SMS Compliance: 10DLC, TCPA and Consent Requirements

The rule, in brief: A compliant business texting program in the United States rests on five obligations: obtain and document consent before the first message, register your brand and campaigns through The Campaign Registry before sending, honor every opt-out request within a reasonable time not to exceed ten business days, respect federal and state calling hours, and retain consent and message records for five years.

Current as of August 2026.

This page is the starting point for organizations that need to run a text messaging program legally, not a definition of the acronyms. It sets out what your organization actually has to do, in the order you have to do it, and points to the detailed guide for each step. FRANSiS™ handles the registration and consent mechanics for its customers, so most of this becomes configuration rather than a project.

Talk to the FRANSiS team about your compliance setup →  |  See plans and pricing

The five obligations of a compliant texting program

Federal law, FCC rules, FTC rules and carrier policy stack on top of each other. Nothing below is optional for an organization sending application-to-person messages to United States mobile numbers.

1. Consent, obtained and documented before the first message

Consent is the foundation, and the standard that applies depends on what you are sending. Informational and transactional messages, such as an appointment reminder or a service notice, generally require prior express consent. Marketing and promotional messages sent with an autodialer or prerecorded voice require the higher standard of prior express written consent.

The FCC defines prior express written consent at 47 CFR 64.1200(f)(9) as an agreement in writing, bearing the signature of the person called, that clearly authorizes the sender to deliver advertisements or telemarketing messages and identifies the telephone number to which they may be delivered. The written agreement must carry a clear and conspicuous disclosure that the person is authorizing those messages and that signing is not a condition of purchasing any property, goods or services. An electronic or digital signature counts where it is valid under federal or state contract law.

In practice this means your opt-in form, your keyword opt-in flow and your paper intake sheet all need to capture and store the same four things: who consented, what they consented to receive, when, and from what source. Verbal consent noted in a staff member's memory is not a record.

Detail: express consent versus express written consent · opt-in and opt-out requirements · double opt-in · consent form template · opt-in form best practices

2. 10DLC brand and campaign registration through The Campaign Registry

Consent satisfies the law. Registration is what makes carriers actually deliver the message. United States wireless carriers require every organization sending application-to-person traffic from a standard ten-digit number to register through The Campaign Registry. Registration has two layers: a brand record identifying your organization, and a campaign record describing each use case you intend to send, along with sample messages and your opt-in language.

Unregistered or misregistered traffic does not bounce with a helpful error. It is filtered, throttled or silently dropped, which is why organizations often discover a registration problem weeks later through a delivery report rather than a rejection notice. Carriers evaluate the brand and campaign against the consent and content standards in the CTIA Messaging Principles and Best Practices, so a campaign whose stated opt-in flow does not match the one on your website is a common cause of rejection.

Detail: what A2P 10DLC is · The Campaign Registry explained · the 10DLC registration guide · how long registration takes · why campaigns get rejected · what the fees cover · trust score · 10DLC versus short code versus toll-free

3. Opt-out handling that works the way the rule says

Under 47 CFR 64.1200(a)(10), a called party may revoke consent using any reasonable method. Replying to a text with stop, quit, end, revoke, opt out, cancel or unsubscribe is reasonable per se, and once used, consent is definitively revoked. If a reply uses different words, the sender must still treat it as a valid revocation where a reasonable person would understand it that way. All revocation requests made in any reasonable manner must be honored within a reasonable time not to exceed ten business days from receipt, and a sender may not designate an exclusive means of revoking consent.

Three operational consequences follow. Opt-out must be processed automatically rather than by a staff member reading an inbox. Free-text replies such as "please take me off this list" have to route to a human or to logic that recognizes them. And your website form, phone line and email must all be able to receive a revocation, because you cannot force people through the keyword.

Separately, 47 CFR 64.1200(d) requires organizations making telemarketing calls to maintain an internal do-not-call list backed by a written policy available on demand and training for the personnel involved, and a do-not-call request must be honored for five years from the time it is made.

Detail: unsubscribe message examples · opt-in message examples · whether the do-not-call registry applies to texts · CTIA messaging guidelines · SHAFT content standards

4. Timing, quiet hours and the state overlay

Federal law sets the outer window. 47 CFR 64.1200(c)(1) bars telephone solicitations to a residential telephone subscriber before 8 a.m. or after 9 p.m., measured in the local time at the called party's location. That is the floor, not the ceiling. Several states impose narrower windows and additional consent duties through mini-TCPA statutes, and where a state rule is stricter, the stricter rule governs.

The practical failure here is scheduling by the sender's time zone. A message queued for 8:30 p.m. Eastern reaches a Pacific recipient at 5:30 p.m., which is fine, but the reverse ordering is not, and a national list contains both.

Detail: quiet hours by state · TCPA texting times · state-by-state marketing laws · mini-TCPA statutes · Florida FTSA · Washington CEMA

5. Records you can produce later

Compliance is proved after the fact, from records. Under the FTC Telemarketing Sales Rule at 16 CFR 310.5(a), sellers and telemarketers must keep records of their telemarketing activity for five years, including scripts and promotional material and a record of each call. The FCC's own five-year clock on do-not-call requests points the same direction.

What you want on hand for any given phone number is the consent artifact and its timestamp and source, the full message history in both directions, every opt-out and the time it took effect, and the campaign record the traffic was sent under. Public agencies have a second reason to care, because constituent text messages are frequently subject to public records law.

Detail: records retention requirements · opt-in record retention · text message archiving · whether government texts are public records

What non-compliance costs

The Telephone Consumer Protection Act carries a private right of action. Under 47 U.S.C. 227(b)(3), a person may recover actual monetary loss or $500 for each violation, whichever is greater, and where a court finds the defendant acted willfully or knowingly it may increase the award to not more than three times that amount. Because liability attaches per message, the exposure scales with list size rather than with intent, which is why consent records matter more than good faith.

Detail: TCPA penalties explained · what class actions teach · who is exempt · whether the TCPA reaches B2B texts · TCPA versus CAN-SPAM · is mass texting legal

How FRANSiS handles this

Most of the work above is either a one-time registration or a piece of platform behavior that should never depend on a person remembering it. FRANSiS™ is built so that it does not.

• Managed 10DLC registration. The FRANSiS team completes brand and campaign registration with The Campaign Registry on your behalf, including the use case descriptions, sample messages and opt-in language carriers review. Customers do not work in a carrier portal, and rejected campaigns are corrected and resubmitted by the team rather than handed back.
• Built-in TCPA consent workflows. Consent is captured with its source and timestamp, stored against the contact record, and enforced at send time, so a contact without valid consent for a given campaign type is not messaged.
• Automatic opt-out handling. Standard revocation keywords are honored automatically and immediately, free-text revocations are surfaced rather than ignored, and opt-outs are suppressed across every future campaign, not only the one the reply came from.
• Quiet-hours enforcement by recipient time zone. Scheduling respects the called party's local time rather than the sender's.
• A durable record. Consent artifacts, full two-way message history and opt-out events are retained and exportable, which is what a records request or a demand letter actually asks for.
• HIPAA compliance supported, with a signed BAA included. For healthcare customers, FRANSiS executes a business associate agreement, which is the documented satisfactory assurance a covered entity must obtain under 45 CFR 164.502(e) before disclosing protected health information to a vendor. HIPAA compliance is a property of your whole program, not of any single tool, so FRANSiS supports it rather than conferring it.
• The AI Powered Helper works inside these rules. Automated replies are governed by the same consent state, opt-out suppression and quiet-hours logic as any other message.

Talk to the FRANSiS team → for a walkthrough of registration and consent setup for your organization, or see plans and pricing first.

Sector-specific requirements

The five obligations are universal. What sits on top of them is not.

• Healthcare. Protected health information adds the HIPAA layer: a signed business associate agreement and Security Rule safeguards. See HIPAA compliant text messaging and SMS for healthcare.
• Nonprofits and faith-based organizations. Tax-exempt nonprofit organizations are treated differently from commercial senders in parts of the FCC rules, but registration and opt-out duties still apply. See 10DLC for nonprofits and AI for nonprofits.
• Schools and districts. Student data brings FERPA into scope alongside consent. See FERPA and student texting and AI SMS for K-12.
• Colleges and universities. Same FERPA questions at larger scale, across admissions, financial aid and student affairs. See SMS for higher education.
• Government agencies. Public records retention and accessibility obligations attach to constituent messaging. See government SMS compliance requirements and government text messaging.

Frequently asked questions

Is 10DLC registration legally required?
It is not a statute. It is a carrier requirement, enforced through delivery rather than through penalties. United States carriers require brand and campaign registration through The Campaign Registry for application-to-person traffic sent from ten-digit numbers, and unregistered traffic is filtered or blocked. The legal obligations, consent and opt-out and timing, come from the TCPA and the FCC rules and apply regardless of registration status.

How long does 10DLC registration take?
Brand registration is typically the faster step and campaign approval the slower one, with the timeline driven by how completely the campaign describes its use case and opt-in flow. Incomplete or mismatched submissions are the main source of delay, because a rejection restarts the review. FRANSiS handles submission and any resubmission for its customers.

Do we need written consent for appointment reminders?
Prior express written consent under 47 CFR 64.1200(f)(9) attaches to advertising and telemarketing content. A purely informational message such as an appointment reminder generally rests on prior express consent instead. The distinction is content, not channel, so a reminder that also promotes a service can change category.

How fast do we have to honor a STOP reply?
Under 47 CFR 64.1200(a)(10), revocation requests made by any reasonable method must be honored within a reasonable time not to exceed ten business days from receipt. Automated suppression at the moment of receipt is the safe implementation, and it is what carriers and the CTIA guidelines expect.

Can we require people to text STOP to opt out?
No. 47 CFR 64.1200(a)(10) states that senders may not designate an exclusive means to request revocation of consent. STOP must work, but so must a request made through another reasonable channel you have held out to the public.

What are the legal texting hours?
47 CFR 64.1200(c)(1) prohibits telephone solicitations to a residential telephone subscriber before 8 a.m. or after 9 p.m. in the called party's local time. State mini-TCPA statutes narrow that window in some jurisdictions, and the stricter applicable rule governs.

How long do we have to keep consent and message records?
Five years is the working answer. The FTC Telemarketing Sales Rule at 16 CFR 310.5(a) sets a five-year retention period for telemarketing records, and 47 CFR 64.1200(d) requires do-not-call requests to be honored for five years. Sector rules can extend this: healthcare and public agencies commonly have longer retention obligations of their own.

Does using a compliant platform make our organization compliant?
No, and any vendor that says otherwise is overselling. A platform can enforce consent state, suppress opt-outs, respect quiet hours, keep records and, for healthcare customers, sign a business associate agreement. Your organization still owns how consent is collected, what the messages say and who is authorized to send them.

How to cite this page

FRANSiS. "SMS Compliance: 10DLC, TCPA and Consent Requirements." fransis.ai, August 2026. https://www.fransis.ai/articles/sms-compliance

About this guide

Last reviewed: August 2026. Every regulatory citation on this page was checked against the primary source before publication: 47 CFR 64.1200, 47 U.S.C. 227, 16 CFR 310.5, 45 CFR 164.502, the CTIA Messaging Principles and Best Practices, and The Campaign Registry. Rules change; carrier policy changes faster than regulation does, so treat the as-of date above as meaningful.

This guide is informational and is not legal advice. Regulatory requirements vary by jurisdiction, industry and use case. Consult qualified counsel before relying on any of it for your own texting program.

Next step: Talk to the FRANSiS team about managed 10DLC registration and consent setup, or review plans and pricing.