One opt-in. Two consents.
Capture SMS opt-in and email permission together at the point of application, so recruiting-ops teams satisfy TCPA and CAN-SPAM in one branded step - with the consent records and audit trail built in.
30-day free trial. No setup fees, no long-term contracts.
Two regulated channels, captured in one action
SMS and email each carry their own rules. Capturing both consents at the same moment - the moment a candidate applies - is what keeps your outreach lawful from the first touch to the offer letter.
SMS opt-in
Before you send a single recruiting text, the candidate must give prior express written consent to receive automated SMS from your organization. The disclosure names the sender, describes the messages (interview scheduling, status updates, outreach), notes that message and data rates may apply, and explains how to stop.
Email permission
Recruiting email carries its own rules. Every message needs an accurate sender identity, a subject line that is not misleading, a physical postal address, and a working unsubscribe that you honor promptly. Permission and unsubscribe state have to travel with the candidate record, not live in a separate list.
Five things two-factor consent gets right
The difference between an applicant and a candidate you can lawfully text and email is a clean consent record on both channels. Here is what a strong point-of-application capture looks like.
One consent moment, two regulated channels
Most recruiting teams treat SMS consent and email permission as two separate chores handled at two different times - and both slip. Two-factor consent captures them together, at the point of application, in one clearly worded step. On an ATS Mako Apply Here page, the candidate sees a standalone SMS opt-in and an email permission statement at the exact moment they submit, so both records are created and timestamped from the first touch.
Separate, specific consent - never bundled
TCPA consent cannot be buried in a general terms checkbox, and CAN-SPAM permission cannot be assumed just because someone applied. The safe pattern keeps each opt-in distinct and purpose-specific: the SMS statement covers automated texts and STOP handling, the email statement covers recruiting emails and unsubscribe. ATS Mako lockable templates let you standardize both blocks across every form, recruiter, and location so the language stays legally sound and on-brand. Update once, deploy everywhere.
Two opt-outs, both honored automatically
Two channels means two exit doors. A candidate who replies STOP, UNSUBSCRIBE, CANCEL, END, or QUIT must be removed from SMS immediately and permanently. A candidate who clicks unsubscribe must be removed from email just as fast. ATS Mako processes both at the platform level: the record is flagged, future automations exclude that channel, and each opt-out is logged with a timestamp - no recruiter cleanup, no accidental re-engagement.
Quiet hours on texts, sender rules on email
The two channels have different guardrails, and your workflow has to respect both. TCPA restricts automated texts to between 8 a.m. and 9 p.m. in the recipient local time zone, and several states go further. CAN-SPAM does not cap the hour, but it demands a truthful header, a valid physical address, and honored unsubscribes. ATS Mako enforces quiet-hours windows on outbound SMS at the platform level and keeps automatic unsubscribe handling and sender details intact on every email send.
One audit trail for both channels
If either channel is ever challenged, you need to show what happened. That means proving when the candidate consented, what SMS and email disclosures they saw, when each message went out, and when either opt-out was processed. ATS Mako logs every SMS and email event - sent, delivered, opened, clicked, replied, opted out - in a timestamped activity feed tied to the candidate profile. Consent records and opt-out history for both channels are one click away.
Why capturing both at once beats bolting one on later
The gaps almost always open up between channels and between moments. Capturing SMS opt-in and email permission together closes both.
| Dimension | Single-channel / later | Two-factor at application |
|---|---|---|
| Where consent is captured | SMS opt-in handled on one screen, email permission assumed or requested later in a separate email. Two moments, two chances to miss one. | Both opt-ins presented together at the point of application on your branded Apply Here page. One submit creates two timestamped consent records. |
| Consent language | A single generic checkbox tries to cover everything, or recruiter-written copy varies by rep. No shared standard for either channel. | Separate, purpose-specific SMS and email statements from a lockable template library. Legal sections cannot be edited or deleted by individual recruiters. |
| Opt-out handling | STOP replies and email unsubscribes tracked in different tools or spreadsheets, sometimes reconciled days later. Risk of contacting an opted-out candidate on the other channel. | Platform-level suppression per channel: STOP halts SMS in real time, unsubscribe halts email in real time, each logged with a timestamp. No cross-channel leakage. |
| Time-of-day rules | A mass SMS scheduled in the recruiter local time can land before 8 a.m. for out-of-zone candidates. Email hour rules rarely considered at all. | Quiet-hours enforced on SMS by recipient time zone at the platform level. Email keeps truthful sender details and honored unsubscribes on every send. |
| Record-keeping | No single place shows who consented to what and when. Email permission and SMS opt-in live in different systems with no common timeline. | Every SMS and email event lives in one timestamped activity feed on the candidate profile. Both consent records and both opt-out histories are retrievable together. |
From application to audit, on both channels
Give every office its own branded Apply Here page, then let ATS Mako carry both consents through every stage - capture, confirm, engage, respond, and audit.
- Step 1ApplyBoth opt-ins captured at the source
A candidate applies through your branded Apply Here page - the same page you drop into job posts, social, QR codes, flyers, and texts. A standalone SMS consent statement and a clear email permission statement appear at the point of submission. When they hit submit, both opt-in records are stored and timestamped in the applicant profile.
- Step 2ConfirmA double-confirmation on each channel
An automated confirmation text goes out naming the sender, describing the recruiting messages, and stating how to stop. A confirmation email does the same with a working unsubscribe. This reinforces both opt-ins and starts the candidate relationship compliant on the first touch.
- Step 3EngageOn-brand outreach across both channels
Outbound SMS and email pull from the lockable template library, so opt-out and unsubscribe language is included by default. Quiet-hours rules hold any text that would fall outside the 8 a.m. to 9 p.m. local window and release it the next morning. Every email carries accurate sender details and a working unsubscribe.
- Step 4RespondEither opt-out, handled instantly
Reply STOP and SMS automations halt in real time. Click unsubscribe and email automations halt in real time. Each event is flagged on the candidate record and logged with a timestamp - no recruiter involvement, no chance of re-engaging on the channel they left.
- Step 5AuditOne timeline for both channels
Every consent record, message, delivery receipt, open, click, and opt-out for SMS and email lives in the candidate profile - searchable and exportable. If either channel is ever questioned, your evidence for both is one click away.
Two-factor consent, answered
Can I capture SMS opt-in and email permission in the same step at application?
Yes - and doing so at the point of application is the cleanest way to stay compliant on both channels. The key is to keep the two consents distinct rather than lumping them into one generic checkbox: present a standalone SMS opt-in statement (covering automated texts and STOP handling) alongside a clear email permission statement (covering recruiting emails and unsubscribe). On an ATS Mako Apply Here page, both statements appear at submission and both records are timestamped in the applicant profile the moment the candidate applies.
Why do SMS and email need separate consent language?
Because they are governed by different laws with different requirements. SMS is regulated under the TCPA, which for automated marketing-style texts calls for prior express written consent that names the sender, describes the messages, notes that rates may apply, and explains how to opt out. Recruiting email is governed by CAN-SPAM, which requires truthful sender identity, a non-misleading subject line, a physical postal address, and a working unsubscribe you honor promptly. A single bundled statement cannot cleanly satisfy both, so the safe pattern keeps each opt-in specific to its channel.
What happens if a candidate opts out of texts but not email?
The two channels are independent. A candidate who replies STOP is removed from SMS immediately and permanently, but you can keep sending recruiting email as long as they have not unsubscribed - and vice versa. ATS Mako handles each opt-out at the platform level: STOP halts SMS automations in real time, an email unsubscribe halts email automations in real time, and each is logged with a timestamp so the two states never bleed into each other.
Do I still need consent if the candidate applied to my job?
Applying is not the same as consenting to automated recruiting texts or ongoing recruiting email. Applying shows interest, but TCPA still expects prior express written consent for automated SMS, and CAN-SPAM still requires that your email respect the sender and unsubscribe rules. Capturing both opt-ins explicitly at the point of application is what turns an applicant into a candidate you can lawfully text and email.
How do I prove consent for both channels if I am ever challenged?
You need a record showing when the candidate consented, what SMS and email disclosures they saw, when each message went out, and when either opt-out was processed. ATS Mako keeps all of this in one timestamped activity feed tied to the candidate profile: SMS opt-in, email permission, every send and delivery receipt, opens, clicks, replies, STOP, and unsubscribe. Consent records and opt-out history for both channels are retrievable and exportable at any time. This guide is educational and not legal advice - confirm your consent language with your own counsel.
Can I roll two-factor consent out across many locations without it drifting?
Yes. Give every office its own branded Apply Here page and drive both opt-ins from lockable templates. The SMS consent block and the email permission block are standardized centrally, so a local recruiter cannot edit or strip the legal language. Update the wording once and it deploys everywhere, which keeps every location capturing the same compliant two-factor consent.
Capture both consents on your own branded page
Spin up an Apply Here page that opts candidates into SMS and email at application, then let ATS Mako handle the outreach, the opt-outs, and the audit trail. Your logo. Your colors. Your domain.
This guide is educational, not legal advice. Confirm your consent language with your own counsel.