Compliant SMS marketing rests on five pillars: lawful consent, automated handling of opt-outs and revocation, carrier registration, auditable recordkeeping, and designing every program to the strictest rule that applies anywhere you send. The records that save you in a dispute are simple: a timestamped consent entry, the exact disclosure version shown at signup, and the inbound text that triggered the opt-in.
TL;DR:
- Promotional texts generally require a clear written agreement naming the brand, with frequency and data rate disclosures; retain the exact disclosure version shown.
- Treat any clear request to stop, including plain language outside standard keywords, as revocation; suppress that contact across all programs within 10 business days.
- Register campaigns sent through standard numbers with ten digits and complete toll free verification; unregistered or mismatched traffic can be filtered, throttled, or blocked.
- Keep consent records for at least four years and suppression logs for five years; consolidate suppression lists so every sending system honors each request.
- State laws in Texas, Virginia, and Washington add requirements or private rights of action, allowing consumers to sue directly over unwanted texts.
Table of Contents
- Which rules and organizations control SMS marketing
- Consent: what counts and how to capture it so it holds up
- Opt-out and revocation: what triggers it and how fast you must respond
- Carrier routing and registration: 10DLC, toll-free verification, and CTIA rules
- Operational compliance checklist: what to fix before your next campaign
- State laws and enforcement: why jurisdiction changes your obligations
- Records and audits: what to keep and for how long
- Enforcement trends and the single highest-impact fix
- How Aylona helps you operationalize compliant messaging
- FAQ
- Sources
Which rules and organizations control SMS marketing
Three layers govern what you can text and to whom. The Telephone Consumer Protection Act (TCPA) is the federal statute, and the FCC's TCPA rules treat text messages sent by autodialers as calls subject to telemarketing restrictions. On top of that sits carrier enforcement: CTIA sets industry messaging principles, and wireless carriers filter or block traffic that does not follow them through programs like 10DLC registration. Finally, individual states layer on their own "mini-TCPA" statutes, often with private rights of action that let consumers sue directly.
Because these layers stack, a national sender cannot pick the easiest rule and apply it everywhere. The practical approach is to build your consent, opt-out, and content rules around whichever jurisdiction imposes the tightest requirement, then apply that standard across your entire list.
Consent: what counts and how to capture it so it holds up
Promotional text messages generally require prior express written consent: a clear, documented agreement where the recipient knows they are agreeing to receive marketing texts from a specific brand, typically through an automated system. Purely transactional or informational messages, like appointment confirmations or shipping updates, are held to a lower bar, but the line between "transactional" and "promotional" blurs quickly once a message includes any sales content, so most teams are safer treating all texting as if written consent applies.
Capturing consent that survives a legal challenge means more than a checked box. Best practice includes:
- An explicit, unticked opt-in action rather than a pre-checked box or bundled consent.
- Disclosure text sitting next to the opt-in, stating that messages are sent via automated technology, naming expected frequency, and including the standard "msg & data rates may apply" language.
- An electronic signature flow consistent with the ESIGN Act when consent is collected digitally.
At the moment of capture, record the phone number, timestamp, IP address or session ID, how the form rendered on screen, the method used (web form, keyword text-in, point of sale), and the exact version of the disclosure the person saw.
Opt-out and revocation: what triggers it and how fast you must respond
Consumers can revoke consent through standard keywords like STOP, UNSUBSCRIBE, CANCEL, END, or QUIT, but the FCC's 2024 Report and Order makes clear that revocation can happen through any reasonable means. A plain-English reply such as "please stop texting me" counts just as much as a keyword, which means keyword-only detection systems miss real revocation requests.
- Treat any reasonably clear request to stop as a valid revocation, not only recognized keywords.
- Honor revocation across all of your messaging programs within a reasonable time, which the FCC caps at no more than 10 business days[citation needed].
- Send at most one confirmation message after a STOP, and make sure it contains no marketing content; sending it within minutes is presumptively compliant.
Pro Tip: Build free-text parsing into your opt-out detection so phrases like "no more texts" or "take me off your list" trigger suppression automatically, not just recognized keywords.
Carrier routing and registration: 10DLC, toll-free verification, and CTIA rules
Carriers filter and throttle application-to-person traffic that is not properly registered, which is why 10DLC and toll-free verification exist. Under CTIA's messaging guidance, unregistered or mismatched campaigns face lower throughput, delayed delivery, or outright blocking on standard 10-digit long codes.
Registering correctly means declaring an accurate brand identity and use case, submitting sample messages that match what you actually send, and monitoring your trust score for flags that signal drift between registration and real traffic. CTIA also enforces content restrictions known by the acronym SHAFT, covering sex, hate, alcohol, firearms, and tobacco content, and violating those rules can get a campaign suspended regardless of consent status. Keeping your registered samples current each time your messaging strategy changes is one of the simplest ways to protect deliverability.
Operational compliance checklist: what to fix before your next campaign
Compliance work has diminishing returns once the basics are solid, so prioritize in this order:
- Confirm every active contact has a documented consent record with a versioned disclosure attached.
- Merge suppression lists across every system that can send a text, so one source of truth governs all sends.
- Verify that STOP processing and free-text revocation both trigger automatic, immediate suppression.
- Register your brand and campaign accurately, and sync your filed sample messages with what you actually send.
- Schedule sends by the recipient's local time zone rather than your own.
- Run periodic carrier and do-not-call scrubs against your active list.
- Retain logs and exportable evidence for every consent, opt-out, and send event.
The most common failure mode is fragmented suppression: a contact opts out through one channel while three other systems keep texting them because nothing synced the request. The fastest fix with the biggest risk reduction is almost always consolidating suppression into a single authoritative list that every sending tool checks before every message goes out.
Pro Tip: Automate suppression syncs between every vendor you use, and write a sync-time service level agreement into each vendor contract so a missed STOP never slips through for more than a few minutes.
State laws and enforcement: why jurisdiction changes your obligations
Several states have added their own text-specific statutes in recent years, and some, including Texas, Virginia, and Washington, have introduced requirements or private rights of action that go beyond federal law. A private right of action means an individual consumer, not just a regulator, can sue directly over a single unwanted text.
That is why national senders design to the strictest applicable rule rather than maintaining different rulebooks per state. TCPA violations carry statutory damages per message, and repeated violations across a list can compound quickly, while carriers can also suspend a sender's traffic entirely for pattern-of-abuse complaints, which cuts off delivery regardless of what a court eventually decides.
Records and audits: what to keep and for how long
The strongest defense in a dispute is a complete, timestamped record, not a memory of what your process was supposed to do. Keep:
- A snapshot of the consent capture screen, including the exact disclosure text and version shown.
- The inbound opt-in and opt-out messages themselves, with timestamps.
- Suppression action logs showing when a request was received and when it was honored.
- Carrier scrub results and campaign-level message logs.
Practitioners commonly recommend retaining consent records for at least four years and opt-out or suppression logs for at least five, since that is the window regulators and courts tend to scrutinize. When choosing a vendor, confirm you can export this evidence in a form that preserves chain of custody.
Enforcement trends and the single highest-impact fix
Recent FCC rulemaking has made revocation easier to invoke, and carriers have tightened filtering in response. Compliance has become an operational problem more than a legal one. The highest-leverage fix is unifying suppression across every system you use, so one STOP anywhere stops everything.
— Hector
How Aylona helps you operationalize compliant messaging
Running consent, opt-outs, and send logs across separate tools is exactly where compliance breaks down, and it is the gap our AI Revenue Operating System is built to close. Our platform logs every send and response as part of its analytics, so you have an exportable record instead of scattered spreadsheets.
Our automation handles suppression at the platform level, which means a contact who opts out through one workflow is suppressed wherever messages are sent on your behalf, and scheduling by recipient time zone is built into how messages are queued rather than something your team manages by hand. For service businesses juggling appointment reminders, this works the same way our waitlist software for medspas handles automated client notifications: consent captured once, honored everywhere. If you are evaluating how to keep message content aligned with what you have registered with carriers, explore our AI Revenue Operating System to see the full feature set.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
What is prior express written consent for SMS?
Prior express written consent is a documented agreement where a recipient clearly agrees, in writing, to receive promotional texts sent through automated technology from a specific brand. It generally requires an unticked opt-in action and disclosure of message frequency and data rate charges, and it is treated as the standard for promotional messaging under the TCPA.
How many days do I have to honor an SMS opt-out?
Under the FCC's 2024 Report and Order, you must honor a revocation request within a reasonable time, which cannot exceed 10 business days, and the request can come through any reasonable means, not just recognized keywords. Best practice is to automate suppression so it happens within minutes rather than days.
Do I need 10DLC registration to send marketing texts?
Yes, if you are sending application-to-person traffic on a standard 10-digit number in the United States, carriers expect 10DLC registration, and unregistered traffic faces filtering, throttling, or blocking. Toll-free numbers require a separate verification process with similar deliverability stakes.
What records should I keep to prove SMS consent?
Keep a timestamped snapshot of the exact disclosure text shown at opt-in, the inbound message that confirmed consent, and any later opt-out or suppression action tied to that contact. Practitioners commonly recommend retaining consent records for at least four years and suppression logs for at least five.
Can I send any message after someone replies STOP?
You may send exactly one confirmation message after a STOP request, as long as it contains no marketing content, and sending it within minutes of the request is presumptively compliant under FCC guidance. Any further messages to that contact require new, documented consent.