A growing online brand schedules its first big SMS campaign for 8:30 on a Saturday morning. The team is in New York, the offer is strong, and the copy is sharp. By the time the messages land, the brand has texted customers in California at 5:30am. A handful reply "who is this??" and "stop texting me". Someone forwards the replies to the marketing lead. Nobody is quite sure which of those replies count as opt-outs, or whether that early send was a problem.
SMS is the most personal marketing channel most brands have. It sits next to messages from friends and family, gets read within minutes, and can drive remarkable results. That intimacy is exactly why it is so tightly regulated, and why mistakes can be expensive: in the United States, the TCPA provides statutory damages of $500 per violation, which a court can increase to up to three times that amount for a willful or knowing violation. The good news is that the basics come down to three habits. Prove it, time it, honour it: prove you had consent, time messages to the recipient's clock, and honour opt-outs however they arrive.
This is general information for marketers, not legal advice. SMS rules differ by country and US state, courts interpret them differently, and they change. Have a qualified lawyer review your texting programme. Building the flows themselves is covered in SMS marketing automation.
The layers of rules
In the United States, SMS marketing sits under three different kinds of rules. The Telephone Consumer Protection Act and the FCC's rules under it are federal law, enforceable by regulators and through private lawsuits. State laws, sometimes called mini-TCPAs, add requirements where a particular statute applies, depending on its definitions and exemptions. Carrier rules are not legislation: the CTIA's messaging principles and each carrier's policies set operational standards, and 10DLC is the carriers' registration system for business texts from standard ten-digit numbers, not a consent law. They still decide whether your messages get delivered at all. Treat the law as the floor and carrier rules as the practical standard.
Two legal developments shape how rules are read in 2026. In January 2025, a federal appeals court struck down the FCC's planned "one-to-one" consent rule before it took effect. And in June 2025, the Supreme Court's McLaughlin decision held that courts are not bound by the FCC's interpretations of the TCPA, which means different courts may read the same rule differently. Both are good reasons to build a programme that is clearly defensible rather than one that relies on narrow readings.
Wati
WhatsApp Business API platform for team inbox, broadcasts, chatbots and automated customer conversations.
Best for: SMBs automating sales & support on WhatsApp
Prove it: consent you can show
Under the FCC's rules, prior express written consent is required for telemarketing texts sent with an autodialer or an artificial or prerecorded voice. Whether your setup is covered is a legal question, and state laws can add requirements, so treat documented written consent as the standard for every marketing text. It can be electronic, but it needs a clear and conspicuous disclosure that the person is agreeing to marketing texts at the number given and that this isn't a condition of purchase; a checked box or keyword reply isn't enough without it. Clearly name the business or businesses the consent covers. Carrier guidance also expects the sign-up to say what messages people will get and how often, that message and data rates may apply, and how to get help and opt out. Keep the evidence: the date, time, source, number and exact wording agreed to. Several years' retention is a prudent policy, not a statutory period.
Things that don't establish marketing consent on their own: a phone number on a business card, a number given only for delivery updates, or a number collected by a partner for its own purposes. Buying a list doesn't by itself prove valid consent either; you would need to verify the original disclosure, what it permitted, and whether your intended use is covered. Keep transactional messages, such as delivery updates, separate from marketing ones, and don't slip promotions into them. A consented SMS list is one of the most valuable forms of first-party data a brand can own, which is another reason to build it properly. The patterns for clear, completable consent flows are in building a consent-based data collection flow, and your privacy policy should match what you actually do, as covered in writing a privacy policy marketers can follow.
| Requirement | What it means in practice | Habit |
|---|---|---|
| Written consent | Law for covered autodialed marketing; good practice for all, with records | Prove it |
| Sign-up disclosure | Legal consent disclosure; carrier guidance also covers message type, frequency, rates, help and opt-out instructions. | Prove it |
| Sender identity | Carrier rules, good practice: say who you are | Prove it |
| Quiet hours | Federal limit on telephone solicitations, disputed for opted-in texts; a conservative guideline | Time it |
| Opt-out by any reasonable method | Law (covered robotexts): not just STOP; emails, calls | Honour it |
| Opt-out speed | Law: within a reasonable time; 10 business days at most | Honour it |
| 10DLC registration | Carrier requirement: register brand and campaigns | Prove it |
Time it: the recipient's clock, not yours
Federal rules bar telephone solicitations before 8am or after 9pm in the recipient's local time, and this window is widely applied to marketing texts. Courts have disagreed about exactly when it applies to messages people opted in to, but that's an argument to have in court, not a plan: treat 8am–9pm as a conservative guideline. State laws can impose stricter restrictions, and whether they cover a given text depends on each statute's definitions and exemptions. Florida's telephone solicitation law, for example, counts texts as sales calls, while its separate 8pm hours rule needs careful interpretation. Check with counsel which apply to your texts. The trap is scheduling by your own clock.
A brand in New York sends to a hypothetical list of 100,000 US subscribers at 8:30am Eastern. Assume this split by time zone, an illustration rather than a measured national distribution:
→ Eastern (47%): 8:30am, inside the window
→ Central (29%): 7:30am, too early
→ Mountain (7%): 6:30am, too early
→ Pacific (17%): 5:30am, too early
About 53,000 people, 53% of this hypothetical list, receive a marketing text before 8am their time.
The evening trap works the other way: a text at 8:30pm Eastern is inside the federal window but after the 8pm limit some states set, such as Florida's, where that limit applies to your texts.
The fix: schedule by each recipient's local time, apply the strictest restriction that clearly applies to your audience, and default to a conservative window when time zone is unknown.
Three habits Prove it, time it, honour it. Prove you had consent, time every message to the recipient's clock, and honour opt-outs however they arrive. Nearly every expensive SMS mistake breaks one of the three.
Honour it: opt-outs, however they arrive
This is where US rules changed most recently. Since 11 April 2025, the FCC's consent revocation rules have required senders of robocalls and robotexts covered by the TCPA to accept a request to stop through any reasonable method, not only a keyword, and to honour it within a reasonable time and no later than 10 business days. Words such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE count as clear revocations, but so can "please stop texting me", an email to your support team, or a request on a phone call. A "wrong number" reply isn't automatically a legal revocation, but treat it as a signal to check the consent record and suppress the number while you do. For marketing texts, you can't insist that people use one specific method.
You may send one confirmation text that only confirms the opt-out and contains no marketing; sending it within five minutes keeps it within the rule's presumption. In practice, automated systems should suppress numbers immediately rather than using the full 10 days, and opt-outs must reach every system that sends texts, including other brands or teams in your group and any agency sending on your behalf.
Update, effective 25 November 2026: a new FCC rule published on 26 October 2026 lets senders limit an opt-out from an informational robocall or robotext to that category, and designate clearly disclosed exclusive opt-out methods for informational messages. It revises the cross-topic provision previously delayed to 31 January 2027. It expressly doesn't change opt-out methods for messages that contain advertising or constitute telemarketing, so marketing texts must still accept any reasonable method; STOP can't be the only option.
Back to the Saturday morning replies: "stop texting me" is almost certainly an opt-out, and "who is this??" is a strong signal that your sender identity or consent trail needs work. Train your team and your tools to treat ambiguous messages cautiously. The same thinking applies to coordinating SMS with other channels, covered in orchestrating SMS and email together.
Get delivered: 10DLC and carrier rules
US carriers require businesses texting from standard ten-digit numbers to register their brand and each campaign through the 10DLC system, describing the message types, how consent is collected, and sample content. Unregistered or mismatched traffic may be filtered or blocked. Carrier rules also restrict some content categories, often summarised as SHAFT (sex, hate, alcohol, firearms and tobacco), which need extra care or age gating; which categories are restricted, and how strictly, varies by carrier and provider. Keep registration details accurate as your messaging evolves; a campaign registered as "order updates" that starts sending promotions is a delivery risk as well as a compliance one.
Outside the US: the essentials
In the UK, PECR requires consent for marketing texts to individuals, with a limited "soft opt-in" for your own existing customers about similar products or services, if you offered an easy opt-out when collecting their details and in every message. It doesn't cover bought lists or prospects, and corporate subscribers follow different rules. In the EU, Member States implement the ePrivacy Directive in national law, so details differ; see GDPR and CCPA for marketers. Canada's CASL covers commercial texts and requires express consent, or implied consent only in specific circumstances, plus sender identification and a working unsubscribe. In India, TRAI's rules require principal-entity registration on DLT, registered headers, content and consent templates, and respect for customer preferences, with different rules for promotional and service messages. The DPDP Act's core notice and consent provisions are due to take effect on 13 May 2027 and complement TRAI's rules, as covered in India's DPDP Rules at one year. Within the US, keep an eye on state privacy laws too, as covered in US state privacy laws in 2026.
A simple operating routine
Compliance lasts when it's built into how messages are sent, not checked once. Capture consent with a clear disclosure and store the evidence. Register campaigns accurately. Schedule by recipient local time with the strictest window that clearly applies. Detect opt-out intent beyond keywords and suppress immediately across every system. Send only one plain confirmation. Keep consent and suppression records for several years as a prudent policy, following data retention and deletion principles. Clean out long-inactive subscribers rather than messaging them forever, using re-engagement automation carefully. And watch the cost of getting it wrong, a trend covered in data privacy fines are rising in 2026. Brands that want SMS programmes built with compliance designed in often work with a specialist email and SMS automation team.
The short version
SMS is personal, powerful and tightly regulated: in the US, the TCPA provides statutory damages of $500 per violation, which a court can treble for willful or knowing violations. The basics come down to three habits: prove it, time it, honour it. Prove it: get prior express written consent, required federally for covered autodialed or prerecorded marketing texts and the sensible standard for all, with a disclosure meeting legal and carrier requirements, keep consent evidence for several years as a prudent policy, keep transactional and marketing messages separate, identify yourself, and register campaigns through 10DLC, a carrier requirement. Time it: treat 8am to 9pm in the recipient's local time as a conservative guideline, check whether stricter state limits apply to your texts, and schedule by recipient time zone, since in our hypothetical list an 8:30am Eastern send reaches about half the subscribers before 8am. Honour it: since April 2025, covered marketing texts must accept opt-outs by any reasonable method within 10 business days, with only one non-marketing confirmation; the November 2026 rule changes informational opt-outs, not marketing ones. Outside the US, follow PECR in the UK, national ePrivacy rules in the EU, CASL in Canada and TRAI rules in India, with DPDP obligations due from May 2027.
Want SMS that performs and stays compliant?
We build SMS programmes with consent, timing and opt-outs designed in.
Explore Email and SMS Automation →Frequently asked questions
Do you need consent to send marketing text messages?
In most major markets, yes, though the legal basis varies. In the United States, FCC rules under the Telephone Consumer Protection Act require prior express written consent for telemarketing texts sent with an autodialer or an artificial or prerecorded voice, and state laws can add requirements, so documented written consent is the sensible standard. It can be electronic but needs a clear disclosure that the person is agreeing to marketing texts at that number and that consent isn't a condition of purchase, and it should name the business or businesses covered. Carrier guidance also expects sign-up disclosures about message type, frequency and how to opt out. In the UK, PECR requires consent for marketing texts to individuals, with a limited soft opt-in for a sender's own existing customers; EU rules vary by Member State. Canada's CASL requires express or, in limited cases, implied consent. In India, commercial messages must follow TRAI's registration and consent rules. This is general information, not legal advice.
What are SMS quiet hours?
Quiet hours are times when marketing messages should not be sent. In the United States, federal rules restrict telephone solicitations to between 8am and 9pm in the recipient's local time, and this window is widely applied to marketing texts, although courts have disagreed about exactly when it applies to messages people have opted in to receive. State laws can impose stricter restrictions, but whether a particular state rule covers your texts depends on its definitions and exemptions, so check with counsel. Because the rules follow the recipient's local time, a campaign scheduled by the sender's clock can easily breach them for people in other time zones. The safest approach is to schedule by each recipient's local time, apply the strictest restriction that clearly applies to your audience, and avoid sending marketing texts early in the morning or late in the evening. This is general information, not legal advice.
How quickly must you honour an SMS opt-out?
As quickly as possible. In the United States, the FCC's consent revocation rules, in effect since 11 April 2025, require senders of robocalls and robotexts covered by the TCPA to accept revocations made by any reasonable method, not only standard keywords, and to honour them within a reasonable time and no later than 10 business days. Words such as stop, quit, end, revoke, opt out, cancel and unsubscribe are treated as clear revocations, but so can phrases like 'please stop texting me', or requests made by email, phone or through a website. Senders may send a single confirmation text, which must not contain marketing content. Best practice is to suppress numbers immediately in automated systems rather than relying on the full period. A further FCC rule, effective 25 November 2026, lets senders limit opt-outs from informational messages to that category and designate exclusive opt-out methods for them, but it does not change the opt-out methods for marketing or telemarketing texts. This is general information, not legal advice.
What is 10DLC registration?
10DLC registration is the process US mobile carriers require for businesses sending application-to-person text messages from standard ten-digit phone numbers. Through a central registry, businesses register their brand and each messaging campaign, describing the type of messages, how consent is collected, and sample content. Carriers use this information to verify senders and reduce spam, and unregistered or mismatched traffic may be filtered, blocked or charged additional fees. Registration also affects how many messages a business can send and how reliably they are delivered. Most SMS platforms guide customers through the process, but it is the business's responsibility to describe its campaigns accurately and keep registration details up to date as its messaging changes. It is a carrier requirement, not a consent law. Toll-free numbers and short codes have their own verification processes. Other countries have comparable systems, such as India's DLT registration for sender IDs and message templates. This is general information, not legal advice.
