Whose Consent Is It When You Text for a Client?
A practical guide to who holds candidate SMS consent and TCPA liability when a staffing agency texts under a client\'s brand, and the platform playbook that keeps every message provable.
Educational overview, not legal advice. Confirm your approach with counsel.
White-label recruiting is built on a simple promise: the candidate sees your client\'s brand, not yours. It is exactly what makes agency texting feel like an in-house team. It is also exactly what makes one compliance question easy to skip past. When a text lands under your client\'s name but your agency pressed send, who actually holds the candidate\'s consent, and who answers if that consent is ever questioned?
Most TCPA guides answer the generic version of this: get lawful prior consent, put a clear opt-out on every message, respect quiet hours. All true. None of it settles the part unique to agencies running client-branded campaigns, where the party the candidate thinks they consented to and the party doing the sending are not the same. That gap is the whole point of this piece.
Four things every agency should settle first
Before a single client-branded text goes out, these are the realities that decide where consent, and liability, actually sit.
Consent is given to whoever the candidate thinks they are talking to
When a text arrives under your client's brand, the candidate believes they consented to hear from that client. That expectation is exactly what TCPA rules are built to protect. If the message identity and the consent record do not line up, the gap is where liability lives.
The agency almost always sends, so the agency almost always sits in the liability chain
You are the party actually pressing send. Under the TCPA, both the entity that initiates a text and the party on whose behalf it is sent can be pulled into a claim. Deciding the client is fully responsible does not make the agency invisible to a plaintiff.
A shared brand does not mean a shared understanding
White-label branding hides the agency from the candidate on purpose. That is great for experience and terrible for ambiguity: if you never wrote down who owns consent for those candidates, both sides assume the other did.
The fix is contractual and technical, not a hope
Consent ownership, disclosure language, opt-out handling, and record-keeping should be spelled out in the client agreement and enforced by the platform, not left to whoever set up the first campaign.
Three ways agencies structure client-branded consent
The right model depends on how honestly the requisition is presented and what your client agreement says. Here is how each one lines up.
Client-branded, agency-operated
- What the candidate sees
- The candidate sees the client's name; the agency runs the campaign.
- How consent works
- Consent should be captured for the client brand the candidate sees, with the agency named as the operator that sends on the client's behalf.
- Risk profile
- Highest ambiguity. If disclosure only names the client but the agency sends from an undocumented number, the trail breaks under scrutiny.
Co-branded, disclosed operator
- What the candidate sees
- The candidate sees the client brand and a clear line naming the agency as the sender.
- How consent works
- Consent language references the client and the agency, so the record matches what the candidate actually read at opt-in.
- Risk profile
- Lower ambiguity. The candidate's understanding, the disclosure, and the send identity all agree.
Agency-branded on client requisitions
- What the candidate sees
- The candidate applies to a client role but is told the agency is the recruiter of record.
- How consent works
- The agency holds and owns the consent; the client is the hiring destination, not the texting party.
- Risk profile
- Cleanest for the agency, but only works when the requisition is honestly presented as agency-recruited.
A compliant agency texting workflow, step by step
Set the trigger. We handle the rest. Here is how a governed, white-label platform turns consent from a hope into a record.
Decide who owns consent before the first text sends
Per client, write down which party the candidate is consenting to hear from and which party operates the campaign. The answer drives your disclosure wording and your opt-out routing. Do not launch a client pipeline until that line exists in the agreement.
Capture consent where the candidate applies, on the client brand
Branded Apply Here pages let each client requisition collect lawful prior consent at the point of application, on your own domain, under the brand the candidate actually sees. The opt-in is tied to the pipeline it belongs to, not to a spreadsheet nobody can find later.
Name the sender in the message, not just the fine print
Use dynamic merge fields and lockable template sections so every automated text identifies the brand the candidate expects and, where your model requires it, the agency as operator. Update the disclosure once and it deploys everywhere.
Keep a clear opt-out on every message and honor it instantly
Every outbound text carries a plain opt-out such as Reply STOP. Automatic opt-out handling suppresses that candidate the moment they reply, and the suppression follows them across the client pipeline so no recruiter re-texts an opted-out contact.
Send inside quiet hours, per client and per candidate
Business-hours-only sending queues texts to appropriate local hours automatically. It respects the candidate, keeps you on the right side of quiet-hours rules, and removes one more thing a recruiter could get wrong on a client's brand.
Log the record so you can prove it later
Consent, disclosure text, delivery receipts, replies, and opt-outs live in a timestamped activity feed tied to the candidate. If a client or a plaintiff ever asks who consented to what and when, the answer is one search away, not a reconstruction.
What a compliant white-label first touch contains
Every automated text on a client\'s brand should do three things without a recruiter thinking about it.
It names the brand the candidate consented to
The message opens with the client brand the candidate saw when they applied. Where your consent model calls for it, one short line discloses the agency as the party sending on that client's behalf. The candidate is never guessing who this is.
It ties back to the role they applied for
A merge field references the position and the application, so the text reads as a continuation of a consented relationship, not a cold message. That is both better candidate experience and a stronger consent trail.
It gives a compliant opt-out every single time
A plain Reply STOP appears on every automated message, and the platform honors it immediately. The opt-out is not a courtesy you remember to add; it is enforced by the template you cannot strip.
The client contract does half the compliance work
Platform controls enforce the rules; the contract defines them. If consent ownership is not written down per client, both sides assume the other has it covered, and neither does.
Name the parties and the sending model
State explicitly which brand the candidate consents to and that the agency operates outbound texting on that client's behalf. Ambiguity in the contract becomes ambiguity in front of a regulator.
Assign consent ownership and record custody
Say who owns the consent record, who stores it, and who can produce it on request. When it lives in one governed platform, custody is clear and exportable.
Lock the disclosure and opt-out language
Agree on the required disclosure and opt-out wording and enforce it with lockable template sections so no recruiter can quietly edit compliant copy out of a message.
Agency SMS consent, answered
sms consent recruiting agency on behalf of client - who actually holds the consent?
Practically, consent belongs to whoever the candidate believed they were agreeing to hear from at the point of opt-in. If a candidate applied to a client-branded requisition and consented to texts under that client's name, the consent is for that client brand, and your disclosure and message identity should match it. The agency that operates the campaign still sits in the liability chain because it is the party initiating the texts, which is why serious agencies document consent ownership per client instead of assuming the client absorbs all responsibility.
Can a staffing agency text candidates under a client's brand without extra risk?
You can text on a client's behalf, but a shared brand does not erase the agency from a TCPA claim. Both the party a text is sent on behalf of and the party that initiates it can be named. Reduce the exposure by capturing lawful prior consent at application on the client brand, naming the sender clearly, keeping a plain opt-out on every message, honoring it instantly, and logging the whole record so you can prove what happened.
Does the candidate need to know an agency is involved?
That depends on your consent model and your client agreement, and it is a question for your counsel, not a blanket yes or no. What matters for compliance is that the disclosure the candidate reads at opt-in, the identity on the messages they receive, and the party actually sending all agree. A co-branded, disclosed-operator model removes ambiguity by naming both the client and the agency, which is the safest posture when white-label branding otherwise hides the sender.
What happens to consent and opt-outs when a candidate moves between clients?
Consent is specific to the brand and relationship it was given for, so consent captured for one client does not automatically transfer to another. Opt-outs, on the other hand, should be honored broadly for the sender. In ATS Mako, consent and opt-out status live with the candidate record and follow them across pipelines, so a candidate who replied STOP is suppressed and no recruiter accidentally re-texts them on a different client's campaign.
How does a white-label ATS help with agency SMS compliance?
It closes the gap between what the candidate consented to and what actually gets sent. Branded Apply Here pages capture consent on the client brand, lockable templates enforce the disclosure and opt-out language you cannot strip, quiet-hours sending queues messages to appropriate local hours, automatic opt-out handling suppresses replies to STOP instantly, and a timestamped activity feed keeps the record you would need to produce if anyone ever asks. One governed platform makes the consent trail an artifact, not a hope.
Is this legal advice?
No. This is an educational overview to help recruiting and staffing teams think through consent ownership when texting on a client's behalf. SMS recruiting is regulated under the TCPA and a growing set of state rules, and the right answer for your firm depends on your contracts, your consent model, and current law. Confirm your approach with qualified counsel before you run outbound texting on a client's brand.
Text on your client\'s brand. Prove every message.
ATS Mako captures consent on the client brand, locks the disclosure and opt-out, sends inside quiet hours, and keeps a timestamped record you can produce on demand. Designed for speed. Built for scale.
No setup fees, no long-term contracts, guided onboarding included.