SMS is the highest-attention channel in ecommerce and the one with the most ways to get it wrong. The regulations carry real penalties, the US carriers will filter unregistered traffic before a regulator ever gets involved, and both failure modes look identical from your dashboard: messages that appear to send and never arrive.
This guide covers what you need in place before your first marketing text — consent, registration, opt-out handling, timing — and what changes outside the US. It is a practical overview rather than legal advice; specifics vary by jurisdiction and by what you sell, so run your programme past counsel before you scale it.
Consent: the foundation everything else rests on
In the US, marketing texts require prior express written consent. Three things make consent valid, and all three are commonly botched.
It must be explicit and specific
The person must actively agree to receive marketing texts from you, at that number. Buried in your terms of service does not count. A pre-ticked box does not count. Consent to email does not extend to SMS, and consent for order updates does not extend to promotions.
The disclosure must be complete
At the point of sign-up, state clearly:
- Who is sending (your business name).
- What kind of messages (marketing, promotions, offers).
- How often, at least approximately — "up to 4 messages per month".
- That message and data rates may apply.
- How to opt out.
- A link to your privacy policy and terms.
Consent must also not be a condition of purchase. You cannot require someone to accept marketing texts in order to check out.
You must be able to prove it later
Keep, for every contact: the timestamp, the source (which form, which page), the exact disclosure language shown at the time, and the IP or session where available. If your consent language changes, keep the old version — you need to show what that person agreed to, not what your current form says.
This record is the entire defence in a complaint. Storing a phone number with no provenance is the same as having no consent.
Opt-outs: the rules tightened
Opt-out handling used to be simple: honour STOP. It is broader now.
| Rule | What it means in practice |
|---|---|
| Any reasonable method counts | "unsubscribe", "cancel", "quit", "end", or a plainly worded "please stop texting me" is a valid revocation — and so, in principle, is one sent by email or left on voicemail |
| Ten business days is the ceiling | Marketing opt-outs must be honoured as soon as practicable, and no later than ten business days. Automate it immediately; the deadline is a ceiling, not a target |
| It must propagate | Revocation applies across your systems, not just the one that received the reply. Opting out of a text must stop the next campaign too |
| One confirmation is allowed | Confirming the opt-out is fine. Using that confirmation to pitch anything is not |
US carrier registration: 10DLC
Separate from the law, and separate from what regulators enforce. The US carriers require application-to-person traffic on standard 10-digit numbers to be registered — in three steps, through your messaging provider.
| Step | What you submit |
|---|---|
| 1. Register your brand | Legal business identity, tax ID, contact details |
| 2. Register your campaign | The use case (marketing, customer care, order notifications), sample messages, and the opt-in flow. This is reviewed — inaccurate descriptions get rejected |
| 3. Associate your numbers | The numbers that will send under that registration |
Two adjacent paths exist. Toll-free numbers have their own verification process, and short codes are a separate, more expensive, higher-trust route usually reserved for large volume. Whichever you use, the sample messages you submit should match what you actually send — mismatches are a common cause of filtering after approval.
If you send through CampGain, SMS and RCS run on your own Twilio account, so registration is completed there and travels with your numbers.
Timing and frequency
| Constraint | The rule | The mistake it prevents |
|---|---|---|
| Quiet hours | 8am–9pm in the recipient's local time zone is the federal baseline; several states are narrower | Scheduling against your own time zone |
| Stated frequency | If sign-up promised four messages a month, send four | Six is a broken promise and an easy complaint |
| Cumulative frequency | Count every programme that texts the same phone as one total | Campaign, cart flow, and shipping notices each staying "within limits" while the recipient gets nine texts |
Outside the US
The rules change at the border, and so does the failure mode. This is an orientation, not legal advice — confirm the specifics for any market before your first send into it.
| Market | Regime | What it demands | What goes wrong |
|---|---|---|---|
| EU & UK | GDPR + national ePrivacy | Consent freely given, specific, informed, and unambiguous. Rights of access, rectification, and erasure. A data processing agreement with every vendor, including your messaging provider | Pre-ticked boxes are explicitly invalid, and an erasure request arriving by email — not as a STOP reply — has nobody to handle it |
| Canada | CASL | Consent, plus sender identification, contact information, and an unsubscribe mechanism that stays valid for a period after sending | Substantial penalties, and enforcement is real |
| India | TRAI | Sender IDs and message templates registered on a distributed-ledger platform before they can be delivered | Unregistered content is blocked, not merely filtered — registration is a prerequisite, not a formality |
| Everywhere else | Assume opt-in is required | Check the specifics before your first send into a new market | The failure mode for guessing is not a warning; it is blocked traffic and a fine |
Writing texts that are compliant and still good
Constraints are not the enemy of a good SMS programme. The channel rewards brevity anyway.
- Identify yourself in the first few words. An unrecognised number is deleted, not read.
- One idea, one link, one action. If a message needs two calls to action, it needs to be an email.
- Use a link domain people recognise. Public shorteners are widely abused and widely filtered; a branded short domain performs better and looks less like a scam.
- Include opt-out language — periodically at minimum, and always in the first message of a sequence.
| Format | Worth a text? |
|---|---|
| Back-in-stock alert for something they asked about | Yes — they requested this exact message |
| A genuine deadline | Yes — time pressure is what the channel is for |
| Shipping and delivery updates | Yes — wanted, and they deflect support tickets |
| Loyalty milestones | Yes — rare and personal enough to earn the interruption |
| Generic weekly promotion | No — nothing about it needed to be a text, and it burns the list that the other four depend on |
RCS: richer, same rules
RCS adds images, buttons, and a verified branded sender to the SMS channel. The compliance position is unchanged — consent, opt-out, and quiet hours apply exactly as they do to SMS.
What does change is the fallback. Not every recipient's device and carrier support RCS, so the message has to degrade to plain SMS. That means the SMS version needs to stand on its own, with any button destinations written into the text — a card whose only call to action is a button becomes a dead end for everyone who receives the fallback.
A pre-launch checklist
- Opt-in form with complete disclosure, no pre-ticked boxes, not a condition of purchase.
- Consent records stored with timestamp, source, and the disclosure text shown at the time.
- 10DLC brand and campaign registration approved, numbers associated (US).
- STOP and equivalent keywords handled automatically, with opt-outs propagating across every system.
- Inbound replies monitored by a person or a process, not ignored.
- Quiet hours enforced by recipient time zone.
- Frequency counted across every programme that texts the same phone.
- Business name and opt-out language in the message.
- Data processing agreements in place for non-US markets.
- A first send to a small internal group, checked on a real phone.
How CampGain fits
CampGain sends SMS and RCS through your own Twilio connection, so your registration, your numbers, and your sender reputation stay yours.
- Per-contact delivery results with the provider's stated reason on failures — which is how you spot filtering that would otherwise look like silence.
- Ready-made SMS and RCS presets written to stay within a single GSM-7 segment, so a template does not quietly triple your cost.
- Segments and suppression built from combined contact and Shopify data, so opted-out contacts stay out of every campaign rather than only the one they replied to.
- Automatic RCS-to-SMS fallback, with the card's button links carried into the fallback text.
- Test sends to a handful of contacts before a campaign reaches the segment.
SMS works best as one step in a sequence rather than a channel on its own — our multi-channel campaign guide covers when a text earns its cost, and the WhatsApp Business API guide covers the channel with its own, quite different, rulebook. See how channels connect.
The short version
Get explicit written consent and keep the evidence. Register with the carriers before your first US send. Honour opt-outs immediately, however they are worded, and make sure the opt-out reaches every system. Send inside the recipient's local quiet hours. Count your total message frequency, not your per-campaign frequency.
Do that, and SMS becomes what it should be: a channel people are glad to hear from, used rarely enough that they still open it.