SMS Marketing Compliance: TCPA, 10DLC and Global Rules

SMS is the highest-attention channel in ecommerce and the one with the most ways to get it wrong. The regulations carry real penalties, the US carriers will filter unregistered traffic before a regulator ever gets involved, and both failure modes look identical from your dashboard: messages that appear to send and never arrive.

This guide covers what you need in place before your first marketing text — consent, registration, opt-out handling, timing — and what changes outside the US. It is a practical overview rather than legal advice; specifics vary by jurisdiction and by what you sell, so run your programme past counsel before you scale it.

Consent: the foundation everything else rests on

In the US, marketing texts require prior express written consent. Three things make consent valid, and all three are commonly botched.

It must be explicit and specific

The person must actively agree to receive marketing texts from you, at that number. Buried in your terms of service does not count. A pre-ticked box does not count. Consent to email does not extend to SMS, and consent for order updates does not extend to promotions.

The disclosure must be complete

At the point of sign-up, state clearly:

• Who is sending (your business name).
• What kind of messages (marketing, promotions, offers).
• How often, at least approximately — "up to 4 messages per month".
• That message and data rates may apply.
• How to opt out.
• A link to your privacy policy and terms.

Consent must also not be a condition of purchase. You cannot require someone to accept marketing texts in order to check out.

You must be able to prove it later

Keep, for every contact: the timestamp, the source (which form, which page), the exact disclosure language shown at the time, and the IP or session where available. If your consent language changes, keep the old version — you need to show what that person agreed to, not what your current form says.

This record is the entire defence in a complaint. Storing a phone number with no provenance is the same as having no consent.

Opt-outs: the rules tightened

Opt-out handling used to be simple: honour STOP. It is broader now.

• Any reasonable method counts. A reply saying "unsubscribe", "cancel", "quit", "end", or a plainly worded "please stop texting me" is a valid revocation. So, in principle, is an opt-out sent by email or left on voicemail.
• Ten business days is the outer limit. Marketing opt-outs must be honoured as soon as practicable and no later than ten business days after receipt. In practice, automate it immediately — the deadline is a ceiling, not a target.
• Opt-out must propagate. If someone opts out by replying to a text, they should not receive the next campaign because a different system did not hear about it. Revocation applies across your systems, not just the one that received it.
• One confirmation message is allowed. Confirming the opt-out is acceptable; using that confirmation to pitch anything is not.

The practical requirement this creates: someone or something must actually read inbound replies. A programme that only sends and never processes what comes back cannot meet the standard.

US carrier registration: 10DLC

Separate from the law, and separate from what regulators enforce. The US carriers require application-to-person traffic on standard 10-digit numbers to be registered.

• Register your brand — your legal business identity, tax ID, and contact details, submitted through your messaging provider.
• Register your campaign — the use case (marketing, customer care, order notifications), sample messages, and the opt-in flow. Registration is reviewed, and inaccurate descriptions get rejected.
• Associate your numbers with that registration.

Registration determines your throughput and your filtering risk. Unregistered traffic on a long code is heavily filtered or blocked outright — and this failure is invisible in the worst possible way, because the message shows as accepted and simply never arrives.

Two adjacent paths: toll-free numbers have their own verification process, and short codes are a separate, more expensive, higher-trust route usually reserved for large volume. Whichever you use, the sample messages you submit should match what you actually send, because mismatches are a common cause of filtering after approval.

If you send through CampGain, SMS and RCS run on your own Twilio account, so registration is completed there and travels with your numbers.

Timing and frequency

• Quiet hours. 8am to 9pm in the recipient's local time zone is the federal baseline, and several states enforce narrower windows. Schedule against the contact's time zone, not your own.
• Respect the stated frequency. If sign-up promised four messages a month, six is a broken promise and an easy complaint.
• Watch cumulative frequency. Your marketing campaign, your abandoned-cart flow, and your shipping notifications all arrive on the same phone. Count them together, not per programme.

Outside the US

European Union and UK

GDPR plus national ePrivacy rules govern marketing messages. Consent is the usual lawful basis, and it must be freely given, specific, informed, and unambiguous — pre-ticked boxes are explicitly invalid. Recipients have rights of access, rectification, and erasure, so you need a process for a request that arrives by email rather than as a STOP reply. You also need a data processing agreement with every vendor in the chain, including your messaging provider.

Canada

CASL requires consent and prescribes what a commercial electronic message must contain: sender identification, contact information, and a working unsubscribe mechanism that stays valid for a period after sending. Penalties are substantial and enforcement is real.

India

TRAI regulations require sender IDs and message templates to be registered on a distributed-ledger platform before they can be delivered. Unregistered content is blocked rather than merely filtered, so the registration step is a prerequisite, not a formality.

Everywhere else

Assume opt-in is required and check the specifics before your first send into a new market. The failure mode for guessing is not a warning; it is blocked traffic and a fine.

Writing texts that are compliant and still good

Constraints are not the enemy of a good SMS programme. The channel rewards brevity anyway.

• Identify yourself in the first few words. An unrecognised number is deleted, not read.
• One idea, one link, one action. If a message needs two calls to action, it needs to be an email.
• Watch message length. A standard SMS segment is 160 characters using the GSM-7 alphabet, but a single emoji or a curly quote switches the whole message to Unicode and drops the limit to 70 — often turning one segment into three, at three times the cost. Check before you send, not on the invoice.
• Use a link domain people recognise. Public shorteners are widely abused and widely filtered; a branded short domain performs better and looks less like a scam.
• Include opt-out language — periodically at minimum, and always in the first message of a sequence.

Formats that consistently earn their place: back-in-stock alerts for something the recipient asked about, a genuine deadline, shipping and delivery updates, and loyalty milestones. Formats that burn a list: generic weekly promotions with no timing reason to be a text.

RCS: richer, same rules

RCS adds images, buttons, and a verified branded sender to the SMS channel. The compliance position is unchanged — consent, opt-out, and quiet hours apply exactly as they do to SMS.

What does change is the fallback. Not every recipient's device and carrier support RCS, so the message has to degrade to plain SMS. That means the SMS version needs to stand on its own, with any button destinations written into the text — a card whose only call to action is a button becomes a dead end for everyone who receives the fallback.

A pre-launch checklist

1. Opt-in form with complete disclosure, no pre-ticked boxes, not a condition of purchase.
2. Consent records stored with timestamp, source, and the disclosure text shown at the time.
3. 10DLC brand and campaign registration approved, numbers associated (US).
4. STOP and equivalent keywords handled automatically, with opt-outs propagating across every system.
5. Inbound replies monitored by a person or a process, not ignored.
6. Quiet hours enforced by recipient time zone.
7. Frequency counted across every programme that texts the same phone.
8. Business name and opt-out language in the message.
9. Data processing agreements in place for non-US markets.
10. A first send to a small internal group, checked on a real phone.

How CampGain fits

CampGain sends SMS and RCS through your own Twilio connection, so your registration, your numbers, and your sender reputation stay yours.

• Per-contact delivery results with the provider's stated reason on failures — which is how you spot filtering that would otherwise look like silence.
• Ready-made SMS and RCS presets written to stay within a single GSM-7 segment, so a template does not quietly triple your cost.
• Segments and suppression built from combined contact and Shopify data, so opted-out contacts stay out of every campaign rather than only the one they replied to.
• Automatic RCS-to-SMS fallback, with the card's button links carried into the fallback text.
• Test sends to a handful of contacts before a campaign reaches the segment.

SMS works best as one step in a sequence rather than a channel on its own — our multi-channel campaign guide covers when a text earns its cost, and the WhatsApp Business API guide covers the channel with its own, quite different, rulebook. See how channels connect.

The short version

Get explicit written consent and keep the evidence. Register with the carriers before your first US send. Honour opt-outs immediately, however they are worded, and make sure the opt-out reaches every system. Send inside the recipient's local quiet hours. Count your total message frequency, not your per-campaign frequency.

Do that, and SMS becomes what it should be: a channel people are glad to hear from, used rarely enough that they still open it.