SMS STOP keyword immediately removes user from marketing SMS lists

TCPA §227(b) imposes strict liability for sending SMS to numbers on the national Do-Not-Call registry or after a STOP reply — penalties run $500–$1,500 per message. Most SMS providers (Twilio, Vonage) auto-honor STOP at the carrier level, but that protection evaporates the moment you switch providers or add a second sending path. Without an inbound webhook that writes opt-out status to your database, the only suppression record lives in a third-party system you don't control. GDPR Art. 7(3) and CCPA §1798.120 add parallel requirements: withdrawal of consent must be honored immediately and must propagate to all processing activities.

Configure an inbound Twilio webhook that validates the signature and writes smsOptOut: true synchronously, then check that flag in every outbound send.

// app/api/webhooks/sms/route.ts
const STOP_KEYWORDS = ['STOP', 'STOPALL', 'UNSUBSCRIBE', 'CANCEL', 'END', 'QUIT']

export async function POST(req: Request) {
  const body = await req.formData()
  const params = Object.fromEntries(body.entries()) as Record<string, string>
  const sig = req.headers.get('x-twilio-signature') ?? ''
  if (!validateRequest(process.env.TWILIO_AUTH_TOKEN!, sig, process.env.TWILIO_WEBHOOK_URL!, params)) {
    return new Response('Forbidden', { status: 403 })
  }
  if (STOP_KEYWORDS.includes((params['Body'] ?? '').trim().toUpperCase())) {
    await db.smsSubscriber.updateMany({
      where: { phoneNumber: params['From'] },
      data: { smsOptOut: true, optOutAt: new Date() },
    })
  }
  return new Response('<Response></Response>', { headers: { 'Content-Type': 'text/xml' } })
}

Also guard every outbound send with a smsOptOut: false check before calling the provider API.