SMS is one of the most effective owned channels and one of the most regulated. The legal risk is real: the TCPA allows private lawsuits with statutory damages commonly cited at $500 to $1,500 per message, and a campaign to a large list can add up fast. This guide explains the rules ecommerce brands need to build into every SMS program.
This post is general information, not legal advice. Work with qualified counsel to review your consent language, flows, and registration.
The short version: get clear written consent for your own brand, honor opt-outs fast and through any reasonable method, respect quiet hours by recipient time zone, and register your sender with carriers. Treat compliance as part of the program build, not a late-stage checklist.
The three layers of SMS compliance
| Layer | What it covers | Who enforces it |
|---|---|---|
| Law (TCPA and state laws) | Consent, opt-outs, quiet hours, disclosures | Courts, FCC, state regulators, private plaintiffs |
| Industry guidelines (CTIA) | Message content, opt-in and opt-out practices | Carriers and aggregators |
| Carrier registration (10DLC and similar) | Brand and campaign approval to send at scale | Carriers through registries |
All three must be right. Clean consent does not help if your messages are blocked for missing registration, and registration does not give you permission to text anyone.
1. Consent: get it right
For marketing texts, the TCPA requires prior express written consent. In practice:
- Clear disclosure at the point of sign-up that says the person is agreeing to receive recurring marketing texts from your brand
- Your brand named in the consent language
- Message frequency and cost disclosures: message and data rates may apply, frequency varies
- How to opt out (for example, reply STOP)
- Links to your terms and privacy policy
- No pre-checked boxes for marketing consent
- Consent is not a condition of purchase
- Records: store the timestamp, number, source, and the exact language shown
What about the one-to-one consent rule?
This is a point of confusion. The FCC adopted a one-to-one consent rule in December 2023 that would have required separate consent for each seller. The Eleventh Circuit vacated it in January 2025, and the FCC later removed it. Several vendor guides still describe it as a 2026 requirement, and several legal-focused sources say it never took effect. Verify with counsel.
Even so, the safest practice is the same: collect consent for your own brand, name it clearly, and do not rely on shared or purchased consent.
2. Opt-outs: honor them fast and in any reasonable form
Since April 11, 2025, businesses must honor revocation of consent made by any reasonable method, not only the STOP keyword. The FCC has identified words such as stop, quit, end, revoke, opt out, cancel, and unsubscribe as reasonable ways to revoke.
What to build in:
- Immediate processing of STOP and equivalent replies
- Handling of opt-outs received by email, phone, or customer support, and passing them to your SMS platform
- One confirmation message after an opt-out, if you use one
- Suppression across all your SMS programs for that brand
A broader "revoke-all" provision, which would treat an opt-out as ending consent for all unrelated messages from a sender, has been delayed. One source cites an effective date of January 31, 2027. Plan your systems with that direction in mind.
3. Quiet hours
Federal rules restrict marketing texts before 8 a.m. and after 9 p.m. in the recipient's local time. Some states are stricter. Florida, for example, is commonly cited with an 8 p.m. cutoff, and other states have their own rules and registration requirements.
What to build in:
- Quiet hours enforced by the recipient's time zone, not yours
- Time zone inference based on area code or shipping address, with a safe default
- Extra care for flows triggered at any hour (abandoned cart, back in stock) so they queue until the window opens
- State-specific rules reviewed by counsel for the states where you have many subscribers
4. 10DLC and carrier registration
If you send marketing texts from a standard 10-digit local number in the US, you register your brand and campaign with carriers through the 10DLC system. Without approval, carriers can filter or block your traffic regardless of consent.
What to know:
- Registration confirms your use case and sample messages. It is not a substitute for consent
- Toll-free numbers and short codes have their own verification processes
- Registration details change, so rely on your platform's current guidance (Klaviyo, Postscript, and others walk you through it)
- Message content must match what you registered
5. Content rules
Carriers and industry guidelines restrict some content categories. Sex, hate, alcohol, firearms, and tobacco (often called SHAFT), along with certain other categories, can face extra scrutiny or be blocked. If you sell in a restricted category, get specific guidance from your platform before you launch.
Other content basics:
- Identify your brand in the message
- Do not use deceptive or misleading content
- Avoid public URL shorteners that carriers flag. Use branded or platform links
- Include opt-out language in marketing messages as required by your platform and guidelines
6. Transactional vs marketing messages
Order confirmations and shipping updates are generally treated differently from marketing texts, but a message that mixes in promotional content can be treated as marketing and need marketing consent.
| Type | Example | Consent needed |
|---|---|---|
| Transactional | Order confirmation, shipping update | Typically based on the customer providing their number for that purpose |
| Marketing | Sale alert, cart reminder with a promotion | Prior express written consent |
| Mixed | Shipping update with a coupon | Treat as marketing |
A cart abandonment text is often treated as marketing. Confirm your approach with counsel.
7. Where ecommerce brands get into trouble
- Pre-checked or buried consent at checkout
- Texting email subscribers who never consented to SMS
- Importing numbers from a prior platform without documented consent
- Missing quiet-hours logic in automated flows
- Slow or incomplete opt-out handling across systems
- Shared consent language that names partners instead of your brand
- Unregistered or misregistered senders
- Rented or purchased lists
8. Compliance when you migrate or change platforms
Moving SMS programs between platforms carries added risk:
- Export consent records with timestamps and source language, not only phone numbers
- Confirm the new platform can honor existing opt-outs from day one
- Register the new sender before you send
- Have counsel review the consent trail before you import
9. Compliance and new formats like RCS
RCS adds rich features, but consent and opt-out rules still apply. See RCS vs SMS.
SMS compliance checklist
- ☐ Consent language names your brand, discloses frequency and rates, and explains opt-out
- ☐ No pre-checked boxes; consent is not required to buy
- ☐ Consent records stored with timestamp, source, and language shown
- ☐ STOP and equivalent opt-outs processed immediately, across channels
- ☐ Opt-outs from email, support, and phone routed to the SMS platform
- ☐ Quiet hours enforced by recipient time zone, with state variations reviewed
- ☐ 10DLC, toll-free, or short code registration approved
- ☐ Message content matches registered use case
- ☐ Transactional and marketing messages separated
- ☐ Counsel reviewed consent language and flows
- ☐ Quarterly compliance review scheduled
FAQ
Do I need written consent for SMS marketing?
Yes. The TCPA requires prior express written consent for automated marketing texts to US numbers.
Is one-to-one consent required in 2026?
The FCC rule was vacated in 2025, though some vendor guides still describe it as required. Naming your own brand in consent language is still the safest approach.
Can customers opt out by saying something other than STOP?
Yes. Reasonable methods count, and your systems need to catch them.
What are the quiet hours for marketing texts?
Federally, 8 a.m. to 9 p.m. in the recipient's local time, with stricter windows in some states.
Does 10DLC registration replace consent?
No. Registration is for carriers. Consent is for the law.
Can I text customers who only gave me their email?
Not for marketing, unless they separately consented to SMS.
How ATTN helps
ATTN builds SMS programs with compliant consent flows, quiet-hours logic, and clean platform setups on Klaviyo and Postscript. We work alongside your counsel to make sure programs hold up. Talk to our retention team about an SMS program review.
ATTN is a marketing agency, not a law firm. This article is general information, not legal advice. Laws and carrier rules on consent, messaging, and privacy change often and vary by state and situation, so consult your own attorney before making decisions about your program.