Shopify SMS Marketing: Building Consent-Safe SMS and Email Retention That Compounds

The problem is consent, not messaging

Every "Shopify SMS marketing" guide starts with copy and send times. The actual blocker is upstream and much less fun: you cannot legally text people who have not documented consent, and most of your list has not.

On a wholesale program I worked on, the numbers were stark: 1,437 active trade accounts — 37% of the base — had no documented SMS consent, because they were onboarded before an opt-in checkbox existed. Only 388 had opted in since it went live.

The consent gap was not a records problem. Multiple onboarding paths bypassed the checkbox entirely — manual sign-ups entered by inside sales, accounts created by third-party cold callers, phone orders typed in by hand.

And TCPA requires documented, timestamped, source-attributed consent. Klaviyo enforces it: a profile without a clean consent record simply cannot be messaged. There is no override.

So the architecture question is not "what do we send?" It is "how does consent get captured everywhere a customer touches us, without building nine different consent mechanisms?"

One canonical opt-in form. Every channel surfaces to it.

That is the whole design principle, and it is worth stating as a rule:

Build one Klaviyo-native sign-up form on one landing page. Every other touchpoint funnels to that URL.

What you get for free:

• One place to maintain compliance language. When legal changes the wording, you change it once.
• Uniform source tracking via URL parameters, so every channel is measurable without extra instrumentation.
• Klaviyo automatically captures timestamp, IP, the exact consent text shown, and the source. That is your audit trail, generated as a side effect.
• Audit complexity collapses from nine mechanisms to one.
• Implementation drops from engineering to configuration plus thin surface layers.

The alternative — a checkout checkbox that writes consent one way, a popup that writes it another, a rep entering it manually a third — is nine places for the compliance language to drift out of sync, and nine things to re-verify when the law changes.

Nine surfaces, and they are "and", not "or"

Each catches a different slice of the audience. You need all of them because no single one reaches everybody:

• An email campaign to the un-consented segment. Cheapest reach, highest volume, one send.
• The landing page with the embedded form. The destination everything else points at.
• A checkout checkbox. First-class on Shopify Plus via Checkout UI Extensions; a workaround off Plus.
• A logged-in popup, segment-targeted at "trade AND not SMS-subscribed", triggered on exit-intent or 50% scroll — never on page load. Page-load popups on a logged-in B2B dashboard are a support ticket, not a growth tactic.
• A dismissible login prompt with a 7-day remind-me TTL.
• A dashboard banner, conditional on customer tag plus a metafield.
• An order-confirmation block. High attention, zero friction.
• A printed QR code on packaging, pointing at the same URL. This one reaches people who never log in.
• A win-back campaign for dormant accounts, where the SMS offer is the reason to re-engage.

Closing the verbal-channel gap

The hardest slice is the one that never touches a screen: customers who give a phone number on a call.

The clean solution is Klaviyo-native double opt-in by text:

• The operator captures the number during the call.
• The profile is added to Klaviyo.
• Klaviyo fires a confirmation SMS.
• The customer replies YES.
• Klaviyo records timestamped consent with a source value marking it as verbal double opt-in.

Compliant, no paperwork, no dependency on anyone's memory or handwriting. A variant that also works: the operator texts the canonical opt-in URL from a company line mid-call, and the customer completes it themselves.

The automated backstop

Nothing above catches everyone, so there is a flow underneath it all — triggered on Customer Created, filtered to the trade tag:

• T+0 — welcome email including an SMS opt-in section.
• T+24h — second touch if still not opted in.
• T+72h — dashboard banner turns on for that customer.

Source attribution: the free metric

Every URL pointing at the opt-in page carries a ?source= parameter drawn from a fixed vocabulary:

?source=checkout
?source=popup_logged_in
?source=login_prompt
?source=dashboard_banner
?source=order_confirmation
?source=packaging_qr
?source=verbal_inside_sales
?source=email_campaign_2026_q3

Klaviyo captures the parameter as a profile property automatically. Which means "opt-in rate by source" costs nothing to build and tells you exactly which of your nine surfaces is worth keeping.

The fixed vocabulary matters. checkout, Checkout and checkout-page are three sources in your report and one source in reality.

The SMS/email routing bug that is probably on your account

I found this in a live Abandoned Checkout flow, and I have since found it on other accounts.

The flow branched on SMS consent. SMS subscribers received exactly one text and zero emails. The people who trusted you with a phone number were receiving the least communication about an abandoned checkout.

The correct shape is base-plus-bonus, never a split:

• Everyone gets the full email sequence.
• SMS-consented profiles additionally get the text.

If your abandoned-checkout flow has SMS on one branch and email on the other, you have this bug right now.

Measure these

• Opt-in rate by source — which surfaces earn their maintenance.
• Time-to-opt-in — Profile Created vs SMS Consent Date. Long gaps mean your early surfaces are not working.
• SMS click-through and conversion.
• AOV of SMS-opted vs email-only profiles. This is the number that justifies the program.
• STOP / unsubscribe rate. Your early warning on frequency, and the only metric that tells you to send less.
• Per-opt-in audit trail — timestamp, source, IP, consent text. Not a growth metric; a legal one.
• LTV by opt-in-speed cohort. Customers who opt in within 24 hours behave differently from those who take a month.

The honest reframe

Discovery on this program found something that changed the entire pitch: email was already healthy. Roughly 39.5% open rate and about US$4.00 revenue per recipient.

So SMS was not rescuing a broken email program. It was additive, and the urgency narrative that had been built around it was wrong. I said so in writing, because a retention program built on a false premise gets measured against the wrong baseline and gets killed when it does not deliver a rescue nobody needed.

Similarly, the conclusion of discovery was not "build a system." It was: "finish publishing one that is already 80% there." The opt-in form existed in Draft with correct compliance language and a proper teaser → form → success structure. SMS was already enabled. The trade tag already synced from Shopify to Klaviyo, so segment targeting needed zero setup.

The blockers were legal, not technical — consent disclosure wording pending outside counsel. That is worth naming for anyone planning an SMS program: budget for the legal review, because it is the critical path and it does not compress.

A related build worth stealing

Back-in-stock waitlists, scoped Klaviyo-native rather than as a new app:

• Per-variant button on the product page.
• Automatic email on restock, SMS optional for consented profiles.
• Phase 1: a weekly CSV to inside sales as callback leads. Unglamorous, immediately valuable.
• Phase 2: order-management integration.

Phase 1 is a CSV export and a calendar reminder. It captured demand signal for months while the real integration was scoped.

The short version

• Consent is the constraint. Solve it first.
• One canonical opt-in form. Every surface points at it.
• Nine surfaces, all of them, because each reaches a different person.
• Double opt-in by text closes the verbal channel legally.
• ?source= on every link, from a fixed vocabulary.
• SMS is additive to email. Never a branch.
• Be honest about whether email is broken before you sell SMS as the fix.

I build retention programs where email and SMS work together and the consent record survives an audit. See [Klaviyo expert services](/klaviyo-expert) or [hire a Shopify developer](/hire-shopify-developer). Related: [11 Klaviyo flow defects that quietly kill email revenue](/blog/klaviyo-expert-flow-audit).

Direct: [WhatsApp +55 11 98851-2788](https://wa.me/5511988512788) · [contato.matheusabrahao@gmail.com](mailto:contato.matheusabrahao@gmail.com)