SMS consent rules in 2026 require every business sending marketing texts to obtain prior express written consent before messaging any contact. Under theTelephone Consumer Protection Act, this consent must be affirmative, informed, and documented. With carriers tightening deliverability requirements through 10DLC registration and TCPA enforcement remaining active, getting SMS consent right is the operational foundation of any business text messaging programme that delivers results without legal exposure.
What TCPA and 10DLC Mean for Business SMS in 2026
Two distinct compliance frameworks govern sms marketing in the United States:
TCPA (Telephone Consumer Protection Act)
- Federal law governing all business text messaging
- Requires prior express written consent before sending marketing messages
- Mandates clear sender identification in every message
- Requires immediate honouring of opt-out requests
- Violations carry penalties of $500 to $1,500 per message
10DLC (10-Digit Long Code)
- Carrier-level registration from AT&T, Verizon, and T-Mobile
- Requires brand and campaign registration with The Campaign Registry
- Part of registration requires demonstrating how contacts opt in
- Rewards compliant senders with better deliverability
- Filters and penalises unregistered senders regardless of content
The most important distinction: 10DLC registration and TCPA compliance are entirely separate requirements. Completing one does not satisfy the other. Industries running bulk sms campaigns including auto dealer text messaging, healthcare sms, and mass texting for schools must have both in place before campaigns go live.
The Three Levels of SMS Consent Under TCPA
1. Implied Consent
- Applies only when a customer initiates a conversation with your business
- Covers conversational messages such as customer support only
- Does not permit promotional or marketing messages under any circumstances
2. Prior Express Consent
- Granted when a customer agrees verbally or in writing to receive future messages
- Covers informational and transactional messages such as appointment reminders and order confirmations
- Applies to medical text messaging and sms for transportation delivery updates
3. Express Written Consent
- Required for all marketing and promotional messages without exception
- Customer must knowingly agree in writing to receive promotional content from your specific business
- Required for restaurant sms marketing, real estate text marketing, text recruiting, and all promotional campaigns
Critical compliance point: Having a phone number for one purpose does not constitute consent for marketing. A billing phone number at checkout is not consent for promotional texts. Each distinct messaging purpose requires its own documented consent basis.
Single Opt-In vs Double Opt-In
Single opt-in: Customer submits their number and is added after one action. Satisfies minimum TCPA requirements with compliant form language but carries higher risk of fake numbers and weak consent documentation.
Double opt-in: Customer submits their number, receives a confirmation text asking them to reply YES, and is only added after that confirmation. Provides stronger documented proof of consent, a cleaner subscriber list, lower complaint rates, and better 10DLC deliverability scores. The recommended standard for any business text messaging service operating at scale.
8 Compliant Methods for Collecting SMS Opt-In Consent
1. Keyword text-to-join Customer texts a word such as JOIN to your number and receives an automatic compliant confirmation. Effective for restaurant texting and text message marketing for small business campaigns.
2. Web form with unchecked consent checkbox Customer actively checks an unchecked box alongside their phone number. Consent language must state what they are agreeing to receive, from which business, at what frequency, and how to opt out. Works for texting services for nonprofits and school texting service flows.
3. Checkout page opt-in A distinct SMS opt-in field at checkout, separate from the billing phone number, with clear consent language and an unchecked checkbox. Covers only the specific messaging purpose disclosed at checkout.
4. QR code to opt-in form QR code in-store or on packaging directing customers to a digital opt-in form. Best paired with double opt-in. Works well for auto dealership text messaging and dealership texting services.
5. Paper form Used at events or physical locations with an active checkbox and a clear consent disclaimer. Records must be scanned and stored digitally for compliance purposes.
6. Verbal consent with written confirmation Verbal agreement followed immediately by a confirmation text the customer accepts. Used in healthcare text messaging and sms recruitment contexts.
7. Email-to-SMS opt-in Email inviting existing subscribers to opt into your SMS programme via a compliant form. Existing email subscribers are not automatically consented to SMS. This is a separate permission.
8. Social media and digital advertising Promoting a keyword or opt-in form through paid social or digital ads. The ad must include the same consent disclosures required on any other opt-in method.
TCPA Compliant SMS Opt-In Confirmation Message: Requirements and Template
Every confirmation message sent immediately after opt-in must include:
- Your business name or brand identifier
- A clear description of the message types the subscriber will receive
- Expected message frequency such as up to 4 messages per month
- A note that message and data rates may apply
- Opt-out instructions such as reply STOP to unsubscribe
- Customer support instructions such as reply HELP for assistance
- A link to your terms and conditions and privacy policy
Compliant confirmation template: “Thanks for joining [Business Name] SMS updates. You will receive up to [X] msgs per month about [purpose]. Msg and data rates may apply. Reply STOP to unsubscribe or HELP for support. Terms: [Link]”
SMS Opt-Out Rules Under TCPA: What Businesses Must Do in 2026
When a customer replies STOP, or any variant including UNSUBSCRIBE, CANCEL, END, or QUIT, all marketing messages to that number must cease immediately:
- Penalties of $500 to $1,500 per message apply for any send after a STOP reply
- All recognised opt-out keywords must be honoured automatically
- High opt-out rates trigger carrier filtering that reduces deliverability across your entire programme
- Manual override of opt-out lists is never permitted under any circumstances
SMS Consent Record Keeping: What to Document and How Long Under TCPA
For every opt-in, records must include:
- The subscriber’s phone number and date and time of opt-in
- Method of consent such as web form, keyword, or verbal
- The exact consent language presented to the subscriber
- A copy of the confirmation message sent and any reply received
- Date of any opt-out and the method through which it was received
Retain records for a minimum of four years, aligned with the standard TCPA statute of limitations.
Industry-Specific SMS Consent Requirements
Healthcare SMS Consent: TCPA and HIPAA Requirements
Healthcare text messaging involving Protected Health Information must comply with both TCPA and HIPAA. Consent for appointment reminders does not extend to clinical messaging.
Education SMS Consent: Parental Permission Requirements
Text messaging for schools involving minors requires parental or guardian consent. Each parent or guardian must have an individual consent record.
Recruiting SMS Consent: Candidate Outreach Compliance
Text recruiting platforms must obtain consent before any candidate outreach. Submitting a resume does not constitute consent to receive SMS messages.
Real Estate SMS Consent: Third-Party Platform Gaps
Sms marketing for real estate agents must ensure leads from third-party listing platforms have consented to receive texts from that specific agent, not just the platform.
Nonprofit SMS Consent: Donor Communication Rules
Texting platforms for nonprofits must obtain consent before sending donation appeals. Prior donation does not constitute consent for marketing texts.
Auto Dealer and Heavy Equipment: Campaign Scope Limits
Automotive text messaging and heavy equipment sms marketing service reminder consent does not extend to promotional sales campaigns. Each campaign type requires its own consent basis.
How SendHub Makes SMS Compliance Manageable
- Double opt-in system automatically collecting confirmation from every subscriber with timestamped records stored without manual tracking
- Text keywords creating compliant opt-in flows for different campaigns and audience segments
- Automatic STOP handling immediately suppressing opted-out numbers from all future sends
- Consent audit logs recording date, time, method, confirmation, and opt-out events for every subscriber
- SMS marketing software with built-in tools managing consent, opt-out processing, and message frequency
- 10DLC registered messaging ensuring carrier-trusted delivery with brand and campaign verification in place
Conclusion
In 2026, TCPA enforcement is active, carrier standards are tightening, and the cost of non-compliance is higher than ever. The businesses that build consent collection, documentation, and opt-out management into their operations from the start are the ones that scale their business text messaging service without legal exposure or carrier filtering slowing them down.
Frequently Asked Questions
TCPA consent is the legal requirement to obtain permission from each recipient before sending marketing messages. 10DLC is the carrier requirement to register your brand before sending at scale. Both are required and neither satisfies the other.
Transactional messages require prior express consent. Marketing and promotional messages require the higher standard of express written consent. Each message type has its own consent requirement.
Not for marketing without a separate opt-in. A billing phone number does not equal consent for promotional messages. A distinct SMS opt-in with compliant consent language is required.
All marketing messages must stop immediately. Penalties of $500 to $1,500 per message apply for any send after a STOP reply. Recognised keywords include STOP, UNSUBSCRIBE, CANCEL, END, and QUIT.
No. Purchased lists do not meet TCPA requirements for express written consent. Every contact must have explicitly opted in to receive messages from your specific business directly.
Your business name, message types, frequency, message and data rate notice, opt-out instructions, and a link to your terms and privacy policy.
A minimum of four years, aligned with the standard TCPA statute of limitations, including the method, consent language, confirmation message, and any opt-out event.
Single opt-in adds a customer after one form submission. Double opt-in requires a second YES reply, providing stronger documented proof of consent and better deliverability performance.
