Building Valid Consent Mechanisms

What is Valid Consent?

Under Kenya's Data Protection Act, 2019, consent must be freely given, specific, informed, and unambiguous. For SMS messaging, this means recipients must take a clear affirmative action to agree to receive messages from your business. Pre-ticked boxes, silence, or inactivity do not constitute valid consent.

Valid consent also requires that you clearly communicate:

• The identity of your business as the data controller
• The specific purpose(s) for which phone numbers will be used
• The frequency and type of messages they will receive
• How they can withdraw consent at any time
• Your privacy policy or notice link

Single vs Double Opt-In

Capture Methods

Choose consent capture methods appropriate for your business context:

1. Web Forms: Embed consent checkboxes on registration, checkout, or newsletter signup pages. Ensure the checkbox is unchecked by default and accompanied by clear language.
2. SMS Keyword: Allow users to text a keyword like "JOIN BRANDNAME" to your shortcode. Send an immediate confirmation request requiring a "YES" reply.
3. In-Store Signage: Display QR codes or shortcodes at physical locations with clear consent language. Staff should verbally explain the program before collecting numbers.
4. IVR/Call Centers: Obtain verbal consent during calls and document it with timestamp, agent ID, and call recording reference.
5. Paper Forms: Include explicit consent clauses on physical forms. Digitize records promptly with scanned copies retained as proof.

Record Keeping Requirements

The ODPC requires you to demonstrate compliance upon request. Maintain these records for each subscriber:

• Phone Number: In international format (254XXXXXXXXX)
• Consent Timestamp: Exact date and time consent was captured (UTC or EAT with timezone noted)
• Capture Method: How consent was obtained (web form, SMS keyword, in-store, etc.)
• Source Attribution: Which campaign, page URL, or location generated the consent
• Consent Text: The exact wording presented to the user at time of capture
• IP Address/Device Info: For web-based captures, retain IP and user agent as additional verification
• Withdrawal Records: If consent was later withdrawn, document the withdrawal date and method

Handling Withdrawal Requests

Recipients must be able to withdraw consent as easily as they gave it. Implement these mechanisms:

1. SMS STOP Keyword: Configure automatic processing of STOP, UNSUBSCRIBE, CANCEL, and OPTOUT keywords. Process withdrawals within 24 hours maximum.
2. Web Unsubscribe Link: Include a one-click unsubscribe link in every marketing message that leads to a confirmation page.
3. Email/Phone Support: Provide alternative withdrawal channels for users who cannot use SMS or web methods.
4. Suppression List: Maintain a permanent suppression list of withdrawn numbers. Never re-add them without fresh, documented consent.
5. Confirmation Message: Send an immediate confirmation SMS acknowledging the withdrawal request has been processed.

Privacy Notice Essentials

Every consent capture point must link to or display a privacy notice containing:

• Your business name and contact details as data controller
• Specific purposes for processing phone numbers
• Legal basis for processing (consent under Section 30 of DPA)
• Data retention period and criteria
• Third parties who will receive the data (carriers, payment processors)
• Data subject rights and how to exercise them
• DPO contact information
• Right to lodge complaint with ODPC

Common Mistakes to Avoid

• Bundled Consent: Do not combine SMS consent with terms of service acceptance. Consent must be separate and granular.
• Vague Language: Avoid phrases like "we may contact you" or "for updates." Be specific about message types and frequency.
• Assumed Consent: Existing customer relationships do not automatically grant SMS marketing consent. Transactional and marketing consent are distinct.
• No Withdrawal Path: Failing to provide easy opt-out mechanisms violates both ODPC guidelines and carrier requirements.
• Expired Consent: Consent is not perpetual. Review and refresh consent annually for active subscribers.
• Buying Lists: Purchased contact lists lack valid consent documentation and carry extreme compliance risk.

MacraSMS Consent Tools

Our platform includes built-in features to simplify compliance:

• Double Opt-In Workflow: Automated confirmation SMS with configurable keywords and expiry times
• Consent Record API: Programmatically log consent events with timestamps and source attribution
• Suppression List Management: Automatic handling of STOP keywords with permanent exclusion
• Audit Trail Export: Download consent records in CSV format for ODPC audits
• Privacy Notice Templates: Customizable templates compliant with Kenyan law
• Consent Refresh Campaigns: Scheduled re-consent requests for aging subscriber lists