Can my tattoo shop text the clients I imported? Only the ones who opted in to your texts, and most exports don't say who did.

A shop owner wrote to me last night. She had just brought 1,600 clients into her waivers.tattoo dashboard from Square and wanted to text them. The answer is the same for a list from Square, Vagaro, GlossGenius, Booksy or a spreadsheet you kept yourself: your shop can text the clients who opted in to your texts, in writing, and it's unlikely your export says who did. Here's what counts as consent, what a text without it can cost, and how a client you imported gives it on your tattoo waiver form at the counter.

This is a plain-language summary, not legal advice. A lawyer has the final word on this. Ask one, and keep your consent records.

What the law calls consent

The federal rule is the Telephone Consumer Protection Act, the TCPA, and it covers marketing texts: your offers, your news, a flash day. (A text about the appointment a client booked needs their consent too, but not in writing.) The FCC's rule under the TCPA says a marketing text needs prior express written consent: "an agreement, in writing, bearing the signature of the person called, that clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages", naming "the telephone number to which the signatory authorizes such advertisements or telemarketing messages to be delivered."

Three parts of that sentence decide most questions.

• It's to your shop. The consent authorizes "the seller," the business whose text it is. A client who opted in to a loyalty program's texts, or to another shop's, hasn't opted in to yours.
• It names the number. The consent goes with the mobile number the client gave when they gave it.
• It's written and signed. A box a client ticks on a form they sign counts, and a signature on a phone has counted since 2000. A name in a spreadsheet doesn't.

The same rule adds one more line: the agreement has to tell the client they are "not required to sign the agreement (directly or indirectly), or agree to enter into such an agreement as a condition of purchasing any property, goods, or services." That's why the texting box on a waiver form has to be optional, and separate from the terms every client accepts to sit down. Our form draws it that way: 2 optional boxes under the terms, one for aftercare and healing and one for your news, offers and events, each with Optional written beside it.

What a client list carries

A client list is contact details: a name, an email, a mobile number, sometimes a birthday and a note. That's what comes out of Square's Customer Directory, Vagaro's customer report, GlossGenius's client file and Booksy's export, and it's what the import in your dashboard reads. It's useful. In most of those files, no consent comes with it.

Some of those systems do hold a client's opt-in to texts, inside. Square's own texting takes one "through your point of sale after a transaction", or when a client joins your loyalty program and reads its disclosure, and it keeps those clients in a "Text Subscribers" group in the directory. GlossGenius keeps a status per client. Booksy keeps a Consents tab. In the 33 systems we read this week, none of the POS and booking tools put that opt-in in the export with a date beside it, and Square's own developers said last year that its API can't say whether a customer is subscribed to text marketing at all. The opt-in stays in the system you left. The list you carry out is names and numbers.

Two things in a Square file look like consent and aren't. "Email Subscription Status: Subscribed" is set the moment you type an email into a profile, by Square's own help, so it's Square's default, not a decision a client made. And a loyalty phone number is an opt-in to the loyalty program's texts on Square, not to your shop's texts from your own number.

What a text without consent can cost

The TCPA lets the person who got the text sue, with no regulator in between: "$500 in damages for each such violation", and when a court finds the sender "willfully or knowingly" broke the rule, up to 3 times that. A flash sale sent to 1,300 imported numbers is 1,300 violations in one press.

The phone carriers are the other side of it. Your shop texts from its own number on a registration that says how your clients opt in. A campaign that texts people outside what it filed can be shut off, and that stops every text, the aftercare notes included.

What happens when you import a list into waivers.tattoo

Your waivers.tattoo dashboard says it before you press Add, and I'll say it here: a client you import gets no email and no text until they say yes on your waiver form. They're on your list from the moment the import finishes. They're just not reachable yet.

The next time one of them walks in, they scan your QR code and sign your waiver form on their own phone, and they land on the record the import made, not a second one. The form shows them the 2 optional boxes. A box they tick opts them in to what it says, by email, and by text when they give a mobile number. From then on your thank-you, your touch-up check-in, your review ask and your offers reach them the way they chose, and your Texting screen counts the clients who have opted in, so you can watch a client list turn into a texting list one visit at a time, in writing. Importing your client list in the help pages walks through the import itself.

That's slower than a blast. It's also the version you keep: every opt-in on it is written and signed, to your shop, with the number beside it. And it works in both directions. The client list you export from your waivers.tattoo dashboard carries each client's consent, which box they ticked, where they gave it and the day, so your list leaves with its consent if you ever leave.

When the opt-ins can come over with your clients

A few systems ran your texting themselves and kept each client's own opt-in with the day it happened. Mailchimp's export carries an SMS folder with a "Subscription Status" and an "SMS Acquisition Time" for each contact, and Klaviyo and Constant Contact keep the same two facts. A waiver system where you wrote a texting question onto your own form, as some shops did on Wavrr, prints the answer and the signing date on each signed record. Those are a client's own consent to your shop, with a date, and we bring them over with your clients: send us the export and tell me which system it is.

A list that only says who is subscribed today, with no day on it, is a harder case, and I'd rather look at yours than promise. Most lists are the section above: one visit, one box.

The one question to ask yourself before a text goes out

Before any text goes to a client: did this person tell my shop, in writing, that I can text them, and do I have the record? If the honest answer is "I'm not sure," it's a no, and the fix is their next visit.