The Complete SMS Compliance Guide for 2026 (North America and Canada Region)

SMS remains one of the most effective communication channels for businesses. However, running SMS campaigns requires compliance with federal, carrier, state, and industry regulations. 

Non-compliance can result in penalties up to $1,500 per message, legal action, blocked campaigns, and damaged brand reputation.

This comprehensive guide covers everything you need to build a compliant, high-deliverability SMS program in the USA and Canada Region.

What is SMS Compliance and Why Does it Matter?

SMS compliance refers to the legal, regulatory, carrier, and industry requirements that businesses must abide by and follow when sending and receiving text messages to customers. 

These regulations are designed to protect customers from spam fraud, unwanted communications, and privacy violations. 

SMS compliance is governed by regulations such as the Telephone Consumer Protection Act (TCPA) in the United States and Canada's Anti-Spam Legislation (CASL), as well as industry standards like CTIA guidelines and carrier requirements such as 10DLC registration.

Here’s why compliance matters in today’s age: 

• Avoids lawsuits and legal penalties that can cost businesses thousands and millions of dollars. 
  
• Prevents carrier filtering and blocking, as mobile carriers actively block messages that violate compliance requirements. 
  
• Protects brand reputation, as non-compliance can lead to customer complaints, negative reviews, and long-term damage to credibility. 
  
• Improves customer trust and credibility, as when messages reach customers, it demonstrates respect for customer preferences. 
  
• Supports long-term SMS campaigns, helping businesses maintain consistent communication channels and avoiding regulatory disruptions.

Who Governs SMS Compliance? 

Several distinct organisations shape what is and is not permitted when sending commercial SMS in the United States. 

SMS Compliance Framework in North America

A combination of federal laws, carrier requirements, industry standards, and state-specific regulations governs SMS compliance in the United States. Understanding each component of the U.S. compliance is important for building and maintaining a compliant SMS campaign. 

TCPA (Telephone Consumer Protection Act) 

The Telephone Consumer Protection Act (TCPA) of 1991 is a primary U.S. federal law regulating SMS marketing and automated communications. 

Governed and overseen by the Federal Communications Commission (FCC), the TCPA requires businesses to obtain the appropriate consent before sending text messages. In addition to SMS and MMS, the TCPA also applies to voice calls, fax transmissions, and robotic or other pre-recorded voice messages.

The act applies to: 

• SMS and MMS marketing messages

• Automated or templated text messages sent to mobile numbers

• Robocalls and pre-recorded voice messages

• Fax transmissions

• AI-generated voice or text communications (per the FCC's February 2024 ruling)

While the TCPA was enacted in 1991, it has been updated several times since. The key recent major updates include: 

• Prior Express Written Consent (PEWC): Required for all marketing messages
• Consent Revocation (April 2025): Businesses must honor opt-out requests by reasonable means (text keywords, email, voicemail)
• 10-Day Processing Rule (April 2025): Process opt-outs within 10 business days (real-time processing is best practice)
• One-to-One Consent (January 2026): Each sender must obtain its own consent—no sharing or selling consent across brands

TCPA Penalties:

The TCPA allows both FCC enforcement and private rights of action, including class-action litigation. Statutory damages are assessed per individual message:

No aggregate cap — a 100,000-message campaign without consent could exceed $150 million in liability.

Recent Example: Designer Shoe Warehouse (DSW) settled for $4.42 million (March 2025) for sending unwanted promotional SMS.

CTIA Messaging Principles 

• Clear, documented opt-in processes
• Sender identification
• HELP and STOP instructions
• Transparent frequency disclosure

Following CTIA standards is essential for maintaining deliverability. 

10DLC Registration (Mandatory) 

10DLC (10-Digit Long Code) is the carrier-approved standard for business SMS. Since February 2025, carriers block unregistered 10DLC traffic. 

Two-Step Process: 

• Brand Registration (~1-3 business days)

  • Legal business name, EIN, business type, website, contact info

• Campaign Registration (~2-7 business days)

  • Campaign purpose, sample messages, opt-in documentation, opt-out procedures

  • Separate registrations needed for different use cases (marketing, support, 2FA, etc.)

Restricted Industries: 

Cannabis, payday lending, debt relief, MLM, certain firearms promotions 

Consent: The Foundation of SMS Compliance

Consent is the foundation of SMS compliance in the United States. Whether a business is sending promotional offers or transactional updates, obtaining the appropriate level of consent is essential to meeting TCPA requirements and reducing compliance risk. 

Types of Consent 

The TCPA distinguishes between two levels of consent based on message type: 

Required Disclosure Elements

Display this information at the point of opt-in: 

• Business/program name
• Message types and estimated frequency (e.g., "up to 6 messages/month")
• Notice that message and data rates apply
• Opt-out instructions (Reply STOP)
• HELP instructions (Reply HELP)
• Statement: "Consent is not a condition of purchase"
• Links to terms and privacy policy

Valid Opt-In Methods

✓ Valid: 

• Web forms with unchecked SMS consent checkbox
• Keyword opt-ins (text JOIN)
• Paper forms with signature
• In-store/point-of-sale opt-ins
• Double opt-in (confirmation reply required)

✗ Invalid: 

• Pre-checked consent boxes
• Consent bundled into general T&Cs
• Collecting phone number alone
• Third-party/purchased consent
• Verbal consent

Best Practices 

• Maintain consent records: Date, time, method, opt-in source
• Use double opt-in: Especially for cart abandonment and high-risk campaigns
• Monitor reassigned numbers: Phone numbers reassigned to new users create compliance risk
• Keep records for: Duration of customer relationship + applicable retention periods

Opt-Out Management

Proper opt-out management is a critical component of SMS compliance. Failing to honor unsubscribe requests can lead to customer complaints, carrier penalties, and potential legal action. Businesses must recognize and process: 

Standard Keywords (any capitalization/punctuation): 

• STOP, END, CANCEL, UNSUBSCRIBE, QUIT 

Expanded Opt-Out Requests (post-April 2025): 

Recent TCPA updates require businesses to recognize opt-out requests communicated through reasonable alternative methods, not just standard keywords. 

• "Please stop texting me"
• "Remove me from this list"
• "Don't contact me anymore"
• Misspellings or abbreviations
• Requests via email, voicemail, or other channels

Opt-Out Processing & Record-Keeping 

• Process within 10 business days (real-time is best practice)
• Send one confirmation message (no promotional content)
• Maintain opt-out records with timestamp, phone number, method, and confirmation
• Apply opt-outs centrally across all campaigns and numbers.

State-specific Regulations 

In addition to federal regulations, several states have introduced their own telemarketing and SMS-related regulations that impose additional compliance obligations. These laws often apply based on the recipient’s location rather than the business location.

States such as Texas, Florida, and Oklahoma have implemented regulations that require businesses to monitor closely. Some of the major state-level SMS regulations examples include:

The National Do Not Call Registry 

The National Do Not Call (DNC) Registry, maintained by the FTC and FCC, allows consumers to opt out of receiving unsolicited marketing calls and text messages. Businesses are responsible for ensuring their marketing lists do not include numbers registered on the DNC list. 

Key compliance requirements include: 

• Scrubbing contact lists against the DNC Registry regularly, typically every 31 days for active campaigns
• Avoiding contact with DNC-registered numbers unless the consumer has provided direct consent to your business after joining the registry
• Maintaining processes to identify and suppress DNC-listed numbers from marketing campaigns
• Using internal or third-party compliance tools to manage DNC screening and recordkeeping

Failure to comply with DNC requirements can result in significant penalties, with violations carrying fines of up to $43,792 per call or text. Regular DNC list management is therefore a critical part of any SMS compliance program. 

Disclosure Language and CTA Requirements

Whenever consumers are asked to opt in to receive marketing text messages, businesses must clearly disclose the terms of the SMS program at the point of consent. Proper disclosure helps ensure transparency, supports compliance, and sets clear expectations for subscribers. 

A compliant disclosure should include: 

• The business or program name
• The types of messages subscribers will receive
• Estimated message frequency
• A notice that message and data rates may apply
• Instructions to opt out (e.g., Reply STOP)
• Instructions to get assistance (e.g., Reply HELP)
• A statement that consent is not a condition of purchase
• Links to the business's terms and conditions and privacy policy 

Disclosure Placement Requirements

Disclosure language should be displayed prominently and immediately adjacent to the opt-in mechanism, such as a sign-up button or consent checkbox. It should be easy to read and not hidden within fine print or separate pages. 

Canada SMS Compliance Framework 

Businesses sending SMS messages to recipients in Canada must comply with a combination of telecommunications regulations, federal anti-spam legislation, and privacy laws. Canada's SMS compliance framework is among the strictest in the world, placing a strong emphasis on consent, transparency, and consumer protection. 

CASL (Canada's Anti-Spam Legislation) 

CASL is Canada's primary law for commercial electronic messages, including SMS marketing. 

Two Types of Consent: 

• Express Consent: Explicit agreement to receive SMS
• Implied Consent: Inferred from existing business relationship (limited period)

Every Commercial SMS Must: 

• Include valid contact information
• Clearly identify the sender
• Honor unsubscribe requests promptly
• Provide functional unsubscribe mechanism

CRTC Enforcement & Privacy Laws 

The Canadian Radio-Television and Telecommunications Commission (CRTC) enforces CASL and focuses on: 

• Proper consent collection
• Consumer protection from spam
• Functional unsubscribe mechanisms
• Record-keeping and documentation

Additional privacy laws govern collection, storage, and use of personal information, including mobile numbers. 

Sender Identification Requirements 

Every commercial SMS must clearly identify who is sending the message. 

Best Methods: 

• Brand name prefix (most common): "[BrandName]: Your order shipped..."
• Branded Sender ID: Alphanumeric ID displaying business name instead of phone number
• Business contact details: Website, email, phone when appropriate

Best Practices: 

• Include identification in EVERY message, not just opt-in confirmations
• Use consistent branding across all campaigns
• Keep contact information current and accessible

SMS Content Compliance Best Practices

Creating compliant SMS content is equally important as obtaining proper consent. Here are the best SMS compliance practices businesses must follow.  

Required in Every Marketing Message: 

• Clear sender/brand identification
• Clear purpose or offer
• Accurate promotional details
• Opt-out instructions ("Reply STOP to unsubscribe")
• Content matching the opt-in promise

Prohibited content categories in SMS 

URL/Link Best Practices:

• Use branded short domains (avoid Bitly, TinyURL)
• Use dedicated link-tracking domains
• Ensure linked websites comply with carrier policies
• Remember: Carriers assess both message AND destination

Age-gated Messaging Requirements

• Verify the recipient's age where required, as certain products can only be promoted to adults. 
  
• Maintain proof of age verification by documenting how age eligibility was confirmed. 
  
• Include responsible marketing practices by ensuring age-restricted content is not sent to underage recipients. 
  
• Comply with local regulations, as age restrictions may vary by state, country, or province.

Quiet Hours (by Recipient Time Zone) 

Federal Standard: 8:00 AM – 9:00 PM (recipient's local time)

Stricter State Rules (examples):

• Florida, Oklahoma, Maryland, New Jersey, Washington: 8:00 AM – 8:00 PM

• Connecticut: 9:00 AM – 8:00 PM

⚠️ Apply the most restrictive rule for each recipient's location

Message Frequency Limits 

Some states restrict how often you can message the same recipient: 

• Florida, Oklahoma, Maryland: Max 3 messages per 24-hour period (same topic/campaign)
• Cart abandonment: One SMS per abandonment event, within 24 hours

Messaging Types and Compliance Examples

Different categories of SMS messages carry different compliance obligations. Understanding these distinctions is critical to applying the correct consent standard and avoiding inadvertent violations.  

Marketing/Promotional SMS 

Requires: Prior Express Written Consent (PEWC) 

Includes: 

• Promotional offers and discount codes
• Product announcements
• Abandoned cart reminders (requires double opt-in)
• Re-engagement campaigns
• Any message with a commercial call-to-action

Compliant Example: "TXTImpact: Get 20% off your next purchase this weekend! Shop now at TXTImpact.com. Reply STOP to opt-out." 

Common Violations: 

• Sending without written consent
• Texting after user opted out
• Contacting DNC-listed numbers
• Missing sender ID or opt-out instructions
• Sending outside quiet hours

Transactional SMS 

Requires: Prior Express Consent (not the higher PEWC standard) 

Includes: 

• Order confirmations
• Shipping notifications
• Appointment reminders
• Account alerts (low balance, fraud alerts)
• Two-factor authentication codes

Critical Rule: Adding even one promotional element (discount, upsell) reclassifies the entire message as marketing and requires PEWC. 

AI-Generated and AI-Assisted Messages 

FCC Ruling (February 2024): AI-generated voices and AI-assisted text constitute "artificial voices" under the TCPA. 

Requirements: 

• Apply same consent standards as human-composed messages
• Disclose to consumers that messages may be AI-generated or personalized
• Subject AI content to prohibited content filters and quiet hours
• Include within existing consent and registration framework

Quiet Hours and Messaging Frequency 

Businesses must comply with SMS sending time restrictions, commonly known as quiet hours. These restrictions are based on the recipient's local time zone, not the sender's, and help protect consumers from unwanted communications during early-morning and late-evening hours. 

Federal Quiet Hours (TCPA) 

Under the TCPA, commercial text messages may only be sent between 8:00 AM and 9:00 PM in the recipient's local time zone. 

Key requirements include: 

• Apply sending schedules based on the recipient's local time
• Monitor campaigns across multiple time zones
• Avoid sending messages outside permitted hours
• Maintain automated controls to prevent accidental violations

Sending messages outside permitted hours may result in TCPA violations and potential penalties. 

State-Level Quiet Hour Requirements 

Several states impose stricter restrictions than the federal standard. Businesses must comply with the most restrictive rule applicable to each recipient. 

Examples include: 

• Florida: No marketing texts before 8:00 AM or after 8:00 PM
• Oklahoma: No marketing texts before 8:00 AM or after 8:00 PM
• Maryland: No marketing texts before 8:00 AM or after 8:00 PM
• New Jersey: No marketing texts before 8:00 AM or after 8:00 PM
• Washington: No marketing texts before 8:00 AM or after 8:00 PM
• Connecticut: No marketing texts before 9:00 AM or after 8:00 PM

Regularly reviewing state-specific requirements is essential, as regulations may change over time. 

Message Frequency Limits 

In addition to quiet hours, certain states restrict how frequently businesses can send marketing messages to the same recipient. 

Examples include: 

• Florida: Maximum of 3 messages within a 24-hour period for the same campaign or subject matter
• Oklahoma: Maximum of 3 messages within a rolling 24-hour period
• Maryland: Maximum of 3 messages within a rolling 24-hour period
• Cart abandonment campaigns: Limited to one SMS per abandonment event and must be sent within 24 hours

Following frequency limits helps reduce consumer complaints, maintain carrier trust, and minimize compliance risk. 

Sender Identification Requirements 

Every commercial SMS should clearly identify the business sending the message. Proper sender identification helps build trust, reduces spam complaints, and aligns with carrier and industry compliance standards. 

Common methods of sender identification include: 

• Brand name prefix: Begin messages with the company or program name (e.g., "[BrandName]: Your order has shipped."). This is the most widely used approach.
• Branded Sender ID: Where supported, use an alphanumeric sender ID that displays the business name instead of a phone number.
• Business contact details: Include a website, email address, phone number, or other contact information when appropriate.

Best Practices:

• Include sender identification in every message, not just the initial opt-in confirmation.
• Use consistent branding across all SMS campaigns and programs.
• Ensure recipients can easily recognize who is contacting them.
• Keep business contact information current and accessible.

Clear sender identification improves customer trust, supports compliance efforts, and helps maintain strong message deliverability by reducing spam reports and consumer confusion. 

TCPA & CTIA Compliance Checklists 

Following a structured compliance checklist helps businesses reduce legal risk, improve deliverability, and maintain alignment with TCPA, CTIA, carrier, and state-level requirements. 

Before Launch ✓ 

• Obtained valid prior express written consent for all marketing recipients
• Maintained timestamped, auditable consent records
• Completed 10DLC brand and campaign registration
• Clear sender identification in every message
• Opt-out instructions in all marketing messages
• Messages scheduled within federal + state quiet hours
• Contact lists scrubbed against DNC Registry
• Previously opted-out contacts removed
• Messages and landing pages reviewed for prohibited content
• Consent collected directly by your organization (not purchased/third-party)

Ongoing Operations ✓ 

• Process opt-out requests within 10 business days
• Recognize standard AND non-standard opt-out requests
• Maintain detailed opt-out records with timestamps
• Apply state-specific quiet hours and frequency limits
• Regularly audit consent and subscriber records
• Review for reassigned numbers
• Update 10DLC registrations when practices change
• Train team on current TCPA/CTIA/state requirements

Consent Compliance Checklist 

Consent remains the foundation of SMS compliance and should be reviewed regularly. 

Key requirements include: 

• Use unchecked opt-in checkboxes by default
• Keep SMS consent separate from other marketing consents
• Display disclosure language clearly near the opt-in mechanism
• Identify the sender, message types, frequency, data rates, and opt-out instructions
• Include links to terms of service and privacy policies
• State that consent is not a condition of purchase
• Use double opt-in for cart abandonment and other higher-risk programs
• Regularly remind subscribers how to opt out of communications

Consistently following these practices helps businesses maintain compliance, improve customer trust, and reduce the risk of carrier filtering, regulatory penalties, and consumer complaints. 

Common SMS Compliance Mistakes

Penalties and Litigation Risk

SMS compliance violations can result in substantial financial penalties, regulatory action, and class-action litigation. Because penalties are often assessed on a per-message basis, even small compliance failures can become costly at scale. 

Non-compliance can be expensive. 

Example Exposure: A campaign of 100,000 non-compliant messages = potential liability exceeding $150 million

Beyond Fines:

• Damaged brand reputation
• Increased spam complaints
• Carrier filtering/blocking of future messages
• Class-action litigation (filings increased 95% through mid-2025)

Best Practices for Sustainable SMS Compliance 

• Choose the right SMS platform: Look for opt-out automation, consent management, 10DLC support, and compliance monitoring
• Work with legal counsel: Review your consent processes and compliance procedures
• Audit regularly: Check consent records quarterly or when regulations change
• Apply the strictest rule: Always use the most restrictive federal or state requirement
• Keep messaging separate: Maintain distinct marketing and transactional programs
• Monitor updates: Follow FCC, CTIA, and carrier policy changes
• Test opt-out workflows: Periodically verify opt-out processes, including non-standard requests
• Honor opt-outs permanently: Don't re-add contacts unless new consent is obtained directly

Quick Reference: Compliance Requirements at a Glance 

Conclusion

SMS remains one of the easiest and most effective communication channels for customer communications and marketing. However, successful SMS campaigns require ensuring compliance at every stage of the messaging process, right from collecting data and building a subscriber list to drafting messages and sending texts to the right people. 

Fortunately, SMS compliance doesn’t have to be overwhelming. With the right business SMS provider, you don’t have to worry about compliance. TXTImpact, a leading and reliable SMS provider, helps your business comply with regulations such as 10DLC, GDPR, TCPA, and HIPAA across all industries and business types. 

It significantly streamlines the crucial 10DLC registration process with its all-new 10DLC AI Campaign Wizard, making it a breeze in just a few steps, without any complicated forms. 

Ensuring compliant messaging not only helps meet legal requirements and protect your brand reputation but also enhances customer satisfaction and experience. Contact us to get started with TXTImpact or start a free trial to learn more.

FAQs 

♦ What role does an SMS provider play in compliance?  

SMS providers like TXTImpact support compliance through opt-out automation, consent management, audit trails, and 10DLC registration. However, the business sending messages remains ultimately responsible for compliance. 

♦ How long should we keep consent records?  

Retain records for the duration of the customer relationship plus applicable retention periods. Many businesses keep records for 3-5 years to support audits and legal disputes.

♦ What's the #1 SMS compliance mistake?  

Assuming a customer's phone number automatically grants permission to send marketing texts. Always obtain proper documented consent before sending promotional SMS.

♦ How often should we review compliance practices?

At least annually and whenever major regulatory, carrier, or operational changes occur. Recent updates (April 2025, January 2026) require immediate review.

♦ Can we send SMS messages outside business hours?

Only during quiet hours permitted by the recipient's location (typically 8 AM – 9 PM, but stricter in some states). Timing is based on recipient's time zone, not sender's.

About the Author:

Sandeep Gulyani (Co-founder Wire2air TXTImpact) Sandeep Gulyani is the Founder of Wire2air TXTImpact, a leading Mass texting and business text service for sending SMS alerts, reminders, notifications, and marketing campaigns to customers and employees worldwide. With over 25 years of experience in technology and innovation, Sandeep has built TXTImpact as a platform that simplifies communication. It offers features like email to text/mms, Outlook to text, Landline to text, etc, and seamless integration with business tools to meet diverse messaging needs.