Business texting answers to three rulebooks at once. The TCPA governs consent and opt-outs, carrier 10DLC registration decides whether your messages are delivered at all, and state telemarketing statutes now name text messages directly in at least a dozen states. A program can satisfy one of the three and fail the other two.
In This Article
Four things decide whether a texting program holds up: delivery, consent, opt-out handling, and the state rules stacked on top. Most programs inherit all four rather than design them, which is why the first sign of trouble is an undelivered message or a STOP reply that did not stick. Those four are the order this covers, because that is the order they fail in.
If you would rather run the review as an engagement, the TCPA compliance consulting service page sets out the audit sequence, including the 10DLC review that runs alongside the consent and DNC work.
Does your business need 10DLC registration to send text messages?
Yes. Any business sending application-to-person text messages from a standard ten-digit US number needs 10DLC registration, and the penalty for skipping it is not a fine but non-delivery.
A2P 10DLC is a carrier framework, not a law. Registration happens in two layers through The Campaign Registry: a brand record that ties your business to a verifiable tax identity, and a campaign record that describes the specific use case you are texting for. Carriers vet both against the CTIA Messaging Principles and Best Practices, the industry guidelines that also dictate things like the rates-may-apply language your terms have to carry.
The operational consequence is the part that surprises teams coming from voice. Since 1 February 2025 the major carriers block unregistered A2P traffic outright rather than throttling it, so a perfectly consent-compliant campaign can produce a zero delivery rate for reasons that have nothing to do with the TCPA. The reverse is also true, and worse: a registered campaign with sloppy consent is delivered efficiently to people who can sue you.
Registrations also go stale. Three details drift out of date and cause rejections or later filtering: a brand record that no longer matches the business name on file with the IRS, a campaign use-case description written vaguely enough to cover messages you have since stopped sending, and an opt-in URL in the registration that no longer resolves. Carriers do check that last one. Re-verify all three whenever the messaging program changes, not annually. The order that review runs in, brand record then campaign record then content review then consent alignment, is set out as the 10DLC review on the TCPA compliance consulting service page, alongside the consent and DNC stages it sits between.
What consent does the TCPA require before you send a marketing text?
Prior express written consent, the same standard a marketing robocall requires. The FCC treats a text message as a call, so the consent bar does not drop because the channel changed.
The definition sits at 47 CFR 64.1200(f)(9): a written agreement bearing the signature of the person contacted, clearly authorizing the seller to deliver marketing messages using an automatic telephone dialing system or prerecorded voice, stating the number those messages may go to, and carrying a clear and conspicuous disclosure that signing is not a condition of buying anything.
For texting programs the failure is almost never the checkbox. It is channel drift. Consent gets collected under a disclosure that names calls, the program then sends SMS, and the disclosure no longer describes what the business is doing. The fix is a sentence, and it has to be in the form before the first message goes out rather than added afterwards, because consent is judged on what the person actually saw on the day they agreed.
One thing that did not change in 2025, despite the headlines: a single consent form can still name more than one seller. The Eleventh Circuit vacated the FCC’s one-to-one consent rule in January 2025, so bundled consent remains lawful under the federal TCPA. What survived is the requirement that the seller doing the texting be clearly authorized by name. A form listing two of your brands does not authorize a third.
The mechanics of collecting, versioning and storing that consent, including the five-year recordkeeping standard and what a complete consent record has to contain, are set out in the prior express written consent guide and not repeated here.
What counts as an opt-out, and how fast do you have to honor it?
A text message opt-out counts whenever the recipient uses any reasonable method to express it. You have ten business days to honor it, and you may not require them to use a channel of your choosing.
Since April 2025 the revocation rule at 47 CFR 64.1200(a)(10) has treated several routes as reasonable per se: a reply text using stop, quit, end, revoke, opt out, cancel or unsubscribe, an automated opt-out offered on a call, or a website or phone line you designated for the purpose. Wording outside that list still counts when a reasonable person would read it as a revocation, which creates a rebuttable presumption against you rather than a safe harbor. A single confirmation message carrying no marketing content is permitted, and is presumed acceptable if it goes out within five minutes.
Narrow parsing is the failure the litigation record keeps surfacing. An opt-out handler that matches exact keywords lets a plain-language request such as take me off your list pass straight through, and the next scheduled message goes out on time. The litigation record is unambiguous about how that reads: the plaintiffs in Steidinger v. Blackstone Medical Services alleged they kept receiving marketing texts after replying STOP, and while the Seventh Circuit ultimately dismissed the claim on statutory grounds in July 2026, the underlying facts are the failure pattern every texting program should be testing against. The TCPA opt-out checklist is a five-point self-scoring framework for exactly this: catching non-standard opt-outs such as QUIT and END, the ten-business-day processing rule and why 72 hours is the safer internal target, and how to prove after the fact that your system caught the request.
Suppression also has to travel. An opt-out captured in the messaging platform that never reaches the dialer list, the CRM segment or the lead vendor’s file is an opt-out you cannot prove you honored. The ten business days apply to the whole chain, not to the platform that received the reply. If your texting program shares a contact database with a calling program, which most do, the same discipline covered in DNC scrubbing best practices applies here: the four sources to scrub against, and why the 31-day window is an outer limit rather than an operating cadence.
Not sure whether an opt-out reaches every list it needs to?
A campaign compliance audit traces consent and suppression across the whole chain, from the messaging platform to the dialer to the vendor file. Most audits take 5 to 10 business days, and the gap report is yours either way.
Which state laws apply to business texting on top of the TCPA?
At least a dozen states regulate business texting on top of the federal TCPA, and those statutes apply based on where the recipient is located rather than where your business sits.
The federal rule is a floor. Several states now name text messages in their telemarketing statutes outright, and two of them moved in the last eighteen months.
State | What it adds for texting | Exposure |
|---|---|---|
Virginia | Recognizes STOP and UNSUBSCRIBE as opt-outs, and requires the opt-out be honored for at least ten years. Amended Telephone Privacy Protection Act, effective 1 January 2026. | Private right of action |
Texas | Extends the state telemarketing framework to text messages and strengthens private enforcement. SB 140, effective 1 September 2025. | Up to $5,000 per message under the Deceptive Trade Practices Act |
Florida, Oklahoma, Maryland | Rebuttable presumption that a recipient with an in-state area code is physically in the state, so area code alone pulls you into the statute. | Per-message statutory damages plus fees |
California | Commercial texts must identify the sending business and make clear the message is an advertisement. | State consumer protection enforcement |
Ten years: how long Virginia requires a text opt-out to be honored, against the five-year federal recordkeeping standard.
Sample opt-in disclosure
By checking this box and clicking Submit, I authorize [Seller legal name] to contact me at the telephone number I provided above by text message, including messages sent using an automatic telephone dialing system, about [specific product or service]. I understand I am not required to give this consent as a condition of purchasing any property, goods or services, and that I may revoke it at any time by replying STOP to any message. Message and data rates may apply.
Sample opt-out confirmation
[Business name]: You are unsubscribed and will receive no further messages from us. No further action is needed.
The confirmation carries no offer, no reactivation instruction, and no link, because a confirmation message that markets is a message the recipient did not consent to receive. Send it once, within five minutes, and stop.
This is operational compliance guidance, not legal advice, and AnswerNet is not a law firm. Consent language interacts with state statutes and your own vendor contracts in ways specific to your program. Run it past qualified TCPA counsel before you deploy it.
Frequently asked questions
What is 10DLC compliance, and is it the same as TCPA compliance?
No, they are separate requirements that apply at the same time. 10DLC compliance means registering your brand and your messaging campaign with The Campaign Registry so that mobile carriers will deliver application-to-person texts sent from a ten-digit number, and it is enforced by carriers through filtering and blocking. TCPA compliance means having valid prior express written consent and honoring opt-outs, and it is enforced by regulators and private lawsuits. A message can pass carrier review and still violate the TCPA.
Do I need written consent to send marketing text messages?
Under the FCC’s rules a text message is treated as a call, so marketing texts sent with an automatic telephone dialing system require prior express written consent, and the disclosure has to name texting as a channel rather than referring only to calls. A February 2026 Fifth Circuit decision held that the TCPA’s own text requires only prior express consent, oral or written, but that ruling binds Texas, Louisiana and Mississippi only, and several state statutes impose written-consent requirements independently.
How quickly do I have to honor a text message opt-out?
Within ten business days of receiving it. The consumer may revoke through any reasonable method, and the rule treats a reply using stop, quit, end, revoke, opt out, cancel or unsubscribe as reasonable per se, along with an automated opt-out on a call or a website or phone line you designated for the purpose. You may not require an exclusive method. One confirmation message with no marketing content is permitted and is presumed acceptable if sent within five minutes.
What happens if I send business texts without 10DLC registration?
The messages are blocked rather than delayed. Since February 2025 the major US carriers block unregistered application-to-person traffic from ten-digit numbers outright, so an unregistered campaign produces delivery failures rather than fines. Registration does not affect your legal obligations in either direction: an unregistered campaign that never delivers can still be non-compliant on consent, and a registered campaign is not thereby TCPA compliant.
Which state laws apply to my text messages?
State telemarketing statutes apply based on where the recipient is located, not where your business is headquartered. At least a dozen states have their own rules, and several now name text messages directly: Virginia requires opt-outs be honored for at least ten years, Texas extended its telemarketing framework to texts with penalties up to $5,000 per message under its Deceptive Trade Practices Act, and Florida, Oklahoma, and Maryland presume that an in-state area code means an in-state recipient.
Put numbers on it before you need to
The outreach compliance risk calculator is un-gated and takes about a minute. Enter monthly volume and an estimated non-compliance rate, and it returns statutory exposure estimates side by side.
