Med Spa Text Message Consent: What Your Forms Need (October 2026)
Med spa text message consent explained: the exact checkbox wording, why SMS needs its own opt-in and email does not, and how to keep proof of every yes.
TL;DR
5 key points- 01Marketing texts need prior express written consent under the FCC's TCPA rule. The patient must opt in with a clear action, and signing cannot be a condition of booking or care.
- 02Email marketing does not need prior permission under CAN-SPAM, only an honest opt-out. That is why clinics usually ask for text consent and let email ride.
- 03A valid checkbox names the clinic, describes the messages, states how often, says rates may apply, and explains STOP and HELP.
- 04Carriers deny 10DLC registrations over pre-checked boxes and bundled consent, so a clean form also gets your number approved.
- 05Keep a record for every yes: the wording shown, the timestamp, the number and the source form.
What Does a Med Spa Need Before It Can Text Patients for Marketing?
A med spa needs the patient's prior express written consent before sending marketing texts, and it needs to be able to prove it. The FCC's rule at 47 CFR 64.1200 defines that consent as an agreement that identifies the phone number, tells the person they can decline, and is not required as a condition of buying goods or services. An electronic checkbox with a timestamp satisfies the writing requirement in practice.
The penalty for getting it wrong is statutory. The TCPA lets a recipient recover at least $500 per violation under 47 U.S.C. 227(b)(3), and a court can increase that up to three times for willful or knowing violations. A single blast to an old list with no consent record multiplies fast.
Two kinds of messages sit under this one rule, and clinics blur them constantly. A reminder for tomorrow's appointment is a care message. A "20% off lip filler this month" text is marketing. The first is expected as part of treatment. The second needs its own yes.
Why Does Text Consent Need Its Own Checkbox When Email Does Not?
Text consent needs its own checkbox because carriers and the TCPA treat SMS as a permission-first channel, while email marketing under the CAN-SPAM Act is opt-out. The FTC's CAN-SPAM compliance guide requires a clear way to unsubscribe and says you must honor it within ten business days, but it does not require the recipient to opt in first.
That asymmetry is why Decoda Health's support team told the owner in the story above to keep the text box and drop the email one. Merging them into a single "I agree to marketing" checkbox sounds tidy, but it fails the stricter test. A carrier reviewer reading a combined box cannot tell whether the patient agreed to texts at all, and the combined consent is only as strong as its weakest channel.
Keep two things true. The SMS box stands alone and is unchecked by default. Email can be captured through the contact fields without a second box, as long as every email carries an unsubscribe link. Ask your attorney to confirm that approach for your state, since some states add their own rules for marketing texts.
What Exact Wording Should the Text Opt-In Checkbox Use?
The checkbox should read as one plain sentence that names the clinic, the kind of texts, the frequency and the exit. Carrier registration guides, including the AWS opt-in requirements checklist, list the same disclosures at the point of consent: message frequency, the line "Message and data rates may apply," links to your privacy policy and terms, and STOP and HELP instructions.
A workable template, to adapt with your attorney:
I agree to receive recurring marketing text messages from [Clinic Name] at the number I provided, including offers and appointment promotions. Frequency varies, up to [X] messages per month. Message and data rates may apply. Reply STOP to cancel or HELP for help. Consent is not a condition of booking or receiving care. See our Privacy Policy and Terms (linked).
Fill in the real frequency you intend to keep, and then keep it. A form that promises four texts a month and delivers fifteen creates a complaint and a registration problem at the same time.
Two details trip clinics up. The sender name in the checkbox has to match the brand on your carrier registration, so "Glow" on the form and "Glow Aesthetics LLC" on the registration is a mismatch. And the privacy policy has to say mobile opt-in data is not shared with third parties for their own marketing, which most generic templates do not.
What Does a Compliant Text Opt-In Look Like Next to a Risky One?
A compliant opt-in is unchecked, specific and optional, and a risky one is the opposite on all three. The table below compares the patterns that come up most often on med spa forms.
| Form pattern | Risk | Fix |
|---|---|---|
| Pre-checked "text me offers" box | Not an affirmative action; common cause of carrier denial | Leave unchecked |
| One "I agree to marketing" box for text and email | Cannot prove SMS-specific consent | Separate SMS checkbox; email via opt-out |
| SMS box required to book or submit | Consent bundled as a condition of service | Make it optional and say so |
| Consent buried in the terms of service | Not specific to SMS | Dedicated checkbox beside the phone field |
| No frequency or STOP wording | Missing required disclosures | Add the full template sentence |
| Phone number typed at the front desk, no record | No proof of the yes | Capture on a form, or log a verbal consent and send a confirmation text |
Most denials trace to the second and third rows. An owner who requires the box is trying to protect her list, and the effect is the opposite: she holds a list she cannot legally text.
How Do You Keep Opt-In Rates Up Without Cheating the Rules?
You keep opt-in rates up by making the box easy to understand and by asking at the moment the patient is already engaged, not by hiding or pre-ticking it. A single checkbox next to the phone field, with one sentence on the benefit ("get appointment openings and member offers by text"), outperforms a wall of legal text in front of the submit button.
Offer a reason to say yes that is true. Clinics that run a waitlist for cancelled appointments can say openings go out by text first, and members respond to renewal and benefit reminders. Do not promise a discount in exchange for the opt-in unless you are ready to document that the offer was not the condition of care.
Ask again later too. A patient who skipped the box on a lead form can opt in at check-in or in the portal once they trust you. A consent form schedule already brings patients back to a screen with a signature on it, so adding the text question to the intake they complete anyway costs nothing.
Where Do Care Texts Stop and Marketing Texts Begin Under HIPAA?
Care texts, such as reminders, prep instructions and follow-ups about the patient's own treatment, are generally treatment communications. Promotions are marketing. HIPAA's rule at 45 CFR 164.508(a)(3) requires written authorization to use protected health information for marketing, with narrow exceptions for face-to-face communications and nominal gifts. Section 164.508(b)(4) adds that treatment cannot be conditioned on signing.
In practice that means two consent tracks. Operational messages can run once the patient has given a number for scheduling. Promotional messages wait for the separate opt-in described above. Our guide on FTC and health data rules for elective care practices covers the related rules on what you can say about a patient's treatment in a campaign.
Keep the message itself light as well. A text that says "time for your Botox refresh" reveals a service to anyone who sees the phone screen. Many clinics keep texts to a prompt and a link, and put the detail behind the portal login.
How Should You Handle STOP, HELP and Quiet Hours?
Handle STOP as an instant, permanent stop for that number across every campaign, and answer HELP with your clinic name and a way to reach a person. The FCC rule says a reply such as "stop" or "unsubscribe" is a reasonable revocation by default and gives a maximum of ten business days to process it, but carriers expect it to take effect at once.
Build the habits around it. After a STOP, send one confirmation text and nothing more. Remove the number from sequences and blasts, not just the one that triggered it. If a patient revokes by saying so at the front desk, log it the same day.
Timing matters as well. The FCC's telemarketing rules bar calls before 8 a.m. or after 9 p.m. in the recipient's local time, and the safe practice is to hold marketing blasts to business hours in the patient's time zone. Clinics that send a promotion at 10 p.m. get replies that start with "why are you texting me" and end with a STOP.
What Proof of Consent Should You Keep, and for How Long?
Keep a record per opt-in that shows who agreed, to what, when and where. At minimum: the phone number, the exact checkbox text the patient saw, the date and time, the form or page it came from, and any later revocation. Without those, a "yes" in your system is a claim you cannot support when a carrier audit or a complaint arrives.
Carriers ask for this at registration as well. You describe every opt-in method (web form, paper intake, verbal, QR code) and supply screenshots or a hosted copy of the form. If your flow starts with a QR code at the front desk, show the QR code and the form behind it.
No rule sets one retention number for consent records, so confirm the period with your attorney. Many clinics keep them at least four years, which matches the general federal limitations period for civil claims under 28 U.S.C. 1658. Keep the record with the patient, not in a campaign tool you may leave.
How Should You Collect Consent Across Leads, Intake and the Front Desk?
Collect it the same way in every place a phone number enters your system, so the proof looks the same everywhere. A clinic typically has three entry points: the website lead form, the new-patient intake packet and the front desk. Each needs the same unchecked box and the same wording.
The lead form is where the problem in the opening story lives, because those visitors are not patients yet and fall under marketing consent rules from the first contact. Our guide to responding to med spa leads fast covers what you can send a lead before they opt in. At intake, the patient is already signing forms, so the text box sits beside the others. At the desk, read the sentence aloud, tick the box for them, and send a confirmation text they can answer.
Whatever you do, never import a purchased or old exported list and text it. A re-engagement campaign only reaches patients with documented consent, which is one more reason to build the habit now.
How Decoda Health Records Text and Email Consent
Decoda Health records text and email marketing consent as separate answers on its lead forms, and a patient can submit the form without opting into either. Consent is granted only for the channel the person answered yes to, so an unchecked text box never creates text consent. That matches the structure above: two channels, two answers, neither a condition of contacting the clinic.
Staff can edit the form in the Growth module and show each opt-in as a simple checkbox instead of a yes-or-no pair, which cuts the visual clutter that worried the owner at the start. Intake and consent paperwork live in Decoda Health's forms, and campaigns and messaging run through communications. Your own attorney still decides the exact wording, and you still need an approved carrier registration before texts go out.
For the wider picture on how consent fits into a patient-acquisition plan, see our med spa marketing guide and the related piece on automating the lead pipeline.
Final Thoughts on Med Spa Text Message Consent
Build one text opt-in sentence, leave the box unchecked, and use it on the lead form, the intake packet and at the desk. Let email ride on a working unsubscribe link rather than a second box. Then audit your list today: any number with no recorded yes should be left out of the next blast until you have one.
If you want to see how Decoda Health handles lead forms, consent and campaigns in one place, you can book a demo here.
Frequently Asked Questions
Do med spas need written consent before sending marketing texts?
Yes. Under the FCC's TCPA rule at 47 CFR 64.1200, automated marketing texts to a mobile number require the person's prior express written consent. That means a signed or electronically signed agreement that names the number, says the texts are marketing, and is not a condition of buying anything. Appointment reminders and other care messages follow a different, lighter standard, but marketing texts do not.
Is a pre-checked box valid SMS consent?
No. Carriers reviewing a 10DLC registration expect a clear, affirmative action by the patient, such as an unchecked box they tick themselves. A pre-checked box, or a box bundled into terms the patient must accept to book, is one of the most common reasons registrations are denied. Leave the SMS box unchecked and optional.
Do I need separate consent for text and email?
For text, yes, and it should stand alone. Email marketing is governed by the CAN-SPAM Act, which does not require prior permission but does require a working opt-out. Because the two sets of rules differ, most clinics ask for SMS consent explicitly and treat email as opt-out. Your attorney should confirm this for your state.
What words must a text opt-in checkbox include?
Name the clinic as the sender, say what kind of messages the patient will get, state how often they will arrive, add "Message and data rates may apply," and explain that replying STOP cancels and HELP gives support. Link your privacy policy and terms next to the box. Say plainly that consent is not required to book or receive care.
How fast do I have to honor a STOP reply?
Treat it as immediate. The FCC rule allows up to ten business days to process a revocation, and a reply like "stop" or "unsubscribe" counts as a valid request, but carriers expect messaging to halt right away. Your texting platform should flag the number the moment the reply arrives so no scheduled campaign can send to it.
Does HIPAA apply to text message marketing from a med spa?
Often, yes, because a patient's name and phone number tied to a treatment is health information. Under 45 CFR 164.508, using it for marketing generally needs the patient's written authorization, and treatment cannot be made conditional on signing. Texts about their own care are treated differently from promotions, so keep the two on separate consents.