Learn · track
Consent, compliance and trust
Opt-in, sender registration around the world, AI disclosure and data handling — the rules that decide whether a message arrives at all.
- 1Consent is a data model, not a checkboxA single yes/no field cannot answer the questions a regulator or a customer will ask — when, for what, on which channel, and how. A simple ledger can, and it keeps more customers reachable.
- Record every grant and withdrawal as a new row: who, which channel, which purpose, when, how, and a pointer to the evidence.
- Keep one central suppression list that every sending system checks, so an unsubscribe in one tool stops messages from all of them.
- Offer preferences — less often, only this topic, another channel — not just on or off, or the only choice left is leaving.
- 2Sender registration around the world: who you have to tell before you textWhy countries regulate who may send business messages, what you usually have to register, and how the rules differ across the US, Canada, Europe, India, Brazil, the Gulf, Singapore and Nigeria.
- Many countries require businesses to register who they are, which sender name or number they use, and sometimes what they will send.
- Unregistered traffic is increasingly blocked or labelled as a likely scam, so registration belongs before launch.
- Keep registrations in your own company's name and track them per country, so you can change provider later.
- 310DLC registration without tearsUS carriers now block unregistered business texts from ordinary ten-digit numbers. The process has two layers, takes longer than launch plans assume, and most rejections are avoidable.
- Register your brand, and each separate use case as its own campaign, during development — weeks before launch, not days.
- Make your legal name, website, opt-in page and sample messages tell one consistent story; mismatches cause most rejections.
- Keep brand, campaign and consent details as records you own; other countries' registers ask for the same facts.
- 4Getting messages into the Gulf: sender IDs, licensed aggregators and the AD markerBusiness messaging in the UAE and Saudi Arabia is a registration and licensing question before it is a technical one, and a global platform does not inherit local standing.
- Allow weeks, not days, for sender ID approval in each Gulf market, and start before the launch date is fixed.
- Keep promotional and transactional messages on separate registered sender IDs, with the required AD marker on promotional ones.
- Ask every provider in writing whether it holds the local licence or reaches the market through a partner.
- 5Telling people they are talking to a machineSince 2 August 2026 this is a legal requirement in the EU, and similar rules exist elsewhere. It is also, independently, what makes automated support tolerable. One line, in the right place, does it.
- Say plainly in the first automated message, in the customer's language, that they are talking to an AI assistant.
- Always offer a working route to a person, and disclose again when a conversation passes back from a human to automation.
- Store each disclosure as a timestamped record beside consent, and block automated replies when it is missing.
- 6Article 50 for messaging teams: what the AI Act's transparency rules requireA reading of the transparency obligations that apply from 2 August 2026, focused on automated conversations rather than AI in general.
- Since 2 August 2026, people in the EU must be told clearly, at the latest at first contact, when they are chatting with an AI.
- A line buried in the terms does not count. Put a plain sentence in the first automated message, in the customer's language.
- Record each disclosure like a consent event, and keep a real route to a person. GDPR still applies alongside.
- 7A consent architecture that survives an audit and a vendor migrationA schema, a set of invariants, and the three queries every send path and every regulator eventually asks.
- Store consent as an append-only list of events (granted, withdrawn, disclosed), never as a yes/no field you overwrite.
- Every record needs who, which channel, which purpose, when, how, and a pointer to the evidence.
- Keep the ledger in your own systems so it survives a change of vendor; send vendors only the derived suppression lists.
- 8The gap nobody fills: service-to-service identityMessaging platforms issue credentials to people and to applications. Few can express 'system A is acting on behalf of customer B, with these permissions, until this moment'.
- An API key says which application is calling. It rarely says which customer the call is for, or until when.
- Prefer short-lived, narrowly scoped tokens that name the customer, can be revoked one by one, and leave an audit trail.
- Set this up while you have few integrations; retrofitting it across many teams and partners is slow and painful.