SMS Marketing Compliance Guide: TCPA, 10DLC and Opt-In Rules

SMS marketing can drive serious revenue, but compliance decides whether you scale safely or get blocked. Moreover, carriers filter aggressively, and regulators keep tightening expectations. Therefore, if you want sustainable results, you need a compliance system—not just good copy.

This guide breaks down the three pillars that matter most for day-to-day SMS marketing: TCPA basics, 10DLC registration, and opt-in/opt-out rules. Additionally, you’ll get practical templates, workflow tips, and a clean checklist you can hand to your team.

Quick Disclaimer And How To Use This Guide

This content provides general information, not legal advice. However, you can use it as a practical operating guide. Then, if you run a regulated program or manage high volume, you should review your exact setup with qualified counsel.

Now, let’s start with the rule set that shapes most U.S. SMS marketing decisions.

TCPA Basics For SMS Marketers

The Telephone Consumer Protection Act (TCPA) sets the core standard for many marketing texts in the U.S. In practice, the TCPA focuses on consent and how you contact consumers, especially when you use automated systems.

So, what do marketers need to know first? Consent drives everything. If you collect consent properly and honor opt-outs quickly, you reduce risk dramatically. Conversely, if you buy questionable lists or hide disclosures, you create the kind of evidence plaintiffs love.

Prior Express Written Consent In Plain English

For many marketing texts sent via automation, marketers typically rely on “prior express written consent.” That usually means:

• The person clearly agreed to receive marketing texts from your brand
• The agreement happened before you sent marketing messages
• The person saw clear disclosures at the time of opt-in
• You can prove what they saw and what they did

Additionally, consent should stay brand-specific. That concept matters even more when you work with lead generators.

The “One-To-One Consent” Rule Update You Need To Know

A few years ago, the FCC adopted a “one-to-one” consent approach to close the “lead generator loophole.” However, the situation changed. The Eleventh Circuit vacated that rule, and later the FCC removed the one-to-one consent rule from its regulations after the court decision.

Even though the one-to-one requirement no longer applies as a binding FCC rule, you should still treat brand-specific consent as a best practice. Therefore, avoid “network partner” disclosures that obscure dozens of sellers behind a single checkbox. Instead, collect consent for your brand clearly and directly.

Now that TCPA sets the consent foundation, carriers add their own enforcement layer through 10DLC.

10DLC Explained: Why Registration Impacts Deliverability

10DLC stands for “10-digit long code.” It’s the standard-looking phone number used for A2P (application-to-person) business messaging in the U.S. Carriers created the 10DLC ecosystem to reduce spam and improve transparency. They expect brands to register their identity and the use case of their message.

So, even if you feel confident about TCPA consent, you can still lose performance if you skip 10DLC registration. In other words, legality alone won’t guarantee inboxing.

What The Campaign Registry Does

The Campaign Registry (TCR) supports brand and campaign registration in the 10DLC ecosystem. Additionally, many messaging providers handle the registration steps inside their dashboards or onboarding flows.

Because carriers use registration to evaluate and manage messaging traffic, registration helps you avoid filtering and throughput limits that can crush campaign performance.

Brand Registration Vs Campaign Registration

Think of 10DLC registration in two layers:

• Brand registration: who you are (legal entity, tax ID, and related details)
• Campaign registration: what you send (use case, sample messages, and opt-in flow)

If your campaign details don’t match your real-world behavior, reviewers can reject your registration or suspend traffic. Therefore, you should keep your campaign description, sample messages, and actual sends aligned.

Providers often publish clear approval requirements and common rejection reasons, such as missing opt-in proof, inconsistent brand details, or unclear message flow.

Now let’s connect 10DLC and TCPA to what marketers touch daily: opt-in, disclosures, and keyword handling.

Opt-In Rules That Keep You Safe And Keep Subscribers Happy

Opt-in is not just a form field. Instead, opt-in is a moment of clarity. If subscribers understand what they’ll receive, they stay longer and complain less. Consequently, compliance and retention go hand in hand.

Use a simple principle: match expectations to reality. If you plan to send three promos per week, say that. If you plan to send only restock alerts, say that too.

What Your Opt-In Disclosure Should Include

A strong opt-in disclosure typically covers:

• Your brand name (clearly visible near the phone field)
• The type of messages (marketing, promotions, alerts, or a mix)
• Expected frequency (a range works well)
• “Msg & data rates may apply” (commonly used in U.S. programs)
• How to get help (HELP) and how to stop (STOP)
• Links to Terms and Privacy Policy when applicable
• A statement that consent is not a condition of purchase (commonly used for marketing consent language)

Additionally, avoid tiny gray text. If people can’t read it, you can’t rely on it.

Single Opt-In Vs Double Opt-In

Single opt-in can grow faster, while double opt-in improves list quality. Therefore, many brands use double opt-in for aggressive acquisition sources (such as giveaways) and single opt-in for high-intent sources (such as checkout).

If you choose double opt-in, keep it simple:

• “Reply YES to confirm.”
• Then send a confirmation message that repeats key disclosures.

Even better, store both steps. That record helps you prove consent later.

Now let’s cover the part almost every brand gets wrong at some point: STOP and HELP.

STOP And HELP: Opt-Out Handling That Actually Works

Opt-out handling is not optional. If someone says STOP, they want out now, not later.

CTIA’s Messaging Principles and Best Practices emphasize consumer protection and clear opt-out expectations across the messaging ecosystem.

Meanwhile, many 10DLC registration processes explicitly require you to define opt-in, opt-out, and help keywords and messages.

Practical Keyword Rules To Follow

To keep things clean and predictable:

• Treat STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT as opt-outs
• Respond once to confirm opt-out, then stop marketing messages
• Treat HELP as a request for support details (brand name, contact method, and how to opt out)
• Log every keyword event and the timestamp

Also, don’t fight the opt-out. If someone opts out, let them go gracefully. Consequently, you reduce complaints and protect deliverability.

Now that your opt-in and opt-out rules are clear, you need operational controls that prevent accidental noncompliance.

Operational Compliance Controls That Prevent Mistakes

Most compliance failures happen through process drift. For example, a new pop-up launches with missing disclosures, or an agency starts texting a segment built from an old upload. Therefore, you need guardrails in your workflow.

Frequency Caps And Quiet Hours

Start with two basic controls:

• Quiet hours by timezone (so you don’t text people at unreasonable times)
• Frequency caps per subscriber (so you don’t cause fatigue and opt-outs)

Even when the law allows certain messages, your customers still judge the experience. So, treat these as both deliverability and trust tools.

Flow Collision Rules

If you run multiple automations, messages can collide. For example, a customer might receive a cart reminder and a promo in the same hour. That feels spammy, so opt-outs rise.

Therefore, build collision rules such as:

• “No more than one marketing message per X hours”
• “Suppress promos for X days after purchase.”
• “Pause marketing during open support cases”

Additionally, build a “global suppression” segment for anyone who opts out, complains, or hard-bounces.

Now let’s talk about the most underrated compliance skill: recordkeeping.

Recordkeeping: The Evidence That Saves You

When disputes happen, the winner usually has better records. Therefore, you should store proof in a way your team can retrieve quickly.

What To Store For Each Subscriber

At minimum, store:

• Phone number and customer identifier
• Opt-in source (page, keyword, QR, checkout, etc.)
• Timestamp of opt-in and the IP/device if collected
• The exact disclosure text shown at opt-in (versioned if it changes)
• Message history (sends, deliveries, replies)
• Opt-out timestamp and keyword used
• Any preference selections (topics, frequency, categories)

Additionally, store your campaign registration details and sample messages used in 10DLC onboarding. Then, if a provider asks for proof, you can respond fast.

Now that you have the building blocks, let’s translate everything into a simple “do this before you send” system.

A Practical Pre-Launch Compliance Checklist

Use this checklist before you launch any new SMS program or automation.

Consent And Disclosure Checklist

• Disclosure shows the brand name near the phone field
• Disclosure states marketing intent clearly
• Frequency range matches your actual plan
• Terms and Privacy links work and load on mobile
• Consent language does not hide behind pre-checked boxes
• Consent record stores timestamp, source, and disclosure version

Messaging Behavior Checklist

• STOP opt-out works instantly across all flows
• HELP response works and includes contact info
• Quiet hours match your customer base’s time zones
• Frequency caps prevent message fatigue
• Collision rules prevent overlapping flows
• Segments exclude anyone without valid consent

10DLC Checklist

• Brand registration matches legal business details
• Campaign use case matches your real message content
• Sample messages match what you will actually send
• Opt-in flow proof is available if reviewers request it
• Opt-out and HELP messages are defined as required by onboarding

Many providers publish campaign approval requirements and rejections that map directly to these checklist items so that you can use them as a validation guide during setup.

Now let’s close with a practical mindset that keeps compliance from slowing growth.

Final Thoughts

SMS compliance doesn’t have to feel like red tape. Instead, it can become your competitive advantage. When you collect clean consent, handle STOP and HELP correctly, and register 10DLC campaigns accurately, you protect both deliverability and customer trust.

So, keep your system simple: get consent right, document it, register your campaigns, and control frequency. Then, when you scale, your program won’t collapse under filtering, complaints, or legal risk.