SMS Consent Rules in the US: TCPA Basics, 10DLC, Quiet Hours and STOP

Business texting in the United States is governed by three layers that are easy to confuse. The law is mainly the Telephone Consumer Protection Act of 1991 and the Federal Communications Commission's rules under it, plus state statutes. The carriers, meaning the mobile networks, run their own registration system called 10DLC and will block unregistered traffic regardless of what the law says. And the industry, through the CTIA's messaging principles, publishes best practices that carriers and platforms treat as requirements.

A business that satisfies all three can text its customers reliably. A business that satisfies the law but skips registration gets filtered. A business that registers but ignores consent gets sued. This post explains each layer at the level a small business owner needs. It is general information, not legal advice; the TCPA has produced an enormous amount of litigation and the rules have shifted several times, so confirm the current position with a lawyer before you launch a program of any size.

The TCPA restricts calls and texts made with automated equipment to mobile phones without the recipient's consent. Courts have treated marketing text messages as calls under the statute for many years, and platform-sent texts are generally assumed to fall under it. The level of consent required depends on the message.

• Marketing messages need prior express written consent. "Written" includes electronic: a checkbox on a form, a reply to a text, or a signed card. The disclosure must say that the person agrees to receive marketing texts from your business at the number given, that the messages may be automated, that consent is not a condition of purchase, and that message and data rates may apply.
• Informational messages need prior express consent. Appointment reminders, delivery updates and order confirmations fall here. Providing a number in the course of a transaction is often enough, but only for messages about that transaction.
• Consent must be revocable by any reasonable means. The FCC has made clear that a person can withdraw consent by replying STOP, by using other common words, or through any reasonable channel, and the business must honor it promptly.

The statute carries damages per message, set at $500 and up to $1,500 for willful violations, and it allows class actions. That is why a texting program with weak consent records is an unusual risk for a small business: the exposure scales with the number of messages, not the size of the company.

10DLC stands for ten-digit long code, the ordinary local phone number a business texts from. Since the carriers introduced the system, application-to-person traffic from such numbers must be registered or it is filtered and eventually blocked. Registration happens through a central registry and has two parts.

• Brand registration identifies your business: legal name, tax ID, address, website. The registry verifies it and assigns a trust score that affects how many messages a day you can send.
• Campaign registration describes what you will send: the use case, sample messages, how people opt in, and your opt-out and help wording. Carriers review it and can reject campaigns whose consent flow is unclear.

Approval usually takes days, sometimes longer, and a number cannot send marketing to US recipients until both parts are complete and the number is linked to the campaign. Toll-free numbers follow a different route, a carrier verification process rather than 10DLC, and an unverified toll-free number cannot send either. Alphanumeric sender names, common in other countries, are not permitted in the US at all. Brainito's compliance wizard collects the brand and campaign details inside the app, tracks the status, and refuses to schedule a campaign into the US until the number is cleared, so a half-registered number cannot fail 10,000 times at send.

Federal rules prohibit telemarketing calls before 8am and after 9pm in the recipient's local time, and the same window is applied to marketing texts by the carriers' guidelines and by most platforms. Several states narrow it further: Florida's and Oklahoma's telemarketing laws, for example, set tighter windows and limits on how many marketing messages may be sent in a day. Because you often cannot tell a recipient's state from their area code with certainty, the conservative approach is to send between 9am and 8pm in the recipient's time zone and to cap marketing at a few messages a month.

Brainito holds any US or Canadian marketing text scheduled outside 8am to 9pm local time until the window opens, and records the hold against the message so you can see why it waited. Frequency is yours to manage: state it in your opt-in wording, as in "up to 4 messages a month", and keep to it, because exceeding what you promised is both a policy issue and the fastest way to earn STOP replies.

Every program must honor opt-out keywords, and the carriers expect specific pieces of wording in specific places. These are checked during campaign registration and spot-checked afterward.

• Opt-in confirmation. The first message after someone subscribes should name your business, describe what they signed up for, state that message frequency varies and that message and data rates may apply, and tell them to reply HELP for help and STOP to opt out.
• STOP. A reply of STOP, and common variants such as UNSUBSCRIBE, CANCEL, END and QUIT, must stop all further messages from that program. Send one confirmation that they are unsubscribed and nothing else.
• HELP. A reply of HELP should return your business name and a way to contact you.
• In the opt-in disclosure itself. The checkbox or form text should carry the business name, the kind of messages, the frequency, "consent is not a condition of purchase", "msg and data rates may apply", and the STOP and HELP instructions. A statement that mobile information will not be shared with third parties for marketing is now expected by the carriers as well.

Brainito generates the confirmation, STOP and HELP replies from your brand name and use case, handles the keywords automatically, records the opt-out on the contact so no later campaign or flow step reaches them, and checks your opt-in wording for the required elements before you register.

• Collect written consent with the full disclosure, on your website form, at checkout, or by a keyword people text in. Keep the record: when, how, and the exact wording shown.
• Register the brand and a campaign before the first marketing text. Budget a week or two for approval.
• Store SMS consent separately from email consent. A phone number in your CRM is not permission to text it. On Brainito, a CSV with a phone column and no SMS consent column adds people for email only.
• Send inside quiet hours, at the frequency you promised.
• Honor STOP instantly and keep the suppression forever. Re-importing an old list must never bring opted-out numbers back.
• Review the rules yearly. The FCC, the states and the carriers all change them.

The SMS marketing page explains how numbers, registration, quiet hours and consent are handled in Brainito, and how a text fits as a step in the same flow as your email. The rules are demanding but they are learnable, and a business that follows them has a channel its competitors are often afraid to use.