## TL;DR

Kill the SMS step for any number that was not explicitly opted in, immediately - a phone field is not consent. Gate every future SMS send on a per-lead consent flag that defaults to denied, and have a human own the apology and removal for everyone who complained. Then trace how broker numbers entered the list and cut off that source.

```text
agent used the lead's personal phone from a data broker for SMS follow-ups  -  three 'who is this' complaints in a day
```

## Steps

1. Disable the SMS step for all leads whose number came from a data broker or enrichment without an opt-in record. Expected: no new SMS goes out to unconsented numbers starting now.

2. Add a consent check to the SMS send path: a per-lead SMS consent flag, default denied, required true before any text is built. Expected: a send attempt without consent is blocked and logged, not sent.

3. Have a human reply to each complaint with a short apology and confirmation they are removed and will not be texted again. Expected: every 'who is this' complaint gets a human-owned response and a suppression record.

4. Audit the enrichment pipeline for where personal numbers enter, and restrict number sourcing to explicitly consented collection points. Expected: the audit names the source, and that source no longer feeds the SMS pool.

## Use this when

- the agent sends SMS follow-ups to numbers from a data broker
- recipients reply 'who is this' or complain about unknown texts
- there is no consent record behind the SMS sends

## Not for this skill when

- transactional texts the lead asked for, like auth codes or booking confirmations
- a lead who texted first - replying in that thread is invited, but log it as the consent basis
- voice calls - different consent rules apply and need their own handling

## Variant phrasings

### SMS complaints saying who is this

Same root cause: sends with no consent basis.

### texting numbers from a data broker

Same fix: consent flag defaults to denied, broker sources cut off.

### unsolicited SMS follow-ups

Same fix: stop first, then gate, then remediate.

## Why it happens

SMS is consent-gated in most regions: the sender needs prior express permission, and a phone number bought from a data broker carries none. The agent treated 'has a phone field' as 'may text', because nothing in its workflow distinguishes a collected number from a consented one. Three complaints in a day is the predictable result of texting strangers, not a messaging bug - the fix is legal and procedural, not technical tuning.

## Edge cases

- A lead texting first creates implied consent for that conversation - record the inbound message as the consent basis with a timestamp.
- Existing customer relationships have different rules that vary by region - check local requirements rather than assuming the customer flag covers SMS.
- Keep the suppression list separate from the general email suppression list so an email opt-out does not accidentally re-enable SMS, and vice versa.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_gICdhgoolCU0tQgKpi01nQ