SMS Compliance Guide: TCPA, Consent, and Opt-Outs (2026)

Business texting is regulated by federal law (primarily the TCPA), a growing set of state "mini-TCPA" laws, and the carriers' own rules (the CTIA Messaging Principles and Best Practices). The stakes are real on both fronts: TCPA violations carry statutory damages of $500 to $1,500 per message, and carriers filter or block traffic from senders who break their rules, which can take your whole program offline.

The good news: compliant texting is mostly a matter of a few habits, and a good platform automates the mechanical parts.

You need the recipient's permission before texting them, and the level of consent depends on the message type:

Whatever the type, keep records. For each contact you should be able to show:

• Who consented (name and number).
• When and how (form URL, checkout checkbox, paper form, keyword).
• What they agreed to receive.

Never text purchased, rented, or scraped lists, and never reuse consent collected for a different sender or purpose. Both are TCPA lawsuits waiting to happen and violate carrier rules.

Recipients must be able to tell who is texting them. Put your business name in the message (the first line is best, since many people will not have your number saved). Misrepresenting your identity or masking the sender violates carrier rules and, in many cases, the law.

The rules here are strict and universal:

• Recipients can opt out at any time by replying STOP (and carriers also recognize variants like UNSUBSCRIBE, CANCEL, END, and QUIT).
• Opt-outs must be honored immediately and permanently until the person opts back in.
• A HELP reply should return your business name and contact information.
• Promotional messages should include opt-out language, such as "Reply STOP to unsubscribe."
• Do not re-add opted-out contacts without brand-new consent.

Quick Send Business processes STOP and HELP automatically and suppresses opted-out contacts from every future send, account-wide, so a missed opt-out cannot slip through a spreadsheet.

The TCPA restricts marketing calls and texts to 8am to 9pm in the recipient's local time, and several states are stricter (some end at 8pm, and some limit how many marketing texts you can send per day). Practical guidance:

• Send marketing campaigns between 9am and 8pm recipient-local time.
• Watch state rules if you text nationally; the strictest state you text into wins.
• Time-sensitive transactional messages (a same-day appointment change) are different, but use judgment.

Carriers prohibit or heavily restrict certain content categories on standard A2P routes, summarized as SHAFT: Sex, Hate, Alcohol, Firearms, and Tobacco (including vaping). Cannabis and CBD content is prohibited on US A2P messaging regardless of state law. Also banned: phishing, deceptive links and misleading link shorteners, high-risk financial offers like payday loans, and any illegal content.

Sending restricted content does not just risk one message being filtered. It risks your number, your registration, and your sender reputation.

Compliance starts before your first message: US carriers require every business sender to register who they are and what they send. Toll-free numbers go through carrier verification, and local numbers go through 10DLC registration with The Campaign Registry. Sending campaign traffic from unregistered numbers gets filtered aggressively.

Quick Send Business collects one registration profile and submits the paperwork for you. See how registration works and the toll-free vs 10DLC guide for timelines.

• Every recipient gave consent appropriate to the message type, and you have records.
• Your number's carrier registration is approved.
• Your business name appears in the message.
• Promotional sends include opt-out language (Reply STOP to unsubscribe).
• STOP/HELP handling and suppression are active (automatic on Quick Send Business).
• The send is scheduled inside quiet hours for every recipient time zone.
• Content is free of SHAFT and other restricted categories.
• Your opt-in description on file matches how you actually collect consent.