Prior express written consent for marketing SMS per TCPA

TCPA §227(b)(1)(A) imposes strict liability for marketing SMS sent without prior express written consent — $500 per message, trebled to $1,500 per message if the violation is knowing or willful. Collecting a phone number at signup for 2FA and then sending promotional SMS is the canonical TCPA violation: the user consented to one purpose (authentication) and received communications for a completely different purpose (marketing). TCPA class actions are the most expensive class actions in US consumer law; a list of 10,000 numbers with improper consent is a $5M–$15M exposure. GDPR Art. 6(1)(a) and Art. 7 require the same specificity of consent for EU users, and CCPA §1798.120 grants opt-out rights that must be built into the consent flow.

Implement a dedicated TCPA-compliant SMS opt-in form with the full required disclosure language — do not reuse the 2FA phone number collection form.

// components/SmsOptInForm.tsx — full TCPA disclosure required
export function SmsOptInForm() {
  return (
    <label>
      <input type="checkbox" name="smsConsent" />
      By checking this box, I consent to receive recurring marketing text messages
      from <strong>YourProduct</strong> at the number provided. Message frequency
      varies. Message & data rates may apply. Reply <strong>STOP</strong> to opt
      out at any time. Consent is not a condition of purchase.{' '}
      <a href="/privacy">Privacy Policy</a>
    </label>
  )
}

// Record consent with evidence — timestamp, source, language version
await db.smsConsent.create({
  data: {
    userId: user.id,
    phoneNumber: normalizedPhone,
    consentedAt: new Date(),
    consentSource: 'signup-form',
    consentLanguage: 'v1-tcpa-2026',
    ipAddress: clientIp,
  },
})

If you plan to send to more than a few hundred numbers, have a telecom attorney review the consent flow before launch.