain opt-in language, reply YES to get offers and updates by text, never a vague stay connected
• Say roughly how often you'll text, and that message and data rates may apply
• Put STOP instructions in that first message, so opting out is as easy as opting in
• Activate only the people who reply affirmatively, and leave every silent profile untouched

The confirmed list will be smaller than the email list it came from, and that's the invite doing its job. The people it lost are the ones who never meant to opt in, which is precisely where complaints come from. Somebody on the team calling the keyword step a conversion leak? That's the instinct to override, because the friction is the mechanism.

Records, quiet hours and a STOP that sticks

Keep the trail, not just the status. For every subscriber you want the actual keyword reply and its timestamp on the profile, so the answer to a complaint is here's the reply they sent on this date. Never we believe they consented. A subscribed flag with nothing behind it is an assumption wearing a database column.

Quiet hours are a separate rule under both regimes, so keep marketing texts inside the day and the evening in the recipient's own time zone, however solid the opt-in was. STOP has to work instantly and completely, including for numbers synced in from a point of sale system Klaviyo never collected. Check that end to end instead of assuming it, and check it again whenever a new source starts feeding the account.

Two edges of the territory are worth naming. Transactional texts, order confirmations and delivery updates, run under different rules and need no keyword ceremony. Email's carve-out for existing customers is a separate story, told in the soft opt-in rules, with text the stricter channel. Running WhatsApp beside SMS adds a further rulebook again, so treat every channel as its own front door.