SMS Compliance for Service Businesses — A Practical Guide (2026)
If you run a salon, dental clinic, fitness studio, or any service business that uses SMS for appointment reminders, confirmations, or marketing campaigns, there is a short answer and a longer one.
The short answer: in most countries, you cannot send someone a business SMS unless they have agreed to receive it. The longer answer involves what counts as agreement, what messages are exempt, how to prove the agreement later, and what to do when someone wants out.
This guide walks you through both, with the setup you need in your WordPress booking system to stay on the right side of the rules. It is written for business owners, not lawyers, so we have left the Latin out and put the practical steps in.
One upfront caveat: this is practical guidance based on public laws and widely accepted industry best practice. It is not legal advice. If your business operates in a regulated field (healthcare, finance) or across many jurisdictions, run your flow past a lawyer before you launch.
Why SMS compliance is not optional
Three forces push every service business towards tight SMS compliance in 2026.
The law has teeth. In the United States, the Telephone Consumer Protection Act (TCPA) sets statutory damages at $500 per unsolicited text, and up to $1,500 per text for willful violations (47 U.S.C. § 227(b)(3)). A single misfired campaign to even a few hundred people can turn into a six-figure problem. In the EU, the General Data Protection Regulation (GDPR) treats a phone number as personal data; Article 7 sets a high bar for valid consent, and national regulators like the UK’s ICO publish detailed guidance for direct marketing. Fines under GDPR can run into millions of euros, and even smaller enforcement actions typically require public remediation.
Carriers filter aggressively. Mobile operators in the US, UK, and much of the EU now use machine filtering to catch non-compliant senders. If your messages lack a clear business identifier, carry suspicious links, or go to recipients who never opted in, your delivery rate will quietly collapse — and your customers will wonder why they stopped getting reminders.
Trust is a feature. Service businesses live or die on reputation. A customer who gets an unwanted SMS after a one-off haircut remembers that experience longer than they remember the haircut. Compliance is not a cost; it is a quiet form of customer care.
The core consent principles
Every SMS compliance regime in the world — US, EU, UK, Canada, Australia — starts from the same foundation. Four principles are worth memorising.
Expressed consent, not implied
Someone booking an appointment is not the same as someone consenting to SMS. The customer must take a specific action — tick a checkbox, sign a form, send a keyword — that is clearly about SMS communication. GDPR Article 7 goes further: the consent must be a “clear affirmative action”, separable from other terms, and recorded.
Practical setup: your booking form should include an SMS consent checkbox that is unticked by default and labelled clearly. Something like “Yes, send me SMS confirmations and reminders about my appointment” works. For marketing SMS (promotional offers, newsletters), use a separate checkbox and a separate purpose statement.
Transactional messages are different from marketing
In most jurisdictions, SMS that are strictly transactional — “Your appointment is confirmed”, “Reminder for tomorrow at 2 pm”, “Your stylist is running 10 minutes late” — fall under a lighter regime, because they are part of the service the customer booked. Marketing SMS — “20% off this week”, “New service launched” — needs stronger, explicit consent.
Practical setup: separate the two in your system. In Bookly, this means distinguishing automated notifications (confirmations and reminders, triggered by booking events) from campaigns (one-off broadcasts you create by hand). The consent you collect for each should match.
Clear opt-out is a right, not a courtesy
Every regime requires an easy way for recipients to withdraw consent. In the US, the FCC expects a “reasonable means” of opting out. In the EU and UK, the user’s right to withdraw consent must be “as easy to withdraw as to give” (GDPR Article 7).
Important for Bookly users: SMS opt-outs are supported by the delivery provider even though replies are not received in Bookly. Your business should include a clear opt-out instruction in the SMS and explain how to use it. If your sender supports replies, use a short line such as “Reply STOP to unsubscribe.” If you send from a business name that cannot receive replies, provide an alternative, such as a working unsubscribe link or an email address where customers can request to stop receiving SMS. Make sure the method you describe works for your sending setup and that opt-out requests are acted on.
Keep records, or you cannot prove anything
Regulators and plaintiff attorneys ask the same question: show me the consent. If you cannot produce a timestamp, the source (which form), the exact text the customer saw, and the IP or user ID at the moment of consent, you lose by default.
Practical setup: With the Bookly Customer Information feature, you can add a consent checkbox to your booking form and store the response in the customer’s profile within your WordPress installation. This records the field value, rather than a complete consent audit trail. If you need timestamped consent history or immutable archives, arrange separate logging and archiving.
You can also add a required checkbox to the Details step so customers confirm that they accept your terms before completing their booking. This gives you a simple way to make acceptance part of the booking process. To keep the response in the customer’s profile, use the Customer Information feature described above.
SMS language guidelines: what to actually write
Compliance is not only about the plumbing. The words inside the SMS matter too. Four rules.
Identify your business in every message
Every SMS should include your business name. Not “we”, not “the team”, not just a service name. This is a baseline requirement under the CTIA Messaging Principles and Best Practices in the US, and a GDPR transparency requirement in the EU.
Good: [Oakwood Salon] Your appointment with Maria is confirmed for Oct 20 at 3 pm.
Weak: Your appointment is confirmed for Oct 20 at 3 pm.
Set honest expectations
If the customer agreed to confirmations and reminders, do not sneak in marketing. If they agreed to marketing, be realistic about frequency — “4 messages per month” is specific; “occasional offers” is not. Expectation drift is one of the most common sources of complaints.
Make the message useful, not performative
Compliance guides sometimes read as if every SMS should carry a page of legal boilerplate. That is counterproductive — SMS is a 160-character medium, and overloaded messages trigger carrier filters. Keep the message focused on the service, with the business name, the specific action or appointment, and (when relevant) a short opt-out line.
Opt-out instructions in marketing SMS
Include a short, clear opt-out instruction in your marketing SMS so customers know how to stop receiving messages. Use “Reply STOP to unsubscribe.” The delivery provider handles the request even though replies are not received in Bookly. As an additional opt-out option, you can offer a working unsubscribe link or a monitored email address. Choose the method supported by your sending setup and make sure requests received through other channels are acted on too.
For pre-written SMS examples across nine service industries — confirmations, 24-hour reminders, and follow-ups — see our free SMS templates library. The templates include Bookly placeholders and guidance on when to use them. Add the opt-out instruction appropriate to your sending setup and check the final message length after the placeholders have been filled in.
Setting up Bookly for compliance
Use these five steps to collect customer preferences, keep appropriate records, and provide a clear way to opt out.
1. Choose how to collect acceptance and consent. You can add a required checkbox to the Details step so customers accept your terms before completing their booking. To collect an SMS consent response and keep its value in the customer’s profile, use the Bookly Customer Information feature. Label the field with your business name and the purpose of the messages. Keep marketing consent separate from acceptance of your booking terms, with a checkbox that customers actively choose to tick.
2. Separate reminders from marketing. Keep appointment confirmations and reminders distinct from promotional campaigns. Match each message to the purpose the customer agreed to, and check your recipients before sending a campaign. A response collected for appointment-related SMS should not be treated as permission for marketing.
3. Save the customer’s choice. The Bookly Customer Information feature saves the customer’s consent field response in their profile within your WordPress installation, so you can refer to their recorded choice.
4. Provide and honour an opt-out method. Include instructions that work with your sender: “Reply STOP to unsubscribe” where supported, or a working link or monitored email address for senders that cannot receive replies. The delivery provider processes supported opt-out replies and blocks further messages from the relevant sender or messaging service. For requests received by email, phone, or another channel, keep a record of the request and make sure your sending process excludes the customer from the messages they have opted out of.
5. Identify your business in every template. Open Bookly → SMS Notifications and include your business name in each message. You can use {company_name} to insert it automatically. Check the text, business name, links, and opt-out instructions using a test booking with your own phone number.
Bookly manages your bookings and customer profiles within WordPress, while Bookly Cloud handles SMS delivery. Combine these tools with your consent-recording and opt-out procedures to support your compliance process.
Five scenarios service businesses actually face
Rules in the abstract are easy to agree with and hard to apply. Here are the five situations we see most often from Bookly users, with a reasonable path through each.
Scenario 1: new customer books online
Situation: A first-time customer books an appointment through your Bookly form.
Compliant flow: The booking form includes an SMS consent checkbox, labelled with your business name and the purpose (confirmations and reminders). The customer ticks it. You store the consent timestamp against the customer record. You send confirmation and reminder SMS — nothing else — until they also consent to marketing.
Scenario 2: existing customers from the pre-Bookly era
Situation: You migrated from a different system (paper, spreadsheet, another plugin) and have 2,000 customer phone numbers. Do you keep sending them SMS?
Compliant flow: Do not assume consent carries over. Send one re-permission email asking them to opt in to SMS, with a clear description of what they will receive. Only move opted-in customers to the active SMS list. This is painful short-term and the only clean path long-term.
Scenario 3: international customers across US, EU, and UK
Situation: You run a boutique spa in Barcelona and get bookings from the US, Spain, UK, and Germany.
Compliant flow: Apply the strictest regime to the whole list. In practice this means GDPR-style consent (explicit, separable, recorded) for everyone — it also satisfies TCPA and UK rules. The upside: one process, no sorting by location.
Scenario 4: marketing campaign to your customer list
Situation: You want to send a one-off “20% off this week” SMS to your 800 past customers.
Compliant flow: Only send to customers who separately consented to marketing. Transactional consent (confirmations and reminders) does not cover promotions. Expect your deliverable list to be smaller than your customer list — that is correct, not a problem to solve.
Scenario 5: customer asks to stop
Situation: A customer emails or calls to say they do not want any more SMS.
Compliant flow: Flag the customer record immediately so no SMS go out. Respond with confirmation of the opt-out and the date it took effect. Keep the record (you still need to prove the consent existed before). GDPR gives recipients up to 30 days to see action, but same-day is normal practice.
Compliance checklist
Print this. Pin it near the person who manages your bookings.
Pre-launch
- Booking form includes a separate, unticked SMS consent checkbox with a specific purpose statement.
- Marketing consent is a separate checkbox from transactional consent.
- Every SMS template includes your business name.
- Opt-out routing is documented (reply STOP, handled by the SMS delivery provider, or a working alternative such as email, account settings, or a preferences page).
- The customer’s SMS consent choice is saved in their profile using the Bookly Customer Information feature.
Monthly audit
- Confirm no SMS went to opted-out customers.
- Review carrier delivery rates; investigate drops below 95%.
- Check that any new SMS templates added during the month have business name and (for marketing) opt-out language.
Annual review
- Reconfirm consent for customers who have been dormant for 12+ months — a reactivation email, not a cold SMS.
- Re-read current guidance from the FCC (US), ICO (UK), and your national data protection authority. The baselines are stable; the details update.
- Confirm your retention schedule still matches your actual data (GDPR expects alignment).
Resources and further reading
- FCC (US) — TCPA guidance:
fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts - GDPR Article 7 — conditions for consent:
gdpr-info.eu/art-7-gdpr/ - UK ICO — direct marketing guidance:
ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/ - CTIA Messaging Principles and Best Practices (US industry baseline):
ctia.org/the-wireless-industry/industry-commitments/messaging-interoperability-sms-mms - Twilio compliance centre (vendor-neutral regulatory overviews):
twilio.com/en-us/legal/tcpa
A final word
Compliance is best thought of as a mindset, not a form. If you can explain to any customer, in one sentence, why you have their number, what you are sending them, and how they can stop, you are 90% of the way there.
The remaining 10% is the plumbing — the checkbox on the booking form, the customer’s saved consent choice, the opt-out routing. That part is your WordPress booking system’s job. Bookly handles the plumbing; you handle the one-sentence explanation.
As a reminder, this guide is practical, not legal. If your business has unusual exposure — regulated industries, EU and US customers in equal measure, large list sizes — talk to a lawyer who specialises in direct marketing. For the common case of a service business running SMS reminders and the occasional promotion, the principles above cover the ground.
Published October 2026. Last reviewed October 19, 2026.
