SMS marketing compliance guide (TCPA, 10DLC, opt-in)

Every business text in the United States has to satisfy two separate rulebooks, and they punish you in opposite ways. The legal layer — the TCPA, the FCC's rules at 47 CFR 64.1200, the FTC's Telemarketing Sales Rule, and a growing set of state statutes — produces lawsuits. The commercial layer — CTIA's Messaging Principles and Best Practices, The Campaign Registry, and each carrier's own filtering — produces silence. You can be entirely lawful and entirely undelivered. Design for both. What follows describes published rules; take advice on your own programme from a lawyer.

Two rulebooks, and why the second one is invisible until it is too late

The failure modes look nothing alike, which is why teams that fix one keep getting hit by the other.

A legal failure is loud and late. Somebody who did not consent receives a marketing text, the statutory damages under 47 U.S.C. 227(b)(3) are $500 per violation with a discretionary treble for a willful or knowing breach, and a text campaign generates violations at the rate of a spreadsheet row. You find out through a demand letter, months later.

A carrier failure is quiet and immediate. Your messaging provider's API returns a success response with a message SID, your dashboard shows the message accepted, and the carrier drops it before it reaches a handset. There is no bounce, no complaint and no error to reconcile. You discover it from a reply rate that never moves, which is the same diagnostic problem cold email has when acceptance is mistaken for delivery — except SMS gives you even less signal to work with.

The two layers overlap but are not the same, and the differences are where people get caught. The commercial layer is in places stricter than the law, and it does not care that a court agreed with you.

The consent standard, and the rule that survived being struck down

47 CFR 64.1200(f)(9) defines prior express written consent as "an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver… advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice". That is the higher of the two federal consent standards, and it is the one marketing texts are measured against.

In December 2023 the FCC adopted an order that would have gone further, requiring consent to be given to one identified seller at a time and to be logically and topically associated with the interaction that produced it. In *Insurance Marketing Coalition Ltd. v. FCC*, No. 24-10277, the Eleventh Circuit vacated that part of the order on 24 January 2025, one business day before it would have taken effect, holding the restrictions inconsistent with the ordinary statutory meaning of prior express consent. There is no one-to-one consent rule in force, and the current text of 47 CFR 64.1200 contains no such language.

Here is the part almost nobody notices. The commercial layer already said the same thing, and it was never before a court. CTIA's Messaging Principles and Best Practices, in the current May 2023 edition, states at section 5.1.2.2 that "a Consumer opt-in to receive messages should not be transferable or assignable" and "should apply only to the campaign(s) and specific Message Sender for which it was intended or obtained". Section 5.1.4 is blunter still: message senders "should not use opt-in lists that have been rented, sold, or shared to send messages" and "should create and vet their own opt-in lists".

So a lead-generation model where consent is captured by one party and passed to another lost its FCC rule in January 2025 and kept its carrier problem entirely. Winning the regulatory argument did not make the traffic deliverable, because the entity deciding whether your message reaches a handset is a carrier applying CTIA guidance and its own filtering, not a court applying the TCPA.

What a compliant opt-in actually has to show

CTIA section 5.1.1 sets out the disclosures a call-to-action should carry, and the list is specific enough to check against your own signup form today. A consumer should be made aware of: the program or product description; the telephone number or short code the messaging will originate from; the specific identity of the organisation being represented in the initial message; clear and conspicuous language about opt-in and any associated fees or charges; and other applicable terms, including how to opt out, customer care contact information and any applicable privacy policy. The same section adds that opt-in details "should not be obscured in terms and conditions".

Section 5.1.2 then lists the evidence to retain, and this is the list an audit or a campaign review will effectively be testing:

• Timestamp of consent acquisition.
• The medium — a web form, a physical sign-up sheet, an SMS keyword, and so on.
• A capture of the experience itself: the exact language and action used to secure consent.
• The specific campaign the opt-in was given for.
• The IP address used to grant consent.
• The phone number consent was granted for.
• The identity of the individual who consented.

For recurring campaigns, section 5.1.2.1 asks for a confirmation message before any further messaging, carrying the program name, customer care contact information such as a toll-free number or HELP instructions, how to opt out, a disclosure that messages are recurring and at what frequency, and clear language about any charges.

Read that list against a typical B2B "we collected the number on a demo form" story and the gap is obvious. A phone field on a form with no SMS-specific language captures a phone number; it does not capture consent to be texted, and it produces none of the seven records above.

Opt-out: the words, the clock, and the trap in matching them

Two standards apply and the wider one wins in practice.

The regulation. 47 CFR 64.1200(a)(10) took effect on 11 April 2025. A called party may revoke consent "by using any reasonable method", and the rule names methods that are reasonable per se: an automated, interactive voice or key-press opt-out mechanism on a call; a website or telephone number the caller designated for opt-outs; and "the words 'stop,' 'quit,' 'end,' 'revoke,' 'opt out,' 'cancel,' or 'unsubscribe' sent in reply to an incoming text message". A revocation must be honoured "within a reasonable time not to exceed ten business days from receipt".

There is one narrow carve-out and it is routinely overread. By Order DA 26-12, released 6 January 2026 in CG Docket No. 02-278, the FCC extended a waiver of 64.1200(a)(10) to 31 January 2027 — but only to the extent the rule requires a caller to treat a revocation made in response to one type of informational message as applying to all future robocalls and robotexts from that caller on unrelated matters. The rest of the rule, including the keyword list and the ten-business-day ceiling, has been in force since April 2025.

The industry guidance. CTIA section 5.1.3 goes further than the regulation in two directions. It asks that standardised STOP wording be used in opt-out instructions, but that "opt-out requests with normal language (i.e., stop, end, unsubscribe, cancel, quit, 'please opt me out') should also be read and acted upon". And it states that "the validity of a Consumer opt-out should not be impacted by any de minimis variances… such as capitalization, punctuation, or any letter-case sensitivities". It also asks for one final confirmation message per campaign, after which no further messages should be sent.

The engineering trap is the matcher. An exact-match check on an uppercase STOP fails on Stop., on stop!!!, on Please STOP and on STOP now — all of which a reasonable reading of both standards treats as opt-outs. Matching too loosely is its own bug: a reply containing "I won't stop buying from you" is not an opt-out, and suppressing that contact silently loses a customer.

The rule that survives both failure modes is to normalise, then match at the edges. Autocloz strips surrounding whitespace and punctuation, uppercases, and treats a message as an opt-out when the whole cleaned message is a keyword or when the first or last token is one — never when the keyword sits mid-sentence. The keyword set is STOP, STOPALL, UNSUBSCRIBE, CANCEL, QUIT, END, OPTOUT and OPT-OUT, with START, UNSTOP, SUBSCRIBE, YES, OPTIN and OPT-IN read as re-subscribes and HELP and INFO routed to customer care rather than to suppression. That matcher runs on the inbound side of the same SMS channel the campaign sends from, which is what makes the suppression immediate rather than a nightly reconciliation between two systems. A suppression row is written against a wildcard channel, so the next touch on email, LinkedIn, WhatsApp or a call is blocked as well — one suppression list every channel reads rather than a per-channel list with a hole in it.

Quiet hours reach texts, and the rule says whose clock

47 CFR 64.1200(c)(1) bars any telephone solicitation to a residential telephone subscriber "before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)". Paragraph 64.1200(e) then extends paragraphs (c) and (d) "to any person or entity making telephone solicitations or telemarketing calls or text messages to wireless telephone numbers to the extent described in the Commission's Report and Order, CG Docket No. 02-278, FCC 03-153". The extending paragraph names text messages in its own words, which is why treating the window as applying to texts is the prudent operating position. The FTC's parallel rule at 16 CFR 310.4(c) sets the same 8 a.m. to 9 p.m. boundary at the called person's location for entities within its jurisdiction.

The operational difficulty is not the rule, it is the input. US numbers are portable, so an area code is a billing artefact rather than a location: a number beginning +1 415 may sit in a pocket in Boston. Inferring a recipient's time zone from the NPA is an assumption you are choosing to make, and it belongs in your records as one. Where you actually know a contact's location — from a signup form, a billing address, an enrichment field — store it on the record and let the schedule read it.

Carriers classify your traffic before anybody reads it

This is the part that has no legal equivalent, and it is where most "our messages just stopped arriving" incidents originate.

CTIA's Exhibit I describes what typical consumer messaging looks like, in numbers: throughput of roughly 15 to 60 messages per minute, volume of about 1,000 a day, a single originating telephone number, around 100 distinct recipients per message, a roughly 1:1 ratio of outgoing to incoming messages, and no more than about 25 repetitive messages. A footnote is careful to add that traffic from a business is non-consumer traffic regardless of whether it stays inside those thresholds — the sender's identity decides the classification, not the shape of the traffic.

Non-consumer traffic on a 10-digit long code has to be registered, which is what brand and campaign registration is for. But the numbers still matter, because several named practices trip filters directly:

• Snowshoeing. Section 5.5.2 defines it as spreading messages across many sending numbers or short codes and says senders should not do it. Buying ten numbers to work around a throughput cap is exactly this pattern, and it is the reason adding numbers does not scale SMS the way adding mailboxes scales email.
• Grey routes. Section 5.5.3 defines a grey route as a path not authorised by service providers for non-consumer messages, and asks senders not to use them. A route that is unusually cheap is usually cheap for this reason.
• Shared URL shorteners. Section 5.3.2 asks senders using a shortener to use one "with a web address and IP address(es) dedicated to the exclusive use of the Message Sender", and says links and their destinations should unambiguously identify the site owner and carry contact information. A public shortener puts your link behind a domain thousands of unrelated senders have already used, and it is one of the most common silent-filtering causes.
• Unattributed phone numbers in the body. Section 5.3.3 says messages should not contain numbers assigned to or forwarding to unpublished numbers unless the owner is unambiguously identified in the text.

One correction worth making, because it is repeated everywhere. The acronym SHAFT-C — sex, hate, alcohol, firearms, tobacco, cannabis — does not appear in CTIA's current Messaging Principles and Best Practices. Section 5.3.1 instead lists categories of unlawful, harmful, deceptive and age-gated content and leaves the specifics to "individual Service Providers' policies". The practical consequence is that the authoritative source for restricted-content rules is your provider's and your carrier's acceptable-use documentation, not a CTIA acronym, and those documents differ from one another.

Wiring consent and suppression so an audit can read them

Compliance that lives in a spreadsheet is compliance you cannot produce under pressure. Three properties make the difference.

Consent is a row, not a checkbox. Autocloz records per-contact consent with a status, a source, a free-text evidence field, a capture timestamp and an optional expiry, scoped to one organisation and one channel — because consent given to one business is not consent for another, which is the same principle CTIA states at 5.1.2.2. A contact who messages you first is recorded as opted in with the evidence field set accordingly, and an explicit opt-out is never overwritten by a later inbound message.

Enforcement is a decision you make deliberately. Opt-in enforcement is off by default and switched on per channel per workspace, so a team can require it for SMS while leaving email alone, and can back-fill evidence before arming the block rather than halting live campaigns the moment the setting appears.

Every refusal is a reason, not a silence. The pre-send gate returns a machine-readable code — dnc_listed, quiet_hours, daily_limit, hourly_limit, min_gap, account_paused — so a message that was not sent is visibly not sent. Identifiers are normalised to E.164 on both sides of the suppression comparison, so a stored +14155551212 matches a raw (415) 555-1212 rather than missing it and texting somebody who opted out.

Autocloz's free plan covers 5 users and 10 mailboxes and puts the shared suppression list, per-contact consent records and the pre-send gate on every channel from the first message — start free if you want the refusal reasons visible before you connect a number. Bringing your own carrier is the normal path: the Twilio SMS integration and its equivalents connect a number you registered yourself, and the gate sits in front of whichever you choose.

What this cannot do for you, and what Autocloz does not do

The honest boundaries are worth more than another paragraph of reassurance.

Autocloz does not register your 10DLC brand or campaign, and does not verify that you did. Registration happens with The Campaign Registry through your messaging provider, against your legal entity and your EIN. What the product carries is the operational surface around it: SMS templates hold a dlt_template_id and a carrier_campaign_id for the registration you obtained, and campaign preflight raises a warning when a sequence has SMS steps with no active registered template, or no SMS sender connected at all. Those are prompts, not proof.

Autocloz does not scrub against the National Do Not Call Registry. The suppression list it enforces is the one your workspace maintains, built from manual entries and captured opt-outs. Registry access is a subscription your organisation holds in its own name, and the FCC and FTC safe harbours are conditioned on using a version obtained no more than 31 days before the call.

Quiet hours in the send gate use the sending account's time zone, not the recipient's. The per-lead time zone is honoured by the campaign sending window, which resolves the lead's zone first, then the campaign's, then the workspace default, then UTC. The account-level gate is separate and uses the account's zone, so a list spanning several US time zones needs either segmented campaigns or an account set to the strictest zone you send into.

No product can tell you whether a specific message is lawful. Whether your call-to-action captured prior express written consent, whether a state statute reads differently on your facts, and whether a given message is marketing or transactional are legal questions decided on evidence a product cannot see — and the TCPA is enforced largely through private litigation, where those facts decide the case. Treat this as a description of published rules: the FCC's at 47 CFR 64.1200, the FTC's at 16 CFR 310.4, the statute at 47 U.S.C. 227, and CTIA's Messaging Principles and Best Practices of May 2023. Then take advice for your own situation, and read how the same consent questions look on the phone before you assume the two channels share one answer.