A Complete Guide to SMS Compliance: TCPA, CTIA, and Carrier Rules

Why SMS Compliance Matters in 2025

Text messaging is one of the most effective communication tools—but with great power comes strict regulation. If your business sends SMS to U.S. consumers, you must comply with federal laws, carrier guidelines, and industry best practices. Failing to follow SMS compliance can lead to message blocking, legal fines, or loss of service.

This guide explains the three key pillars of SMS compliance:
TCPA (Telephone Consumer Protection Act)
CTIA Guidelines
Carrier Rules (10DLC, Toll-Free, Short Code)

1. TCPA – The Federal Law

The TCPA is a U.S. law that governs all automated messaging to mobile numbers. It applies to any Application-to-Person (A2P) messaging—whether for marketing, transactional, or informational purposes.

Key TCPA Rules:

• Prior Express Consent is Required
  You must get clear permission before sending texts.
• Consent Must Be Documented
  Keep proof of opt-in (e.g., web form submission, keyword opt-in).
• Opt-Out Option is Mandatory
  Every message must include instructions to stop (e.g., “Reply STOP to opt out”).
• Quiet Hours Apply
  Avoid sending messages before 8 a.m. or after 9 p.m. in the recipient’s time zone.

2. CTIA – Industry Guidelines

The CTIA (Cellular Telecommunications Industry Association) is a trade group that sets best practice standards for messaging. Carriers use CTIA’s Messaging Principles and Best Practices to decide what’s acceptable.

CTIA Requirements Include:

• Honest Message Content – No misleading claims, phishing, or scams.
• Consent-Based Marketing – Clear opt-ins for every campaign.
• Content Classification – Properly labeling messages (e.g., promotional vs. informational).
• Campaign Vetting – Brand and campaign approval via The Campaign Registry (TCR).

Non-compliant messages may be filtered, blocked, or reported. 3. Carrier Rules – 10DLC, Toll-Free & Short Code

Mobile carriers (like Verizon, AT&T, T-Mobile) have their own messaging rules depending on the channel you use:

10DLC Compliance:

• Brand and campaign registration required (via TCR)
• Use case approval (e.g., OTP, alerts, marketing)
• Daily throughput tied to vetting score

Toll-Free SMS Compliance:

• Requires verification form submission
• Best for alerts, customer support, marketing
• Blocked if unverified (especially post-2024 enforcement)

Short Code Compliance:

• Carrier vetting required
• Used for high-volume, high-speed messaging
• Messages must follow CTIA standards

Common Mistakes That Get SMS Blocked

• Using shared short codes (now prohibited)
• Sending without opt-in
• Sending SHAFT content (Sex, Hate, Alcohol, Firearms, Tobacco)
• Ignoring STOP/HELP keyword handling
• Using URL shorteners with poor reputation

How to Stay Compliant (Best Practices)

1. Always Collect Explicit Consent
   Use double opt-in for added protection.
2. Use Proper Opt-In Language
   Example: “By subscribing, you agree to receive marketing texts. Msg & data rates may apply. Reply STOP to cancel.”
3. Register Your Campaigns
   For 10DLC or Toll-Free, use a provider that registers you with TCR.
4. Honor Opt-Outs Immediately
   Don’t send after a user replies STOP.
5. Work with a Trusted Messaging Provider
   They’ll help handle vetting, registration, and compliance monitoring.