SMS opt-out via STOP persisted and respected for all future messages

TCPA (47 U.S.C. § 227) imposes statutory damages of $500–$1,500 per message sent to a consumer who has opted out via STOP. GDPR Article 21 and CCPA § 1798.120 impose parallel opt-out obligations in their jurisdictions. An in-memory opt-out store survives only until the process restarts; a persistent database table that is never read before sends is functionally equivalent to no opt-out at all. The failure mode is silent: every SMS send succeeds from the carrier's perspective while each one adds to legal exposure. A single batch run against a list that includes opted-out numbers can generate thousands of violations before anyone notices.

Persist opt-out status in a dedicated database table and route every SMS send through a single function that checks it before calling the carrier API. Add a webhook handler at src/app/api/webhooks/sms/route.ts that writes STOP replies to the table immediately:

// prisma/schema.prisma
model SmsOptOut {
  phone_number String    @id
  opted_out_at DateTime
  opted_in_at  DateTime?
}

// src/lib/sms.ts — central send function
async function sendSMS(phoneNumber: string, message: string) {
  const optOut = await db.smsOptOut.findUnique({ where: { phone_number: phoneNumber } })
  if (optOut?.opted_out_at && !optOut.opted_in_at) return { blocked: true }
  return twilioClient.messages.create({ body: message, from: process.env.TWILIO_PHONE!, to: phoneNumber })
}

Every SMS-sending function in the codebase must call sendSMS() — not the Twilio client directly.