SMS opt-in popups: what compliance actually requires
An SMS opt-in popup collects a phone number and a permission in the same step. The technical part is a field with the right input type. The part that decides whether the list is usable is the disclosure: what the person is signing up for, how often, how to stop, and a record that proves they saw it. iOS and Android differ in how the field behaves, not in what the law expects.
Key takeaway: show the phone field, an unticked consent line naming the programme and the message frequency, the opt-out instruction, and a link to terms, then store the text and timestamp with the number. Send one confirmation message before the first campaign.
The short answer
- Collect in one step: number plus explicit consent, with the disclosure visible on the same screen. A second screen for the legal text loses most of the opt-ins.
- Confirm once: a single confirmation message that repeats the programme name and the stop instruction turns a typed number into a subscriber you can message.
- Keep the proof: the number, the exact disclosure, the timestamp, the page and the consent mode. Without it, every complaint becomes an argument you lose by default.
Rules differ by country, and the penalties differ more. In the United States the Telephone Consumer Protection Act sets the standard for marketing texts, in the European Union the GDPR and the ePrivacy rules apply. This is general information, not legal advice.
What the popup must contain
| Element | What it does | Common failure |
|---|---|---|
| Phone field | Collects the number with the right keyboard and country format | A free text field that accepts anything, then a list full of invalid numbers |
| Consent line | States what the person agrees to receive, from whom | "Get updates" with no programme name and no frequency |
| Opt-out instruction | Explains how to stop, usually a keyword reply | Present in the terms but not in the popup, so the person never saw it |
| Message frequency | Sets the expectation that keeps complaint rates low | Unlimited frequency implied, then a spike of opt-outs on the first campaign |
| Terms link | Holds the full programme description | A link to the general privacy policy with no SMS section |
What changes between iOS and Android
The legal requirements do not change. The behaviour of the field and the screen does.
- Input type: use a telephone input with the country prefix pre-filled from the page locale. iOS shows a numeric keypad for this input type, Android shows a dial pad. A text input opens a full keyboard and invites typos.
- Autofill: both systems offer to fill the number, and the offer appears above the keyboard or in a bar. Design the popup so the autofill suggestion does not cover the consent line: on a small screen, the consent text is often pushed out of view exactly when the person is about to submit.
- Keyboard height: the on-screen keyboard takes about a third of the screen. A popup that opens its field automatically will be half hidden on iOS and almost entirely hidden on some Android devices, unless the layout scrolls.
- Back gesture: iOS uses a swipe from the edge, Android uses a system back button or gesture. A popup that traps the back action will be closed through the system control, sometimes leaving the page in a scroll-locked state.
- Message handling: the confirmation arrives in the default messaging app on both, but link previews and sender formatting differ. Test the confirmation on a real iPhone and a real Android, not in an emulator.
Build it in five steps
- Decide the programme. A name, a purpose, a frequency and an offer. "Back-in-stock alerts, about four messages a month" is a programme. "Updates" is not.
- Write the disclosure before the design. If the text does not fit the popup at 12 pixels on a phone, shorten the programme, not the disclosure.
- Turn on the consent field and make it unticked. In GrowthTools the consent field is configured per widget with its own text, so the SMS wording can differ from the email wording on the same site.
- Send the confirmation. Repeat the programme name, the frequency and the stop instruction. If your provider supports a reply-based confirmation, require the reply before adding the number to the main list.
- Test three devices. One iPhone, one Android, one small screen. Check that the consent line is visible while the keyboard is open, that the submit button is reachable, and that the confirmation arrives with a readable sender name.
Mobile layout rules that also protect SEO
An SMS popup is an overlay on a phone, which puts it under the same scrutiny as any interstitial. Keep it dismissible, avoid covering the main content on page load, and never show it before the visitor has done something. Our mobile interstitial penalty guide covers the coverage and dismissal rules, and exit intent on mobile covers the signals that make a delayed popup feel earned rather than random.
What to measure
- Opt-in rate per hundred mobile sessions, with the widget on the pages where it appears.
- Confirmation rate if you use a reply-based confirmation. A large gap between opt-ins and confirmations means the disclosure or the number entry is misleading.
- Opt-out and complaint rate on the first two campaigns. It is the honest test of whether the frequency promise matched reality.
- Revenue per message compared with email. SMS costs more per send in most countries, so the comparison has to be per message, not per subscriber.
Honest limits
SMS lists are small, expensive and easy to burn. One campaign sent to a list collected with a vague disclosure can produce enough opt-outs and complaints to make the channel unusable, and the damage is not recoverable by apologising. Start with one programme on one page, measure the first two sends, and only then widen the placement. If you cannot staff replies to the stop keyword, do not run the programme at all.
Collect numbers with the consent line visible.
GrowthTools runs mobile capture widgets with a phone field and its own consent wording, from the same script as your other campaigns.
Create your free accountQuestions
In most jurisdictions, yes for marketing messages: consent must be an explicit affirmative action, which means an unticked box or a clear statement that submitting the form subscribes the person. A pre-ticked box or a hidden disclosure is not enough. Check the specific rules for the countries you message, since the United States and the European Union set different bars.
A confirmation step is worth it when the number is used for recurring campaigns, because it proves the person controls the phone and reduces complaints. It costs opt-ins. For a one-off transactional alert, the reply itself is the confirmation. Either way, store the disclosure the person saw and the timestamp.
Usually the keyboard. When the field opens automatically, the on-screen keyboard covers the consent line and the submit button, so the visitor sees a form that looks broken. Let the visitor tap the field, keep the consent text above the keyboard, and test on a real device rather than a responsive preview.
It can if it covers the main content immediately after load or is hard to dismiss. A popup shown after a visitor action, with a visible close control and no full-screen coverage on entry, stays within what Google describes as acceptable. Keep it dismissed-friendly and delayed.
Test one SMS programme on one page.
Create a free account, publish the popup on a single mobile page, and read the first two sends before widening it.
Create your free accountPublisher: GrowthTools by Seinsights. Product demonstrations are illustrative; results depend on your site and campaign.