A phone match is not SMS consent

By the Leafprint team at Gold Standard Solutions. Published October 31, 2026. General information, not legal advice.

The short version

If a platform matches a website visit to a phone number, you have learned a possible phone number. You have not received permission to send that person marketing texts. Those are two entirely separate things, and mixing them up can cost you a lot.

What consent means for marketing texts

In the United States, the federal Telephone Consumer Protection Act and its rules generally require prior express written consent before you send automated marketing texts. In practice, that means a clear agreement from the person, tied to your business and the phone number, with disclosures about what they are signing up for. Several states have added rules of their own.

Browsing your website is not that agreement. Neither is having a phone number on file with a data provider. The person did not agree to anything from you, and they may not even know you have their number.

This is general information, not legal advice. Ask your counsel what applies in your states and to your program.

Why the risk is real

The TCPA allows private lawsuits with damages set per message, and text marketing is a well-known target for litigation. A program that sends to a large unconsented list can multiply that exposure quickly.

Then there are the carriers. Text programs in the US go through carrier registration and monitoring, and carriers have strict standards, especially for cannabis. Complaints or suspicious sending patterns can lead to filtered messages or a suspended number. If your text channel drives real revenue, losing it could hurt more than any fine.

Your customers matter too. Getting an unexpected text from a dispensary, with no memory of signing up, is the kind of thing people screenshot and share. In a category where discretion matters, that is a costly way to meet someone.

What about asking for consent by text?

This comes up often. The idea is to text a matched number once, asking the person to opt in. That first message is itself a text sent without consent, and it may well be treated as marketing. Do not assume it is a safe workaround, and ask counsel before trying anything along these lines.

What about email?

Email follows different rules. The federal CAN-SPAM Act, for example, works largely on an opt-out basis rather than requiring consent up front, while some states and other countries are stricter. That does not make matched email a free pass. Privacy laws, your email platform's terms, and your domain's sending reputation all matter, and many email platforms prohibit lists you did not collect yourself. Review it before sending anything.

What you can do instead

• Earn the opt-in. Use visitor data to find pages where interested people are leaving, then put a clear signup offer there, with proper consent language.
• Improve the offer. If people are not joining, the value may not be clear. Test what you are offering in exchange.
• Use in-store moments. Your budtenders and your checkout are strong places to collect consent.
• Work on content and channels. Use what you learn about interest to improve pages, promotions, and where you spend money.
• Keep your records. For each subscriber, record when they agreed, how, and what they saw when they did.

A quick test for your team

When someone proposes an outreach idea, ask where the permission came from. If the answer is a signup form, a checkout box, or a keyword the person texted to you, and you can produce the record, you have something to work with. If the answer is that the number showed up in a report, stop there. That single question catches most problems before they begin.

Build the check into your process

Rules on paper fail if the workflow makes mistakes easy. Keep matched data separate from your subscriber list. If you use webhooks, do not connect them straight to a sending tool. Train new staff on the difference between a contact and a subscriber. Make sure any agency working for you understands this as well, because your name is the one on the messages.

How we talk about this

We build Leafprint, so we have every reason to make the product sound as powerful as we can. We still will not tell you that identified contacts flow into your text list, because it would not be true without written consent. If another vendor tells you otherwise, ask them to show you how they handle consent, and get your counsel to review the answer. Our compliance page covers the wider picture.