Complete SMS Compliance Guide Laws and Rules

Here's who oversees text message compliance:

• Cellular Telecommunications Industry Association (CTIA): An association of mobile carriers that sets rules and standards for the SMS marketing industry. Carriers enforce their messaging principles and best practices by filtering or blocking messages that don't follow them.
• The Campaign Registry (TCR): Registers and vets business brands and texting campaigns for 10DLC on behalf of the major carriers.
• Federal Communications Commission (FCC): Enforces the TCPA, which treats texts the same as calls.
• Federal Trade Commission (FTC): Enforces the Telemarketing Sales Rule and the CAN-SPAM Act, which mostly covers email.

CTIA and TCR set the standards carriers follow, while the FCC and FTC enforce federal SMS laws. Some states add stricter "mini-TCPA" laws on top of federal rules, and these SMS marketing laws apply based on where the recipient lives.

Here's a quick look at how these rules fit together:

Now that you understand the basic terms surrounding text message compliance, here are some critical steps to consider:

1. Outline Your Program Details at Opt In

When it comes to text messaging compliance, how you present and promote your SMS campaign also falls under scrutiny.

Wherever you provide a call-to-action to opt in to your SMS program, you must include the following details:

• Your business name
• The types of messages recipients can expect
• Your messaging cadence
• Text message and data rate notices
• A link to your terms and conditions
• Privacy policy
• Opt-out instructions
• Help instructions (such as replying HELP)
• A note that consent isn't a condition of purchase

Here's a sample disclosure you can adapt for a checkbox on your website sign-up form:

"By checking this box, you agree to receive recurring automated marketing texts from [Business Name] at the number provided. Consent is not a condition of purchase. Msg frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel. View our Terms and Privacy Policy."

2. Receive Prior Express Written Consent

SMS compliance laws place a special emphasis on consent. Under TCPA, you must receive express written consent to text consumers marketing messages.

Texting consumers who did not give authorization can cost you $500 per message, or up to $1,500 if the violation is willful. There's no cap on total TCPA fines, so one campaign sent to the wrong list can add up fast.

You can obtain express written consent via online forms. However, you must explicitly state that enrolling means subscribers agree to receive text messages from your business, and your consent language should name it directly.

Keep a timestamped record of every opt-in, along with the disclosure the subscriber saw. TCPA claims can be filed up to four years after a text is sent, so plan to keep those records at least that long.

3. Confirm Opt-Ins

As soon as someone opts in, send them a confirmation text. CTIA guidelines call for this message in recurring text programs, and carriers often review it during registration.

This message should reiterate the details of your SMS program stated at opt-in. Here's an example:

"[Business Name]: Thanks for subscribing to texts! Msg frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel."

Some businesses also ask new subscribers to reply YES before adding them to the list, which is known as a double opt-in. It isn't legally required, though it gives you a stronger record of consent.

4. Clearly Communicate Terms and Conditions

Before launching an SMS campaign, you should develop a page that outlines the full details of your SMS policy.

Provide a link to the terms and conditions in the initial disclosure text, and periodically remind your customers how to access the policy. You should also notify your subscribers via text whenever terms and conditions change.

5. Time Your Texts Appropriately

Texting your audience at the wrong time can also put you in violation of SMS marketing compliance laws. Under the TCPA, you cannot text or call subscribers before 8:00 AM or after 9:00 PM in the recipient's local time zone.

Some states set tighter limits. In Florida, for example, marketing texts have to end by 8:00 PM, and businesses can't send more than three on the same topic within 24 hours. The safest approach is to schedule campaigns within the strictest window that applies to anyone on your list.

6. State Your Business Name in Every Message

Every text you send needs to name your business, so subscribers always know who's messaging them. Carriers also look for it when they review your sample messages during 10DLC registration.

7. Allow Your Audience to Easily Opt Out

Opt-outs are central to SMS compliance, so make leaving your list quick and simple for every subscriber. For example, customers should be able to text "STOP" to unsubscribe from marketing text messages. Include opt-out instructions in your first message and repeat them regularly to maintain text message compliance.

Once someone opts out, you can send one final text confirming it, as long as it goes out within five minutes and doesn't include any marketing. After that, stop sending marketing texts to that number. Opt-outs from non-marketing texts, like appointment reminders, can follow different rules, so check the latest FCC guidance when you set up your process. Textedly processes STOP replies automatically, so opted-out numbers drop off your future campaigns.

8. Avoid Banned Language

SMS compliance requirements also cover the content of your message. Under CTIA's SHAFT-C guidelines, carriers limit texts about sex, hate, alcohol, firearms, tobacco, and cannabis. This rule also applies to any promotion of your SMS marketing program.

Companies that sell alcohol or tobacco can still message their audience about deals and specials, but must include an age gate so only people above the legally permitted age can sign up to receive texts.

Links can get your messages flagged, too. Carriers often filter texts that use public link shorteners like bit.ly, since spammers rely on them. Branded short links that show your business name are less likely to get blocked.

Breaking this rule puts your company at risk of being banned from sending text messages.

9. Don’t Text Opt-Outs or Do Not Call Numbers

The National Do Not Call Registry also applies to SMS marketing. You can't send marketing texts to numbers on the registry without that person's express written consent. Subscribers who have opted out of your texts are also off-limits, even if they gave consent before.

Check your list against the registry at least every 31 days, and maintain an internal do-not-text list to keep opt-outs suppressed across every campaign.

10. Register Your Number Before You Send

Every business texting program needs an approved number before the first message goes out. For a 10DLC number, that means registering your brand and each campaign. Toll-free numbers go through their own verification, and short codes need separate carrier approval.

Since February 2025, carriers have blocked texts from unregistered 10DLC numbers entirely. Registration also reviews your opt-in process and sample messages, so the steps above double as prep work. Textedly walks you through 10DLC registration and toll-free verification right from your dashboard.