SMS Marketing Rules for Small Businesses

The sources used are the current text of 47 CFR 64.1200 on the eCFR (the FCC's TCPA rules), the CTIA Messaging Principles and Best Practices (May 2023 edition), The Campaign Registry's 10DLC overview, and regulation 22 of the UK Privacy and Electronic Communications Regulations as amended. State laws in the US can add stricter rules, and penalties are not covered here. For marketing email, see our separate email marketing rules guide.

Three kinds of business text

The CTIA principles, the US wireless industry's guidance for business messaging, sort texts into three types, each with its own level of consent:

• Conversational: the customer texts first and you reply. "If the Consumer initiates the conversation and the Non-Consumer simply responds, then no additional permission is expected."
• Informational: appointment reminders, welcome texts and alerts the customer asked for when they gave you their number. These need express consent, which can be given "over text, on a form, on a website, or verbally."
• Promotional: any message containing a sales or marketing promotion. These need express written consent. CTIA warns that "adding a call-to-action (e.g., a coupon code to an informational text) may place the message in the promotional category."

That last point catches many businesses: a reminder text with a discount code attached is marketing, and needs marketing consent.

US: consent under the FCC rules

Section 64.1200(a)(2) bars telemarketing calls to mobile numbers made with an autodialer or a prerecorded voice "other than a call made with the prior express written consent of the called party". Despite the wording, the rules treat texts as covered: paragraph (a)(10), for example, speaks of consent "to receive calls or text messages", and paragraph (e) applies the timing and do-not-call rules to "telemarketing calls or text messages to wireless telephone numbers". Whether a particular texting platform counts as an autodialer is a legal question for your lawyer; the safe course is to collect written consent for every marketing text.

The rule defines prior express written consent as "an agreement, in writing, bearing the signature of the person called" that authorises the seller to send marketing messages to a stated phone number. The agreement must clearly disclose that:

• by signing, the person authorises the seller to send them telemarketing messages using an autodialer or prerecorded voice; and
• the person "is not required to sign the agreement (directly or indirectly), or agree to enter into such an agreement as a condition of purchasing any property, goods, or services."

An electronic signature counts where federal or state law recognises it, so a web form checkbox can work if it is set up properly. In practice this means a separate, unticked box next to the phone number field, with wording that names your business and says marketing texts will follow and that agreeing is not required to buy. Our guide to contact and quote forms covers form layout. Keep the consent specific: CTIA says an opt-in "should not be transferable or assignable" and should apply only to the sender and campaign it was given for, and that senders "should not use opt-in lists that have been rented, sold, or shared."

US: opt-outs and the ten business day limit

Paragraph (a)(10) says a person may revoke consent "by using any reasonable method to clearly express a desire not to receive further calls or text messages". Replying with "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe" counts automatically, and if someone replies with other words you must treat it as a revocation "if a reasonable person would understand those words" that way. You cannot make one channel the only way to opt out: senders "may not designate an exclusive means to request revocation of consent."

On timing, the rule says all revocation requests "must be honored within a reasonable time not to exceed ten business days from receipt". Paragraph (a)(12) allows one confirmation text after an opt-out, provided it "merely confirms" the request, contains no marketing and is the only further message. If it goes out within five minutes it is presumed to be covered by the original consent. If you send several kinds of texts, that confirmation may ask which ones the person wants to stop, but you must stop all of them unless they say otherwise.

If your texting system cannot receive replies, each message must say so and give "reasonable alternative ways to revoke consent." CTIA's guidance points the same way: support opt-out by "phone call, email, or text," use standard STOP wording, and send "one final opt-out confirmation message per campaign."

US: calling hours and do-not-call lists

Under paragraph (c), telephone solicitations may not be made to a residential subscriber "before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)", or to a number on the national Do Not Call registry, unless an exception applies such as a signed written agreement to be contacted. Paragraph (d) requires anyone doing telemarketing to keep their own do-not-call list, with a written policy and trained staff. As noted above, paragraph (e) applies these rules to marketing texts to mobile numbers. Send in the recipient's time zone, not yours.

Carrier rules: CTIA and 10DLC registration

Separately from the law, US carriers set rules for business texting. The CTIA principles ask that a sign-up "Call-to-Action" tells people the program description, the number messages will come from, who is sending, any fees, and how to opt out, with customer care and privacy details. For recurring messages, senders should send a confirmation that includes "a disclosure that the messages are recurring and the frequency of the messaging". CTIA also lists what to record as proof of each opt-in, including the timestamp, the method, the wording shown, the campaign, the IP address and the phone number.

If you text from an ordinary 10-digit number, you will also meet 10DLC. According to The Campaign Registry, "any business that wants to use a SMS on 10DLC to communicate with their customers and/or employees is required to register", including businesses sending individual non-marketing messages. You register a brand (your business) and a campaign (the use case, such as Marketing or Customer Care). Businesses do not register with the registry directly; your texting provider does it for you. Describe the use you actually have, so the campaign type matches the messages you send.

UK: PECR regulation 22

PECR's definition of "electronic mail" expressly "includes messages sent using a short message service", so marketing texts follow the same rule as marketing email. Regulation 22(2) says you may not send unsolicited direct marketing by electronic mail to individual subscribers "unless the recipient of the electronic mail has previously notified the sender that he consents for the time being" to it.

Regulation 22(3) gives the "soft opt-in" exception, which applies only where all three are true:

• you got the person's contact details "in the course of the sale or negotiations for the sale of a product or service" to them;
• the marketing is about your own "similar products and services only"; and
• they were given "a simple means of refusing" when you collected the details and in every message since.

Since 5 February 2026, a new regulation 22(3A) gives registered charities a similar exception for supporters. Regulation 22 applies to individual subscribers; for texts to company numbers, check the regulator's guidance for your case. Every marketing text should still say who it is from and how to stop.

A practical checklist

• Decide which of your texts are conversational, informational or promotional.
• Collect marketing consent with a separate, unticked box and clear wording, not buried in terms.
• Store the consent record: time, form, wording shown, number and campaign.
• Send a confirmation text for recurring programs, with frequency and STOP instructions.
• Honour STOP and plain-language opt-outs from any channel, within ten business days at most (sooner is better), and send at most one confirmation.
• Send marketing only between 8 a.m. and 9 p.m. in the recipient's time zone, and check do-not-call lists.
• Ask your texting provider to register your brand and campaign for 10DLC.
• Never buy or rent phone lists. For customer service chat, see also WhatsApp Business for customer messages, which has its own opt-in rules.

Frequently asked questions

Do I need written consent to send marketing texts in the US?

The FCC rule in 47 CFR 64.1200(a)(2) requires prior express written consent for telemarketing calls and texts sent with an autodialer or prerecorded voice, and the CTIA carrier guidance expects express written consent for all promotional texts. A signed web form or checkbox can qualify if it meets the rule's disclosure requirements. This is general information, not legal advice.

How fast must I stop texting someone who replies STOP?

Under 47 CFR 64.1200(a)(10), revocation requests must be honored within a reasonable time not to exceed ten business days from receipt. You may send one confirmation text without marketing content; if it is sent within five minutes it is presumed to be covered by the earlier consent.

Can I make customers opt out only by replying STOP?

No. The FCC rule says senders may not designate an exclusive means to request revocation of consent, and a request made by any reasonable method counts. CTIA also asks senders to accept opt-outs by phone call, email or text.

What is 10DLC registration?

It is the US carriers' registration system for business texting from ordinary 10-digit numbers. The Campaign Registry says any business using SMS on 10DLC must register its brand and campaign, which is done through your texting provider, not directly.

Do UK rules allow marketing texts without consent?

Only under the soft opt-in in PECR regulation 22(3): you got the number during a sale or negotiations for a sale, you market only your own similar products and services, and you offered a simple way to refuse when collecting the number and in every message.

Need sign-up forms that collect and record SMS consent properly? See our website development service and all our services, or email [email protected].