The Exact Words That Get Your A2P Campaign Denied

Every clinic that registers to send text messages assumes the review is about the texts. It is not, at least not first. Before a single message goes out, the registration process reads your business record, the written description of what you intend to send, your opt-in page, your privacy policy, your terms of service, and the rest of your public website. The messages themselves are two sample lines near the end of a long form.

That is why denials feel so arbitrary. A clinic owner reads the rejection, looks at the perfectly reasonable appointment reminder they planned to send, and cannot work out what the problem was. The problem was almost never the reminder. It was a sentence on the services page, a checkbox coded the wrong way, or a link pointing at a page that no longer exists.

We have been through this on our own accounts. Two registrations we submitted were denied, and neither was denied for anything we had sent. What follows is what actually caused them, the language we had to strip out, and the pass we now run before anything gets submitted. Approval sits with the registry and the carriers, standards change without notice, and outcomes vary by account, so read this as our operating experience rather than a guarantee or as legal advice.

What Is Actually Being Reviewed

Business-to-person messaging in the United States runs through a registration system. Your business is registered as a brand, and each messaging program you run is registered as a campaign through The Campaign Registry by way of your messaging provider. A clinic cannot register itself directly, and the registration is checked before your number is allowed to send commercial traffic.

There are two gates, and they fail differently. The first is an automated compliance checker inside your messaging platform that scores your opt-in page, your privacy policy, and your terms of service against a fixed checklist. That gate is a parser: it reads your HTML and looks for specific strings in specific tags. The second gate is the registry review, which is where a reviewer looks at your whole business and decides whether the messaging you described is what the system was built to allow. Passing the first gate does not get you through the second.

Denial One: The Words on the Site

The first denial came back as disallowed content, error code 30897. Three things caused it.

The campaign description said the brand was operated by another company of ours. That single phrase reads as an intermediary sending on someone else's behalf, which is the exact pattern the content rules exist to catch. The description was also generic enough that it could have described any business, which gives a reviewer nothing to verify. And the website carried marketing language describing going into a clinic's existing patient records to find people to text.

That last one is the important lesson. Nothing about it was untrue or unusual as agency marketing. But the entire purpose of the content standards is to stop messages going to people who never agreed to receive them, and language about mining an existing list for people to contact describes precisely that, whether or not it is what you actually do. The reviewer is not reading your intent. They are reading your words.

The fix was a full site rewrite that removed the trigger vocabulary, presented the business as the direct sender rather than as something operated by someone else, and replaced the generic description with a specific one naming the real form, the real consent flow, and the real message types.

Denial Two: The Form Nobody Could Find

The second denial was a call-to-action verification failure, error code 30909. The cause was simpler and more embarrassing. The opt-in URL on the submission pointed at a website that had since been rebuilt somewhere else. The page returned an error. There was no form to verify, so nothing else in the submission mattered.

A close cousin of this failure is worth its own warning, because it wasted a full review cycle for us and it looks nothing like what it is. Our opt-in page was live and every required disclosure was present, but the site had bot protection and a managed robots file enabled. The automated reviewer was blocked, and the checker reported the disclosures as missing. We spent an afternoon rewriting text that was already correct. Confirm your opt-in page, privacy policy, and terms are reachable by an automated visitor before you blame your wording.

The Language to Strip Out First

Reviewers crawl the whole site, not just the page you submitted. Run these replacements across every public page before you register, including the blog and the about page.

Remove	Use instead	Why it trips
Weight loss, fat loss, inches lost	Wellness program, metabolic reset, body contouring program	Consumer outcome claims attached to a health service
Guaranteed results	Individual results vary	Outcome guarantees are not permitted, and they are indefensible anyway
Database reactivation, re-engage	Patient outreach, reconnect with, invite back	Reads as messaging a list that never opted in with you
Lead generation, lead qualification, nurture leads	Inquiry management, responding to inquiries	Third-party lead vocabulary, associated with unsolicited traffic
Operated by, a brand of, doing business as, dba	Is a service of your legal entity	Reads as an intermediary sending for someone else
Our scheduling assistant, automated sequences	Your scheduling system, appointment reminders	Implies an outside party runs the messaging
Revenue claims, income claims, profit center	Program, our success is tied to yours	Financial promise language
Cure, heal, treat	Supports, is used for	Medical claims a wellness business cannot make

The pattern underneath all eight rows is the same. Anything that sounds like a promise, and anything that sounds like you are texting strangers, is a problem. Neutral, specific, verifiable descriptions of your own services pass. Our post on marketing without overpromising covers the same discipline for public-facing campaigns, and the two jobs are close enough that fixing one usually fixes the other.

Half the Review Is Structure, Not Words

This is the part that catches people who did everything else right. The automated checker parses HTML structure. Having the correct words in the wrong tags fails. We failed twice on this before we understood it.

• Each consent checkbox needs a real label element bound to the input by matching identifiers. Consent text wrapped in a span inside a paragraph does not count, no matter how correct the sentence is.
• Zero inline styles on the consent block, the inputs, or the labels, and no style block sitting in the page head. Move everything to your stylesheet. Both of those cost us a review round.
• Watch stylesheet specificity. A single global rule that forced labels to display as blocks was enough to break our consent parsing on a page whose text was verifiably correct.
• The business name in the consent text must match your registered brand record character for character, including capitalization and punctuation. Not the version with a comma. Not the version with your service name in parentheses after it. Copy the registered string exactly.
• Two separate checkboxes, one for transactional messages and one for promotional messages, both unchecked by default, both optional. The words transactional and promotional need to appear.
• The phone field must not be required and must not carry an asterisk. A required phone field implies consent is a condition of service.

The Lines Your Legal Pages Must Contain

Your privacy policy and terms of service are checked for specific disclosures, and the check is closer to a string search than a reading. Paraphrasing fails. Your privacy policy needs an explicit statement that mobile information will not be sold, rented, or shared with third parties or affiliates for their own marketing purposes, and a statement that carriers are not liable for delayed or undelivered messages. Your terms need the same carrier statement, an age requirement of eighteen or older, opt-out instructions, message and data rate disclosure, a support contact with both an email address and a phone number, and a link back to the privacy policy. Both pages need a plain statement that consent is not a condition of purchase.

Writing the Campaign Description

Every platform pre-fills this field with sample text. Replacing that sample text is not optional, and leaving it in is a documented denial cause. Write the description yourself and make it specific enough that a stranger could verify it. It should say who the business is and where it operates, name the exact page where people opt in, describe what you send in plain terms such as appointment confirmations and service updates, state that consent is not required to buy anything, say how someone stops the messages, and point to the privacy policy and terms by name. Your two sample messages should carry your clinic name, realistic content you would actually send, opt-out language, and no health, outcome, or income claims of any kind.

What a Denial Actually Costs

The rewrite is a day. The queue is the expense. Every resubmission goes back into a review process you cannot escalate, and an unapproved campaign cannot send. If you have dated a launch event around the assumption that reminders and confirmations will be running, a denial does not delay one task, it removes an entire layer of the event. That is why registration belongs at the front of the runway and not beside it, a point we make in detail in the thirty-day runway. Filling a room is hard enough with your reminder system working, as anyone who has tried to fill a launch event calendar knows.

The Pass to Run Before You Submit

This is the sequence we run on every account now, and it has held.

• Search your entire site for every term in the table above, including the pages you forgot you published.
• Open the opt-in URL in a private browser window and confirm the form loads and the page is not a redirect to something else.
• Confirm bot protection and robots rules are not blocking automated visitors on the opt-in, privacy, and terms pages.
• Copy the registered brand string directly from your account record into the consent labels rather than typing it from memory.
• View the page source and confirm there are no inline styles and no style block anywhere in the consent markup.
• Wait several minutes after any deploy before running the compliance checker, so it reads the new page rather than a cached one.
• Replace every pre-filled field. Do not navigate backwards in the wizard, which can clear fields you already completed.
• Save the complete submission, every field, both sample messages, and all URLs to a document before you click submit.

That last item is the one clinics skip and regret. A denial notice tells you a category, not a sentence. Without a saved copy of exactly what you submitted, you cannot compare the attempt that failed with the attempt that passed, and you end up guessing through another cycle. Email deliverability has the same forensic problem, which we covered in why clinic emails land in promotions.

The Practical Takeaway

Registration is not judging whether your clinic is legitimate. It is judging whether your public writing and your consent form describe a business that texts people who asked to be texted. Most clinic denials are caused by marketing copy written years earlier by someone trying to sound impressive, and by a form that a developer styled inline because it looked better that way. Fix the words, fix the markup, verify the pages are reachable, and keep a record of what you sent. Do that before the event is on the calendar rather than after.