What Mobile Marketing Is, and What Each Channel Needs Before You Can Run It

Seven ways to reach a phone, and the permission each one demands first. See which you can start this week and which needs a written opt-in.

Neeraj JivnaniFounderSeptember 3, 2026 · 18 min read

Mobile marketing is any marketing that reaches a person on the phone they are carrying. Seven places on that phone can hold a message, and choosing between them is not the first move.

Five of the seven open only if somebody else lets you in, and two need nobody's permission at all. That split decides which you can start this week and which needs a written opt-in you have probably not collected yet.

So here are the seven, and the price of admission to each.

TL;DR

Mobile marketing is a delivery constraint before it is a discipline. The phone decides what a message may contain, how long it may run, and who has to agree to it first.
Seven places can hold a message on a phone: a text, a push notification, an in-app message, an ad in an app or a game, a location trigger, a QR code, and the mobile site itself. Social feeds and search results are already mobile, and they get chosen on other grounds.
The text message is the most heavily governed of the seven. The current text of the federal delivery-restrictions rule names seven words that revoke consent outright when a person sends one back: "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe."
The clock on that reply runs to ten business days at the outside, and the same rule says a sender may not designate an exclusive way to opt out. Other words count too, whenever a reasonable person would read them as a request to stop.
One confirmation text is allowed back. It may carry no marketing content, and it is presumed to fall within the consumer's prior express consent if it goes out within five minutes.
Push is a permission on Android, not a default. Android 13, API level 33, introduced POST_NOTIFICATIONS, and Google's documentation says a new install's notifications are off until the user grants it.
Location is two permissions and two accuracies. Google's documentation puts approximate location within about 3 square kilometers, and precise location usually within about 50 meters.
Cost follows the character count, not the send. Forbes Advisor reports mass texting software with starting costs ranging from 2.5 cents per text to $219 per month, and a plain message past 160 characters is split into parts of 153.

Mobile Marketing Is a Delivery Constraint, Not a Channel

Mobile marketing is a constraint on delivery before it is a channel of its own. What changes is not the message you would like to send, but the ones the device will carry.

The definition is wide on purpose. A message can start on paper, as a QR code on a poster, and still be mobile marketing, because the phone is where it gets read.

So "should we do mobile marketing" is not a question with an answer. The phone is not somewhere you decide to go. It is where the message ends up whenever the person holding it is not at a desk.

The question worth asking is narrower. Which of the seven places on that phone do you already have the right to use, and what would the rest cost you to earn?

How It Differs From Marketing You Do Not Carry

A billboard, a magazine spread and a radio spot are all delivered to a place. Mobile is delivered to a person, and that person is holding the receiver in their hand at the moment it arrives.

Three consequences follow, and they are the reason mobile gets its own rules.

The message is interruptive by construction. A text or a push arrives whether or not the reader asked for it right then, which is exactly why the law treats it differently from a page you chose to open.
The message is short by construction. A single text carries 160 characters in GSM encoding, according to Wikipedia's article on mobile marketing, and 70 if it holds an emoji or an accent, because those use a wider encoding.
The message is revocable by construction. The reader can stop it in one reply, delete the app, or turn the permission off in settings, and none of those needs your cooperation.

Nothing on a billboard is revocable. That single difference is where most of the requirements below come from.

Why It Gets Its Own Name Within Digital Marketing

Mobile is not a peer of email or search in a channel list. It cuts across all of them, because email is read on a phone and search happens on a phone.

It earns a separate name for one reason: three of the seven do not need a browser or an inbox to arrive. A text message, a push notification and an in-app message land on the handset itself, which is why the rules in front of them are different.

That is the line worth holding. Email and search are better for being built for a phone, but none of the seven gates stands in front of them.

Seven Places a Message Can Land on a Phone

Seven places on a phone can hold a marketing message, and the useful way to sort them is by what each demands before it will carry anything at all.

One demands a documented consent, three demand an app the person has installed, and one demands only money and an ad account. Two demand nothing at all.

Social feeds and search results are deliberately not counted here. They are already mobile, they are already most of what a phone does, and what to post or how to rank is decided by the platform and the query rather than by the handset.

Text Messages

A text message needs a documented consent from the person before the first send, and it is the only one of the seven with a federal rule naming the words that take that consent away again.

The rule defines that consent too. Prior express written consent, at 47 CFR 64.1200(f)(9) in the Code of Federal Regulations (CFR), is an agreement in writing bearing the signature of the person called.

It has to name the telephone number it covers, and it has to clearly authorize the seller to send advertisements or telemarketing messages to that number using an automatic telephone dialing system or an artificial or prerecorded voice.

Two disclosures have to sit on the face of that agreement. It has to say that signing authorizes those messages, and that the person is not required to sign as a condition of buying anything. An electronic or digital signature counts.

The mechanics are worth knowing before you write one. Wikipedia's article on mobile marketing records that a longer message is split and recombined, with each part holding 153 characters instead of 160.

That split is a billing unit, not a formatting detail. A 177-character message is sent as two, and an emoji drops the ceiling from 160 characters to 70, so either can double what a send costs.

The sender identity is a choice too. Short codes are the short numbers, usually five or six digits, used for mass sending. Wikipedia notes they are preferred over a dedicated virtual number for time-sensitive campaigns because they carry higher throughput.

Push Notifications

A push notification needs an app the person has installed, and then a permission. On Android it is POST_NOTIFICATIONS, and the person has to grant it actively.

Android 13, API level 33, introduced a runtime permission called POST_NOTIFICATIONS, and Google's own documentation is blunt about what changed. If a user installs your app on a device running Android 13 or higher, your app's notifications are off by default.

There is a trapdoor in that documentation worth reading twice.

If your app targets 12L, API level 32, or lower and the user taps Don't allow even once, they are not prompted again until they uninstall and reinstall the app, or you update it to target Android 13 or higher.

So push is not a list you build. It is a permission you ask for once, at a moment of your choosing, and it can be spent.

In-App Messages

An in-app message needs the app and nothing else. The person is already holding the surface open, which is why no separate consent stands in front of it.

The cost is who it can reach.

An in-app message goes no further than your own install base, and it reaches them only while the app is open.

That makes in-app the least gated of the app-based channels and the narrowest at the same time.

It is the right place for onboarding, for a feature nobody has found, and for the offer that only makes sense to somebody already using the thing.

Ads in Apps and Games

An ad in an app or a game needs money and an ad account. It needs no consent from the reader, because it is bought against an audience rather than sent to a person.

This is the only one of the seven that reaches people who have never heard of you, which is what it is for. Salesforce's guide describes in-app marketing as reaching users in a contextually relevant environment, with in-app ads, sponsored content and branded experiences among its forms.

Games are a real placement and the narrowest of them.

Rewarded video and interstitials sit between levels, and the game itself is most of the targeting: you are buying the audience a title attracts.

Getting found in the store is its own job. Wikipedia's article names the practice App Store Optimization, meaning the work of maximizing an app's visibility in the store so downloads rise.

Location and Proximity Triggers

A location trigger needs a permission that the reader grants to an app on their device, and it is the strictest of the app-based gates.

Forbes Advisor's guide states the operating limit clearly: location-based mobile marketing requires opt-in, and you cannot target the devices of random passersby. Geofencing, it notes, works with a device's GPS, and the same technique aimed at a competitor's premises goes by the name geoconquesting.

The developer side is stricter still. Google's documentation says an app requires background location access if it uses the Geofencing API, that ACCESS_BACKGROUND_LOCATION must be declared on Android 10, API level 29, and higher, and that Google Play restricts background location to apps that need it for their core features.

Two different things sit under the word geofence. One is inventory bought from an ad platform, which reaches phones it already knows about.

The other is a trigger in an app you own, and that one runs on a permission the customer granted to you rather than on a budget.

QR Codes

A QR code needs no permission at all, which makes it the outlier of the seven. The person points a camera at it, so the whole transaction is reader-initiated.

What it is worth is decided by what sits behind it.

A code that drops a new customer on a generic home screen has spent the only intent it was ever going to get.

The Mobile Site Itself

The mobile site needs nothing from anybody. You own it, and no permission stands in front of it.

It is also the only one of the seven that works for a business with no app, no phone number list and no ad budget. WSI's guide on the importance of mobile marketing names the requirement in one line: responsive design and fast loading.

That makes it the honest first move for a business with none of the other six switched on.

Every gate has two halves. You can only fill in one of them

Tick what you have already built and each of the seven places resolves. The second half of every row is drawn as a box you cannot tick, because on four of the seven it is not yours to tick.

What you have built

A mobile site you own
An app people can install
A written consent form that names the telephone number it covers
An ad account and a budget
Something printed customers already handle: packaging, a receipt, a poster, a counter card

A text message
Your half is not built
Yours, and not built yet. A written consent form that names the telephone number it covers
Not yours to tick. The customer signs it, and the agreement names their own telephone number. An electronic or digital signature counts, and the consent has to exist before the first send.
A push notification
Your half is not built
Yours, and not built yet. An app people can install
Not yours to tick. The person installs the app, and then grants the notification permission. On Android it is POST_NOTIFICATIONS, and they have to grant it actively.
An in-app message
Your half is not built
Yours, and not built yet. An app people can install
Not yours to tick. The person installs the app and opens it. An in-app message goes no further than your own install base, and it reaches them only while the app is open.
An ad in an app or a game
Your half is not built
Yours, and not built yet. An ad account and a budget
Bought, not granted. It is bought against an audience rather than sent to a person, which is why it is the only one of the seven that reaches people who have never heard of you.
A location trigger
Your half is not built
Yours, and not built yet. An app people can install
Not yours to tick. The person grants the location permission to an app on their device. Approximate or precise is their choice, and that decides whether you get a district or your door.
A QR code
Your half is not built
Yours, and not built yet. Something printed customers already handle: packaging, a receipt, a poster, a counter card
Nobody grants this one. A QR code needs no permission at all, because the person points a camera at it and the whole transaction is reader-initiated.
The mobile site
Your half is not built
Yours, and not built yet. A mobile site you own
Nobody grants this one. The mobile site needs nothing from anybody, and no permission stands in front of it.

Where that leaves the seven

Nothing ticked yet, so all seven sit on your half. Tick what you have built and watch how far it gets you.

This counts what each place requires before it will carry anything. It says nothing about whether a place is worth using, which turns on how often the same person buys from you.

Table of the seven places a message can land on a phone, each paired with the permission required before it can be used and who grants that permission, showing that text messages need documented prior express written consent from the customer, push notifications need an installed app plus the Android POST_NOTIFICATIONS runtime grant, in-app messages and in-app ads need an installed app and an ad account respectively, location triggers need a device location permission, and QR codes and the mobile site need no permission at all. — Neeraj Jivnani · Built from 47 CFR 64.1200 current text, Android Developers notification and location permission documentation, and Forbes Advisor's beginner's guide, all read September 2026

The Seven Words That End a Text Campaign

Text messaging is the one place on a phone where a federal rule names the exact words a customer can use to switch you off.

That rule is 47 CFR 64.1200, and its relevant paragraphs took their current shape after the Federal Communications Commission's 2024 order on revoking consent.

What follows is what that text says today.

What Counts as Revoking Consent

A person revokes consent by any reasonable method that clearly expresses a wish to stop hearing from you. The rule then names the methods that count as reasonable on their face, and one of them is a list of words.

Sent in reply to an incoming text, each of these revokes consent by itself:

stop
quit
end
revoke
opt out
cancel
unsubscribe

An interactive voice or key press opt-out on a call, and a website or phone number you yourself designated for opt-outs, count the same way.

Two duties sit on top of that list, and both are easy to get wrong.

The first is that the seven words are a floor and not a limit. If a reply uses other words, the rule still requires you to treat it as a valid revocation whenever a reasonable person would understand it as one.

The second is the deadline. Every request made in any reasonable manner must be honored within a reasonable time not to exceed ten business days from receipt.

The rule closes one more door. A sender of the calls and texts it covers may not designate an exclusive means to request revocation of consent, so "reply STOP" printed on every message does not narrow the ways a customer may use.

One more route counts, and one more duty comes with it. A revocation that arrives by some other way, a voicemail or an email to a number or address meant to reach you, creates a rebuttable presumption that consent is gone once the customer produces evidence that they asked.

In that case it counts unless you can show otherwise, judged on the totality of the circumstances. And if you send on a protocol that cannot take replies, every message has to say so clearly and give another way to stop.

The One Reply You Are Still Allowed to Send

You are allowed exactly one message back, and its contents are prescribed.

A one-time text confirming the revocation does not break the rule, as long as it merely confirms the request, carries no marketing or promotional information, and is the only further message sent after the request arrives.

Timing decides how safe it is. Sent within five minutes of receipt, the confirmation is presumed to fall within the consumer's prior express consent. Sent later, the sender has to show the delay was reasonable.

There is one useful allowance in it. Where somebody had consented to several categories of message, the confirmation may ask which of them the revocation was meant to cover, and until they answer you must stop everything that needed consent.

The Piece That Is Suspended Until 2027

One part of that rule is not in force, and it is the one that would matter most to a sender running several message programs at once.

On 6 January 2026 the Federal Communications Commission released Order DA 26-12. It extends a waiver of one clause in section 64.1200(a)(10), and the clause it names is the revoke-everything one.

The suspended duty is this: treating a revocation sent in reply to one kind of informational message as applying to all future calls and texts from that sender on unrelated matters. The order sets the effective date for it at 31 January 2027.

The Commission was explicit about the limit of what it had done. The waiver reaches only that portion of the rule, and it does not alter the status quo on any other ruling about revoking consent.

Read plainly, that means the seven words, the ten business days, the ban on an exclusive opt-out method and the confirmation allowance all bind you today. The single piece on hold is whether one "stop" sent about an informational message has to silence every unrelated program you run.

Infographic listing the seven words that the current text of 47 CFR 64.1200 recognizes as revoking consent to marketing texts, stop, quit, end, revoke, opt out, cancel and unsubscribe, shown alongside the three duties the same rule attaches to them: honor a revocation within a reasonable time not to exceed ten business days, do not designate an exclusive means of opting out, and one confirmation message with no marketing content presumed lawful if sent within five minutes. — Neeraj Jivnani · Electronic Code of Federal Regulations, 47 CFR 64.1200(a)(10) to (a)(12), current text read September 2026

Distance Means Three Different Things Here

Three location terms get used as synonyms in mobile advertising, and they answer different questions: geotargeting, geofencing and proximity.

Geotargeting selects an audience by the area they are in or associated with. GroundTruth's guide on mobile marketing strategies treats location-based marketing and geotargeting as the same practice, and it is bought the way any audience is bought, by setting a place alongside demographics, goals, budgets and dates.

Geofencing draws a boundary and reacts to a crossing. GroundTruth describes it as creating a virtual boundary around a location, a building or a shopping area, and then showing ads to people who fall within it and meet your criteria.

Proximity is the shortest range of the three and the oldest. Wikipedia's article records that proximity marketing rests on cell broadcast, a mechanism that sends a message to every phone in a defined geographical area rather than to a list.

The difference between the first two is not a preference.

It is a permission the customer either granted or did not.

What the Two Location Grants Are Worth

Google's documentation states that approximate location, granted through ACCESS_COARSE_LOCATION, is accurate to within about 3 square kilometers (about 1.2 square miles). Precise location, granted through ACCESS_FINE_LOCATION, is usually within about 50 meters (about 160 feet) and sometimes within a few meters.

So the reader who grants only approximate location can be geotargeted to a district and cannot be geofenced to your door. The permission, not the platform, decides which of the first two you get.

Scale comparison of the two location accuracies Android grants an app, showing approximate location from the ACCESS_COARSE_LOCATION permission resolving a phone only to within about 3 square kilometers or 1.2 square miles, against precise location from ACCESS_FINE_LOCATION resolving it to within about 50 meters or 160 feet, with the marketing consequence beside each: a city or district audience for the coarse grant, and a single shop doorway for the fine grant. — Neeraj Jivnani · Android Developers, Request location permissions, read September 2026

Everything Eventually Lands on a Page You Control

Six of the seven places on a phone end with a tap, and the tap lands on something you control. That makes the mobile site the shared dependency of the whole set, and the one worth fixing first.

The site is never finished, because the devices underneath it keep changing, and how you build it decides how much of that you are signing up for.

That problem has a cheap answer and an expensive one. The cheap answer is to build one page that reflows and to test it on real hardware.

The expensive answer is to keep a separate mobile build, and to discover, later, that only one of the two got the update.

An app is the other landing place, and it is a different commitment.

It has to be promoted through other channels and its downloads encouraged with something, as Salesforce's guide says plainly, which makes an app a distribution problem before it is a product one.

The site is a fixed cost that the other six channels can all point at.

The app is a fixed cost that only pays back if people keep opening it.

So the sequencing is not a matter of taste. Get the destination right, then buy traffic to it.

What Only a Phone Lets You Count

A phone produces four counts worth watching that a desktop channel does not hand you, and three of them are costs rather than wins.

The first is segments rather than sends. You are billed per segment, so the length and the encoding decide the cost before the send count does.

Forbes Advisor puts mass texting software at 2.5 cents per text at the low end. So a 177-character message costs 5 cents a recipient rather than 2.5, and nothing in the campaign report will call that a mistake.

The second is the permission grant rate. Since Android 13 made notifications a runtime permission, the share of installs that allow them is a real number with a real ceiling, and it is counted once per install rather than continuously.

The third is revocation, and here the rule names the words that trigger it.

Every reply carrying one of the seven words starts a clock that runs to ten business days at the outside, so the count of open revocations is a compliance number, not a marketing one.

The fourth is uninstalls. An app is the only place on this list where a customer can remove you in a single gesture, and the removal is recorded, which makes it the cleanest negative signal in mobile work.

Taps, sessions and conversions are the same arithmetic a phone reports as everything else does.

Where the Complaints Come From

Four complaints come up again and again about marketing to a phone, and each has a different remedy.

Interruption and ad fatigue. Ads that get in the way, too many pushes and messages that land at the wrong hour are what produce uninstalls, opt-outs and a worse impression of the brand. The remedy is frequency, and frequency is a number somebody has to set on purpose.
Privacy. Be plain about what you collect and what you do with it. The operative half of that is consent, because on a text it is not a preference but a rule with a deadline attached.
Device and platform fragmentation. A single creative has to survive a wide spread of screen sizes, operating systems and mobile browsers, which is the reason responsive design is a requirement rather than a nicety.
Battery and data cost. Heavy ads and heavy app features drain a battery and consume a data allowance, and that bites hardest where connectivity is limited or data is expensive.

The last one deserves more attention than it gets. It is the only complaint on the list where the reader pays a direct cost to receive your message, and they are the ones who notice.

Buying Software Before You Have Permission to Use It

There is no best mobile marketing platform, and the reason is not diplomacy. The seven places on a phone are served by different categories of tool, and which category you need is decided by which gate you have already passed.

The price band is public for one of them. Forbes Advisor found mass texting providers with starting costs ranging from 2.5 cents per text to $219 per month.

Notice what that buys and what it does not. It buys sending, a number to send from, and the machinery for handling replies. It does not buy the consent, and a sending tool with no consented list behind it is a monthly cost against an audience of nobody.

The same test applies to the rest of the category. A push tool needs an app that exists and users who have granted the notification permission.

A geofencing tool needs an app with background location, and an in-app messaging tool needs sessions to interrupt.

So the order is permission first, then software.

Say a clinic has been taking phone numbers at reception for years with no written consent to market to them.

No sending tool on the market makes that list usable. Buying one only turns a compliance problem into a monthly subscription.

Rule Changes With Dates on Them

Two changes with dates on them govern most of the seven. One flipped a default in Android, and the other put a piece of the federal revocation rule on hold.

The Android Default That Flipped

A push plan that counts on reaching every installed user was written for Android 12 and earlier. Since Android 13 the install and the grant are two separate events, and only the second one makes a phone reachable.

That is a change to your denominator, not to your creative.

The Clause That Is Not in Force

The date to put in a diary is 31 January 2027.

If you run several message programs, connecting them is not work to start in the month it becomes a duty.

None of that softens what already binds. A compliance process built on reply-STOP alone falls short of 47 CFR 64.1200 today, because the rule reaches other wording and other routes as well.

Timeline of the two dated rule changes governing mobile messaging, showing Android 13 at API level 33 turning notifications into the POST_NOTIFICATIONS runtime permission so that a new install starts with notifications off, and the Federal Communications Commission's Order DA 26-12 of 6 January 2026 extending to 31 January 2027 the waiver of the single clause requiring a revocation on one topic to stop a sender's unrelated messages, while the seven revocation words, the ten business day ceiling, the ban on an exclusive opt-out method and the one confirmation message remain in force today. — Neeraj Jivnani · Android Developers notification runtime permission documentation and FCC Order DA 26-12, CG Docket No. 02-278, adopted and released 6 January 2026, both read September 2026

Start With the Permission You Already Have

The order of work falls out of the gates rather than out of preference. Start with the place on the phone you already have the right to use, because that is the campaign you can run this week.

Almost everybody owns the mobile site, so it goes first, and it is the destination the other six point at anyway. A tap that lands on a slow page wastes whatever the tap cost.

Next is whatever consent you already hold. If you have collected phone numbers with a documented, written opt-in, texting is available now, and 47 CFR 64.1200's duties are what you run it against. If you have an app with granted notification permissions, push and in-app are available now.

If you hold neither, build the permission before you buy the tool. A QR code on packaging, a receipt, a poster or a counter card is the cheapest consent-collection surface there is, because the customer initiates it and no permission stands in front of it.

Whether that is worth doing turns on how often the same person buys from you.

A shop with regulars should start collecting consent today, because a text list earns back its cost from people who come back. A business selling something people buy once should put the same money into a fast mobile site and into bought placement, and leave the app alone.

/ Mobile Marketing Is a Delivery Constraint, Not a Channel

/ How It Differs From Marketing You Do Not Carry

/ Why It Gets Its Own Name Within Digital Marketing

/ Seven Places a Message Can Land on a Phone

/ Text Messages

/ Push Notifications

/ In-App Messages

/ Ads in Apps and Games

/ Location and Proximity Triggers

/ QR Codes

/ The Mobile Site Itself

/ The Seven Words That End a Text Campaign

/ What Counts as Revoking Consent

/ The One Reply You Are Still Allowed to Send

/ The Piece That Is Suspended Until 2027

/ Distance Means Three Different Things Here

/ What the Two Location Grants Are Worth

/ Everything Eventually Lands on a Page You Control

/ What Only a Phone Lets You Count

/ Where the Complaints Come From

/ Buying Software Before You Have Permission to Use It

/ Rule Changes With Dates on Them

/ The Android Default That Flipped

/ The Clause That Is Not in Force

/ Start With the Permission You Already Have