SMS Marketing Compliance Guide 2026: TCPA, 10DLC & Best Practices
TCPA violations cost $500–$1,500 per message. Class action lawsuits have cost businesses tens of millions. This guide covers everything you need to run compliant SMS marketing — consent rules, 10DLC registration, opt-out handling, and which platforms do the heavy lifting for you.
Not legal advice
This guide summarizes SMS marketing regulations for educational purposes. For legal advice specific to your business, consult a telecommunications attorney. Laws vary by state — Florida and Oklahoma have stricter rules than federal TCPA.
What is the TCPA?
The Telephone Consumer Protection Act (TCPA) is a federal law passed in 1991 and significantly expanded in 2012 and 2023. It governs all commercial phone and text communications in the United States — including automated SMS marketing.
The 2024 FCC one-to-one consent ruling tightened rules further: companies can no longer use a single opt-in to authorize SMS from multiple brands or third parties. Every brand must obtain its own individual consent.
For SMS marketers, the core TCPA requirements are:
- ✓Prior express written consent before any marketing message
- ✓Clear opt-out instructions in every message
- ✓Immediate honoring of STOP/UNSUBSCRIBE requests
- ✓No messages between 9pm–8am (recipient's local time)
- ✓Accurate sender identification in every message
- ✓Maintain consent records in case of dispute
Key SMS Compliance Rules at a Glance
| Law / Standard | Requirement | Detail | Fine |
|---|---|---|---|
| TCPA | Prior express written consent | Must be obtained before any marketing SMS. Digital opt-ins count — but disclosure language must be present. | $500–$1,500/msg |
| CTIA | Opt-out honoring | STOP, QUIT, CANCEL, END, UNSUBSCRIBE must all work. Honor within 10 business days. | Carrier suspension |
| 10DLC | Brand & campaign registration | Register with The Campaign Registry before sending commercial SMS on long codes. | Message filtering/blocking |
| TCPA | Quiet hours | No messages between 9pm–8am in the recipient's local time zone. | $500–$1,500/msg |
| CAN-SPAM | Business identification | Must clearly identify your business name in messages. No misleading sender info. | Up to $50,120/violation |
| State laws | Florida & Oklahoma FTSA | Florida's FTSA (2021) is stricter than TCPA — requires 1:1 consent, bans list purchases. Check state-specific rules. | Up to $500/msg (FL) |
Getting Valid Consent
Consent is the foundation of SMS compliance. Not all opt-ins are legally equal — here's what counts as valid written consent under TCPA and what doesn't:
Example: Text JOIN to 55555
Best for: Brick-and-mortar, promotions, ads
Example: Checkbox: 'I agree to receive marketing texts'
Best for: eCommerce, SaaS signups
Example: Shopify checkout SMS opt-in
Best for: DTC brands, eCommerce
Example: Customer says 'yes' to receiving texts
Best for: In-person sales, call centers
Example: Buying a phone number database
Best for: N/A
Example: Phone given for delivery updates = marketing OK
Best for: N/A
Required disclosure language(must be visible at point of opt-in): "By providing your phone number and opting in, you agree to receive automated marketing text messages from [Business Name] at the number provided. Message frequency varies. Message & data rates may apply. Reply STOP to unsubscribe, HELP for help. Consent is not a condition of purchase."
10DLC Registration: Step-by-Step
As of 2023, all US carriers require commercial SMS to be sent via registered 10DLC numbers. Unregistered messages are filtered or blocked. Registration takes 3–8 days and costs around $10–48/month.
Choose an SMS platform
Platforms like SimpleTexting, Twilio, and EZTexting handle 10DLC registration for you. Pick your platform before registering.
Register your brand
Submit your business name, EIN, address, and business type to The Campaign Registry (TCR). One-time registration.
Register your campaign
Describe your SMS use case (marketing, transactional, etc.), sample messages, and opt-in method. Submit for carrier review.
Link your number
Assign your registered 10DLC number to your approved campaign. Start sending.
Pro tip:Most SMS platforms (SimpleTexting, EZTexting, Twilio, SlickText) handle 10DLC registration directly in their dashboard. You don't need to interact with TCR yourself — the platform submits on your behalf. This is one reason to choose a compliance-focused SMS platform.
Opt-Out Handling Requirements
Every marketing SMS must include a clear opt-out path. Failing to honor opt-outs is one of the most common TCPA violations — and one of the easiest to prevent.
Required opt-out keywords
- STOP— must all trigger opt-out
- QUIT— must all trigger opt-out
- CANCEL— must all trigger opt-out
- END— must all trigger opt-out
- UNSUBSCRIBE— must all trigger opt-out
Opt-out rules
- ✓ Send one-time opt-out confirmation message
- ✓ Honor within 10 business days (immediately is best)
- ✓ No charges for opt-out messages
- ✗ Never re-subscribe without new explicit consent
- ✗ Never send marketing after opt-out (even once)
Quiet Hours & Sending Windows
TCPA prohibits sending SMS between 9pm and 8am in the recipient'slocal time zone — not yours. If you're sending nationwide, your effective window is 11am–6pm ET to be safe across all US time zones.
Most SMS platforms allow you to set "smart sending windows" that automatically respect the recipient's time zone. Enable this feature — it's one of the easiest compliance wins.
Best SMS Platforms for Compliance Automation
The right SMS platform handles most compliance requirements automatically — 10DLC registration, opt-out management, quiet hours, and consent tracking. Here's how top platforms compare:
| Platform | 10DLC | Auto Opt-Out | Quiet Hours | Consent Logs | Best For |
|---|---|---|---|---|---|
| SimpleTexting | ✓ | ✓ | ✓ | ✓ | SMB marketing |
| EZTexting | ✓ | ✓ | ✓ | ✓ | Beginners |
| SlickText | ✓ | ✓ | ✓ | ✓ | Loyalty programs |
| Twilio | ✓ | ✗ | ✗ | ✗ | Developers (DIY) |
| Attentive | ✓ | ✓ | ✓ | ✓ | eCommerce DTC |
| Klaviyo | ✓ | ✓ | ✓ | ✓ | Email + SMS unified |
Note: Twilio is a raw API — compliance features must be built by your development team. This is not a knock on Twilio; it's designed for developers who want full control.
SMS Compliance Checklist
Before launching any SMS marketing campaign, run through this checklist:
Consent
- Opt-in method collects prior express written consent
- Disclosure language present at point of opt-in
- Consent records stored and exportable
- One-to-one consent obtained per brand (no shared lists)
10DLC Registration
- Brand registered with The Campaign Registry
- Campaign registered with correct use case type
- Approved 10DLC number assigned to campaign
- Carrier vetting passed (check platform dashboard)
Message Content
- Business name clearly identified in message
- Opt-out instructions included (STOP to unsubscribe)
- No deceptive or misleading claims
- Character count within limits (160 chars for single SMS)
Sending Practices
- Quiet hours enforced (8am–9pm recipient local time)
- Unsubscribe requests honored immediately
- Suppression list checked before every send
- Message frequency disclosed at opt-in
SMS Compliance FAQ
Can I text customers who gave me their number for something else?
No — not for marketing SMS. If a customer gave you their number for a delivery update, appointment reminder, or account notification, that consent covers transactional messages only. Marketing SMS requires explicit consent to receive promotional content. Getting new explicit consent from existing customers is a common compliance step when launching SMS marketing.
What's the difference between transactional and promotional SMS?
Transactional SMS are messages the recipient specifically requested or that are triggered by their actions — order confirmations, shipping updates, appointment reminders, password resets. These require less stringent consent (implied/prior relationship is acceptable). Promotional/marketing SMS are messages sent to sell or promote a product, offer a discount, or drive purchases. These require prior express written consent under TCPA.
Does TCPA apply to B2B SMS marketing?
TCPA applies to personal cell phones regardless of whether the recipient is a consumer or a business contact. If you're texting a business contact's mobile number for marketing purposes, TCPA consent requirements apply. B2B landline texting has slightly different rules. When in doubt, treat all mobile numbers as requiring TCPA-compliant consent.
How long do I need to keep consent records?
Best practice (and what most compliance attorneys recommend) is 4 years — matching the TCPA statute of limitations. Store the consent date, opt-in method, IP address or keyword used, and the disclosure language shown at the time of opt-in. Most enterprise SMS platforms export consent logs automatically.
Is SMS marketing legal in all US states?
Federal TCPA applies nationwide, but several states have passed stricter laws. Florida's FTSA (2021) requires individual prior express written consent (no shared consent forms), limits hours to 8am–8pm, and allows private lawsuits for violations. Oklahoma, Texas, and Washington have also passed or proposed additional SMS regulations. Always check state law for your target audience.
Ready to run compliant SMS marketing?
The right SMS platform handles 10DLC registration, opt-out management, and compliance automation for you. Compare top platforms to find the best fit.