%201.png)
2. SMS Compliance in the US
Ask AI
Ask questions about this page
2.1 The regulatory bodies that govern SMS marketing in the US
Text messaging in the US is governed by four separate overlapping systems:
1. FCC (Federal communications commission)
The FCC writes and enforces the rules that implement the Telephone Consumer Protection Act (TCPA). It is responsible for
- Consent standards
- Defining what counts as an autodialer
- Maintaining Do Not Call protections for text messages
- Rules on revocation of consent.
The TCPA has a private right of action, meaning consumers and class-action firms can sue businesses directly for unsolicited messages. Statutory damages can range from $500 to $1,500 per text with no cap on total exposure.
2. FTC (Federal trade commission)
The FTC enforces the Telemarketing Sales Rule (TSR), which is a separate rule that applies along with the TCPA.
The TSR
- Requires clear disclosures
- Prohibits misrepresentation
- Sets calling and texting time limits
- Requires honoring do-not-contact requests
As of 2026, the maximum civil penalty is $51,744 per violation, with each day of a continuing violation counted separately.
3. State legislatures and attorneys general
More than 15 states now enforce their own telemarketing statutes, often called "mini-TCPAs," that go beyond federal law. Most often they have broader autodialer definitions and their own private rights of action.
Florida, Oklahoma, Washington, and Texas are the most consequential for SMS programs.
4. CTIA
CTIA is the trade association for the US wireless industry. Its messaging principles and best practices aren't law, but carriers use them as the operational standard for what gets delivered.
The framework covers,
- Consent language
- Opt-in and opt-out handling
- Disclosures
- Content restrictions.
CTIA last updated the framework in October 2025, tightening rules on URL handling, sender identification, and opt-in language specificity.
5. The Campaign registry (TCR) and wireless carriers
Marketing texts sent using an autodialer or prerecorded messages require Prior Express Written Consent (PEWC).
A phone number alone is not consent. Consent must be tied to a clear disclosure of what the consumer is signing up for. Best practice is to collect consent that's specific to your brand rather than shared across a co-branded or third-party list.
Several state mini-TCPAs impose their own requirements on top of the federal standard, so brand-specific consent is the safer default regardless of channel or vendor.
2.2 Consent requirements for text marketing in the US
SMS marketing is the practice of sending promotional or transactional text messages to customers on their phone numbers, with their consent. Since SMS marketing is not dependent on an internet connection and doesn’t require any app installation, it enables brands to reach customers anywhere in the world.
However, it doesn’t mean that businesses can spam customers with back-to-back texts. In 2026, you need explicit consent from your prospects and customers.
Opt-out and revocation of consent rules in the US
Effective April 11, 2025, the FCC's revocation of consent rule applies to every business sending marketing texts:
- Consumers can revoke consent through any reasonable means, not just a specific keyword.
- The FCC named seven words that must always be honored as valid opt-outs: stop, quit, end, revoke, opt out, cancel, unsubscribe. Other clearly expressed requests count too.
- Businesses cannot designate an exclusive opt-out channel. A policy requiring "text STOP to this number only" as the sole valid method is no longer enforceable.
- Revocation requests must be honored within 10 business days.
- One follow-up clarification text is allowed, with no promotional content, to confirm scope when a consumer is signed up for multiple message types.
- Revocation applies across channels: a consumer who texts STOP has also revoked consent for autodialed or prerecorded calls from that same sender.
- Businesses may still ask which message types a consumer wants to stop when they're signed up for multiple types, provided the clarification request doesn't try to talk them out of opting out.
What are the legal hours for sending marketing text messages in the US?
Federal law restricts marketing texts to 8:00 a.m. to 9:00 p.m. in the recipient's local time zone. Several states set tighter windows:
- Florida, Oklahoma, Washington: 8:00 a.m. to 8:00 p.m.
- Texas (SB 140): 9:00 a.m. to 9:00 p.m Monday to Saturday. 12PM to 9PM on Sundays.
- Oregon (HB 3865, effective January 1, 2026): 8:00 a.m. to 8:00 p.m., capped at three contacts per consumer per day.
SMS Marketing platforms need time-zone-aware scheduling that applies the strictest window in effect for each recipient, not a single national default.
2.3 What Is A2P 10DLC registration?
A2P 10DLC (Application-to-Person 10-Digit Long Code) registration is the process businesses must complete before sending automated or bulk SMS messages from a standard 10-digit US phone number. Businesses register their brand and messaging campaign with The Campaign Registry (TCR), so wireless carriers can verify the sender and reduce spam and fraud.
Any business sending automated or bulk SMS from a standard 10-digit US number must register through TCR.
- Brand registration: legal business name, EIN, business type, website.
- Campaign registration: use case, sample messages, opt-in URL, estimated volume.
- Carrier review: submitted through your messaging provider (Twilio, Bandwidth, and similar) typically 1 to 4 weeks depending on use case.
Changes made in 2026:
- Authentication+ verification is now required for publicly traded companies, at a $12.50 fee.
- A reseller IDis mandatory for any agency or platform registering campaigns on behalf of another business.
- The registering EIN must be at least 15 days old at the time of submission.
- Opt-in URLs must be live and carrier-verifiable at review time, not placeholder pages.
High-risk categories, including cannabis, firearms, payday loans, and gambling, face heavy filtering or outright rejection regardless of registration status. Toll-free numbers use a separate verification process, not 10DLC, but still need carrier approval before sending at volume.
Which states in the US have their own SMS marketing laws?
- Florida (Telephone Solicitation Act): the original 2021 mini-TCPA, broad autodialer definition, three-call daily limit on the same subject matter, and private right of action.
- Oklahoma (Telephone Solicitation Act, 2022): closely mirrors Florida's statute.
- Washington: private right of action, damages up to $1,000 per violation for repeat conduct.
- Texas (SB 140, effective September 1, 2025): extended "telephone solicitation" to cover texts and images, a private right of action, and damages up to $5,000 per violation.
- Maryland (Stop the Spam Calls Act): express written consent and detailed consent-log requirements.
- Oregon (HB 3865, effective January 1, 2026): three-contact daily cap, 8 a.m. to 8 p.m. window.
- Virginia (effective January 1, 2026): STOP and UNSUBSCRIBE requests must be honored for at least 10 years.
- Connecticut: penalties up to $20,000 per violation.
More states, including New Jersey, Massachusetts, South Carolina, Michigan, North Carolina, and Georgia, have bills in progress. For any multi-state SMS program, build to the strictest applicable state law rather than the federal minimum.
2.4 Penalties for SMS Non-compliance in the US
Regulator or Law
Penalty
FCC / TCPA
$500 to $1,500 per text, no cap, private right of action
FTC / TSR
Up to $51,744 per violation, per day for continuing violations
State mini-TCPAs
Varies by state; up to $20,000 per violation in Connecticut, $5,000 in Texas, $1,000 in Washington
Carriers / CTIA / TCR
No direct fine, but campaign termination, number blacklisting, and lasting sender reputation damage
SMS compliance checklist for 2026
Collect and document prior express written consent for every marketing text recipient.
Treat consent as brand-specific rather than shared across a marketing list.
Support opt-out by any reasonable means, not just a single keyword.
Honor all seven required opt-out keywords, plus any clearly expressed request.
Process revocations within 10 business days, faster where possible.
Send at most one clarification text after an opt-out, with zero promotional content.
Apply time-zone-aware sending windows, using the strictest window across federal and state law for each recipient.
Register every 10-digit sending number's Brand and Campaign with TCR before sending.
Confirm opt-in URLs are live and carrier-verifiable before campaign submission.
Map your sending footprint against state mini-TCPA laws in every state you message.
Retain consent and opt-out records for as long as the strictest applicable state law requires.
2.5 FAQs
1. How long do businesses have to process an SMS opt-out?
No more than 10 business days, and sooner where a faster turnaround is practicable. This replaced the previous 30-day standard on April 11, 2025.
2. Do carriers block unregistered SMS numbers?
Yes. AT&T, T-Mobile, and Verizon have blocked unregistered A2P 10DLC traffic since February 2025, with no grace period.
3. What's the maximum penalty for a TCPA violation?
Between $500 and $1,500 per text message, with no cap on total liability across a campaign, and consumers can sue directly.
