SMS consent documentation
sms_consent with the verbatim disclosure text shown, identical to the production flow at /join-sms. All other consent flows described below are live at the URLs given.1. business overview
bandsbandsbandsis a personal digest tool for live music fans. it tracks bands a user chooses to follow, sources tour dates and news for those bands from public sources, and delivers a daily digest via the user's chosen messaging channel. the service also generates band and show recommendations based on a user-curated taste graph.
1a. consent model
Two-tier consent. Phone entry consents to a one-time TRANSACTIONAL SMS — the 6-digit verification code from Twilio Verify used to confirm number ownership. A separate, OPTIONAL, unchecked-by-default checkbox captures express written consent for the recurring MARKETING program: the daily digest, BREAKING tour announcements, band and show recommendations, and ticket reminders.
Marketing consent is not a condition of completing the verification transaction. A user can enter a phone number and verify it via OTP without opting in to the recurring program. When the marketing checkbox is unchecked, server-side we still record the consent event (with marketing_opt_in: false) but we do not insert an SMS notification channel and we do not send the welcome message. The checkbox carries the verbatim phrase "Consent is not a condition of purchase." per CTIA / TCR guidance.
2. SMS use cases
users authenticate their phone number via 6-digit OTP using Twilio Verify. this is the entry point for both new signups and existing-account additions of an SMS channel.
provider: Twilio Verify (managed OTP service, separate from A2P 10DLC traffic)
once a user has opted in, they receive a daily digest of new tour dates, news, and recommendations for the bands and cities they have explicitly chosen to follow. digest frequency is typically 1 message per day. burst frequency (1-3 messages per week) occurs when a band the user follows announces a tour.
when a user marks a show as "want tickets" or "going" via the agent interface, the service may send a one-time reminder message ahead of the show date with venue and time details.
3. consent collection flow
there are two ways a user provides SMS consent. both flows are live at production URLs.
path A: new-user signup
- user visits bandsbandsbands.app/auth and clicks the "sign in with SMS" button.
- user lands on bandsbandsbands.app/join-sms and enters their mobile phone number and display name.
- the transactional disclosure is shown inline under the phone field, and a separate UNCHECKED-BY-DEFAULT marketing opt-in checkbox is rendered below it (see section 5 verbatim). marketing consent is optional — the Continue button is enabled by phone validity alone, not by the checkbox.
- user clicks Continue. server calls Twilio Verify to send a 6-digit OTP.
- user enters the OTP. server verifies via Twilio Verify and creates the user account. server writes a consent record (section 8) capturing both disclosure texts and the actual checkbox state in
marketing_opt_in. - if the marketing checkbox was checked, server provisions an SMS notification channel and sends a one-time welcome SMS. if unchecked, the account is created with no SMS channel — the user can opt in to the digest later via settings.
path B: existing-user adds SMS to their account
- authenticated user visits bandsbandsbands.app/settings.
- user clicks "ADD SMS" in the CHANNELS section.
- user enters phone number; same two-piece disclosure as path A — inline transactional text under the phone input, separate optional marketing checkbox below (section 5 verbatim).
- user clicks Continue. server calls Twilio Verify to send a 6-digit OTP.
- user enters the OTP. server verifies and writes a consent record. if the marketing checkbox was checked, server writes a
notification_channelsrow withchannel_type='sms'and sends a welcome SMS. if unchecked, no channel is added.
4. live URLs (visit to verify the flow)
- phone-entry (new user): bandsbandsbands.app/join-sms
- settings "add SMS" (existing user): bandsbandsbands.app/settings
- primary login page: bandsbandsbands.app/auth
- privacy policy: /legal/privacy
- SMS terms: /legal/sms-terms
- terms of service: /legal/terms
a separate undocumented reviewer URL is provided in the campaign registration's reviewer-notes field. it is structurally identical to /join-sms (signup is fully self-serve) but tags the reviewer's test session with a distinct source_url in our consent records, so we can later distinguish reviewer traffic from real users in the TCPA audit trail.
5. consent disclosure language (verbatim)
two pieces of consent text are shown on the phone-entry screen. the first sits inline under the phone input and covers the transactional verification SMS. the second is on an unchecked-by-default checkbox and covers the recurring marketing program (the daily digest). marketing opt-in is optional — phone verification completes either way.
phone-entry disclosure (transactional)
"By entering your phone number and clicking "Continue", you consent to receive SMS messages from bandsbandsbands, including a verification code. Msg & data rates may apply. Reply STOP to cancel. Reply HELP for help. SMS Terms & Privacy Policy"
marketing opt-in checkbox (unchecked by default, optional)
"I also agree to receive promotional messages from bandsbandsbands (e.g. daily digest, tour announcements, band recommendations). Msg frequency varies. Consent is not a condition of purchase."
both texts are logged into sms_consent.disclosure_text_shown along with the actual checkbox state (recorded as sms_consent.marketing_opt_in) so we can prove what the user saw and what they affirmatively consented to.
6. sample messages
7. opt-out and HELP handling
recognized opt-out keywords
STOP response (auto-replied by Twilio)
HELP response (auto-replied by Twilio)
opt-out keywords are processed immediately by Twilio's built-in Advanced Opt-Out handler at the messaging-service level. additionally, users can opt out by removing the SMS channel from their settings page on the website.
8. record retention
we retain the following consent records for 4 years per TCPA requirements:
| data point | description |
|---|---|
| timestamp | when consent was provided (UTC) |
| phone number | normalized to E.164 format |
| source URL | the page where the user opted in (/join-sms or /settings) |
| consent disclosure | exact verbatim text shown to the user at opt-in |
| IP address | for fraud prevention and audit |
| user agent | browser/device information |
| user_id | if the user is authenticated (path B); null on path A |
| marketing opt-in flag | always false; we do not separate transactional vs marketing opt-in for this program |
consent records are stored in the sms_consent Postgres table on Supabase. access is restricted to the application service role.