SMS marketing laws in the United States

SMS marketing laws in the United States come mainly from the Telephone Consumer Protection Act (TCPA) and the Federal Communications Commission’s rules under it: you need the person’s prior express written consent before sending marketing texts from an automated system, you must not text numbers on the National Do Not Call Registry without consent, and you must honour an opt-out such as “STOP” within 10 business days. On top of the law, the wireless carriers expect senders to follow CTIA’s messaging principles and to register business texting, which is what 10DLC registration is about.

This is a summary drawn from FCC orders, FTC guidance and CTIA’s own document. It is general information, not legal advice. TCPA claims are expensive to defend, so have a US lawyer who works on telemarketing check your consent wording before you send.

SMS marketing laws at a glance

State laws can add their own rules, so check the states you text into as well.

Why texts count as calls under the TCPA

The TCPA was written in 1991 about phone calls, but the FCC treats texts as calls. In its February 2024 order on consent (FCC 24-24), the Commission restates that it has confirmed a text message sent using an autodialer is a “call” subject to the TCPA. The same order notes that for robocalls that introduce an advertisement or contain telemarketing, the FCC’s rules require the caller to obtain the prior express written consent of the person called.

For a business, that means almost any marketing text sent from an SMS platform or CRM should be treated as needing written consent. Most platforms send automatically, which is exactly what the rules are about. Two-way texting, where staff reply from a shared inbox, is covered in our guide to two-way SMS for business.

Consent: what each type of text needs

CTIA’s Messaging Principles and Best Practices (May 2023) give a practical way to sort your texts into three groups. CTIA says the examples are not legal advice, but they line up with how carriers judge traffic.

• Conversational. The customer texts you first and you reply with relevant information. CTIA treats this as implied consent, so no further permission is expected.
• Informational. The customer gives you their number and asks to be contacted, for example for appointment reminders or alerts. CTIA expects express consent for that specific purpose, which can be given by text, on a form, on a website or verbally.
• Promotional. Any sales or marketing message. CTIA expects express written consent, such as signing a form or ticking a box online. Adding a coupon code to a reminder can move it into this group.

CTIA also says the sign-up wording, which it calls a call-to-action, should tell people the programme or product, the number or short code the texts will come from, who is sending, any fees or charges, and other terms such as how to opt out and where the privacy policy is. Opt-in details should not be buried in terms and conditions.

One more CTIA principle catches many businesses: consent is not transferable. It applies only to the sender and the campaigns it was given for, and CTIA says senders should not use opt-in lists that have been rented, sold or shared.

Do Not Call rules apply to texts

In its December 2023 order (FCC 23-107), adopted on 13 December 2023, the FCC codified that the National Do Not Call Registry’s protections apply to text messages. The same order required mobile carriers to block texts from a number after FCC notification, unless their investigation finds the texts are not illegal, and encouraged carriers to make email-to-text an opt-in service.

The registry itself is kept by the Federal Trade Commission. The FTC’s Q&A for telemarketers and sellers says data for up to five area codes is free, and that from 1 October 2026 the fee is $85 per area code after five, up to a maximum annual fee of $23,425 (US dollars). It also says lists must be synchronised with the registry at least every 31 days. That Q&A is written about the Telemarketing Sales Rule, which concerns calls, so confirm with your adviser how your texting programme uses the registry.

The cleanest approach is to rely on consent: if someone has given you prior express written consent to marketing texts, you are not relying on the registry being clear.

Opt-outs: the FCC’s 2024 rules

The FCC’s order adopted on 15 February 2024 set out how people can withdraw consent to robocalls and robotexts. It adopted rules to:

• make clear that consent can be revoked in any reasonable manner
• require callers and texters to honour do-not-call and revocation requests within a reasonable time, not exceeding 10 business days of receipt
• limit senders to a one-time text confirming the opt-out, with no marketing in it

The order lists replies that count as a reasonable way to revoke consent by text: “stop”, “quit”, “end”, “revoke”, “opt out”, “cancel” and “unsubscribe”. It also says a confirmation text sent within five minutes of the request is presumed to fall within the person’s earlier consent. The order said some of these rules would take effect only after a further review and a notice in the Federal Register, so check the current position with your adviser.

CTIA’s principles point the same way: support opt-out by text, phone or email, send one final confirmation, then stop. CTIA also asks senders to act on normal language such as “please opt me out” as well as the exact keyword.

10DLC registration: what it is and why it matters

10DLC stands for 10-digit long code, which is an ordinary local phone number used to send business texts. It is not a law. It is how US carriers manage business texting from those numbers, and most SMS platforms will ask you to register your business and each campaign (what you send, how people opt in, sample messages) before your texts are delivered at full volume.

The FCC’s own record shows how this works in practice. In the March 2023 text blocking order (FCC 23-21), comments filed with the Commission describe carriers classing business messages as business-to-consumer traffic that requires the sender to register with carrier programmes, naming The Campaign Registry as one. CTIA’s principles say individual providers may add measures such as campaign pre-approval, vetting, audits and filtering of unwanted messages.

Registration fees and approval times are set by your SMS provider and the carriers, so check your provider’s own pages. What helps approval is the same thing that keeps you within the law: a clear sign-up form, a privacy policy link, accurate sample messages and a working STOP.

Records to keep

If a complaint or claim arrives, you need to show consent. CTIA suggests keeping, where they apply:

• the date and time consent was given
• how it was given (web form, paper form, keyword text, phone)
• a copy of the wording and action used to get consent
• the campaign the consent was for
• the IP address used
• the phone number and who consented

Keep opt-outs just as carefully, and remove disconnected numbers regularly so a reassigned number does not receive texts meant for someone else. A CRM set up to store this with each contact does most of the work; CentriWeb sets up texting and follow-up automation with consent and opt-outs recorded in the CRM.

A US text marketing checklist

1. Split your texts into conversational, informational and promotional, and keep promotions out of reminders. Our guide to appointment reminder texts shows how.
2. Add an unticked consent box for marketing texts that names your business, says what you will send and how often, mentions message and data rates, and links your privacy policy.
3. Send a confirmation text after opt-in with your business name, how to get help, how to opt out and the message frequency.
4. Honour STOP and similar replies across every tool, well inside 10 business days.
5. Never text a bought, rented or shared list.
6. Register your business and campaigns for 10DLC through your provider before you launch.
7. If you also call customers, or use an AI to call them, read our guide to TCPA rules for AI calls.

If you also text people in Canada, the rules differ: see CASL compliance.