SMS & WhatsApp Opt-in Popups: TCPA-Compliant Phone Capture for Shopify

SMS marketing delivers 98% open rates. WhatsApp achieves 3-5x higher engagement than email. But there's a catch.

Get consent wrong, and you're looking at $500-$1,500 per violation under TCPA. Class action lawsuits have cost brands millions.

This guide shows you how to build SMS and WhatsApp subscriber lists the right way—legally compliant, high-converting, and protected from legal risk.

Why phone numbers are the new email addresses

Email inboxes are overcrowded. Open rates hover around 20%, and promotions often land in spam folders.

Text messages are different:

The numbers are compelling. But collecting phone numbers requires more care than emails.

What is TCPA and why does it matter?

The Telephone Consumer Protection Act (TCPA) is a US federal law that regulates text message marketing. Violations carry penalties of:

• $500 per unsolicited message (negligent violations)
• $1,500 per message (willful violations)

These add up fast. Sending 10,000 messages without proper consent = $5 million to $15 million in potential liability.

TCPA requirements for SMS marketing

1. Prior express written consent before sending marketing messages
2. Clear disclosure of what they're consenting to
3. Easy opt-out mechanism in every message
4. Identification of who is sending the message
5. No pre-checked consent boxes

WhatsApp Business Policy requirements

WhatsApp has its own rules on top of TCPA:

1. Active opt-in required (separate from email consent)
2. Clear business identification in the opt-in
3. Template message approval for promotional content
4. 24-hour messaging window for conversational replies
5. Opt-out mechanism provided

The anatomy of a compliant opt-in popup

A TCPA-compliant phone capture popup needs these elements:

1. Separate phone field (not bundled with email)

Phone collection must be explicitly separate from email collection. You can't bury phone consent in email terms.

✅ Correct:
[Email address field]
[Phone number field] (optional)
☐ I agree to receive SMS marketing messages...

❌ Wrong:
[Email address field]
☐ I agree to receive email and SMS messages...

2. Unchecked consent checkbox

The SMS consent checkbox must be unchecked by default. Pre-checked boxes don't constitute valid consent.

✅ Correct: ☐ I agree to receive promotional SMS messages...
❌ Wrong:  ☑ I agree to receive promotional SMS messages...

3. Required consent disclosure elements

Your consent text must include:

• Business name (who is sending)
• Message type (marketing/promotional)
• Opt-out instructions (how to stop)
• Message frequency (optional but recommended)
• Data rates disclosure (optional but recommended)

4. Example compliant consent language

Here are ready-to-use templates:

Standard SMS consent:

I agree to receive promotional SMS messages from [Store Name]. 
Reply STOP to unsubscribe. Msg & data rates may apply.

Detailed consent (recommended):

By checking this box, I consent to receive marketing text messages 
from [Store Name] at the number provided. Message frequency varies. 
Reply STOP to opt out. Reply HELP for help. Msg & data rates may apply.

WhatsApp-specific consent:

I agree to receive promotional WhatsApp messages from [Store Name]. 
You can unsubscribe anytime by sending STOP.

Combined SMS + WhatsApp:

I agree to receive promotional messages via SMS and WhatsApp from 
[Store Name]. Reply STOP to unsubscribe. Msg & data rates may apply.

Phone verification: why it matters

Collecting phone numbers is only valuable if they're real. Phone verification (OTP) serves multiple purposes:

1. Validates real numbers

Fake or mistyped numbers waste money when you try to send messages. Verification catches errors before they enter your database.

2. Confirms ownership

Verification proves the person entering the number actually owns it—critical for TCPA compliance.

3. Reduces fraud

Bots can't complete OTP verification. This protects your list from fake signups.

4. Increases deliverability

Verified numbers have higher deliverability rates because they're confirmed real and active.

Setting up phone capture with Revenue Boost

Revenue Boost includes a dedicated Phone Capture popup with built-in TCPA compliance features:

Step 1: Create a phone capture campaign

Go to Campaigns → New Campaign → Phone Capture. You'll see templates optimized for:

• Discount for phone (exchange discount for verified number)
• VIP text club (exclusive SMS subscriber benefits)
• Order updates + marketing (transactional + promotional combo)

Step 2: Configure phone fields

Key settings in the popup editor:

Step 3: Customize consent language

Edit the SMS consent text to include your store name:

I agree to receive promotional SMS/WhatsApp messages from 
{{shop_name}}. Reply STOP to opt out.

The {{shop_name}} variable automatically inserts your Shopify store name.

Step 4: Configure verification

When SMS verification is enabled:

1. Visitor enters phone number
2. Revenue Boost sends 6-digit OTP via SMS
3. Visitor enters code to verify
4. Discount code delivered after verification

Verification settings:

• Resend cooldown: 60 seconds between resend attempts
• Code expiry: 10 minutes
• Max attempts: 3 before lockout

Step 5: Set up the discount incentive

The most effective phone capture offers a discount in exchange for a verified number:

Configure in Discount Settings:

• Discount type: Percentage, fixed amount, or free shipping
• Minimum order: Optional threshold
• Valid for: Days until expiry
• Usage limit: Once per customer

Step 6: Target the right visitors

Phone capture works best on engaged visitors:

Avoid showing phone capture to first-time visitors on landing—wait for engagement signals.

International phone support

Revenue Boost uses libphonenumber for international phone validation, supporting 53+ countries:

How it works

1. Auto-detect country: Uses browser geolocation to suggest country code
2. Country selector: Dropdown to manually select country
3. Format validation: Validates number format per country
4. E.164 conversion: Stores numbers in standard international format

Supported regions

TCPA compliance checklist

Before launching your phone capture popup, verify these requirements:

✅ Consent language

• Includes your business name
• States message type (marketing/promotional)
• Includes opt-out instructions (Reply STOP)
• Checkbox is unchecked by default
• Consent is separate from email opt-in

✅ Data storage

• Consent text stored with phone number
• Consent timestamp recorded
• IP address logged (optional but recommended)
• Page URL where consent given stored

✅ Opt-out mechanism

• STOP keyword processes unsubscribes
• Unsubscribe links in all messages
• 10-day maximum to process opt-outs

✅ Message content

• Business name in every message
• Opt-out reminder periodic (every 30 days)
• No messages before 8am or after 9pm local time

Common TCPA mistakes to avoid

Mistake 1: Pre-checked consent boxes

Wrong: Having the SMS consent checkbox checked by default.

Fix: Always default to unchecked. The customer must actively check the box.

Mistake 2: Bundling SMS consent with email

Wrong: "I agree to receive email and SMS marketing..."

Fix: Separate checkboxes for email and SMS consent.

Mistake 3: Not storing consent records

Wrong: Only storing the phone number, not the consent details.

Fix: Store exact consent text, timestamp, IP address, and page URL.

Mistake 4: Buying or renting phone lists

Wrong: Sending messages to purchased phone lists.

Fix: Only message numbers where you have documented first-party consent.

Mistake 5: Ignoring time zones

Wrong: Sending promotional messages at 6am or 10pm.

Fix: Use recipient's local time zone. Send between 8am-9pm only.

Phone capture vs email capture: when to use which

Pro tip: Start with email-only popups for new visitors. Offer phone capture as a second touch for returning engaged visitors.

Combining phone capture with other popups

Revenue Boost supports multi-field popups that capture both email and phone:

Progressive profiling

1. First popup: Email only (welcome discount)
2. Second popup: Phone capture (VIP text club)
3. Third popup: Birthday field (birthday discount)

Each popup builds your subscriber profile without overwhelming visitors.

Gamification + phone capture

Combine spin-to-win or scratch cards with phone capture:

1. Visitor enters email → spins/scratches
2. Prize revealed with option to add phone for "bonus prize"
3. Phone verified → extra discount unlocked

This two-step flow captures both contacts without friction.

Conversion benchmarks for phone capture

Industry averages for phone capture popups:

Phone capture has lower raw conversion than email (higher friction), but the leads are higher quality and more engaged.

FAQ: Phone capture and TCPA compliance

Do I need TCPA compliance for WhatsApp?

TCPA specifically covers SMS and phone calls. However, WhatsApp has its own Business Policy that requires similar opt-in consent. The consent language templates in this guide work for both.

Can I use the same consent for email and SMS?

No. TCPA requires separate, explicit consent for SMS marketing. You cannot bundle SMS consent into email terms. Use separate checkboxes.

What if someone opts in but never verifies?

Don't message unverified numbers. Without OTP verification, you can't prove ownership—which weakens your consent documentation in case of disputes.

How long is SMS consent valid?

There's no fixed expiration, but consent should be "fresh." If someone hasn't engaged in 18-24 months, consider them lapsed. Re-consent before messaging again.

Do I need consent for transactional messages?

Transactional messages (order confirmations, shipping updates) don't require the same marketing consent. However, you still need permission to contact them via that channel.

What about GDPR and phone capture?

GDPR (EU regulation) has similar consent requirements. The opt-in standards in this guide comply with both TCPA and GDPR. Use the detailed consent language template for EU customers.

Can I send promotional messages to existing customers?

Having a purchase history doesn't grant SMS marketing consent. You need explicit opt-in regardless of customer status.

Get started with compliant phone capture

Building an SMS/WhatsApp subscriber list is one of the highest-ROI marketing activities—if done correctly. The 98% open rate and 90-second response time create opportunities email can't match.

Here's your action plan:

1. Install Revenue Boost on your Shopify store
2. Create a Phone Capture campaign from templates
3. Customize consent language with your store name
4. Enable SMS verification for ownership confirmation
5. Set discount incentive (10-15% works well)
6. Target exit intent or high-intent pages first
7. Store consent records (automatic with Revenue Boost)
8. Monitor verification and redemption rates

Most stores can launch a compliant phone capture popup in under 10 minutes. The key is getting consent right from the start—it protects your brand and builds a high-quality subscriber list that actually converts.