A2P Compliance Updates

Overview

This article is to help make sure that your institution is following the rules and regulations around A2P Compliance and text messaging. Below you will find important information around collecting consent and what carriers are requiring at the current moment. Please keep in mind that these rules and regulations are evolving as they identify how to keep the text messaging ecosystem free from fraudulent activity and unwanted messaging practices.

Collecting Consent/Opt In

A key requirement by mobile carriers to help keep messaging free from fraudulent activity and part of a trusted network is that anyone texting through A2P (Application to Person) must collect consent for the people they plan to text. 

This means that you must collect whether or not the individual wants to receive text messages from your institution. You must make it clear to an individual they are agreeing to receive the types of text messages you're going to send and you need to keep a record of the consent, such as a copy of the document or form that the message recipient signed, or a timestamp of when the individual completed a sign-up flow.

For ex: Mongoose State sends text messages with information about.... application process, application status, alumni giving day, donor events, student activities, financial aid etc...

Note: Consent can't be bought, sold, or exchanged. For example, you can't obtain the consent of message recipients by purchasing a phone list from another party.

How to Collect Consent

Consent can be collected in a variety of ways, however, the most reliable and trusted way is through a form, portal, or wherever information is collect as it provides a record or "paper trail" should the question of that individuals opt in gets questioned. 

As a best practice, anywhere you ask an individual to provide you their mobile number; whether this is a student portal, application, form, alumni contact information updates etc.. you are including a clear call to action for that individual to opt in or opt out of receiving text messages. Below you will find the opt in requirements that are in place by Twilio and the carriers.

Within Mongoose, we also help keep track of opt out status and ensure that contacts are aware of how to opt out of text messages by sending a compliance opt out text once you do begin texting with them. However, please note that Mongoose alone does not indicate you've collected consent. We are a tool to help you keep track of any updates to that communication preference but you do need to be collecting that consent prior to text conversations with that individual.

Consent/Opt In Requirements

The following information MUST be included when collecting consent. 

• The opt-in consent should be provided through a single selectable checkbox for the end-user, it should not be pre-selected, and this should not be a required field on the form
  
  • [  ]  I agree to receive SMS messages from Mongoose University. 
• Brief description of the types of messages being sent
  
  • Mongoose University utilizes text messaging to send out important notifications and updates about opportunities from Mongoose University. 
• Service delivery frequency ("4 messages per month", "Message frequency varies", etc)
  • Message frequency may vary.
• Fee disclosure
  • Message and data rates may apply.
• Customer care information (typically "Text HELP for help" or Help at XXX-XXX-XXXX)
  • You can text STOP to opt out at any time. Text HELP for assistance.
• Link to Privacy Policy describing how end user opt-in information will be used with specific SMS language in it AND/OR a link to SMS Terms and Conditions describing terms of service
  

  • For more information visit our privacy policy and SMS policy.

Here is an example of a form that contains all of the requirements that Twilio and Carriers are looking for when collecting consent.

The layout of this information is equally important in order to pass through registration successfully. Below is a snapshot of what Twilio and carriers are looking for on a form, which is showing that the consent statement is directly underneath the phone number field.

Here is a color-coded breakdown of how this is compliant:

Privacy Policy / SMS Terms & Conditions

If a dedicated SMS policy does not exist, Twilio will accept a privacy policy being linked, however the privacy policy has to have a section in it regarding SMS specifically. The SMS portion in a privacy policy must state the following:

• How SMS consent is collected
• What messages are sent (how SMS is used)
• How users opt out
• That mobile numbers and SMS consent are not sold or shared for marketing 

An example of an SMS Privacy Policy can be found here: Mongoose University Sample SMS Terms & Conditions

Adding an SMS Section to a Privacy Policy

Below is an example of the minimum requirements for adding SMS-specific language to an existing privacy policy. Excluding any parts of this may result in campaign rejection.

Key Takeaways

Twilio and the mobile carriers do not allow much flexibility in how consent is collected or how SMS terms and conditions are communicated. Any deviation from the requirements outlined above may result in rejection and delays in enabling texting capabilities. Please follow this guide closely so we can get you up and running as quickly as possible.

The Mongoose team is here to support you whether you need to make updates to your current collection process or just need help getting started. If you have any questions, please reach out to your Client Success Manager or Mongoose Support (Support@hellomongoose.com).