Compliance & Regulations

Compliant messaging protects your businesses from fines, lawsuits, and carrier penalties. This page covers the four pillars of SMS compliance: federal regulations (TCPA), carrier registration (10DLC), consent management, and deliverability. Your account team handles most of the technical setup during onboarding -- your role is understanding the rules and following them in your day-to-day messaging.

TCPA: Federal Texting Regulations

The Telephone Consumer Protection Act (TCPA) is the primary federal law governing commercial text messages in the United States. It establishes who you can text, when you can text them, and what you must include.

Consent Requirements

You must have consent from every customer before sending them a text message. The consent level depends on your message type:

• Marketing messages (promotions, offers, event invitations, newsletters) require express written consent -- the customer explicitly agreed in writing to receive marketing texts from your businesses.
• Informational messages (appointment reminders, order confirmations, account alerts) require express consent -- the customer provided their phone number knowing they would receive texts.

What counts as written consent:

• A web form with an unchecked checkbox and clear texting disclosure
• A text-to-join keyword opt-in where the customer initiates
• A signed paper or electronic form stating the customer will receive text messages

What does NOT count:

• Buying or renting a contact list from a third party
• A pre-checked opt-in checkbox
• Assuming consent because someone is a customer or customer
• Having a phone number in your database without texting disclosure

Time Restrictions

Do not send messages before 8:00 AM or after 9:00 PM in the recipient's local time zone. This applies to all message types. When scheduling campaigns across time zones, 10:00 AM to 5:00 PM Eastern is safe for all U.S. time zones.

Opt-Out Handling

When a customer texts STOP (or CANCEL, END, QUIT, UNSUBSCRIBE), you must stop messaging them immediately. The platform handles this automatically -- opted-out customers are removed from your messaging program and receive a confirmation. You cannot re-add them manually. The customer must re-opt in on their own by texting a keyword or submitting a new opt-in form.

Message Content Rules

Every message should include:

• Your businesses's identity -- recipients must know who is texting them
• Opt-out instructions -- include "Reply STOP to opt out" at minimum in the first message
• Clear purpose -- the message should relate to the reason the customer opted in

Prohibited content (SHAFT categories): Sex/adult content, Hate speech, Alcohol, Firearms, Tobacco. Messages in these categories may be blocked by carriers and can result in account suspension.

Penalties

TCPA violations carry $500 per unsolicited message and $1,500 per willful violation. These are per message, per recipient. A non-compliant campaign to 1,000 customers could result in $500,000 to $1,500,000 in liability.

10DLC Registration

10DLC (10-Digit Long Code) is the carrier-approved system for sending business text messages in the United States. All major carriers require registration before you can send. Your account team handles the entire process during onboarding.

Why It Matters

How Registration Works

Step 1: Brand Registration (1-3 business days) Your business identity is submitted to The Campaign Registry (TCR). You provide your legal business name, EIN, address, website, and customer information. TCR verifies this against public records and assigns a trust score.

Step 2: Campaign Registration (1-5 business days) Your messaging use case is registered as a "campaign" describing what you will send. Common types:

Most businessess choose Mixed for maximum flexibility.

Step 3: Phone Number Provisioning (same day) Your number is linked to your registered brand and campaign, whitelisted with the carriers, and ready to send.

Total timeline: 2-5 business days from document submission to sending.

What You Need to Provide

• Legal business name (must match IRS records exactly)
• EIN (Employer Identification Number)
• Physical business address (no P.O. boxes)
• Live business website
• W-9 or EIN confirmation letter
• Recent phone bill (if porting an existing number)
• 2-3 sample messages representing what you will actually send

Common Registration Issues

• Name mismatch -- legal name does not match IRS or Secretary of State records. Check punctuation, suffixes (LLC, Inc.), and capitalization.
• Website not live -- carriers verify your website during brand review.
• Generic sample messages -- provide realistic messages that match your campaign type and include opt-out language.
• Wrong campaign type -- if you send any promotional content, choose Marketing or Mixed, not Transactional.

Consent Management

Proper consent documentation is your primary legal defense if a complaint arises. The burden of proof is on you.

Consent Levels

Rule of thumb: When in doubt, get express written consent. It covers all message types.

Mixed Content Warning

If a single message contains both transactional and promotional content, the entire message is treated as marketing and requires express written consent. For example, an appointment reminder that includes "15% off referrals this month" becomes a marketing message. Either split the content into separate messages or ensure you have written consent.

Records to Keep

For each customer, maintain:

• When they opted in (timestamp)
• How they opted in (web form, keyword, paper form)
• What disclosure they saw (exact language)
• IP address (for web form opt-ins)

Retain consent records for at least 5 years (the TCPA statute of limitations is 4 years). Keyword opt-ins are documented automatically by the platform.

Re-Opt-In Best Practices

• customers dormant for 12+ months: send a re-opt-in message before resuming campaigns
• customers inherited from a business acquisition: send a fresh opt-in request from your businesses's identity
• customers who opted out: they must re-initiate via keyword or form -- you cannot text them to ask

Carrier Filtering & Deliverability

Even with 10DLC registration, your messages can be filtered. Carriers use automated systems to detect spam-like patterns.

Content Triggers to Avoid

High-risk words: FREE (especially in caps), "Act now," "Limited time," "Exclusive offer," "Winner," "Cash prize," "Guaranteed," "No obligation"

Financial terms: Credit, loan, debt relief, mortgage, investment, crypto

Formatting red flags: ALL CAPS words, excessive punctuation (!!!), multiple dollar signs ($$$), emoji overuse

Instead of: "FREE event this Saturday! Act now -- limited spots!!!" Write: "You're invited to our customer appreciation event this Saturday at 2 PM. RSVP by Thursday to reserve your spot. Reply STOP to opt out."

URL Best Practices

Never use third-party URL shorteners (bit.ly, tinyurl, ow.ly). Carriers block these at 90%+ rates because spammers use them to mask malicious links.

Do use:

• Your platform's built-in link tracking (trusted domain, click tracking included)
• Your businesses's own website domain
• Full HTTPS URLs

Personalization Prevents Filtering

Sending identical messages to many recipients is a strong spam signal. Use merge tags to personalize every message:

Risky: "Don't forget our annual meeting next Thursday at 7 PM. Reply STOP to opt out." Better: "Hi {first_name}, don't forget our annual meeting next Thursday at 7 PM. We look forward to seeing you there. Reply STOP to opt out."

Even a single {first_name} merge tag makes each outbound message unique.

Volume Ramp-Up

Sudden jumps in sending volume trigger filtering. If you are new to texting or planning a large campaign:

1. Start small -- send to 50-100 of your most engaged customers
2. Increase gradually -- add 20-30% more volume each day
3. Spread sends over time -- send a 1,000-customer campaign over 2-4 hours, not all at once
4. Maintain consistency -- regular small sends build better reputation than occasional large blasts

Carrier-Specific Notes

• AT&T -- most aggressive content filtering; particularly strict about shortened URLs
• T-Mobile -- volume-focused; will throttle if you exceed your trust score allocation
• Verizon -- reputation-based; high opt-out rates trigger filtering quickly

Deliverability Checklist

Before sending any campaign, verify:

• Message includes your businesses's name
• Opt-out language included ("Reply STOP to opt out")
• No third-party shortened URLs
• Links use platform link tracking or your own domain
• No all-caps words or excessive punctuation
• Merge tags used for personalization (at minimum {first_name})
• Volume is consistent with recent sending patterns
• customers have documented consent
• Campaign scheduled during compliant hours (8 AM - 9 PM recipient time)
• Test message sent and delivered successfully

How the Platform Helps

Your text messaging platform includes built-in compliance features:

• Automatic opt-out processing -- STOP and similar keywords handled automatically
• Consent tracking -- the platform records how each customer was added and their opt-in method
• Keyword opt-in documentation -- text-to-join opt-ins are logged with timestamps
• Built-in link tracking -- platform-generated short links use a trusted, carrier-recognized domain
• Scheduled sending -- campaigns can be timed to respect quiet hours across time zones
• Merge tag support -- personalize messages to reduce carrier filtering

Tips & Best Practices

• Always get consent first. Never import customers without verified consent. When in doubt, send a confirmation asking customers to opt in.
• Document everything. Keep records of how and when each customer gave consent. Keyword opt-ins are automatic; web and paper form records are your responsibility.
• Identify yourself in every message. customers should know who is texting without asking.
• Only send relevant content. If a customer opted in for event updates, do not send sales promotions unless they also consented to marketing.
• Scrub your list regularly. Remove customers who have not engaged in 6+ months. Consider a re-opt-in campaign for dormant customers.
• Never buy contact lists. Purchased lists lack proper consent and result in high opt-out rates, spam complaints, and legal liability.
• Send a test first. Before launching a campaign, send a test message to yourself and verify it delivers across carriers.
• Keep marketing and transactional content separate unless you have express written consent for marketing.

Common Questions

Do I need to handle 10DLC registration myself?

No. Your account team handles the entire registration process during onboarding. You provide the required documents (business information, W-9, phone bill), and they manage the submission to TCR.

How long does 10DLC registration take?

Typically 2-5 business days from when you submit all documents. Brand registration takes 1-3 days, campaign registration takes 1-5 days, and phone number provisioning is same-day.

Can I send messages before registration is complete?

No. Carriers require 10DLC registration before business text messages can be sent. Attempting to send without registration results in messages being blocked.

What if my messages are being filtered even though I am registered?

Registration reduces filtering but does not eliminate it. Check your message content for trigger words, verify you are not using third-party URL shorteners, ensure you are personalizing with merge tags, and review your sending volume for sudden spikes. customer your account team if the issue persists.

Do I need written consent for appointment reminders?

Appointment reminders are informational, so express consent (not necessarily written) is typically sufficient. However, if your reminder includes any promotional content ("While you're here, check out our new services"), the entire message becomes marketing and requires written consent.

What happens if a customer opts out and wants to opt back in?

They must re-initiate by texting a keyword to your number or submitting a new opt-in form. You cannot text them to ask if they want to re-subscribe.

Is there a daily message limit?

Your throughput is determined by your 10DLC trust score. There is no hard daily limit, but sending patterns that deviate significantly from your normal volume will trigger carrier filtering. For large campaigns (1,000+ customers), spread sends across multiple hours or days.

Does TCPA apply to existing customers or customers?

Yes. Being an existing customer or customer does not automatically constitute consent for text messaging. You still need documented consent before adding anyone to your texting program.

What is the difference between 10DLC and a short code?

10DLC uses standard 10-digit phone numbers. Short codes (5-6 digit numbers) are a separate, more expensive channel for high-volume enterprise senders. 10DLC provides similar deliverability benefits at a fraction of the cost.

Can I appeal a carrier block?

Your account team can submit an appeal on your behalf. Provide the affected phone numbers, message content, and when the issue started. Appeals typically take 3-5 business days.