SMS compliance is more carrier-enforced than regulator-enforced, and the enforcement is fast. A single bad campaign can get a brand blocked across all major carriers in hours. The rules are not negotiable.
SMS compliance is the set of legal and carrier rules that govern how a business sends text messages. In the US, it covers TCPA (requiring express written consent before marketing SMS), A2P 10DLC (requiring brand and campaign registration with carriers), mandatory STOP and HELP keyword handling, and TCPA quiet-hour restrictions (no marketing SMS between 9pm and 8am recipient time). Non-compliance leads to fines up to $1500 per unauthorized message and carrier blocking of the brand.
Six things to understand about SMS compliance: consent, registration, keyword handling, quiet hours, record-keeping, and the consequences of getting it wrong.
US TCPA requires express written consent before any marketing SMS. The disclosure must identify the sender, state message frequency, mention costs, and include opt-out instructions. "Reply STOP to opt out" must be in the disclosure or the first message. Written means recordable, not pen-on-paper: a web form or keyword text qualifies.
US carriers require every brand sending application-to-person SMS to register the brand (identity verification) and each campaign (use case, consent language, sample messages). Unregistered brands run at punitive throughput ceilings and face carrier filtering. Registration takes 1 to 2 weeks and is handled by the messaging platform.
Every SMS program must honor STOP (and variants: UNSUBSCRIBE, QUIT, CANCEL, END, OPTOUT, STOPALL, ARRET, REVOCAR) by immediately removing the contact and sending one confirmation message. HELP (and INFO, AIDE) must return a brand identifier and contact info. Strkr Messaging enforces this automatically on every send.
TCPA restricts marketing SMS to 8am to 9pm in the recipient time zone. Transactional messages (OTP, order updates) are exempt. State-level laws (Florida Mini-TCPA) are stricter in some cases. Platforms respect quiet hours on scheduled sends automatically.
For every contact, keep the consent event: timestamp, source (form URL, keyword text, API call), exact disclosure text shown, and a record of the opt-in action. In disputes (TCPA class action, carrier audit), the business must produce this evidence. A CRM that stores consent context per contact is the baseline.
TCPA class actions can seek $500 to $1500 per unauthorized message. Carrier violations lead to brand throughput reduction or complete blocking across all major carriers. Both happen fast. The cost of compliance is tiny compared to a single TCPA settlement.
The Telephone Consumer Protection Act (TCPA) is the US federal law that governs SMS to consumers. It predates smartphones but has been extended through FCC rulings. The requirements below are the parts that matter for every SMS program.
Marketing SMS requires express written consent. The disclosure must identify the sender, state message frequency ("up to 10 msgs/mo"), mention that message and data rates apply, and include opt-out instructions. Pre-checked boxes, buried disclosures, and inferred consent do not qualify under TCPA.
Non-marketing transactional messages (order confirmations, OTP, delivery updates) require prior express consent, which is a lower bar than express written consent. If the consumer provided the number for the purpose, consent is implied. The disclosure requirements are lighter.
A STOP keyword (or any variant) revokes consent for all marketing SMS from the sender. The system must remove the contact from marketing lists and never send marketing SMS to that number again. One confirmation message is allowed. Any further marketing SMS violates TCPA.
TCPA restricts marketing calls and texts to 8am to 9pm local time of the recipient. Scheduled campaigns must respect the recipient time zone, not the sender time zone. A nationwide campaign scheduled at 10pm Eastern can only reach contacts in later time zones. Transactional messages are not subject to quiet hours.
Messages sent through automated systems (which most SMS platforms are) historically triggered stricter consent rules. The 2021 Supreme Court ruling (Facebook v Duguid) narrowed what counts as an autodialer, but prudent programs still get express written consent for anything that could qualify.
Several states (Florida, Washington, Oklahoma) have enacted mini-TCPA laws with stricter consent and private-right-of-action provisions. National programs often adopt the strictest state standard as a baseline. Attorney general enforcement in these states has increased since 2022.
A2P 10DLC is the carrier framework for application-to-person SMS on 10-digit long codes. It is enforced by US carriers (not the FCC) and sits on top of TCPA. Every US business sending SMS must comply or face throughput reduction and filtering.
Each business registers its brand with The Campaign Registry (TCR), including legal name, EIN, website, and primary contact. Carriers assign a trust score (low, medium, high) based on verification. The score affects throughput ceilings and campaign filtering.
A brand can run multiple campaigns, each with a declared use case (marketing, 2FA, notifications, mixed). Each campaign includes the opt-in flow, sample messages, and expected volume. Marketing campaigns face more scrutiny than 2FA campaigns and get lower throughput ceilings.
10 MPS at the floor. 40 to 75 MPS at medium trust. 150 to 300+ MPS at top tier. Marketing use cases cap lower than 2FA. Pools of numbers scale horizontally. See the SMS throughput answer for the full tier breakdown.
Toll-free numbers (TFN) use a separate verification path. Once verified, TFN carries a 3 MPS throughput ceiling with excellent deliverability for transactional messaging. TFN is preferred for 2FA, OTP, and support use cases. Verification takes 2 to 4 weeks.
The rules are not complicated. Translating them into a working program takes six practical steps that mature programs follow.
Every opt-in form has a disclosure that identifies the sender, states message frequency, mentions costs, and includes STOP instructions. The disclosure appears above or next to the submit button, not buried in a footer. "By entering your number you agree to marketing texts from Acme at up to 10 msgs/mo. Reply STOP to opt out."
For every opted-in contact, store the consent event in the CRM. Timestamp, source URL or keyword, exact disclosure shown, and the opt-in action. Strkr Messaging stores this per-contact and per-message so disputes have evidence to point to.
The platform must detect STOP (and variants) and HELP (and variants) on every inbound message, remove the contact immediately, send the single allowed confirmation, and never send marketing again. Hand-rolled keyword logic breaks when a variant arrives. Platforms handle it.
The CRM stores recipient time zone (or inferred from phone number area code or address). Scheduled campaigns pause outside the 8am to 9pm window per contact. Transactional messages (OTP, order updates) can send outside quiet hours.
Marketing SMS and transactional SMS run on different campaigns (and often different numbers) because the rules differ. Mixing them pulls transactional into stricter marketing rules and reduces throughput. Separate campaigns is cleaner and faster.
Opt-out rate above 2 percent is a signal of bad targeting. Complaint rate above 0.1 percent is a signal of carrier filtering risk. Alerts on both let the program adjust before carriers reduce throughput or block the brand.
Strkr Messaging ships A2P 10DLC registration, STOP and HELP keyword enforcement, quiet-hour scheduling, and per-contact consent context. SMS is 2 cents per segment, MMS is 5 cents per message, and brand registration is included.
SMS compliance is the set of legal and carrier rules governing text message sending. In the US, it covers TCPA (consent and opt-out rules), A2P 10DLC (carrier registration and throughput tiers), mandatory STOP and HELP keyword handling, and quiet-hour restrictions. Non-compliance leads to fines and carrier blocking.
The Telephone Consumer Protection Act (TCPA) is the US federal law governing SMS and voice calls to consumers. Key requirements: express written consent before marketing SMS, immediate opt-out on STOP, and marketing SMS only between 8am and 9pm recipient time. TCPA class actions can seek $500 to $1500 per unauthorized message.
A2P 10DLC is the US carrier framework for application-to-person SMS on 10-digit long codes. Brands register with The Campaign Registry (identity verification). Each use case is registered as a separate campaign. Carriers assign throughput tiers based on brand trust score and campaign type.
STOP, UNSUBSCRIBE, QUIT, CANCEL, END, OPTOUT, STOPALL, ARRET, and REVOCAR must all trigger immediate opt-out. HELP, INFO, and AIDE must return a brand identifier and contact info. These are enforced by every US carrier and must be handled on inbound SMS, not just advertised.
For transactional messages (OTP, order confirmations), yes. For marketing SMS, no. TCPA restricts marketing SMS to 8am to 9pm in the recipient time zone. Scheduled campaigns must respect each recipient time zone, not the sender time zone. Platforms enforce this automatically on scheduled sends.
TCPA class actions can seek $500 to $1500 per unauthorized message. Carrier violations lead to brand throughput reduction or complete blocking across all major US carriers. Enforcement is fast: a single bad campaign can get a brand filtered within hours. The cost of compliance is tiny compared to a single settlement.
Yes. Strkr Messaging handles A2P 10DLC brand and campaign registration, enforces STOP and HELP keyword variants automatically, respects quiet hours on scheduled sends, and stores per-contact consent context so disputes have evidence. SMS is 2 cents per segment and MMS is 5 cents per message.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
