SMS marketing compliance in 2026: TCPA, 10DLC and consent, explained plainly

Consent: the part that matters most

The Telephone Consumer Protection Act requires prior express written consent before sending marketing texts with an automated system. In practice that means the person typed their number into your form and agreed, in words they could read, to receive marketing texts from your business, with a note that consent isn't a condition of purchase and that message and data rates may apply. A checkbox that's pre-ticked doesn't count. A number scraped from a website doesn't count. A customer who bought something once doesn't count unless they agreed to texts.

Keep the record: what the form said, when the person submitted it, and from where. If a complaint arrives a year later, that record is your defense.

What happened to the one-to-one consent rule

In late 2023 the FCC adopted a rule requiring consent to name each specific seller, which would have ended shared lead forms. The Eleventh Circuit vacated it in January 2025 in Insurance Marketing Coalition v. FCC, and the FCC formally repealed it in July 2025. The prior standard applies: prior express written consent, clearly disclosed, to the business doing the texting. Consent captured on your own form, for your own business, was always the safe route and still is.

A2P 10DLC registration

US carriers require businesses that text from standard 10-digit numbers to register their brand and their campaign through The Campaign Registry, usually via the texting provider. Unregistered traffic is filtered or blocked. Registration takes a few days, asks what you'll send and how people opt in, and sets your daily throughput. Do it before the first send, and describe the campaign honestly, because the sample messages you submit are what the carriers expect to see.

STOP, HELP and quiet hours

• STOP (and common variants) must end messages immediately and get a single confirmation reply. Under the FCC's revocation rules, any reasonable request to stop counts, not just the keyword.
• HELP must return your business name and a way to reach you.
• Identify yourself in the first message and in any message after a gap.
• Send during reasonable hours. Federal rules restrict telemarketing calls to 8 AM to 9 PM in the recipient's time zone, and several states are stricter for texts. We keep sends between 9 AM and 7 PM local unless the customer started the conversation.
• Frequency stated at opt-in and respected afterward.

Content the carriers filter

Carrier rules block or throttle messages about cannabis, gambling, high-risk financial products and similar categories regardless of consent, and they penalize public URL shorteners, all-caps and messages that look like spam. Use your own branded short domain for links, write like a person, and keep it to one conversation per customer.

What a compliant program looks like

One thread per customer, a person's name, a reason the text exists, and the opt-out in the first message. This is the shape of the SMS programs we run.

Checklist before the first send

• Consent language on every form, reviewed by counsel
• Consent records stored with timestamp and source
• Brand and campaign registered for A2P 10DLC
• STOP, HELP and reasonable opt-out requests handled automatically
• Business name in the first message
• Sends limited to reasonable local hours
• Branded link domain, no public shorteners
• No purchased or scraped numbers, ever

FAQ

Sources

1. FCC, Telemarketing and robocalls (TCPA)
2. Womble Bond Dickinson, FCC repeals one-to-one consent rule following Eleventh Circuit decision
3. The Campaign Registry, A2P 10DLC
4. CTIA, Messaging Principles and Best Practices
5. FCC, AI-generated voices in robocalls are artificial under the TCPA