To send marketing text messages legally in the U.S., get each person’s prior express written consent, identify your business, include opt-out instructions, honor opt-outs quickly, text only during permitted hours and register your texting program with the carriers (10DLC). Keep records of consent, and update your privacy policy to explain how you collect and use phone numbers.
Reviewed and updated October 2026: this guide was checked against current federal rules, including the FCC’s 2025 opt-out requirements, and corrected. It is general information, not legal advice; talk to an attorney about your specific program.
SMS marketing is a powerful tool for engaging with customers, but businesses must follow SMS marketing compliance regulations to avoid legal risks. Text message marketing is governed by strict laws that protect consumer privacy and prevent spam. Companies that fail to comply with these regulations may face lawsuits, hefty fines, or carrier-imposed message blocks.
To legally send marketing texts, businesses must get the right kind of consent, honor opt-outs quickly, respect calling hours and be transparent about how they use phone numbers. In the U.S. the main law is the Telephone Consumer Protection Act (TCPA), backed by state laws and by carrier rules that are separate from the law. Businesses texting people in Europe also need to follow the EU’s ePrivacy rules and the General Data Protection Regulation (GDPR), and California’s privacy law (CCPA) governs how larger businesses handle the mobile numbers they collect.
This guide covers the background of SMS privacy laws, current requirements, how carrier registration (10DLC) works and how it differs from the law, and what your website privacy policy should say. It is general information to help you ask the right questions, not legal advice for your specific situation.
Which Laws Regulate SMS Marketing?
Evolution of SMS Messaging
The history of SMS (Short Message Service) dates back to 1992, when engineer Neil Papworth sent the world’s first text message, “Merry Christmas,” to a Vodafone executive. This moment marked the beginning of an era in communication. By the early 2000s, SMS had evolved into a dominant form of personal and business communication, allowing people to exchange messages instantly.
Businesses saw the potential of SMS for client engagement as the use of mobile phones increased dramatically. Text messaging evolved into a straightforward and powerful marketing tool for everything from appointment reminders to special offers. With an open rate of over 90%, SMS messages are one of the most dependable ways to reach clients, in contrast to emails, which are frequently ignored.
But difficulties also accompanied this expansion. As companies started using SMS for marketing, the increase in spam texts raised serious privacy issues for customers. Inboxes were overflowing with unsolicited messages, which irritated customers and drew attention from authorities. Governments throughout the world have responded to these worries by enacting laws and rules that shield customers against unsanctioned usage of their phone numbers and spam.
Key Privacy Laws Regulating SMS Messaging
Several privacy laws regulate how businesses can collect and use phone numbers for SMS marketing. These laws ensure consumers have control over their data and prevent businesses from sending unwanted messages.
1. Telephone Consumer Protection Act (TCPA) – 1991
The TCPA, enforced by the Federal Communications Commission (FCC) and through private lawsuits, regulates telemarketing calls and, as the FCC and courts have confirmed, text messages to mobile phones.
Key provisions of the TCPA include:
- Prior Express Written Consent: marketing texts sent with automated systems require the recipient’s prior express written consent: a signed agreement (an electronic signature, checkbox or keyword reply can qualify) that clearly authorizes marketing texts to that number and states that consent is not a condition of purchase. Informational messages such as appointment reminders need ordinary prior express consent.
- Opt-Outs by Any Reasonable Means: since April 11, 2025, FCC rules require businesses to honor a revocation made in any reasonable way, including replies such as STOP, QUIT, END, CANCEL, UNSUBSCRIBE or REVOKE, within 10 business days. If your number cannot receive replies, your messages must say so and give another way to opt out. A rule that would make one opt-out apply to every type of message from the same business has been delayed to January 31, 2027.
- Do Not Call and Calling Hours: marketing texts count as telephone solicitations, so the National Do Not Call Registry applies unless you have the recipient’s consent, and solicitations may only be sent between 8 a.m. and 9 p.m. in the recipient’s local time.
- Penalties for Violations: recipients can sue for $500 per unlawful message, and courts can triple that to $1,500 per message for willful or knowing violations. Because damages are counted per text, class actions over a single campaign can reach millions of dollars.
2. State Telemarketing Laws
Several states have their own “mini-TCPA” laws that go further than federal rules. Florida, Oklahoma and Maryland, for example, have telephone solicitation laws with their own consent requirements and private lawsuits, and some states set narrower calling hours or limit how many messages you can send on the same topic in 24 hours. If you text customers in multiple states, follow the strictest rules that apply.
A note on the CAN-SPAM Act: CAN-SPAM governs commercial email. It does not cover ordinary text messages sent to phone numbers. A related FCC rule applies only to messages sent to wireless email addresses, which is rare for SMS marketing today, so the TCPA and state laws are the rules that matter for texting.
3. General Data Protection Regulation (GDPR) – 2018
The GDPR applies to businesses established in the EU and to businesses outside the EU that offer goods or services to, or monitor the behavior of, people in the EU. For text marketing specifically, the EU’s ePrivacy rules (and the UK’s equivalent, PECR) require prior consent, with a narrow exception for existing customers who bought similar products and were given a chance to opt out. Key GDPR requirements include:
- Explicit Consent: Businesses must obtain clear and affirmative consent before sending marketing messages.
- Consumer Data Rights: Recipients can access, modify, or delete their data upon request.
- Transparency Requirements: Businesses must clearly explain why and how they use customer phone numbers.
GDPR fines can reach €20 million or 4% of a company’s worldwide annual revenue, whichever is higher, so businesses texting EU residents should take these rules seriously.
4. California Consumer Privacy Act (CCPA, as amended by the CPRA)
The CCPA gives California residents rights over their personal data, including phone numbers. It applies to for-profit businesses that do business in California and meet at least one threshold: more than $26,625,000 in annual gross revenue (the figure set for 2025 and 2026), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning half or more of revenue from selling or sharing personal information. Covered businesses must:
- Disclose data collection practices and inform consumers how their data will be used.
- Honor requests to know, correct and delete personal information, and to opt out of the sale or sharing of it.
- Avoid using or disclosing information beyond what was disclosed when it was collected.
The CCPA does not regulate text messages themselves; consent to receive marketing texts is governed by the TCPA and state laws. But a business covered by the CCPA must handle the phone numbers it collects according to these rules.
What Do Businesses Need for SMS Compliance?
Why SMS Campaign Registration is Required
Businesses that send texts from standard 10-digit phone numbers (10DLC) for marketing, customer service or notifications must register their brand and each messaging campaign. This is a carrier requirement administered through The Campaign Registry, usually submitted by your texting platform on your behalf. It is not a law, and registering does not make your messages compliant with the TCPA by itself.
- Prevents Spam and Fraud: registration lets carriers verify who is sending messages and filter unsolicited or deceptive traffic before it reaches consumers.
- Supports Legal Compliance: carriers review your opt-in process, sample messages and privacy policy during vetting. That review encourages good practices, but meeting carrier rules and meeting the requirements of the TCPA and state laws are separate obligations.
- Protects Consumers from Unwanted Messages: carriers can suspend campaigns that send messages without consent or generate high complaint rates.
Since early 2025, U.S. carriers have blocked texts from unregistered 10DLC numbers, and carriers can charge non-compliance fees or suspend a brand that violates their policies.
Key Components of SMS Campaign Registration
To successfully register an SMS campaign, businesses must provide detailed information about their messaging practices and compliance measures.
1. Campaign Description
Businesses must submit a campaign description detailing:
- Business type (e.g., healthcare, finance, retail, education)
- Purpose of SMS messages (e.g., promotional offers, appointment reminders, customer support)
- Intended recipients (e.g., customers, employees, or both)
- Message frequency (e.g., daily, weekly, or on-demand)
- Compliance statement confirming that messages will not include unsolicited marketing unless the recipient has explicitly opted in
This transparency ensures that mobile carriers approve messages aligned with legal and industry standards.
2. SMS Opt-In Methods
Businesses must collect consent in a way they can prove later. Common methods include:
a. Verbal Opt-In
- Customers give consent during a phone call or in person.
- Verbal consent can support informational messages, but marketing texts sent with automated systems require written consent, so follow up a verbal request with a keyword or web opt-in.
b. Keyword Opt-In
- Customers text a keyword (e.g., “JOIN”) to your number after seeing clear terms describing what they will receive.
- A confirmation message must immediately follow, including:
- Business name
- Message frequency
- Opt-out instructions (e.g., “Reply STOP to unsubscribe”)
c. Written Opt-In
- Customers sign a physical or digital form agreeing to receive SMS messages.
- The form must include a clear statement explaining how their phone number will be used.
d. Web Opt-In
- Customers enter their phone numbers through an online form.
- A consent checkbox must be included (pre-checked boxes are not permitted).
- The disclosure next to the checkbox must say the customer agrees to receive marketing texts at that number, that consent is not a condition of purchase, the expected message frequency, that message and data rates may apply, and how to opt out, with links to your privacy policy and SMS terms.
Using multiple opt-in methods ensures compliance with various consumer preferences and legal requirements.
3. Privacy Policy and Terms & Conditions Updates
Businesses must update their privacy policies, terms, and conditions to reflect SMS compliance requirements. Key updates include:
- Disclosure of SMS messaging practices, specifying how phone numbers are collected, stored, and used.
- Terms outlining opt-in and opt-out processes, ensuring customers can unsubscribe at any time.
- Data-sharing policies clarify whether mobile numbers will be shared with third parties.
4. Sample SMS Messages
As part of the registration process, businesses must submit sample SMS messages for carrier approval. These messages must:
- Clearly identify the business
- Include opt-out instructions (e.g., “Reply STOP to unsubscribe”)
- Match the registered campaign description
Example SMS Message for Opt-In Confirmation:
“Thank you for signing up for [Business Name] updates! Expect 2-3 messages per month. Reply STOP to unsubscribe. Standard message & data rates apply.”
By adhering to these registration requirements, businesses can maintain SMS marketing compliance, avoid message blocking, and foster trust with their audience.
What Role Do Messaging Providers Like Bandwidth Play?
Who is Bandwidth?
Bandwidth is a leading telecommunications provider that supplies 10DLC (10-Digit Long Code) numbers for A2P (Application-to-Person) messaging. As an industry leader, Bandwidth ensures that businesses using SMS for marketing, notifications, or customer service comply with carrier regulations and avoid messaging disruptions.
Why Bandwidth Matters for SMS Compliance
-
10DLC Registration and Vetting
- Your messaging platform registers your brand and SMS campaigns with The Campaign Registry, and carriers such as Bandwidth rely on that registration to deliver your messages.
- Vetting includes your opt-in process, privacy policy and sample messages.
-
Filtering and Message Approval
- Bandwidth helps prevent spam by blocking non-compliant messages before they reach consumers.
-
Preventing Legal and Financial Consequences
- Unregistered or non-compliant campaigns face blocking, carrier fees, service interruptions or suspension.
A 10DLC Compliance Checklist
- Brand Registration: Submit accurate business details.
- Opt-In Message Requirements: Include brand name, message frequency, and opt-out instructions (e.g., “Reply STOP to unsubscribe”).
- Opt-Out Message Requirements: Send one confirmation that messages have stopped, and nothing further.
- Privacy Policy & Terms: Provide a clear link in the opt-in process.
How Should You Update Your Privacy Policy for SMS?
Why Privacy Policy Updates Are Necessary
For businesses using SMS marketing, keeping a clear and up-to-date privacy policy is essential for compliance and consumer trust. A well-structured privacy policy ensures businesses follow federal and industry regulations while protecting customer data.
-
Clarifies Data Collection and Usage Practices
- Businesses must explain why they collect phone numbers and how they will be used for SMS communications.
- Customers should know whether their data will be used strictly for business purposes or shared with third parties.
-
Specifies Opt-In and Opt-Out Procedures
- The policy should outline the process for opting into SMS messaging, whether through verbal, written, or digital consent.
- Inform customers of their right to opt out at any time and provide a simple method.
-
Ensures Transparency and Legal Protection
- A clearly stated privacy policy helps businesses comply with laws like TCPA, GDPR, and CCPA.
- Transparency reduces legal risks by demonstrating that the business follows industry best practices for consumer protection.
Example SMS Privacy Policy Language
“By providing your mobile number, you consent to receive SMS messages from [Company Name] for [specific purpose, such as appointment reminders or promotional offers]. Message frequency varies. Message and data rates may apply. Mobile information will not be shared with third parties or affiliates for marketing purposes. Reply STOP to unsubscribe or HELP for help.”
Have your attorney adapt this language to your business; carriers check that your privacy policy includes a statement like the one about not sharing mobile information.
What Are the Best Practices for SMS Compliance?
Businesses must go by carrier requirements and industry laws to conduct an SMS marketing campaign that is both successful and compliant with the law. Adopting best practices guarantees unbroken message delivery, legal protection, and customer trust.
Ensure Opt-In is Clear and Transparent
Businesses must get the receivers’ express agreement before sending SMS texts. Whether by verbal agreements, online forms, or keyword-based memberships, opt-in techniques should be made explicit. Consumers must be well aware of the frequency and content of the messages they are subscribing to.
Provide Easy Opt-Out Options
Every SMS program must make it simple to unsubscribe. Include opt-out instructions such as “Reply STOP to unsubscribe” in your first message and regularly afterwards, and treat any reasonable request to stop, even one worded in plain language, as an opt-out. Honor opt-outs within 10 business days at the latest, and sooner is better: most platforms stop messages to that number automatically.
Maintain Records of Consent
Keeping detailed records of how and when a customer opts in protects businesses from legal disputes. These records should include:
- The date and time of consent
- The method of opt-in (verbal, web form, keyword, written)
- A copy of the opt-in confirmation message
Regularly Update Privacy Policies and Terms
As regulations evolve, businesses must review and update their privacy policies to reflect any changes in SMS data collection and usage, keeping them consistent with the TCPA, state laws, carrier rules and, where they apply, the GDPR and CCPA.
Properly Register SMS Campaigns to Avoid Blocking
Mobile carriers require businesses to register their SMS campaigns through The Campaign Registry, usually via their texting platform. Registration keeps messages deliverable; unregistered traffic is blocked, and non-compliant campaigns can face carrier fees or suspension.
How Do You Stay Compliant Long Term?
Maintaining SMS compliance is crucial for businesses that use text messaging as a marketing or communication tool. Failing to follow regulations can result in fines, legal action, and message blocking, ultimately damaging a company’s reputation and customer relationships.
To stay compliant, businesses should:
- Register their SMS campaigns through their texting platform to keep messages deliverable.
- Collect the right consent for each message type: prior express written consent for marketing texts, recorded so you can prove it.
- Honor opt-outs made by any reasonable means within 10 business days, and only text during permitted hours.
- Regularly update privacy policies, terms, and conditions to reflect current compliance requirements.
By implementing these steps, businesses can protect themselves from legal risks while building trust and engagement with their audience. Texting works best as part of a first-party data strategy; see marketing in a post-cookie world, marketing automation and our restaurant email and text marketing guide. For a compliant, managed texting program, see our SMS marketing services.
