Writing a consent request that stands up

Between 1 February 2023 and 13 February 2024, Allay Claims Ltd sent 4,046,947 marketing texts promoting PPI tax refunds. On 15 January 2026 the ICO fined the company £120,000 and served an enforcement notice, and the reason given in the ICO's annual report for 2025/26 fits in half a line: the messages went out "without the required consent". Nothing about the wording of the texts or the time of day they arrived. The consent wasn't there, so four million texts were four million breaches of regulation 22.

A consent request is a small piece of writing, a line on a form or a word on a poster, and the law is unusually exact about what that line has to do. Get it right and keep the record, and a marketing text is lawful; nothing in the text itself can make up for it if you don't.

The definition, in full

The UK GDPR defines consent at article 4(11), and it's short enough to quote whole: "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".

Four adjectives and an act. Freely given, specific, informed, unambiguous, and then a statement or a clear affirmative action. Recital 32 fills in what the act can look like: "ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance". Then comes the sentence that finished off the pre-ticked box: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent."

Article 7 adds four conditions. The controller "shall be able to demonstrate that the data subject has consented" (that's the record-keeping duty, and it's the one that catches people out). If the request sits inside a document that covers other things, it has to be "clearly distinguishable from the other matters", in "clear and plain language". The person can withdraw at any time, must be told that before they consent, and "It shall be as easy to withdraw as to give consent." And when deciding whether consent was freely given, "utmost account" is taken of whether a contract or service was made conditional on consent the contract didn't need.

The texting rule itself is in PECR, regulation 22(2). A person must not send unsolicited marketing by electronic mail (which the ICO's guide to PECR says includes any text message sent over a public network) unless the recipient "has previously notified the sender that he consents for the time being to such communications being sent by, or at the instigation of, the sender". Three phrases in there do most of the work. "Previously": before the first text, never after. "For the time being": consent has a shelf life. "The sender": consent is to you, by name. The ICO's direct marketing guidance says PECR "uses the same standard of consent as data protection law", so the article 4(11) definition is the one a text has to meet.

What the ICO adds for texts

The ICO's guidance turns the definition into a set of tests, and a few of them bite harder on texts than on anything else.

Consent is specific to the channel. The guidance says in terms that consent for phone calls "doesn't cover direct marketing by text message", and that a consent line which just says "electronic mail" is "not specific or informed enough". If you want to text people, the request has to say texts.

Then there's who it names. The request must explain "who wants to rely on the consent (eg you or another organisation)", and the ICO's consent guidance adds that "consent for categories of third-party controllers will not be specific enough". A box that says "and selected partners" consents nobody to anything.

It has to stand on its own, too. The request should be "prominent, in plain language and separate from your privacy information", and the ICO gives the example of a box confirming you've read a privacy policy, which is consent to nothing at all. The consent guidance lists the things that make consent invalid, and read backwards it's a decent checklist: pre-ticked boxes "or other methods of default consent", a clear imbalance of power, not telling people about their right to withdraw, no easy way to withdraw, and "you don't have clear records to demonstrate they consented".

It doesn't last forever. The direct marketing guidance says how long consent lasts "depends on the circumstances", and that consent for a one-off message or a specific context doesn't cover all future marketing. The consent guidance is more concrete: "If in doubt, we recommend you consider refreshing consent every two years", with a longer period if you can justify it and a shorter one if the context calls for it. Consent that came through a third party has a tighter limit. The ICO says you "should not use consent for direct marketing that was given via a third party more than six months ago".

And there's no opt-out consent. The consent guidance is blunt about it: "there is no such thing as 'opt-out consent'". Clear affirmative action "means someone must take deliberate and specific action to opt in".

Why the ICO still sees so many of these

The ICO's annual report for 2025/26 counted 6,649 concerns about spam texts made through its online reporting tool, alongside 24,710 about emails. The text figure has come down each year from 7,405 in 2023/24, and the report keeps telling people to forward spam texts to the networks' 7726 service as well as reporting them to the ICO (our post on what happens when someone reports your text to 7726 covers that route). The same report records 10 monetary penalty notices under PECR in the year, totalling £1,445,000, and 10 enforcement notices.

Each of those concerns is a person who didn't think they'd agreed to be texted. Some had, and forgot. Others agreed to something else entirely: a prize draw, or a company with a different name. The texts themselves are often perfectly polite. The agreement underneath them is what's missing.

Worked wording for a text opt-in

A text opt-in happens in three places, and each needs its own line.

On a form, online or on paper, the request is an unticked box with a label that does the whole job in one sentence. For a dental practice, something like this:

Text me Crown Dental offers and news, about two a month. Reply STOP to any text to opt out.

That names the sender (Crown Dental), the channel (text), the purpose (offers and news), gives a sense of how often, and states the way out, which article 7(3) says the person must be told about before they consent. It sits apart from the terms and conditions and from any box about the privacy notice. Want to email them as well? That's a second box, because consent to one channel isn't consent to another.

By keyword, the affirmative act is the text itself. The poster or the till card is the request, so it has to say what the person is signing up to:

Text OFFERS to 07700 900123 for Crown Dental offers by text, about two a month. Reply STOP at any time.

Someone who sends OFFERS to that number has made "a clear affirmative action" in the words of recital 32, and the inbound message is its own timestamped record. What the poster said at the time matters just as much, so keep a copy of each version with the date it went up.

The welcome text closes the loop. It confirms what they've joined and repeats the way out:

Crown Dental: thanks for joining our offers by text. About two a month. Reply STOP to opt out.

The thing to avoid at every step is a line that bundles. "By booking you agree to receive offers" fails article 7(4), because the booking doesn't need the offers. "Tick to receive updates from us and our partners" fails the specificity test twice over. "We may contact you about products you might like" doesn't say how, so it fails the channel test.

The records that prove it

Article 7(1) is a duty to be able to demonstrate consent, and the ICO's consent guidance spells out what that means. You need to be able to show who consented (a name, or an identifier such as the mobile number), when (a dated form, or a timestamped record), what they were told (a master copy of the consent wording and the privacy information in use at the time, with version numbers and dates), how they consented (the submitted form data with its timestamp, the inbound keyword text, or a note made at the time for consent given in person), and whether and when they withdrew it.

For a keyword opt-in that's four things: the number, the time, the word they sent, and the version of the poster or advert that asked for it. For a form, it's the field value and the timestamp plus a copy of the label as it read that day. Not a lot, either way. A column in a spreadsheet saying "opted in: yes" with no date and no wording is a different matter, and the ICO's list of invalid consent says why.

Withdrawals need the same care. The ICO says withdrawal should be an "easily accessible one-step process", ideally by the same method used to give consent, and that you must stop the processing as soon as possible once it comes. For texts the obvious one-step process is a reply, and a reply of STOP should land on a suppression list that you keep. The ICO allows you to hold that record so you don't text the person again, provided you tell people you keep it. Our post on how long to keep text message records goes through the retention side.

What to do this week

Read your own opt-in line out loud and check it against the four adjectives and the act: does it name you, say texts, say what for, give the way out, and need a tick or a keyword to happen? Then find the record for the last ten people you sent a marketing text to. If you can't put your hand on the date and the wording each one saw, that's the gap, and it's the gap Allay Claims had.

If the list is older than two years and hasn't been refreshed, the ICO's "if in doubt" advice applies. While the existing consent is still live, a short text asking people to reply YES to stay on the list is itself a consent request in the article 4(11) sense, and the replies are the record.

CaptiFi Connect keeps the inbound text for a keyword opt-in with its time and number, sends the automatic reply you set as the welcome text, and treats STOP, UNSUBSCRIBE and the rest as an opt-out on every campaign without anyone touching it. Every campaign carries "Reply STOP to opt out" by default. The record it can't make for you is the one on the poster or the form, so keep those.