SMS marketing compliance: consent, opt-outs, quiet hours and carrier registration for ecommerce brands

SMS marketing compliance in the US starts with the TCPA. Marketing texts sent with an autodialer need the recipient's prior express written consent, and that consent can't be a condition of purchase. Opt-outs sent by any reasonable means, including replies like STOP, must be honored within 10 business days. Add quiet hours, carrier registration for 10-digit numbers, state laws and honest content, and keep records that prove every consent.

What does SMS marketing compliance cover?

Four layers of rules apply to a marketing text, and a program has to pass all four:

1. Federal law: the Telephone Consumer Protection Act and the FCC's rules under it, which set consent, opt-out and calling-hour requirements.
2. State law: states can add telemarketing laws of their own. Florida's, covered below, is one example.
3. Carrier rules: the wireless industry's messaging guidelines from CTIA, and registration with The Campaign Registry for texts sent from ordinary 10-digit numbers.
4. Advertising law: a marketing text is an ad, so hold its claims to the same standard as your VSL and your label.

Four numbers anchor the federal layer:

The federal numbers behind SMS marketing compliance

10 business daysthe most time you have to honor a request to stop47 CFR 64.1200

8 a.m. to 9 p.m.when telephone solicitations may reach a residential subscriber, in their local time47 CFR 64.1200(c)

$500damages per violation a recipient can sue for under the TCPA, up to three times that if willful or knowing47 U.S.C. 227(b)(3)

Jan 31, 2027until when the "revoke-all" part of the opt-out rule is waivedFCC, DA 26-12

This is a summary for marketers, not legal advice. The primary sources are linked throughout; have counsel review your program before it launches.

TCPA SMS rules: when you need prior express written consent

The FCC's rules require the called party's prior express written consent for autodialed or prerecorded calls that include an advertisement or constitute telemarketing, made to wireless numbers. Calls without marketing content made the same way, such as shipping updates, need prior express consent, which doesn't have to be in writing (47 CFR 64.1200). The rules cover texts as well as voice calls: the opt-out rule speaks of calls and text messages, and the FCC's orders call autodialed texts "robotexts" (FCC, DA 26-12).

The same section defines prior express written consent. It is an agreement in writing, signed by the person, that clearly authorizes the seller to deliver marketing calls or texts using an autodialer or a prerecorded voice. It must also disclose, clearly and conspicuously, that the person isn't required to sign it, directly or indirectly, as a condition of buying anything. Electronic and digital signatures count where federal law or state contract law recognizes them.

Whether a particular texting platform counts as an autodialer is a legal question with a long history. Don't build your program on the answer. Plan for written consent on every marketing text: CTIA's guidelines expect businesses to get a consumer's express written consent to specifically receive marketing messages (CTIA Messaging Principles and Best Practices).

One rule you may have read about never took effect. On January 24, 2025, the Eleventh Circuit vacated the part of the FCC's 2023 order that held the "one-to-one consent" rule and its "logically and topically related" requirement (Insurance Marketing Coalition v. FCC). Consent still has to authorize you, the seller, to text the person.

What a compliant SMS opt-in looks like

Consent is only as good as the form that collected it. Build the opt-in around five things:

• A deliberate act. An unchecked box the buyer ticks, or a keyword they text to your number. A pre-ticked box, or treating the phone field on the order form as consent, is hard to defend as a signed agreement to receive marketing.
• Its own words. The consent sentence sits next to the box, in plain language, not inside your terms of service.
• Optional. The order goes through without it, and the form says so. That is the "not a condition of purchase" disclosure.
• What CTIA says a call to action should tell people: the program or product, the number or short code, who you are, clear opt-in language and any fees, how to opt out, a customer care contact, and your privacy policy, which should be reachable from the opt-in itself.
• A record. Save the phone number, the time, the page and form version, and the exact text the person saw. If a consent is ever disputed, that record is your evidence.

CTIA expects a recurring program's confirmation message to state how often messages will come, so the confirmation repeats the frequency. Here is the same opt-in built two ways:

Two SMS opt-ins

AvoidHard to defend

• A pre-ticked box, or the phone field taken as consent
• Consent buried in the terms of service
• Required to complete the order
• No brand name, frequency or STOP instructions
• No record of what the person saw

Do thisBuilt to hold up

• An unchecked box the buyer ticks, or a keyword they text
• The consent sentence next to the box, in plain words
• Optional, with a line saying consent is not a condition of purchase
• Brand, what you will send, how often, fees, HELP and STOP, links to terms and privacy
• Time, page, form version and exact wording saved with the number

How to handle STOP, HELP and opt-out requests

The FCC's revocation rules took effect on April 11, 2025 (FCC, DA 26-12). A consumer may revoke consent by any reasonable method, and a reply of "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" counts as reasonable in itself. You must honor the request within a reasonable time, no more than 10 business days after you receive it (47 CFR 64.1200). What that means in practice:

• Automate the seven words, and read everything else. Your platform should opt those replies out at once. Someone who writes "please don't text me anymore" has opted out too, so a person or a rule has to catch it. CTIA likewise asks senders to act on ordinary words such as stop, end, unsubscribe, cancel and quit.
• Send one confirmation, then nothing. The FCC's rule allows a single text that only confirms the opt-out, with no marketing or promotional content, as the only message after the request. Sent within five minutes, it is presumed to fall within the person's earlier consent; any later and you would have to show the delay was reasonable. CTIA's guidelines say the same: one final confirmation per campaign, and no messages after it.
• Ask, don't assume, when there is more than one kind of text. If the person agreed to several kinds (offers and order updates, say), the confirmation may ask whether the opt-out covers all of them. Without an answer, the rule says to stop every text that requires consent.
• Suppress everywhere. A STOP received by one platform has to reach every tool and agency that can text that number.
• Answer HELP. Reply with your brand, a way to reach support and how to stop.

Which messages an opt-out reaches is where the rules are still moving. The part of the revocation rule that is waived, often called "revoke-all", covers an opt-out sent in reply to one type of informational message, such as a delivery update. Under it, that opt-out would also apply to all your robocalls and robotexts on unrelated matters. It is waived until January 31, 2027 (FCC, DA 26-12).

A draft order the FCC circulated for its September 30, 2026 meeting would replace that part. FCC listings show the adopted version as FCC 26-67. In the draft, an opt-out from one category of informational messages would cover only that category, while an opt-out from marketing would still cover all your marketing calls and texts. Senders could also name an exclusive way to opt out, such as standardized reply words, if they disclose it clearly and conspicuously in the text. The changes would take effect 30 days after publication in the Federal Register. A further notice asks whether to shorten the 10-business-day limit; a joint letter it cites proposes seven (FCC draft order and fact sheet). We couldn't open the adopted text, so treat these details as pending and check fcc.gov before you change anything. Here is how the rules got here:

How the texting opt-out and consent rules changed

1. Jan 24, 2025One-to-one consent rule vacatedThe Eleventh Circuit strikes it down before it takes effect.
2. Apr 11, 2025Revocation rules take effectAny reasonable method; honored within 10 business days. The "revoke-all" part is waived.
3. Jan 6, 2026Revoke-all waiver extendedTo January 31, 2027, by FCC order DA 26-12.
4. Sep 30, 2026FCC meeting takes up changesA draft order would narrow revoke-all. Check the adopted text, listed as FCC 26-67.
5. Jan 31, 2027Waiver endsUnless the new order replaces that part first.

Quiet hours, message frequency and state laws

The FCC's calling-hours rule bars telephone solicitations to a residential subscriber before 8 a.m. or after 9 p.m., local time where the person is. Apply the same window to every marketing text: it costs little and removes an argument. Take the time zone from the shipping address where you have one. An area code shows where a number was issued, not where its owner is today.

Frequency is a promise. State it at opt-in, repeat it in the confirmation and stay inside it. If you said "up to 4 msgs/month", the fifth text in a month breaks the terms the person agreed to.

State laws can reach further than the federal one. Florida's Telephone Solicitation Act is an example. It counts a text message as a "telephonic sales call" and requires prior express written consent for automated sales calls. It lets a recipient sue for actual damages or $500 per violation, whichever is greater, and a court may award up to three times that for willful or knowing violations. Before suing over texts, the recipient must reply STOP, and the sender then has 15 days to stop (Fla. Stat. 501.059). Check the laws of the states where your customers live, not only where your business is. For a supplement brand, that can include Washington's My Health My Data Act, with consent rules for collecting and sharing consumer health data.

10DLC registration and carrier rules

If you text from an ordinary 10-digit number, your traffic runs on 10DLC, short for "10 Digit Long Code". The Campaign Registry describes it as the sanctioned standard for non-consumer, or A2P, texting from a traditional 10-digit number (The Campaign Registry). Two registrations matter:

• Your brand: the company the recipient believes is sending the message.
• Your campaign: the use case, which defines the type of content you'll send. Marketing and customer care are separate examples.

You don't register with The Campaign Registry yourself. It doesn't take registrations directly from brands, so your messaging provider, acting as a campaign service provider, registers your brand and campaigns. Describe each campaign so it's very clear what it will be used for, then send what you described. If offers and reorder reminders will come from the same number, say so in the registration.

CTIA's Messaging Principles and Best Practices are voluntary guidance written by CTIA's member companies, not law. Read them anyway, because they describe what the wireless industry expects of business texting: express written consent for marketing, standardized STOP wording, a single opt-out confirmation, and marketing content that isn't misleading and complies with the FTC's truth-in-advertising rules.

What a supplement brand can say in a text

Texts are ads, and the rules that govern your VSL govern a one-line message too. Keep a supplement's texts inside the claims its label can make; the structure/function claims post linked below and the supplement advertising rules post set out where the lines are. A text has no room for a disclaimer or for context, so the simplest policy is to keep health claims out of texts entirely and let them handle logistics and offers:

Start every text with your brand name, keep deadlines real, and send the reader to a page where the claims, the disclaimer and the evidence live. The VSL compliance guide covers that page. Texts that remind buyers to reorder are one of the retention levers for a consumable, so they're worth doing properly.

An SMS compliance checklist before the first send

Run through this list with the person who owns your texting platform, and again whenever you add a new form, platform or agency:

SMS compliance before the first send

• The opt-in is an unchecked box or a keyword, optional, with its own sentence and the "not a condition of purchase" disclosure.
• The call to action names your brand, what you will send, how often, any fees, HELP and STOP, and links to terms and privacy.
• Each consent is stored with the number, time, page, form version and the exact text shown.
• The confirmation text states the frequency and how to get help or stop.
• The seven STOP words opt out at once, and other requests to stop are caught well within 10 business days.
• Opt-outs reach every platform and agency that can text the number.
• Marketing texts go out between 8 a.m. and 9 p.m. in the recipient’s time zone.
• Your brand and campaigns are registered for 10DLC through your messaging provider.
• No health claims in texts, and every offer and deadline is real.
• Counsel has checked the program against federal law and the laws of the states you sell into.

0 of 10 done

Email follows lighter consent rules but strict opt-out rules of its own. The post-purchase email flow post covers CAN-SPAM for the emails that go out alongside your texts.