A small business’s email and text lists live inside someone else’s software, and the permission to use them lives in consent records, so both need a copy the business controls before a platform changes its terms, closes an account or raises prices.
Eight Nights · Part 4 of 8 · See the full series
Advertisement
Export on a schedule, consent included
Most marketing platforms make exporting easy, but a bare list of addresses is not enough. Mailchimp, for example, exports separate files for subscribed, unsubscribed, non-subscribed and cleaned contacts, with fields such as OPTIN_TIME, CONFIRM_TIME and CONFIRM_IP that record when and how someone signed up. Those details are the evidence that a person asked to hear from the business.
A monthly export, saved to company storage with restricted access, should include every status, not just active subscribers. The unsubscribed file matters as much as the subscribed one, because it records who must not be contacted again. For text lists, the export should include each phone number, its consent status, the date consent was given and where it was collected, such as a checkout box, a web form or a keyword sign-up. Dated screenshots of each sign-up form, showing its exact wording, complete the record.
Email: the CAN-SPAM basics
The Federal Trade Commission’s compliance guide to the CAN-SPAM Act lays out the core rules for commercial email, and it notes that the law makes no exception for business-to-business messages. Header information must be accurate, subject lines cannot be deceptive, and the message must be identified as an advertisement. Each email needs a valid physical postal address and a clear explanation of how to opt out.
Opt-outs carry deadlines. The FTC guide and the text of the law both say a business must honor an opt-out within 10 business days, and the opt-out mechanism must keep working for at least 30 days after the message is sent. Once someone opts out, the business cannot sell or transfer that address, except to a company hired to help it comply. The FTC also warns that hiring another company to send email does not shift legal responsibility; both companies can be held liable.
Texts: express written consent first
Marketing texts face stricter rules than email. Under the Federal Communications Commission’s rules implementing the Telephone Consumer Protection Act, advertising or telemarketing calls to cell phones made with an autodialer or a prerecorded voice require the recipient’s prior express written consent, and the FCC applies its consent rules to text messages as well as calls. The rule defines that consent as a written agreement, signed by the person, that clearly authorizes the seller to send such messages to a specific phone number, with a clear disclosure that agreeing is not a condition of purchase. Electronic or digital signatures count when federal or state law recognizes them.
Advertisement
The FCC tried to tighten that definition in 2023, but a federal appeals court vacated the change, and in 2025 the agency restored the earlier wording. Consent can also be withdrawn. FCC rules say people may revoke consent by any reasonable method, that replies such as “stop” or “unsubscribe” count, and that requests must be honored within no more than 10 business days. The FCC revised parts of its opt-out rules in 2026 and has asked whether the deadline should be shorter, so the safest practice is to process a STOP reply right away and check the current rule.
Business texting needs registration
Separately from the law, U.S. wireless carriers require businesses that send texts through software from ordinary 10-digit numbers to register under a system called A2P 10DLC, short for application-to-person, 10-digit long code. Twilio’s documentation says anyone sending SMS or MMS messages over a 10DLC number from an application to the U.S. must register a brand, which identifies who is sending, and a campaign, which describes the messages’ purpose and how people can opt in, opt out and get help. Twilio blocks messages to U.S. numbers from 10DLC numbers that are not tied to an approved campaign.
Amazon Web Services lists what to have ready before registering: a documented opt-in flow that captures explicit consent, a privacy policy and terms of service on the website, sample messages and a business website that matches the brand. The Campaign Registry, the industry database behind the system, says messaging providers collect a company’s tax ID to verify the brand. Toll-free numbers and short codes go through separate processes.
Moving lists without losing consent
Switching platforms is where permission most often gets lost. The new system needs each contact’s consent status and, ideally, the original consent date. Klaviyo, for example, accepts an SMS marketing consent status on import with an optional consent timestamp column, and it advises that a contact who opted out after that date be imported as subscribed only if the person opted in again. Unsubscribes and suppressed contacts should move too, so the new platform does not message people who already said no.
Texting registration does not travel automatically. The Campaign Registry says each messaging provider must register the brands it works with, even if another provider has already registered them, so a business changing SMS providers should plan for a new registration before its first send. Keeping the old account open until the new one is approved avoids a gap.
The Fenway Web Take
The customer list is often the most valuable thing a small business builds online, and it is easy to treat it as the vendor’s property. The useful mindset is that the platform is a tool, while the list and its consent history belong to the business. A dated export and a folder of sign-up form screenshots cost little and answer the two questions that matter in a dispute or a migration: who agreed, and to what. Fenway Web offers clients a free continuity review that includes how their website sign-up forms record consent.
Tonight’s checklist
- Export every email contact status, including unsubscribes, to company storage.
- Export the text list with consent dates and sources.
- Screenshot each sign-up form and save its wording with the date.
- Check that every marketing email shows a postal address and a working opt-out.
- Send STOP to the business’s own text line from a staff phone and confirm the opt-out works.
- Ask the texting provider whether the brand and campaign are registered.
- Set a monthly reminder for the next export.
What it means for you
- A list without consent records is a liability, not an asset, when the business changes platforms.
- Commercial email runs on opt-out rules, but autodialed marketing texts need written consent before the first message.
- Unregistered business texting can be blocked by carriers, however good the consent records are.
- Unsubscribe records must move with the list so no one who said no is contacted again.
Test yourself
1. How quickly must a business honor an email opt-out under CAN-SPAM?
Answer: Within 10 business days, according to the FTC’s guide and the text of the law.
2. Does CAN-SPAM exempt business-to-business email?
Answer: No; the FTC says the law makes no exception for business-to-business messages.
3. What two things does A2P 10DLC registration cover?
Answer: A brand, identifying who sends the texts, and a campaign describing their purpose and how people opt in, opt out and get help.
4. Why should unsubscribed contacts be exported along with subscribers?
Answer: They record who must not be contacted, and that record needs to move to any new platform.
Discussion
- Where would the business’s customer list be if its email platform closed the account tomorrow?
- Is a checked box at checkout clear enough consent for marketing texts, or should the wording be more explicit?
- Who on staff should own the monthly export and the consent records?
From the network
- Boston Made Reader — every story from the family in one free reading app.
- Fenway Web — the web design and care studio of Boston Made, Inc.
- Boston Made — the marketing agency and parent brand behind the network.