Red Rock Capital · For your web developer

SMS Consent Block — Implementation Guide

Why this matters

Mobile carriers review the actual opt-in form during A2P 10DLC campaign registration — not just the privacy policy. A compliant policy behind a bare “I agree to be contacted” checkbox is the single most common reason campaigns get rejected. This block is what the carrier reviewer needs to see.

1. Where this goes

Add the consent block to every form that collects a phone number, immediately above the submit button:

/apply-for-loan/ — loan application (use the full version)
/contact/ — contact form (use the full version)
Broker registration / broker inquiry form (use the full version)
Any pop-up, landing page, or short lead capture form (compact version is acceptable)

2. Live preview

This is exactly how the block renders. The checkboxes below are interactive — click them.

Full version

Compact version

I agree to receive calls, emails, and text messages from Red Rock Capital
about my inquiry, including by automated means. Msg frequency varies.
Msg & data rates may apply. Reply STOP to opt out, HELP for help.
Privacy Policy ·
Terms

3. The code

3.1 HTML — full version (application & contact forms)

<!-- ============================================================
     RED ROCK CAPITAL — CONSENT BLOCK (full / loan application)
     Place immediately ABOVE the submit button.
     Both checkboxes MUST render unchecked on page load.
     ============================================================ -->
<fieldset class="rr-consent">
  <legend class="rr-consent__legend">Contact preferences</legend>

  <!-- 1. TRANSACTIONAL CONSENT — may be required to submit -->
  <label class="rr-consent__row" for="rr_consent_contact">
    <input type="checkbox"
           id="rr_consent_contact"
           name="consent_contact"
           value="yes"
           required>
    <span class="rr-consent__text">
      I agree that Red Rock Capital may contact me by phone, email, and text
      message about this inquiry or application, including by automated means,
      at the number and address I provided. Message frequency varies. Message
      and data rates may apply. Reply STOP to opt out or HELP for help.
      See our <a href="/privacy-policy/" target="_blank" rel="noopener">Privacy Policy</a>
      and <a href="/terms-and-conditions/" target="_blank" rel="noopener">Terms &amp; Conditions</a>.
    </span>
  </label>

  <!-- 2. MARKETING CONSENT — MUST be separate and MUST be optional -->
  <label class="rr-consent__row" for="rr_consent_marketing">
    <input type="checkbox"
           id="rr_consent_marketing"
           name="consent_marketing"
           value="yes">
    <span class="rr-consent__text">
      <strong>Optional:</strong> I also agree to receive marketing text messages
      from Red Rock Capital about loan programs, rates, and events, including by
      automated means. Message frequency varies. Message and data rates may apply.
      Reply STOP to opt out or HELP for help.
      <em>Consent is not a condition of any loan or purchase.</em>
    </span>
  </label>

  <p class="rr-consent__note">
    We do not sell, rent, or share your mobile number or text-message consent
    with third parties for their marketing purposes.
  </p>
</fieldset>

<!-- Hidden fields: capture the consent record for your TCPA audit trail -->
<input type="hidden" name="consent_page_url"  id="rr_page_url">
<input type="hidden" name="consent_timestamp" id="rr_timestamp">
<input type="hidden" name="consent_text_hash" value="rrc-consent-v1-2026-08-14">

3.2 HTML — compact version (short lead forms)

Use only where the full block genuinely will not fit. The full version is preferred everywhere.

<!-- ============================================================
     RED ROCK CAPITAL — CONSENT BLOCK (compact / short lead form)
     ============================================================ -->
<label class="rr-consent__row" for="rr_consent_contact_s">
  <input type="checkbox" id="rr_consent_contact_s" name="consent_contact" value="yes" required>
  <span class="rr-consent__text">
    I agree to receive calls, emails, and text messages from Red Rock Capital
    about my inquiry, including by automated means. Msg frequency varies.
    Msg &amp; data rates may apply. Reply STOP to opt out, HELP for help.
    <a href="/privacy-policy/" target="_blank" rel="noopener">Privacy Policy</a> ·
    <a href="/terms-and-conditions/" target="_blank" rel="noopener">Terms</a>
  </span>
</label>

3.3 CSS

Drop into your global stylesheet. Adjust colors to match the site, but keep the text at 13.5px or larger — carriers reject disclosures rendered in fine print.

/* Red Rock Capital — consent block styles */
.rr-consent{
  border:1px solid #d8dbe0;
  border-radius:8px;
  padding:18px 20px 14px;
  margin:24px 0;
  background:#fafbfc;
}
.rr-consent__legend{
  font-size:12px;
  letter-spacing:.1em;
  text-transform:uppercase;
  font-weight:700;
  color:#9b2226;
  padding:0 8px;
}
.rr-consent__row{
  display:flex;
  align-items:flex-start;
  gap:11px;
  margin:0 0 14px;
  cursor:pointer;
}
.rr-consent__row input[type="checkbox"]{
  flex:0 0 auto;
  width:18px;
  height:18px;
  margin:2px 0 0;
  accent-color:#9b2226;
  cursor:pointer;
}
.rr-consent__text{
  font-size:13.5px;
  line-height:1.55;
  color:#3c4149;
}
.rr-consent__text a{color:#9b2226;text-decoration:underline}
.rr-consent__note{
  font-size:12.5px;
  line-height:1.5;
  color:#6b7078;
  margin:0;
  padding-top:10px;
  border-top:1px solid #e6e8ec;
}

3.4 JavaScript — consent audit trail

Stamps the page URL and timestamp into the hidden fields so each consent record is defensible.

// Stamp the consent record at submit time (TCPA audit trail)
document.addEventListener('DOMContentLoaded', function () {
  var url = document.getElementById('rr_page_url');
  var ts  = document.getElementById('rr_timestamp');
  if (url) url.value = window.location.href;
  if (ts)  ts.value  = new Date().toISOString();
});

4. Non-negotiable rules

These are the requirements carriers and the TCPA actually enforce. Each one has been the basis for a rejected campaign or a lawsuit.

Both boxes render unchecked. Never pre-check, and never rely on CSS to hide state. Pre-checked boxes are not valid consent.
Marketing consent is a separate box from transactional consent, and the marketing box is never required. Bundling them into one checkbox invalidates both.
The form must not block submission on the marketing box. Verify server-side validation does not require consent_marketing.
“Consent is not a condition of any loan or purchase” must appear in the marketing consent text, visibly — not only in the linked policy.
Message frequency varies and message and data rates may apply must appear next to the checkbox, not just in the policy.
STOP and HELP must be named in the consent text.
Links to both the Privacy Policy and Terms & Conditions must be present, live, and publicly reachable without a login.
The disclosure sits directly adjacent to the checkbox — not in a footer, tooltip, modal, or collapsed accordion.

5. What to store with every submission

If a TCPA claim is ever made, the defense is the consent record. Store these fields with each lead and retain them for at least five years after the last message you send to that number:

Field	Example	Why
`consent_contact`	`yes`	Transactional consent given
`consent_marketing`	`yes` / empty	Marketing consent given or withheld
`consent_timestamp`	`2026-08-14T17:04:22Z`	When consent was given
`consent_page_url`	`https://www.fundwithredrock.com/apply-for-loan/`	Which form and campaign
`consent_text_hash`	`rrc-consent-v1-2026-08-14`	Proves the exact wording shown
`ip_address`	`203.0.113.42`	Corroborates the submission
`phone`	`+17195550142`	The number consented for

Version the consent text. Whenever you change the wording, bump consent_text_hash to a new value (rrc-consent-v2-…). That is how you prove which disclosure a given lead actually saw.

6. Handling opt-outs

Honor STOP, QUIT, END, CANCEL, UNSUBSCRIBE, OPT OUT, and REVOKE as valid revocation. Most platforms handle the standard keywords automatically — confirm yours covers all of them.
Honor revocation received by any reasonable method — a phone call, an email, a reply to a loan officer — within 10 business days. This is the part platforms do not automate: your team needs a way to flag a number as opted out in the CRM when someone says so verbally.
Send exactly one confirmation message after an opt-out. A second message is a violation.
Keep a permanent suppression list. Do not delete opted-out numbers — deleting the record is how a number gets re-messaged later.
Purchased or scraped lists are never consented. Do not text them.

7. Registration checklist

Before submitting the A2P 10DLC campaign:

https://www.fundwithredrock.com/privacy-policy/ is live and publicly reachable
https://www.fundwithredrock.com/terms-and-conditions/ is live and publicly reachable
Consent block is deployed on every form that collects a phone number
A screenshot of the deployed opt-in form is ready to submit as proof of consent flow
Sample messages for the campaign match the categories described in the Terms (transactional, conversational, marketing)
Both URL fields are populated in the campaign submission — as of June 30, 2026 a campaign without both is rejected at review
Legal entity name on the brand registration matches Island View Mortgage, Inc. exactly, as filed with the IRS for the EIN

One more

The brand registration EIN and legal name must match IRS records exactly. “Red Rock Capital” is the DBA — register the brand as Island View Mortgage, Inc. and list Red Rock Capital as the DBA or display name. Mismatches here are the second most common rejection reason after opt-in flow.

SMS Messaging Consent & Terms