SMS Marketing Compliance: The 2026 Do’s and Don’ts
By Eric Bouvier, EJB Technology Support, LLC
If your business sends marketing text messages — or is thinking about starting — there are three separate rulebooks you’re subject to at the same time: a federal law with real financial penalties, a set of carrier standards that aren’t law but can get your number shut down anyway, and a registration system that decides whether your texts get delivered at all. Most businesses only find out about one of these the hard way. Here’s what actually matters.
The Three Layers of SMS Regulation
Unlike email marketing, where one law (CAN-SPAM) mostly covers you, SMS marketing sits under overlapping oversight from three different directions.
1. The TCPA — federal law with teeth
The Telephone Consumer Protection Act requires prior express written consent before you send someone a marketing text. That consent has to be clear — a checked box or signed form that specifically says the person agrees to receive marketing messages from your business — not something buried in a paragraph of terms and conditions. Violations carry penalties of $500 to $1,500 per message, and the TCPA allows private lawsuits, which is how most businesses actually encounter it: not as a regulatory fine, but as a class action.
2. CTIA messaging principles — not law, but enforced anyway
The CTIA (the wireless industry’s trade association) publishes messaging guidelines that carriers like AT&T, Verizon, and T-Mobile use to decide whose texts get delivered. These aren’t legally binding, but ignoring them is just as damaging in practice: carriers can filter your messages, block your number, or shut down your campaign entirely.
3. A2P 10DLC registration — the gatekeeper
Before you can reliably send business texts at scale, your brand and your specific messaging use case need to be registered with The Campaign Registry (TCR). Marketing campaigns get extra scrutiny here, particularly around how you’re getting consent — more on that below.
Do’s
- Get prior express written consent before the first marketing text — a checkbox or signed form that clearly names your business.
- Identify your business name in every message you send.
- Disclose message frequency and that “message and data rates may apply” right at the point of opt-in.
- Give a clear way to opt out (e.g., “Reply STOP to unsubscribe”) and honor it immediately.
- Respond to HELP requests with real support contact information.
- Send only during compliant hours — 8 a.m. to 9 p.m. recipient local time at minimum.
- Keep records of exactly how and when each person consented.
- Register your brand and use case with TCR, and keep your message content matched to what you registered.
- Maintain a public, compliant privacy policy and terms of service page.
Don’ts
- Don’t text people from purchased or rented lead lists. Consent has to run to your specific business, and carriers reject campaigns that can’t show a legitimate opt-in source.
- Don’t send SHAFT content — Sex, Hate, Alcohol, Firearms, Tobacco (including CBD) — or unlabeled age-restricted material.
- Don’t ignore or delay an opt-out. As of 2025, the FCC requires honoring any reasonable method — STOP, CANCEL, END, QUIT, UNSUBSCRIBE, a phone call, an email, or a web form.
- Don’t keep messaging someone who’s opted out, even on a “different” campaign from your brand, without separately documented consent.
- Don’t bury your consent language in dense fine print.
- Don’t send high-volume marketing traffic from a number that isn’t registered.
- Don’t assume one national rule covers you everywhere — some states go further (see below).
Quiet Hours: It’s Not Just 9 P.M. Everywhere
Federal law sets the outer boundary, but a growing list of states impose stricter windows. When rules conflict, follow whichever is strictest for that recipient.
| Jurisdiction | Allowed Window | Notes |
|---|---|---|
| Federal (TCPA baseline) | 8:00 a.m. – 9:00 p.m. local time | Applies nationwide as the floor |
| Florida, Oklahoma, Washington | 8:00 a.m. – 8:00 p.m. | One hour stricter than federal |
| Texas (since Sept. 2025) | 9 a.m.–9 p.m. Mon–Sat; noon–9 p.m. Sun | Also requires state registration for many telemarketers |
What Changed in 2025–2026
- The one-to-one consent rule is dead. The FCC’s 2023 rule requiring a separate consent per seller was vacated by the 11th Circuit in January 2025 and formally repealed. A single clear opt-in can still authorize multiple sellers, though seller-specific consent is now a common best practice anyway.
- Opt-out methods expanded. Since April 2025, businesses must honor opt-outs through any reasonable method — not just one specific keyword.
- The “revoke-all” rule keeps getting delayed. A proposal that would make one opt-out apply across every channel a company uses has been pushed back again, most recently to January 2027.
Quick Launch Checklist
☐ Opt-in flow discloses business name, frequency, and “msg & data rates may apply”
☐ Privacy policy and terms of service are live, public, and linked at the opt-in point
☐ STOP / HELP keywords configured with compliant auto-replies
☐ Send times respect the strictest quiet-hours rule that applies to your recipients
☐ Message content matches your registered TCR use case, with no SHAFT content
☐ Brand and campaign are registered and approved in A2P 10DLC before sending
Need a Second Set of Eyes on Your Setup?
We help businesses get their SMS marketing registered correctly the first time — consent flow, A2P 10DLC brand and campaign registration, and message templates included. If you’re not sure your current setup would pass, reach out and we’ll take a look.
This article summarizes general industry and regulatory practice as of July 2026 for informational purposes and is not legal advice. TCPA, FCC, CTIA, and state requirements change frequently and vary by jurisdiction; consult a qualified attorney before making compliance decisions for your business.