Privacy Policy and Terms and Conditions for SMS Marketing

If you use SMS marketing then it is important that you are aware of and take appropriate steps to comply with applicable anti-spam and privacy laws, and that you have a Privacy Policy and Terms and Conditions agreement.

This article will cover what SMS marketing is and how it can be used as a part of your business's overall advertising strategy. You will also learn what laws your business needs to abide by when using SMS marketing, as well as what information your Privacy Policy and Terms and Conditions agreement should include in order to protect your business and your customers' personal information.

What is SMS Marketing?

Short message service (SMS) marketing is a method that businesses use to send bulk text messages to multiple consumers' mobile devices.

You've probably received correspondence from a business that uses SMS marketing before. SMS marketing is quite popular due to its ability to help businesses save time and money. It provides a simple means of communication via mass texts sent directly to your audiences' mobile devices.

Benefits of SMS Marketing

SMS marketing provides businesses with an inexpensive and efficient way to reach more of their target audiences, and engage with their customers in a more personalized way.

Saves Time and Money

SMS marketing is a cost-effective method of directly communicating with your audience that is capable of producing high open rates and quick conversion rates.

Extended Reach

According to a Pew Research Center study, most adults in the United States own a mobile device, and according to Open Market, people are more likely to open a text message than an email, which means that SMS marketing is capable of reaching more of your audience than other forms of digital marketing.

Customizable

You can create SMS campaigns that cater to specific demographics, send messages to announce new products or services, schedule or remind customers about their appointments, and advertise sales or promotions to particular audiences.

Privacy and Anti-Spam Requirements for Businesses That Engage in SMS Marketing

There are certain laws that you need to be aware of if your business engages in SMS marketing, including federal anti-spam laws such as CAN-SPAM, and various state and global privacy regulations.

Federal Anti-Spam Laws

CAN-SPAM is the United States' anti-spam law that businesses that use SMS marketing are obligated to follow. Failure to adhere to its requirements can result in financial penalties and even jail time.

CAN-SPAM

CAN-SPAM is an acronym that stands for Controlling the Assault of Non-Solicited Pornography And Marketing, and is an act passed into law by Congress on December 16th, 2003, in order to protect consumers from "unwanted mobile service commercial messages," which includes emails and some text messages sent to wireless devices.

The Federal Trade Commission (FTC) website outlines some of CAN-SPAM's requirements. If businesses fail to meet these conditions, they run the risk of receiving hefty fines. One such requirement is giving recipients the chance to opt-out of receiving additional messages.

HealthCare.gov complies with this by letting recipients of its text messages know how they can get assistance or stop receiving texts, and includes a link that users can visit to learn more about the organization:

CAN-SPAM requires that businesses that engage in SMS marketing give consumers the opportunity to decline to receive messages at any point in time and clearly inform consumers what business is sending them text messages.

Here's how Osprey Tacos lets consumers know that it is the entity sending them messages as well as what platform it is using to send the messages:

According to the official text of CAN-SPAM, in order to send marketing texts to consumers, businesses must first get "affirmative consent." That means that consumers need to explicitly agree to receive SMS marketing text messages from your business before you send them.

The Good and the Beautiful is a business that sells educational products that maintains an entire Agreement to Receive Text Messages page on its website. This page informs consumers that by providing their phone number to the company, they are agreeing to let its texting service send them SMS or Multimedia Messaging service (MMS) messages:

Now let's look at some state laws in the United States, as well as a global law that affects this type of marketing.

State and Global Privacy Laws

Whenever you gather consumer's personal information (such as phone numbers) you need to make sure that you are observing relevant state and global privacy laws. Both state and global privacy laws apply to organizations that are based in the state or country the law originated in, as well as to any company that does business with a citizen of that state or country.

The CCPA

Probably the best known and most all-encompassing state privacy law is the California Consumer Privacy Act (CCPA/CPRA). Businesses that make over $25 million a year and collect or share personal information from more than 50,000 California residents each year or get at least half of their revenue from selling the personal information of California residents must observe the CCPA's guidelines.

The CCPA (CPRA) requires any business that falls under its jurisdiction to:

• Inform consumers about what information it collects and what it does with the information
• Give consumers an easy way to opt-out of the sale of their personal information
• Notify consumers of their right to delete the personal information it collects
• Provide consumers with a method for deleting their personal information
• Agree not to discriminate against consumers for exercising their rights under the Act

Violating the CCPA (CPRA) can result in fines of up to $7,500 per intentional violation.

Section 1798.100 of the CCPA outlines some of California consumers' rights and applicable businesses' responsibilities under the Act:

The GDPR

The General Data Protection Regulation (GDPR) is the European Union's (EU) primary privacy regulation. The GDPR applies to any businesses that collect or process personal data from consumers living within the EU, and gives EU consumers the right to access, change, or delete their personal data.

Companies found in violation of the GDPR can be fined up to 4% of their annual revenue. In order to comply with the GDPR, businesses must:

• Only collect or process data that is essential to the functioning of the business
• Keep the collected personal data secure
• Inform consumers of their rights to access, change, or delete their personal data

Article 5 of the GDPR describes how businesses should treat the personal data they collect:

If you engage in SMS marketing with citizens of the EU, you will need to do so in a way that doesn't violate the GDPR.

How to Comply With Anti-Spam and Privacy Laws

If your business engages in SMS marketing, then you will need to put specific information within texts to your consumers and make sure that your Privacy Policy and Terms and Conditions agreement contain clauses that fulfill the requirements laid out in federal anti-spam laws and state and global privacy regulations.

In order to comply with these laws, you will need to:

• Make sure that you get consent from consumers before sending text messages
• Clearly identify your business as the originator when sending SMS messages to consumers
• Give consumers a way to opt-out of receiving text messages from your business
• Make sure that your Privacy Policy and Terms and Conditions contain relevant clauses

Creating a Privacy Policy for SMS Marketing

If your business uses SMS marketing then you need to have a clear, easily accessible, up-to-date Privacy Policy that tells users what kind of information you collect and what you do with it, whether you sell or share their personal information, and how they can contact you to make requests concerning their personal information.

Your Privacy Policy should be written in easy to understand language, and should be easily accessible.

You will need to keep your Privacy Policy up to date, and make sure that it accurately reflects any changes that you make to how you handle consumers' personal information.

What Types of Personal Information You Collect and Why

Whenever you collect personal information for SMS marketing, you should make sure that your Privacy Policy informs customers what type of information you are collecting and for what purposes.

Bed Bath and Beyond provides coupons to consumers who opt in to its text messaging subscription service, and uses its Privacy Policy to inform consumers about the personal information it collects. Its Privacy Policy explains the context in which it collects personal information, and the types of information it collects, as well as why it collects the information and what it is used for:

If You Sell or Share Personal Information

You should let users know if you sell their personal information to or share the data you collect with any third parties.

Here's how Michaels includes an Information Sharing, Service Partners, and Affiliates section within its Your Privacy Rights page that describes how it shares information with third party service providers:

Your Privacy Policy should include your contact information so that users can get a hold of you to access their data or request any changes be made, and can include steps that users can take to have their personal information deleted.

What Rights Consumers Have

Let users know what legal rights they have when it comes to their personal information, such as the right to have their data deleted, or request that you not sell it.

Rocket Mortgage is a lending company that includes a Consumer Rights section in its Privacy Policy that describes what rights its consumers have regarding their personal information, as well as how consumers can make requests concerning their personal information:

Displaying Your Privacy Policy

Many companies put a link to their Privacy Policy within their website footer so that consumers can find it no matter what page they are on.

You can also include a link to your website within your text messages so that it's easy for users to find your Privacy Policy.

Burst is an oral care company that includes a link to its Privacy Policy within its SMS messages:

Next let's look at how to create and display a Terms and Conditions agreement that coincides with your SMS marketing campaigns.

Creating a Terms and Conditions Agreement for SMS Marketing

Your Terms and Conditions agreement is a document that outlines the rules your consumers agree to abide by whenever they use your products or services. If your business uses SMS marketing, then you should make sure that your Terms and Conditions agreement includes clauses pertaining specifically to text messaging.

Your Contact Information

You should make sure that your Terms and Conditions agreement contains a method (or better yet, multiple methods) for users to get in contact with you.

PetSmart's Terms of Use lets users know that there are several ways that they can get in contact with the company, including via email, regular mail, and phone:

Opting Out of Receiving SMS Marketing Messages

Your Terms and Conditions agreement should have information letting users know how they can opt out of receiving text messages from you.

Joann Fabrics' Terms and Conditions contains a link to its SMS Terms and Conditions:

The SMS Terms agreement has a clause that lets users know how to opt out of receiving messages from the company:

Associated Costs

It's important to be aware that some cell phone providers may charge fees for receiving text messages, and to let users know that your business is not liable for those costs.

The SMS section of Domino's Terms of Use lets users know that it is not responsible for any charges that users may incur from their cell phone providers:

Limitation of Liability

A limitation of liability clause lets users know that your business is not responsible for any harm that may occur to users from accessing the information contained within your text messages. Including a limitation of liability clause within your Terms and Conditions agreement helps educate your users about their responsibilities as well as provide your business with a layer of legal protection.

Applebee's Terms of Use includes a Limitation of Liability section that lets users know that it is not to be held responsible for any losses or damages that users may incur, either directly or indirectly, through the use of its website or content:

Mobile Terms

You can also add a mobile terms clause to your Terms and Conditions to address SMS marketing subscribers.

For example, Office Depot's Terms of Use includes a Mobile Terms of Use section that describes what users need to agree to in order to receive text messages from the company.

SMS-Specific Terms and Conditions

Some businesses create special Terms and Conditions agreements just for users who receive SMS text messages.

AmeriLife has an SMS Text Messaging Terms and Conditions page, which explains how the company uses text messaging:

Adventist Health maintains a Texting Terms and Conditions page, which outlines the terms that users must agree to in order to use its services:

Displaying Your Terms and Conditions Agreement

Make sure your Terms and Conditions agreement is displayed in places where it can be easily accessed at any time. The most common place to display this agreement is in a website footer.

Here's how AmeriLife adds legal links at the bottom of its homepage, including a link just for its SMS Terms and Conditions:

Adventist Health maintains a link to its Texting terms as a part of its Notice of Privacy Practices page:

Summary

SMS marketing is a tactic that businesses use to send advertising or promotional messages to large groups of people.

Many businesses use SMS marketing because bulk texts are an efficient, cost-effective, and easily customizable way to reach their audiences.

If your business uses SMS marketing, then you need to be aware of any privacy or anti-spam laws such as CAN-SPAM, the CCPA (CPRA), and the GDPR that may apply to you.

In order to comply with anti-spam and privacy laws, you should:

• Get consumers' consent before collecting their personal information or sending them texts
• Clearly inform users that your company is the organization that is texting them
• Give consumers an easy way to opt out of receiving texts from you

Your Privacy Policy should be clearly written, easy to understand, and kept up to date. It should include information about how you collect users' personal information and what you do with it, including any third parties you share their information with or sell their information to.

Your Privacy Policy should also inform users of their rights regarding their personal information, and give them a way to contact you and make requests concerning their personal information.

Your Terms and Conditions should include clauses that specifically address SMS text messaging and inform users what they must agree to in order to use your products or services.

Make sure that both agreements are displayed in a way that makes them easily noticeable and freely accessible at any time to anyone who wishes to view them.