Business SMS Compliance: Rules, Laws, and Carrier Standards

When it comes to SMS compliance regulations, business texting sits on top of three separate rulebooks. Breaking any one of them is expensive in a different way:

• Break the Telephone Consumer Protection Act (TCPA), and you get sued. Statutory damages run $500 per unconsented text ($1,500 if willful), with no cap on the total.
• Break carrier content rules, and your messages get silently filtered. Your platform reports “delivered,” but the recipient gets nothing, and you likely won’t know unless a customer complains about not hearing from you.
• Skip 10DLC registration, and carriers block your traffic outright. Every text from an unregistered number gets dropped before it reaches the network.

This guide covers TCPA consent rules, Cellular Telecommunications Industry Association (CTIA) carrier standards, and 10DLC registration, plus the state laws that are stricter than all of them, so you can ensure that your SMS campaigns reach your target audience.

The Three Layers of Business Text Messaging Compliance

Federal law, carrier standards, and technical registration are three separate gates. A text message must clear all three gates to reach a phone without legal or deliverability risk:

• Federal law (the TCPA) governs consent and opt-out rights. It’s enforced by the FCC and through private lawsuits when customers’ opt-out requests aren’t honored. This is where the $500-per-message liability lives.
• Carrier standards (CTIA Messaging Principles and Best Practices) govern whether AT&T, T-Mobile, and Verizon will actually deliver your traffic. The CTIA updated these guidelines in May 2023, and carriers treat them as mandatory for application-to-person (A2P) messaging. Violate them and your messages get filtered, even if they’re legal.
• Technical registration (A2P 10DLC) governs whether your numbers can send messages at all. Unregistered traffic gets blocked outright on the major carrier networks.

We’re going to talk more about these below.

Prior express written consent: What the TCPA requires

The TCPA is the primary federal law governing business texting. It requires businesses to obtain express written consent before sending automated informational messages and SMS marketing or promotional messages. Violations carry $500 per message in statutory damages, $1,500 for willful violations, and no aggregate cap.

One rule that generated significant industry attention has been resolved. The FCC’s one-to-one consent rule, which would have required separate consent for each seller, was vacated by the 11th Circuit on January 24, 2025, in Insurance Marketing Coalition v. FCC. The court held that the FCC exceeded its statutory authority. The FCC then formally repealed the vacated language in July 2025. Pre-2023 prior express written consent standards remain the governing federal rule, meaning a single consent disclosure can cover multiple sellers.

That said, many compliance teams still operate as if one-to-one consent is in force. It’s a stronger litigation defense, some state laws independently require seller-specific consent, and the concept could return through narrower rulemaking or legislation.

State-specific regulation

On top of federal regulation is the state layer. Several states have passed their own telemarketing statutes that are stricter than federal TCPA rules, and these are where recent litigation has concentrated. Build your program to the strictest standard that applies to any contact based on the state.

State	Law	Key rule beyond federal
Florida	FTSA (§ 501.059) and FTA (§ 501.616)	Establishes a calling window from 8 a.m. to 8 p.m., limits contact attempts to a maximum of three per 24 hours on the same subject, and imposes penalties of $500 to $1,500 per violation, with a private right of action. The 2023 amendment added a 15-day STOP cure period for text lawsuits and narrowed the statute to unsolicited messages.
Texas	SB 140 (Bus. & Com. Code §§ 301–305, effective Sept. 1, 2025)	Expanded “telephone solicitation” to cover text and image messages. Requires registration with the Secretary of State and a surety bond before sending.
Oklahoma	OTSA (15 O.S. § 775C)	Mirrors the FTSA closely. Bans caller ID masking, caps contact attempts at three per 24 hours.
Maryland	Stop the Spam Calls Act (Com. Law § 14-4501, effective Jan. 1, 2024)	Requires that calls be made between 8 a.m. and 8 p.m., with a maximum of three contact attempts per 24 hours on the same subject. Prior express written consent is required. This provision is enforced under the Maryland Consumer Protection Act.
Virginia	VTPPA (Va. Code § 59.1-510 et seq., amended effective Jan. 1, 2026)	Explicitly covers text messages alongside calls. Opt-out via STOP or UNSUBSCRIBE must be honored for at least 10 years.
Washington	CEMA (RCW 19.190)	Private right of action for unsolicited commercial electronic messages, including texts.

Keep in mind that state legislation is constantly evolving, so make sure you’re checking jurisdictions where you may have customers to ensure you’re abiding by the strictest guidelines applicable to your business.

The Three Consent Tiers: Conversational, Promotional, and Informational Text Messages

Treating consent as one thing is the most common compliance error in business texting, and it’s regulated by the CTIA.

The CTIA’s Messaging Principles sort SMS communications into three tiers based on who initiates the message and what it is for:

• Conversational: When a customer texts you first, you have implied consent to respond to that specific inquiry. That consent doesn’t extend to future marketing, alerts, or anything beyond answering the question they asked.
• Informational: Messages like shipping updates, billing notices, and appointment reminders require express consent. The customer must provide their number for this purpose, and you must document the number, opt-in method, and timestamp.
• Promotional: Discount codes, sale announcements, and any message designed to drive a purchase require prior express written consent. The consent form must include a clear disclaimer that consent isn’t a condition of purchase, and the customer must take an active step, like checking an unchecked box. Pre-checked boxes don’t count.

Sending a promotional text under informational consent (aka essentially sending an unsolicited text message) is a TCPA violation and a carrier filtering trigger at the same time. Here’s a quick breakdown that you can access for reference:

Tier	Consent required	When it applies	Example
Conversational	Implied	Customer texts you first through SMS messages	Replying to an inbound question
Informational	Express consent, documented	Customer gives their number for updates, including for transactional messages	Appointment reminder, shipping alert
Promotional	Must get express written consent	Any sales or marketing message, including recurring marketing text messages	Discount code, sale announcement

What Is 10DLC and Why Is Registration Mandatory?

Carriers block business outgoing texts from unregistered numbers outright, and they don’t tell you when they do it. 10DLC registration is what gets your messages through carrier networks, and it must happen before you send anything.

10DLC stands for 10-Digit Long Code, which is a standard local business phone number. U.S. carriers route business texts from these numbers over A2P networks, and they require you to register your legal brand and each campaign with The Campaign Registry (TCR).

Registration has two tracks:

1. Standard registration requires a valid EIN or Tax ID, and it’s what most established businesses and even government entities will use.
2. Sole proprietor registration is available for smaller businesses without an EIN, but it carries lower daily message limits.

Either way, unregistered means filtered. Nextiva handles 10DLC registration directly in the platform admin settings, so you don’t have to navigate TCR separately.

Anatomy of a Compliant Text Message

Every outbound business text needs three things to satisfy both federal law and carrier standards. Missing any one of them can trigger filtering, a TCPA complaint, or both.

Sender identification

Every message must state the business name up front. The TCPA requires commercial callers to identify themselves, and the CTIA Messaging Principles reinforce this by requiring a “recognizable program name or brand identifier” in the message body or an introductory message. Don’t abbreviate in ways the recipient wouldn’t recognize.

Opt-out instructions

Every promotional campaign needs an easy, visible opt-out. Standard keywords include STOP, UNSUBSCRIBE, CANCEL, END, and QUIT. Carriers expect instant, programmatic handling of these keywords. The FCC requires honoring a revocation within 10 business days.

Content restrictions

SHAFT is the acronym the CTIA Short Code Monitoring Handbook uses for content carriers blocked on sight: sex, hate, alcohol, firearms, and tobacco. Cannabis and CBD campaigns are blocked, too, because cannabis remains federally illegal regardless of state law. Public link shorteners like Bitly also trigger carrier filters. Use a branded domain for any links in your messages.

Protect Your Business From Penalties and Blocks

Two operational gaps create the most compliance exposure, and both are fixable before they become problems.

First: Your consent records are your defense in court.

Keep proof of every opt-in: the phone number, the timestamp, and the collection method. The TCPA doesn’t specify its limitations period, but courts apply the federal catchall under 28 U.S.C. § 1658(a), which gives plaintiffs four years from the date of each violation.

Retain consent records, searchable, for at least that long. A consent record that says “opted in” without a timestamp, method, or disclosure version won’t hold up in a TCPA lawsuit.

Second: Texting from employee cell phones lacks documentation.

Texting from an employee’s personal line means no archiving, documented consent trails, or automatic STOP handling. When a customer dispute arises, and you need to prove what was said and when consent was given, personal phones leave you with nothing. This is both an operational gap and a legal one.

Nextiva’s business texting and Message Pro let employees text from dedicated business lines while keeping a compliant, archived log of every interaction, with automatic STOP handling and secure storage built in. Whether you’re a small business or a large enterprise managing call center compliance, Nextiva has you covered.

Build a Texting Program That Ships and Stays Safe

Compliance has three layers, and your program needs to clear all of them: TCPA and state law for consent, CTIA carrier standards for content and format, and 10DLC registration for deliverability. Skipping any one silently breaks the others.

It’s also critical to remember that business texting compliance isn’t a one-time checkbox. Carriers score your sending behavior continuously, and a registered program that starts generating spam complaints or sending SHAFT-adjacent content will get throttled or suspended, even with a valid registration in place.

Nextiva’s business phone service handles 10DLC registration, automatic opt-out processing, and secure message archiving in one platform, so the compliance work is built into the tool rather than bolted on after the fact.

See how Nextiva handles business texting compliance.