The Business Guide to Mass Texting Laws & SMS Compliance (2026)

Sending mass texts without understanding the rules governing them is a sure way to end up facing regulatory fines, get your messages blocked by carriers, or both. Compliance for business SMS has gotten a lot more complex in recent years. TCPA enforcement is stiffer than ever, A2P 10DLC registration is now a carrier requirement, and international rules like GDPR and CASL apply to anyone messaging contacts outside the U.S.This guide covers what your organization needs to know to send SMS legally and build a messaging program that doesn’t expose you to avoidable liability. 

The Telephone Consumer Protection Act (TCPA)

The TCPA is the federal law that covers commercial text messaging in the United States. The Federal Communications Commission (FCC) enforces it. It gives consumers the right to sue businesses for violations, with statutory damages of $500 to $1,500 per message, which means TCPA liability adds up fast.

What Does the TCPA Mean for You?

The TCPA says that you can’t send automated text messages to a mobile phone without the recipient’s prior consent. However, the type of consent required depends on the type of message:

• Prior express written consent is required for marketing and promotional messages (texts sent for the purpose of selling a product or service). It has to be in writing (which includes electronic signatures and digital opt-in forms), has to clearly disclose that the consumer is agreeing to receive automated texts, and can’t be a condition of any purchase.
• Prior express consent (without the written requirement) usually applies to informational and transactional messages like appointment reminders, account alerts, order confirmations, and other notifications that don’t relate to marketing.

You can’t blur the lines, either. If your appointment reminder happens to mention a discount or upsell, regulators and plaintiffs’ attorneys may treat it as marketing, which requires written consent.

Recent FCC Findings

The FCC has continued to interpret and enforce TCPA requirements, with particular attention to one-to-one consent. Recent FCC findings clarified that getting consent for one business entity doesn’t extend consent to marketing from affiliates or third parties. Each organization sending marketing texts has to get its own consent from each recipient. If you collect leads through third-party platforms or lists that you buy, each contact still has to give you their consent.The FCC has also clarified revocation of consent. Consumers can revoke consent through any reasonable means, not just by sending STOP. Businesses need to capture and honor revocations through channels other than text.

TCPA Recordkeeping

If a consumer claims they never gave consent and you can’t show that they did, you’re in trouble. Consent records should include:

• The phone number associated with the consent
• The date and time consent was given
• The method through which consent was obtained (web form, paper form, keyword opt-in, etc.)
• The specific disclosure language the consumer agreed to
• The source of the opt-in (which campaign, landing page, etc.)

You need to keep these records for at least four years (TCPA statute of limitations) and make sure they’re accessible if needed.

A2P 10DLC Registration

A2P 10DLC registration is now non-negotiable for anyone sending business SMS at volume. Chances are good that your business is missing it.

What Is A2P 10DLC?

A2P stands for Application-to-Person. Think automated messages sent from a business to a consumer, rather than P2P (person-to-person) traffic between two individuals. 10DLC refers to 10-digit long codes (standard phone numbers used for business texting).Historically, long codes weren’t intended for high-volume business messaging, and carriers couldn’t tell legitimate business texts apart from spam. A2P 10DLC registration solves that problem by creating a formal registration process that links your business identity to the phone numbers and campaign types you’re using to send messages.

What Does Registration Involve?

Brand registration is the first step. You register your organization (the legal business name, EIN, address, and business type) with The Campaign Registry (TCR). Carriers use this to verify messages are coming from a real business entity.Campaign registration is the second step. A campaign is just a specific messaging use case, like marketing promotions, appointment reminders, customer notifications, emergency alerts, and so on. Each campaign type has its own registration and is subject to carrier review. You’ll describe what the campaign is, how recipients consented, and what types of messages you’ll send.

Why Does Registration Matter?

Registered campaigns get preferential treatment from carriers (messages from registered numbers are less likely to be filtered or blocked). Unregistered numbers sending business volume are flagged as potential spam even if your content is legitimate, because carriers can’t verify your identity.If your messages aren’t getting delivered, or if your deliverability has dropped, unregistered numbers are probably the cause. A lot of SMS platforms now require registration as a condition of sending.The other benefit to registering is carrier trust. Registration tells carriers that your business has been vetted and your messaging complies with the CTIA principles, which affects whether your messages get to the intended inboxes.

Recent FCC Findings

The FCC has continued to interpret and enforce TCPA requirements, with particular attention to one-to-one consent. Recent FCC findings clarified that getting consent for one business entity doesn’t extend consent to marketing from affiliates or third parties. Each organization sending marketing texts has to get its own consent from each recipient. If you collect leads through third-party platforms or lists that you buy, each contact still has to give you their consent.The FCC has also clarified revocation of consent. Consumers can revoke consent through any reasonable means, not just by sending STOP. Businesses need to capture and honor revocations through channels other than text.

TCPA Recordkeeping

If a consumer claims they never gave consent and you can’t show that they did, you’re in trouble. Consent records should include:

• The phone number associated with the consent
• The date and time consent was given
• The method through which consent was obtained (web form, paper form, keyword opt-in, etc.)
• The specific disclosure language the consumer agreed to
• The source of the opt-in (which campaign, landing page, etc.)

You need to keep these records for at least four years (TCPA statute of limitations) and make sure they’re accessible if needed.

A2P 10DLC Registration

A2P 10DLC registration is now non-negotiable for anyone sending business SMS at volume. Chances are good that your business is missing it.

What Is A2P 10DLC?

A2P stands for Application-to-Person. Think automated messages sent from a business to a consumer, rather than P2P (person-to-person) traffic between two individuals. 10DLC refers to 10-digit long codes (standard phone numbers used for business texting).Historically, long codes weren’t intended for high-volume business messaging, and carriers couldn’t tell legitimate business texts apart from spam. A2P 10DLC registration solves that problem by creating a formal registration process that links your business identity to the phone numbers and campaign types you’re using to send messages.

What Does Registration Involve?

Brand registration is the first step. You register your organization (the legal business name, EIN, address, and business type) with The Campaign Registry (TCR). Carriers use this to verify messages are coming from a real business entity.Campaign registration is the second step. A campaign is just a specific messaging use case, like marketing promotions, appointment reminders, customer notifications, emergency alerts, and so on. Each campaign type has its own registration and is subject to carrier review. You’ll describe what the campaign is, how recipients consented, and what types of messages you’ll send.

Why Does Registration Matter?

Registered campaigns get preferential treatment from carriers (messages from registered numbers are less likely to be filtered or blocked). Unregistered numbers sending business volume are flagged as potential spam even if your content is legitimate, because carriers can’t verify your identity.If your messages aren’t getting delivered, or if your deliverability has dropped, unregistered numbers are probably the cause. A lot of SMS platforms now require registration as a condition of sending.The other benefit to registering is carrier trust. Registration tells carriers that your business has been vetted and your messaging complies with the CTIA principles, which affects whether your messages get to the intended inboxes.

Carrier Rules vs. Legal Requirements

One of the most common compliance-related mistakes businesses make is thinking that is that TCPA compliance is enough. It’s not. Carrier policies and CTIA messaging principles operate independently from federal law, and carriers can block your messages even if you’re not violating the law.

4 Layers of SMS Compliance

A message can be legally compliant under the TCPA, and a carrier can still block it. Carriers set their own standards for what they’ll deliver, and those standards have tightened substantially as they’ve worked to address spam and fraud on their networks.

CTIA Messaging Principles

The CTIA sets industry best practices for business SMS use. Some of the most important requirements include identifying your organization in every message, honoring opt-outs immediately, including opt-out instructions in recurring campaigns, and not sending messages during restricted hours. Carriers actively enforce these principles, too. Content that violates CTIA guidelines will be filtered even if your recipient opted in to receiving it.

When in doubt, get written consent. The cost of doing so will always be less than the cost of defending your business against a CTIA claim.

Opt-Out Management

The TCPA says that you have to honor opt-outs immediately (within 10 business days is the regulatory standard, but best practice is instant). Here’s what opt-out management looks like:

Required Keywords

• STOP: This is the primary opt-out keyword. Sending STOP has to immediately halt all automated messages from your number to that contact.
• UNSUBSCRIBE, CANCEL, END, QUIT: These are additional keywords carriers and CTIA principles require you to honor as opt-out requests.
• HELP: This has to return your business name and a contact method (phone number or website). This is a carrier requirement, and it’s not optional.
• START or UNSTOP: These allow a previously opted-out consumer to re-subscribe to your messages.

Opt-Out Confirmation Messages

When someone sends STOP, you can send a single confirmation message acknowledging the opt-out. This message is permitted even though the contact has opted out. It should confirm the opt-out, identify your business, and note that no further messages will be sent.Example: “You’ve been unsubscribed from [Business Name] alerts. No further messages will be sent. Text START to re-subscribe. For help, call [number].”

Suppression Lists

Every opt-out has to be added to a suppression list immediately and maintained permanently. Sending a message to a number that has opted out carries major TCPA liability, and “I didn’t know they had opted out” is not a defense if your suppression list wasn’t properly maintained. Audit your list regularly and bump it against your active contact database.Finally, remember that opt-outs don’t expire. A number that opted out in 2019 stays opted out unless the consumer explicitly re-subscribes.

Record Keeping

Good record keeping is your only real protection in any consent dispute or regulatory inquiry. Your record-keeping system should capture:

• Consent logs: For each opted-in contact, a record of what they consented to, when, and through what mechanism.
• Timestamps: Date and time of opt-in, timestamped with the platform’s server time, not the user’s local time.
• Source of opt-in: The specific form, keyword, landing page, or in-person sign-up that captured consent. 
• Disclosure language: What the opt-in language said at the time consent was obtained. If you update your disclosure language, save the historical versions so you can match records to the language used when each consent was captured.
• Delivery history: A record of what messages were sent to who and when they were sent. If a consumer disputes getting a message, your delivery log should show that they did.
• Opt-out records: Date and time of every opt-out, the keyword or mechanism used, and confirmation that the contact was suppressed.
• Audit trails: System logs showing that opt-outs were handled immediately and that suppression lists were applied before sends.

Make sure to keep all consent and communication records for at least four years. For healthcare organizations where HIPAA applies, financial services firms, and other regulated industries, you may need to deal with other record-keeping rules.

Why Do SMS Campaigns Get Blocked?

Even legal campaigns can get blocked by carriers if they look like spam or fraud. Here’s what to watch for:

• Unregistered numbers. Sending business-volume traffic from an unregistered long code is the most common reason to be filtered. 
• Missing opt-out language. Marketing messages that don’t include STOP instructions violate CTIA guidelines and will be flagged. 
• Excessive message frequency. Sending too many messages very quickly, or more messages than your disclosed frequency, usually leads to filtering.
• High complaint rates. When recipients report messages as spam, carriers track those complaint rates by sending number. Lots of complaints mean you get filtered.
• Spam-like content. All-caps messages, excessive punctuation, “FREE!!!” subject matter, misleading claims, and other characteristics of spam content will get you filtered regardless.
• URL shorteners and shared links. Third-party URL shorteners (bit.ly, tinyurl.com) are used to hide malicious links. Use branded short domains or full URLs instead. Shared links used across multiple campaigns are also flagged because carriers see the same link pattern in spam.
• Poor list hygiene. Sending to numbers that have opted out, are disconnected, are invalid, or consistently don’t engage contributes to complaint rates and filtering. Clean your lists regularly.
• Sending during restricted hours. Most carriers restrict commercial messaging to between 8 AM and 9 PM in the recipient’s time zone. Sending outside those times is likely to get you filtered.

International SMS Compliance

If you’re messaging contacts outside the United States, U.S. law doesn’t apply, but that doesn’t mean you have no hurdles. Every major international market has its own protections, and the penalties in some jurisdictions (GDPR in particular) are a lot stiffer than what the TCPA hands down.

European Union (GDPR and ePrivacy Directive)

The GDPR applies to any organization that processes personal data of EU residents, regardless of where that organization is based. A phone number is personal data under GDPR. Sending marketing SMS to EU contacts requires a lawful basis for processing. For most marketing, that means freely given, specific, informed, and unambiguous consent. Pre-checked boxes and consent bundled into terms of service don’t count.The ePrivacy Directive (sometimes called the “Cookie Directive”) covers electronic marketing communications, including SMS, and requires prior opt-in consent for direct marketing. Most EU members have adopted this through national law.GDPR violations can mean fines of up to €20 million or 4% of your global annual revenue, whichever is higher.

Canada (CASL)

Canada’s Anti-Spam Legislation (CASL) covers commercial electronic messages, including SMS, sent to or from Canada and requires express or implied consent before sending commercial messages. Express consent requires a clear opt-in, and implied consent only exists in limited circumstances (an existing business relationship, for instance). Implied consent is time-limited, too, usually two years from your last business transaction.Every commercial message has to identify the sender, provide contact information, and include a way to unsubscribe. CASL violations carry administrative penalties up to $1 million for individuals and $10 million for businesses per violation.

United Kingdom (PECR)

The UK’s Privacy and Electronic Communications Regulations (PECR) cover electronic marketing to UK residents, including SMS. Since Brexit, the UK operates its own version of GDPR (UK GDPR) alongside PECR. Marketing texts need to have prior opt-in consent. Soft opt-in rules can apply in limited circumstances where there’s an existing customer relationship and the message is for similar products or services.The Information Commissioner’s Office (ICO) enforces PECR and can issue fines up to £500,000 for serious violations.

Australia (Spam Act 2003)

Australia’s Spam Act prohibits sending commercial electronic messages (including SMS) without the recipient’s consent. That can be express (direct opt-in) or inferred (from conduct or an existing business relationship). Messages have to identify the sender and a way to unsubscribe (that has to be honored within five business days).The Australian Communications and Media Authority (ACMA) enforces the Spam Act. Penalties for serious or repeated violations can reach millions of dollars.

Industry-Specific Compliance Considerations

The TCPA applies across industries, but compliance looks different depending on what your business actually does.

• Healthcare: HIPAA puts additional requirements on top of the TCPA for any SMS that involves protected health information (PHI) (potentially including even things like appointment reminders that include patient names or provider names, or appointment details). If you’re a healthcare organization, make sure your SMS platform meets HIPAA technical safeguards, and that consent language is coordinated with HIPAA authorization requirements.
• Schools: The Family Educational Rights and Privacy Act (FERPA) covers student records. School messaging that includes identifiable student information has to have appropriate consent and data handling. If your school’s SMS program communicates with parents rather than students, that can sidestep some issues but still requires TCPA-compliant consent.
• Churches and religious organizations: Churches and religious organizations aren’t exempt from the TCPA. Consent is required before sending automated texts to congregation members, church visitors, donors, or volunteers (your tax-free status doesn’t change compliance).
• Property management: Property managers texting tenants about rent, service/repairs, maintenance, and building operations need consent as part of the lease process. Emergency notifications to tenants may benefit from a specific consent provision in the lease that covers urgent communications.
• Nonprofits: The TCPA applies to nonprofit fundraising and advocacy texts. Some exemptions exist for emergency purposes, but they’re narrow. Nonprofits collecting mobile numbers through fundraising campaigns should get consent at the point of collection and be specific about text message intent.
• Utilities: Utilities sending outage notifications, restoration notices, billing alerts, and service updates are in something of a gray area. Emergency communications don’t really require an opt-in, but proactive marketing texts need the standard TCPA consent.
• Staffing and recruiting: Recruiting texts to job applicants or potential candidates need consent before automated messages are sent. Make sure you include SMS consent in the application or candidate intake process.
• Real estate: Real estate professionals texting leads, sellers, prospects, and clients need consent before doing any kind of automated outreach. Real estate marketing texts fall squarely within the prior express written consent requirement. 

Your SMS Compliance Checklist

Use this checklist before launching any SMS campaign:Consent and Opt-In

• Obtained express consent before sending any automated messages
• Obtained prior express written consent for marketing and promotional texts
• Consent disclosure clearly identified your organization and described the message type and frequency
• Consent was not a condition of purchase or service
• Consent records include timestamp, source, and disclosure language

Registration and Technical Setup

• Brand registered through A2P 10DLC
• Campaign registered for each use case (marketing, notifications, alerts, etc.)
• Sending numbers are provisioned for business messaging

Every Message

• Message identifies your business by name
• STOP instructions included in marketing messages and initial campaign sends
• HELP response configured to return business name and contact information
• Message content doesn’t include spam-like language, misleading claims, or flagged URL patterns
• Message sent within permitted hours (8 AM to 9 PM in the recipient’s local time)

Opt-Out Handling

• STOP and all required opt-out keywords are monitored and processed
• Opt-outs honored immediately and added to suppression list
• Opt-out confirmation message configured
• Suppression list reconciled against active contact database before every send

Records and Auditing

• Consent logs maintained with timestamps and source documentation
• Delivery history logged and accessible
• Opt-out records maintained permanently
• SMS program reviewed against current TCPA guidance at least annually
• Legal counsel consulted on any significant changes to consent practices or message types

How Does DialMyCalls Support SMS Compliance?

Compliance isn’t just about covering your legal bases. The features your messaging platform offers directly affect your ability to meet the requirements above. Here’s how DialMyCalls supports compliance:

• Contact list: Organize contacts by opt-in source, consent type, communication preference, and more. Segmenting your list by consent type makes sure that marketing messages only go to those with written consent, and transactional messages reach the right audience.
• Opt-out handling: DialMyCalls handles all opt-out keywords automatically and removes opted-out contacts from future messaging. Suppression is applied before every campaign, which means fewer worries about TCPA compliance for you.
• Delivery reporting: Message delivery status is logged for every message, including who got what, when, and whether the message was delivered successfully. That makes record-keeping easier and gives you information to investigate filtering or deliverability issues.
• Scheduled messaging: Restrict messaging to compliant hours by scheduling texts to go out within specific windows. Scheduling also helps keep your cadence consistent, which can reduce complaints.
• Audience segmentation: Send the right message to the right audience without broadcasting to your entire list. Segmentation reduces complaints, bumps up engagement, and makes sure that messages are matched to consent level.
• A2P-compatible messaging workflows: DialMyCalls is A2P compliant for the brand and campaign registration process carriers require for business SMS.
• SMS and voice broadcasting: For organizations that need to reach contacts who may not respond to text or for emergency communications, DialMyCalls supports SMS, voice broadcast, and email all at the same time.
• Communication records: Message history, consent records, delivery confirmations, and contact interaction logs give you an audit trail for compliance.

DialMyCalls helps organizations manage compliant SMS programs from consent management and opt-out processing to A2P-compatible messaging and delivery reporting. Get in touch today to learn more or start your free trial.

Frequently Asked Questions

What is A2P 10DLC? A2P 10DLC is a registration system that lets businesses send automated (Application-to-Person) text messages through standard 10-digit phone numbers. Businesses register their brand and specific messaging campaigns with carriers through The Campaign Registry. Unregistered numbers sending business-volume messages often get filtered or blocked.

Do businesses need consent before sending text messages? Yes. The TCPA requires consent before sending automated texts to mobile phones in the United States. The consent type depends on the message you’re sending, though. Prior express written consent for marketing and promotional texts; prior express consent for transactional and informational messages. Sending without consent could mean paying damages of $500 to $1,500 per message.

What’s the difference between TCPA and CTIA? The TCPA is federal law, enforced by the FCC with private right of action for consumers. The CTIA is an industry trade organization that publishes messaging best practices and principles. Carriers enforce CTIA guidelines through their own filtering and blocking systems. A business can technically comply with the TCPA while still having messages blocked for violating CTIA principles, so they both matter.

Are appointment reminders subject to TCPA? Yes, appointment reminders sent through automated systems require consent. Transactional reminders like confirming an appointment time without any promotional content usually require prior express consent rather than written consent, but if the reminder includes any promotional element, prior express written consent is safer.

Can nonprofits send mass text messages? Yes, but they’re not exempt from the TCPA. Nonprofit organizations sending automated texts for fundraising or operational communications need consent before sending. Some narrow exemptions do exist for true emergency communications, but standard outreach falls under the rule that applies to for-profit businesses.

Can schools text parents without written consent? Yes, schools can communicate with parents through text, but automated mass texts still need TCPA-compliant consent. A lot of schools collect mobile contact information and communication preferences during enrollment (a natural time to capture SMS consent). Messages that include identifiable student information also come with FERPA considerations.

What happens if someone replies STOP? You have to immediately add that number to your suppression list and stop sending automated messages. A single confirmation message is allowed (and expected) to acknowledge the opt-out, but that’s the only message allowed after a STOP reply. The number should remain on your suppression list permanently unless the consumer explicitly re-subscribes using START or UNSTOP.

How long should businesses keep consent records? At minimum, keep your consent records for four years (TCPA statute of limitations). Healthcare organizations, financial services firms, and other industries may have longer retention requirements. Opt-out records should be kept permanently, as opted-out numbers stay suppressed indefinitely.

Can businesses send international SMS campaigns? Yes, but each country has its own laws. Sending to EU residents means dealing with the GDPR and the ePrivacy Directive. Canada requires CASL compliance. The UK has its own rules (similar to the GDPR), plus PECR. Australia’s Spam Act covers commercial electronic messages. In most cases, the consent and opt-out requirements are similar to U.S. standards but differ in specific details and penalties. 

How does SMS support business continuity? 

SMS gets to recipients directly on their mobile devices with a 98% open rate and an average read time under three minutes, which is important when internet access or office systems are unavailable. It supports both outbound mass notifications and inbound two-way communication.

Mass texting laws and carrier requirements change. This guide reflects the regulatory environment as of 2026, but you should verify current requirements with legal counsel before making compliance decisions. Nothing in this article constitutes legal advice.