SMS Compliance Guide: TCPA, 10DLC, Quiet Hours and Opt-Outs

SMS compliance is the set of laws and carrier rules you follow to send marketing texts legally and get them delivered. For US ecommerce brands that means TCPA consent, quiet hours and opt-out rules from the FCC, state laws with stricter limits, and carrier requirements, including 10DLC, toll-free or short code registration. Australia and the UK have their own consent laws.

Get it right and nobody notices. Get it wrong and you’re looking at filtered traffic, a suspended number, or a class action priced per text. This guide covers what we set up on every SMS marketing program, with links to the primary sources as of September 2026.

---

Who sets the rules for SMS marketing

Three layers of rules apply to every marketing text sent to a US number, and they don’t always line up:

Layer	Who	What it controls	Consequence of breaking it
Federal law	FCC, under the Telephone Consumer Protection Act (TCPA)	Consent, quiet hours, opt-outs, Do Not Call	Statutory damages of $500 per violation, up to $1,500 if willful (47 U.S.C. § 227(b)(3))
State law	State legislatures (Florida, Oklahoma, Texas and others)	Stricter quiet hours, frequency caps, registration	State damages and penalties, often with private rights of action
Carrier rules	Wireless carriers, through CTIA guidelines and registries such as The Campaign Registry	Sender registration, opt-in and opt-out wording, content restrictions	Filtering, blocked messages, suspended numbers

The law decides whether you can be sued. The carriers decide whether your texts arrive. You need both.

---

Consent: prior express written consent

Under the FCC’s rules, marketing texts sent with an autodialer need prior express written consent. The definition in 47 CFR 64.1200(f)(9) requires a written agreement, signed by the person, that:

• clearly authorises the seller to send marketing messages using an autodialer or prerecorded voice,
• names the phone number the consent covers, and
• includes a clear and conspicuous disclosure that the person is authorising those messages and doesn’t have to agree as a condition of buying anything.

Electronic signatures count where federal or state law recognises them, which is what makes a checkbox, a form submission or a reply keyword workable.

In practice, almost every ecommerce SMS platform sends in a way that makes written consent the standard to design for. State laws such as Florida’s Telephone Solicitation Act define written consent to cover text messages explicitly, and carriers expect clear opt-in regardless. Treat every marketing text as needing it.

What doesn’t count as consent:

• A phone number collected for shipping updates or order confirmations.
• A pre-ticked box, or SMS consent bundled into accepting terms.
• Consent a customer gave to a different brand, or a list you bought or rented. CTIA’s Messaging Principles and Best Practices says consent isn’t transferable and rules out rented, sold or shared lists.

A note on the “one-to-one consent” rule. In 2023 the FCC adopted a rule requiring consent to be given to one seller at a time. The Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC in January 2025, and the FCC removed it from the rules in August 2025. For a brand collecting consent on its own site, the practical answer hasn’t changed: get consent for your brand, on your form.

---

Consent language: what your opt-in form should say

Your SMS sign-up (the “call to action”, in carrier terms) should put the disclosure right next to the phone field or submit button, not behind a link. Pulling together the FCC’s consent definition and CTIA’s guidance, it should cover:

1. Who is texting: your brand name.
2. What they’re signing up for: recurring marketing texts (and informational texts, if you’ll send them).
3. That texts may be sent by autodialer.
4. That consent isn’t a condition of purchase.
5. Frequency: “Msg frequency varies” or a specific number.
6. Costs: “Msg & data rates may apply”.
7. How to get help and how to stop: reply HELP for help, STOP to cancel.
8. Links to your terms and privacy policy. CTIA expects the privacy policy to be reachable from the call to action.

A working example you can adapt:

By entering your number and submitting this form, you agree to receive recurring automated marketing texts (e.g. cart reminders and offers) from [Brand] at the number provided. Consent is not a condition of purchase. Msg frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel. See our Terms and Privacy Policy.

Most ecommerce SMS platforms, including Klaviyo, provide a default disclosure you can adapt. Use it, but read it: it needs to match what you actually send.

Double opt-in. Sending a confirmation text that asks the subscriber to reply (usually Y or YES) before they’re added is best practice rather than a legal requirement in the US. It weeds out typos and fake numbers, and it gives you a clean record of consent. We use it by default.

The confirmation message. Once someone opts in to a recurring program, CTIA expects a confirmation text that names the program, says messages are recurring and how often, mentions message and data rates, and explains how to get help and opt out. For example:

[Brand]: Thanks for subscribing to texts! Msg frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel.

Keep records. CTIA’s principles list what to keep for each opt-in: the timestamp, how it was collected, a capture of the consent experience, the campaign, the IP address, the phone number and the person’s identity where known. If a consent claim is ever challenged, this is your defence.

---

Opt-out keywords and the FCC’s revocation rules

The FCC’s revocation rules (FCC 24-24, in force since April 11, 2025) changed how opt-outs work. Under 47 CFR 64.1200(a)(10) and (a)(12):

• Any reasonable method counts. Consumers can revoke consent in any reasonable way, and you can’t dictate an exclusive method.
• These words are automatically valid: stop, quit, end, revoke, opt out, cancel and unsubscribe. So is any other wording a reasonable person would read as a request to stop (“please take me off this list”, “no more texts”).
• 10 business days, maximum. Opt-outs must be honoured within a reasonable time not exceeding 10 business days. In practice your platform should process them instantly.
• One confirmation text. You may send a single confirmation after an opt-out, with no marketing in it. If it goes within five minutes, it’s presumed to be covered by the original consent.
• One-way senders must say so. If your number can’t receive replies, every text has to say that and give another way to opt out.

What’s still moving. A further piece of the rules, requiring an opt-out to apply to all of a sender’s unrelated messages, has been delayed; the FCC’s January 2026 order pushed it to January 31, 2027. In September 2026 the FCC also circulated a draft order that would loosen parts of the revocation rules, including letting senders designate an exclusive opt-out method. It hadn’t been adopted at the time of writing, so check its status before changing anything.

The carrier layer. CTIA expects senders to honour STOP and its common variants (END, CANCEL, UNSUBSCRIBE, QUIT) and to respond to HELP with the program name and how to contact you. The simplest compliant setup: treat all the FCC keywords and the CTIA keywords as opt-outs, match them even when they appear inside a longer reply, and test them all on a live number before launch.

---

Quiet hours

The federal rule, 47 CFR 64.1200(c)(1), bars telephone solicitations before 8 a.m. or after 9 p.m., local time at the recipient’s location. Section 64.1200(e) extends it to texts sent to mobile numbers.

Some states go further:

Jurisdiction	Sending window	Other limits	Source
Federal (TCPA)	8 a.m. to 9 p.m. recipient’s local time	Do Not Call Registry applies to texts	47 CFR 64.1200
Florida	8 a.m. to 8 p.m.	No more than 3 commercial solicitations per 24 hours on the same subject	Fla. Stat. § 501.616
Oklahoma	8 a.m. to 8 p.m.	No more than 3 solicitations per 24 hours on the same subject	Oklahoma Telephone Solicitation Act, HB 3168

Each state law has its own definitions and exemptions, so read them against your business before relying on one. The operational answer most brands use: a single window of 8 a.m. to 8 p.m. in the recipient’s time zone, which satisfies all three. Klaviyo’s default quiet hours are tighter still (it holds marketing texts between 8 p.m. and 11 a.m.). See our Klaviyo SMS marketing guide for how it queues messages.

Time zone is the catch. A phone number’s area code doesn’t tell you where the person is today. Use the best location data you have, and when in doubt, send in the later time zone’s window.

---

Do Not Call and state registration laws

National Do Not Call Registry. Numbers on the registry are off-limits for telephone solicitations, and the FCC confirmed in 2024 that the protection extends to texts. Having the subscriber’s prior express written consent is what lets you text a number that’s on the registry.

Florida. Beyond quiet hours, the Florida Telephone Solicitation Act (§ 501.059) gives recipients a private right of action with $500 statutory damages, trebled if willful. Before suing over texts, the recipient has to reply STOP and give the sender 15 days to stop, which is one more reason to make your opt-out handling bulletproof.

Texas. SB 140, in effect since September 1, 2025, expanded Texas’s definition of telephone solicitation to include text messages. That pulls texts into Texas’s telephone seller registration law (Business & Commerce Code ch. 302), which has exemptions that often matter for ecommerce, including messages to current or former customers from a business operating under the same name for at least two years. Check the exemptions against your program with counsel.

---

What you can’t text: SHAFT and restricted content

Carriers treat some content categories as high risk. CTIA’s Short Code Monitoring Handbook calls them SHAFT: sex, hate, alcohol, firearms and tobacco. Legal SHAFT content needs a working age gate, and content that is federally illegal gets programs shut down. In practice, many platforms and carriers restrict these categories further, and cannabis and CBD brands often find SMS unavailable entirely.

For supplement and health brands, the risk is different: claims. A 160-character text doesn’t get a lighter standard than your product page. Keep disease and treatment claims out of SMS copy entirely.

---

10DLC: what it is and how registration works

10DLC (10-digit long code) is a standard local-format US phone number used for application-to-person (A2P) business texting. US carriers require every business sending A2P traffic from a 10DLC number to register first. Unregistered 10DLC traffic is filtered or blocked.

Registration runs through The Campaign Registry (TCR), but brands can’t register directly. Your messaging provider (TCR calls them campaign service providers) submits it for you in two parts:

1. Brand registration. Your legal business name, EIN or tax ID (sole proprietors are handled separately), address, website and contact details. The details must match your official records exactly; mismatches are the most common reason registration stalls.
2. Campaign registration. Each use case you’ll send (marketing, account notifications, customer care and so on), with sample messages, your opt-in method and your opt-in, opt-out and help wording.

Brands can also pay for vetting, which carriers use to decide your sending throughput. TCR itself doesn’t approve or reject campaigns; your provider and the carriers review them.

How much 10DLC costs. TCR’s terms and fee schedule (dated October 2025) lists what it charges providers:

TCR fee	Amount
Brand registration	$4.50 one-off
Standard vetting	$41.50
Enhanced vetting	$101.50
Marketing or mixed campaign	$10 a month (initial 3-month minimum)
Low-volume mixed campaign	$1.50 a month

Providers can pass these on or add a margin, and carriers charge their own per-message fees on top. Ask your provider for their full 10DLC fee list before you register.

How long it takes. There’s no single published timeline. Review happens at your provider and the carriers, and a campaign that’s flagged for manual review takes longer. Plan for weeks, not days, and never start in November.

How to get approved first time:

• Make sure your website is live, has a privacy policy and terms, and shows the same business name as your registration.
• Show a real opt-in: a form with the full disclosure, not a bare phone field.
• Submit sample messages that match what you’ll actually send, with your brand name and opt-out wording.
• Pick the right use case. “Marketing” for promotional texts; don’t register marketing as account notifications.

10DLC vs toll-free vs short code

10DLC isn’t the only option. Many ecommerce platforms send from toll-free numbers or short codes instead:

Sender type	What it is	Registration	Best for
10DLC	Local-format 10-digit number	Brand and campaign registration through TCR	Low to mid volume; conversational texting
Toll-free	8XX number	Toll-free verification through your provider	Many ecommerce platforms’ default US sender
Short code	5 or 6 digit number	Application through the Short Code Registry and carrier approval	High-volume programs and big send days

Klaviyo, for example, starts US senders on a toll-free number with short codes as the paid upgrade, rather than 10DLC. Whichever you use, the consent and opt-out rules above are the same.

---

SMS marketing compliance in Australia

Marketing texts to Australian numbers are “commercial electronic messages” under the Spam Act 2003, enforced by the ACMA. The three core rules, per the ACMA’s guidance:

• Consent. Express consent (they opted in) or consent that can reasonably be inferred from an existing relationship. The ACMA notes inferred consent doesn’t cover sending marketing just because someone bought from you.
• Identify yourself. Every message must clearly identify the business that authorised it, with contact details valid for at least 30 days.
• A working unsubscribe. Every message needs one, honoured within five working days, without requiring a login or extra personal information. “Reply STOP” works, but only if the sender can receive replies, and the ACMA points out that alphanumeric sender IDs generally can’t.

The SMS Sender ID Register. Under the Telecommunications (SMS Sender ID Register) Industry Standard 2025, businesses registered alphanumeric sender IDs (your brand name in place of a number) through their telco or SMS provider from late 2025. Since 1 July 2026, texts from unregistered sender IDs display as “Unverified”, per the ACMA and business.gov.au. If you have an ABN, the ID has to match your business name, company name, trademark or domain. Sending from a standard phone number doesn’t need registration.

Enforcement is real. In January 2024, Outdoor Supacentre paid a $302,500 penalty after sending more than 81,000 marketing texts without consent and 1,575 to people who had unsubscribed. The ACMA’s other recent retail penalties have been for email, and one is a direct warning for SMS programs too: in March 2026 Lululemon was penalised $702,900 after order and shipping emails that contained promotions went out without an unsubscribe. Put marketing in a transactional message and it becomes a marketing message. If you’d rather have consent capture, sender ID registration and SMS flows set up for you, see our Klaviyo agency for Australian brands.

---

SMS marketing compliance in the UK

In the UK, marketing texts fall under the Privacy and Electronic Communications Regulations (PECR), which treat SMS as electronic mail. Regulation 22 requires prior consent to send marketing texts to individuals, with one exception, the soft opt-in, which applies only when all three conditions are met:

1. You got the number during a sale, or negotiations for a sale, to that person.
2. You’re only marketing your own similar products and services.
3. You gave a simple, free way to refuse when you collected the number, and in every message since.

The ICO’s guidance is the practical reference, though it notes it’s under review after the Data (Use and Access) Act 2025.

The stakes went up in 2026. Since 5 February 2026, the Data (Use and Access) Act 2025 has applied UK GDPR-level fines to PECR. For marketing breaches under regulation 22 the maximum is £17.5 million or 4% of total worldwide annual turnover, whichever is higher.

---

SMS compliance checklist for ecommerce brands

• Separate, optional SMS consent at every collection point (forms, checkout, keywords), never pre-ticked
• Full disclosure next to the field: brand, recurring automated marketing texts, not a condition of purchase, frequency, msg and data rates, HELP and STOP, terms and privacy links
• Double opt-in, and a confirmation text with program name, frequency, rates, HELP and STOP
• Consent records stored: timestamp, source, form version, IP address, phone number
• Sender registered and verified (10DLC, toll-free or short code in the US; sender ID register in Australia) before the first send
• All FCC opt-out words and CTIA keywords processed automatically, tested on a live number
• Quiet hours set to the strictest rule on your list, by recipient time zone
• Brand name in every message; opt-out reminder where your platform or country requires it
• No purchased, rented or shared lists
• No SHAFT content without an age gate; no health or disease claims in supplement texts
• Transactional and marketing texts kept separate, with no promotions inside order or shipping updates

For the channel basics, start with our SMS marketing guide. For platform choice, see the best SMS marketing platforms, and for compliant copy, our SMS marketing examples.

---

Want a second pair of eyes on your SMS compliance?

We build Klaviyo SMS programs with registration, consent capture, opt-out handling and quiet hours set up before the first text goes out. If you want your current forms, disclosures and flows checked, request a free audit.

This guide is general information, not legal advice. Laws and carrier rules change; confirm your program with a qualified lawyer in each country you send to.