If you send business text messages in the United States, the CTIA messaging principles and best practices are the rulebook your carriers actually enforce. The CTIA is the wireless industry’s trade association, and while its guidance is not a statute, AT&T, T-Mobile, and Verizon treat it as a condition of network access. Ignore it and your messages get filtered silently or your campaign gets shut down. Layered on top are the Telephone Consumer Protection Act and the FCC’s rules under it, which turn certain violations into per-message lawsuits. Compliance comes down to four things: sending on a properly registered number, collecting the right kind of consent and keeping proof of it, honoring time windows and opt-outs, and staying out of prohibited content categories.
Pick and Register Your Sending Channel
Before anything else, you choose a number type. Each has its own registration path, throughput ceiling, and cost structure.
- Short codes. Five- or six-digit numbers built for high-volume one-way campaigns like flash sales or two-factor authentication. They push roughly 500 messages per second but require carrier-by-carrier approval that takes eight to twelve weeks, and monthly lease fees run $500 for a random code or $1,000 for a vanity code.
- 10DLC. Standard ten-digit numbers authorized for business-to-consumer messaging. Registration goes through The Campaign Registry, and throughput depends on your brand’s trust score and the carrier. This is the most common channel for mid-volume senders and supports voice and text on the same number.
- Toll-free numbers. Numbers with 800, 833, 844, 855, 866, 877, or 888 prefixes. They must be verified before sending any messages to U.S. or Canadian recipients; unverified toll-free traffic is blocked outright. Default throughput is around three SMS segments per second, with higher rates available on approval.
10DLC Brand and Campaign Registration
If you’re sending business messages from a ten-digit number, registration through The Campaign Registry is not optional. Carriers block unregistered 10DLC traffic. Your messaging provider submits your business details to TCR: legal company name, EIN, business address, and industry vertical. Everything must match your IRS records exactly. A mismatch between EIN and company name will stall the process. Sole proprietors without an EIN register under a separate category with lower volume limits.1The Campaign Registry. Resources
TCR then runs an automated “Standard Vet” that assigns your brand a trust score from 0 to 100. That score directly controls how many messages you can send, and each major carrier applies it differently to daily caps or per-minute throughput.2The Campaign Registry. TCR CSP User Manual
Once your brand is verified, you register each campaign individually. Every campaign requires a declared use case (marketing, customer care, two-factor authentication, and so on), a description, at least one sample message, and documentation of your opt-in flow. Opt-out and HELP keyword support must be built in before submission.2The Campaign Registry. TCR CSP User Manual Budget for a one-time brand registration fee, a per-campaign vetting fee, and ongoing monthly charges, plus per-message carrier surcharges your messaging platform passes through.3Twilio Help Center. What Pricing and Fees Are Associated with the A2P 10DLC Service?
Get Consumer Consent the Right Way
Consent is where most legal exposure lives. The TCPA lets consumers sue for $500 per unwanted message, and courts can triple that to $1,500 per message for willful violations.4Office of the Law Revision Counsel. 47 U.S. Code 227 – Restrictions on Use of Telephone Equipment Several states have their own mini-TCPA statutes with per-violation damages that can run higher. One campaign sent to a list with stale consent can generate six- or seven-figure liability overnight.
Match the Consent to the Message
The type of consent you need depends on what you’re sending. Informational messages like appointment reminders, delivery notifications, and security alerts generally require prior express consent. Promotional or marketing messages demand a higher bar: prior express written consent, which the FCC defines as a written agreement (electronic signatures included) that clearly authorizes the sender to deliver telemarketing messages using an autodialer or prerecorded voice. That agreement must disclose that signing is not a condition of purchasing anything.5eCFR. 47 CFR 64.1200 – Delivery Restrictionsa>
Beyond the legal minimum, the CTIA requires every opt-in call-to-action to include the program name, a description of the messages the consumer will receive, the expected frequency, a disclosure that message and data rates may apply, and links to your terms and conditions and privacy policy.6CTIA. Messaging Principles and Best Practices Missing any of these gives carriers grounds to suspend your campaign.
Send a Confirmation Message First
For recurring messaging programs, the CTIA requires a confirmation message after the consumer opts in and before any other messages go out. That confirmation must repeat the program name, provide customer care contact information, explain how to opt out, disclose that messages are recurring and how often they’ll arrive, and use clear language about any fees.6CTIA. Messaging Principles and Best Practices It also helps verify that the person who gave you the number actually holds the phone.
Consent travels with the specific campaign and sender it was given to. You cannot transfer it to a different brand, repurpose it for an unrelated campaign, or share it with affiliates for their own marketing.
Document Every Opt-In
Keep records: date, time, method (web form, text keyword, paper form), and the exact disclosure the consumer saw. For web-based opt-ins, capture the IP address. These records are your defense in carrier audits and litigation. If you can’t produce documentation showing when and how a specific number opted in, carriers and courts will assume the consent never existed.
Check for Reassigned Numbers
Phone numbers get reassigned to new subscribers regularly, and consent from the previous holder does not transfer. The FCC operates a Reassigned Numbers Database that lets you check whether a number has been disconnected or reassigned since the date you obtained consent. Querying the database before sending creates a safe harbor: if the database incorrectly returns “no” and you rely on that response, you’re shielded from TCPA liability for contacting the wrong person.7Federal Communications Commission. Reassigned Numbers Database Skipping the check leaves you exposed every time a number changes hands.
Send Only During Permitted Hours
FCC regulations prohibit telephone solicitations to residential subscribers before 8:00 a.m. or after 9:00 p.m. local time at the recipient’s location.8eCFR. 47 CFR 64.1200 – Delivery Restrictions The restriction is based on where the recipient is, not where your servers are. A sender on the West Coast texting a New York number at 6:15 p.m. Pacific is hitting that phone at 9:15 p.m. Eastern. You need reliable time-zone data for every number in your list; area code mapping or carrier-provided location data is the safest way to determine local time before sending.
Neither the CTIA nor the FCC caps how many messages per week you can send, but the frequency you disclosed at opt-in becomes the ceiling you’re held to. Telling someone “up to 4 msgs/month” and then sending daily texts is a consent violation even if the content is something the subscriber wants.
Handle Opt-Outs Immediately
Your system must recognize and immediately process the standard opt-out keywords: STOP, END, CANCEL, UNSUBSCRIBE, and QUIT. The CTIA also expects you to honor plain-language opt-out requests like “please opt me out.”9CTIA. CTIA Short Code Monitoring Program Handbook When a recipient sends any of these, your platform sends one final confirmation acknowledging the opt-out, and then no further messages of any kind go to that number until the person opts in again.6CTIA. Messaging Principles and Best Practices
You also need to respond to the HELP keyword. When a recipient texts HELP, your system must reply with the program name and contact information for reaching a human, such as a phone number or email address.9CTIA. CTIA Short Code Monitoring Program Handbook Carriers audit for HELP support, and failing the audit can get your campaign pulled.
The Broader FCC Revocation Rule
The FCC adopted a rule requiring callers and texters to honor consent revocation through any reasonable method, not just standardized keywords. Once a consumer revokes consent, the sender may no longer send robocalls or robotexts to that person absent an exemption. As of April 11, 2026, this includes a cross-campaign requirement: a revocation made in response to one type of message must be applied to all future automated calls and texts from that sender on unrelated matters.10Federal Communications Commission. DA 25-312A1 Previously, opting out of a promotional campaign might not have affected transactional messages from the same sender. Under the new rule, a single “stop texting me” in response to any message type shuts down all automated messaging from that sender.
Maintain a real-time suppression list and check it before every send. A message that slips through to someone who already opted out creates both legal liability and carrier complaints, and a spike in spam reports against your number is one of the fastest ways to get your traffic throttled or your campaign terminated.
Stay Out of Prohibited Content
Even with perfect consent, certain content will get your messages blocked. The industry uses the SHAFT framework to categorize restricted material: Sex, Hate, Alcohol, Firearms, and Tobacco. Adult content and hate speech are flatly prohibited on carrier networks. Alcohol, firearms, and tobacco messaging may be permitted in narrow circumstances with age-gating technology that verifies the recipient is of legal age before delivering the message.9CTIA. CTIA Short Code Monitoring Program Handbook
Cannabis marketing remains prohibited regardless of state legality because federal law still classifies it as a controlled substance. Carriers will not distinguish between a licensed dispensary in a legal state and an unlicensed seller.9CTIA. CTIA Short Code Monitoring Program Handbook High-risk financial offers like payday loans and debt consolidation face heavy filtering. Gambling content is generally restricted unless the sender holds specific regulatory approvals and limits delivery to permitted geographies.
Carriers scan messages with automated filters looking for terms associated with prohibited categories. Violations typically result in immediate campaign termination without warning, and repeat offenders risk permanent blacklisting of their sending numbers.
Political Messaging Has Its Own Layer
Political organizations face additional registration. As of February 17, 2026, carriers require any 527 tax-exempt political committee sending A2P messages through 10DLC, short code, or toll-free channels to hold a valid Campaign Verify authorization token. Eligible entities include candidates, parties, PACs, and other political committees registered with the FEC or a state or local election authority. Verification costs $95 per entity per two-year election cycle and involves submitting a request, receiving a PIN at the address or contact listed on the official filing record, and entering that PIN to generate a token.11Campaign Verify. Frequently Asked Questions Carriers block 100% of unregistered political A2P traffic, and messaging platforms will suspend accounts that attempt to send it.
Identify Yourself in Every Message
Every message you send must make clear who it’s coming from. The CTIA requires a recognizable program name or brand identifier either within the message body or in an introductory message at the start of the conversation. Recipients who can’t tell who’s texting them are far more likely to report the message as spam.
How Carriers Actually Enforce This
Carriers escalate through several measures. They filter or block individual messages before delivery, suspend messaging traffic for an entire sender, or disconnect a provider’s access to their network when they determine it’s necessary to stop unwanted messages.6CTIA. Messaging Principles and Best Practices They may also require pre-approval for campaigns, conduct in-market audits of active programs, and assign unique identifiers to track repeat offenders.
What makes this enforcement dangerous is its opacity. Filtered messages don’t bounce back with an error. They simply vanish. A sender can blast thousands of texts, see them marked as “sent” in the platform dashboard, and have no idea none were delivered. By the time the problem surfaces through plummeting response rates, the damage to sender reputation is already done. Building consent, registration, and content controls correctly from the start is dramatically cheaper than trying to recover after a carrier shuts you down.