MESSAGE_FLOW rejection: fix an opt-in the reviewer can't verify
Short answer
The reviewer could not see or confirm how people agree to receive your texts. Rewrite the message flow field so it names every opt-in method, links to a public page or screenshot that shows it, and quotes the full disclosure: brand, message type, frequency, “Message and data rates may apply”, HELP, STOP, and links to your Terms and Privacy Policy.
What you'll see
| Where | Code | Wording |
|---|---|---|
| HighLevel (older screens) | MESSAGE_FLOW | “The campaign submission has been reviewed and it was rejected because of provided Opt-in information.” |
| Twilio, HighLevel | 30909 | “Message Flow or Call to Action incomplete/unverified” |
| Twilio, HighLevel | 30896 | “Campaign vetting rejection - Opt-in Error” |
| Twilio, HighLevel | 30917 | “All opt-in methods must include complete workflow descriptions” |
| Twilio, HighLevel | 30924 | “Missing or non-compliant consent agreement language in opt-in flow” |
| Telnyx, Bandwidth, Bird | 806 | Call to action can't be verified: opt-in path, HELP, STOP, frequency, rates or privacy missing |
| The Campaign Registry | CALL_TO_ACTION | TCR's official rejection category for this problem; MESSAGE_FLOW is the API field name |
Text in curly quotes is the provider's wording; the rest is our summary.
Why it happens
- The flow says “customers opt in on our website” without a URL, or links the homepage instead of the page with the form.
- The form is behind a login, inside a checkout, or not live yet, and no public screenshot is linked.
- The disclosure next to the checkbox misses an element: brand name, message type, frequency, “Message and data rates may apply”, HELP, STOP, or the Terms and Privacy links.
- Several opt-in methods were selected (web, keyword, verbal) but only one is described (Twilio 30917).
- Consent is implied (“by submitting this form you agree”), pre-checked, required, or bundled with accepting your terms.
- Verbal or paper opt-in with nothing the reviewer can check: no script, no image of the form.
- The flow mentions sharing opt-ins, partners or purchased lists.
How to fix it
- List every opt-in method customers can use. Twilio, HighLevel and Bandwidth all want each one described; skipping one triggers 30917.
- For a web form, give the exact URL of the page that has the phone field. If it is behind a login or not launched, host a screenshot on a public URL and link it, plus a screenshot of what happens after submitting. Twilio's toll-free guide accepts Google Drive or OneDrive links set to “Anyone with the link can view”.
- Quote the disclosure word for word. Twilio's template:
By checking this box and submitting this form, you consent to receive recurring [message type] text messages from [Business Name] at the mobile number provided. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to opt out. Read our full [Terms of Service] and [Privacy Policy].
- Say the checkbox is optional and unchecked by default, and that consent is not a condition of purchase.
- If you send marketing and informational texts, describe two separate checkboxes (Twilio 30913).
- For keyword opt-in, give the keyword, the number, where the call to action is shown, and the replies. Twilio expects a double opt-in: welcome text, a request to reply Y, then a confirmation.
- For verbal opt-in, quote the script, explain how consent is logged, and describe the confirmation text. Twilio says verbal consent alone is not enough for marketing.
- Finish with the exact opt-in confirmation text the subscriber receives.
Gets rejected
Customers opt in on our website.
Gets approved more often
Customers opt in on our booking form at https://brightsmiledental.com/book. Below the phone field is an optional, unchecked checkbox: "By checking this box, I agree to receive recurring appointment reminder text messages from Bright Smile Dental at the phone number provided. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply HELP for help or STOP to opt out." Links to our Terms of Service (https://brightsmiledental.com/terms) and Privacy Policy (https://brightsmiledental.com/privacy) sit directly below the checkbox. After opting in, customers receive: "Bright Smile Dental: You're subscribed to appointment reminders. Message frequency varies. Message and data rates may apply. Reply HELP for help, STOP to opt out."
Field limits
The Campaign Registry accepts 40 to 4,096 characters in the message flow field, and its API spec says: If multiple opt-in methods can be used for the same campaign, you must list them all.
Twilio caps the field at 2,048 characters, and other providers may be stricter, so keep it tight: method, link, quoted disclosure, confirmation text.
Check before you resubmit. Every rejection costs days, and often another $15 vetting fee. Paste your description, message flow, samples and policy text into the free preflight check, or generate a consistent set with the campaign builder.
Frequently asked questions
What does MESSAGE_FLOW mean in a rejection?
It is the name of the registration field that describes how consumers opt in, also called the call to action (CTA). A MESSAGE_FLOW rejection means the reviewer could not verify consent from what you wrote or linked. The Campaign Registry files it under CALL_TO_ACTION, and since March 2026 Twilio returns more specific codes such as 30909, 30896 and 30917.
Can I use a screenshot instead of a live URL?
Yes, when the form is not public (behind a login, not launched yet, or on paper or a tablet). Host the image on a public URL and open it in a private browser window to confirm it loads without signing in. Twilio's toll-free guide accepts Google Drive or OneDrive links set to 'Anyone with the link can view'.
Do I have to describe every opt-in method?
On Twilio, HighLevel and Bandwidth, yes: list every method a consumer can use, or you get code 30917. Telnyx says one method is enough, but describing every method you actually use is the safer choice everywhere.
Do disclosures in my Terms count for the call to action?
No. Twilio's 2026 guidance says the call to action itself must show the brand, purpose, frequency, rates, HELP and STOP. Having them only in your Terms does not fix CTA rejections.
Sources
- Twilio: A2P 10DLC Campaign Onboarding Guide (updated 2026-09-24)
- Twilio: A2P 10DLC Campaign Registration Rejected (updated 2026-09-10)
- Twilio error 30909 (accessed 2026-10-03)
- Twilio changelog: more actionable A2P 10DLC campaign error codes (published 2026-03-06)
- HighLevel: A2P campaign rejections, required fixes and vetting errors (modified 2026-09-09)
- Bandwidth: 10DLC vetting guide (2026-08-18)
- Telnyx: Guide to the 10DLC message flow field (accessed 2026-10-03)
- The Campaign Registry: CSP API OpenAPI spec (accessed 2026-10-03)
- CTIA Messaging Principles and Best Practices (May 2023 (current))
Rules change often and providers sometimes disagree; where they do, this page says so. This is general information, not legal advice, and no one can guarantee approval. See the disclaimer.
Related problems
- Twilio 30925, 30923, 30931, 30913, 30475, 30551, 30556 · DCA 803 · TF 1401-1407Opt-in checkbox rejections: pre-checked, required or bundled consent
- Twilio 30503, 30540 · DCA 611 · Proxy 6001-6006 · TF 1311, 1315Opt-in confirmation message rejected: what the first text must say
- Twilio 30446, 30476, 30498, 30509, 30510, 30513, 30543 · TF 1408-1414Toll-free verification rejected for opt-in: Twilio 30476, 30509, 30513
- Twilio 30908, 30932, 30536, 30477, 30519, 30550 · DCA 805, 851, 852 · TF 1207, 1501-1503Privacy policy rejections: the SMS clause carriers require
The Approval Kit adds industry template packs, opt-in and policy page templates, and an agency checklist.