SMS Compliance Made Easy: Tips for Business Owners

Sending SMS messages allows your brand to send promotions to customers' smartphones in the form of a text message and can increase web traffic and sales.

However, it's important to keep in mind that SMS is a regulated marketing channel with federal laws in place to protect consumers. For example, sending someone a text message from your business is illegal unless they've given you explicit consent.

Before you upload your contacts to an SMS marketing software, you should be aware of the legal implications of SMS marketing. This article will discuss everything you need to know about SMS compliance to avoid penalties that can cost your business.

What is SMS compliance?

SMS marketing compliance is the set of laws and carrier rules governing how businesses send marketing text messages. In the US, compliance rests on three things: prior express written consent from every recipient, a working opt-out in every message, and sending only during permitted hours.

The Telephone Consumer Protection Act (TCPA) is the federal law behind most of it. The CTIA — an association of wireless carriers — publishes guidelines that carriers enforce directly, which matters because a carrier can block your messages long before a regulator ever contacts you. Both sets of rules apply at once, and meeting one does not satisfy the other.

The underlying concern is privacy. Phone numbers are personal data, and the rules dictate how you collect them, what you may do with them, and what you must tell people at the moment they hand them over. If you already run email marketing, the shape of this will be familiar — but SMS is stricter, and the penalties are assessed per message.

Consumers are alert to it. When US consumers were asked why they don't complete a signup form, the most common answer — from 49.3% of them — was worry about receiving too many emails or texts.3 Good consent management isn't only a legal obligation; it's the thing that makes people willing to opt in at all.

In addition, you must respect when a customer opts out of receiving your business text messages. If you use email marketing to connect with customers, these rules aren't new. You should already know that your subscribers must opt-in to comply with various rules and regulations.

While SMS marketing and email are similar, they have several key differences, including the types of fonts and graphics used, character counts, and compliance. SMS compliance differs in one key aspect: when you can send text messages.

With SMS compliance, there are federal and state laws that determine when you can send marketing text messages to customers because their smartphones are typically with them any time of day, and your texts could interfere with their daily lives.

For example, you can't text someone at midnight when they're most likely sleeping.

SMS compliance for businesses

SMS compliance is crucial for business owners because it protects the consumer and the business. With rules in place dictating who you can text and when, you can ensure your SMS marketing efforts are effectively reaching the right people at the right times.

However, these laws are in place primarily to protect the consumer. Maintaining SMS compliance is crucial because it can affect your reputation and result in fines if you fail to comply.

In addition to avoiding fines, SMS compliance ensures that your business won't end up on any blacklists affecting its ability to send SMS marketing campaigns to customers.

Phone carriers are cracking down to help eliminate spam in their customers' text apps, which can result in your business getting blacklisted.

SMS compliance benefits businesses because it can protect individuals from receiving text messages they don't open or take action on. Instead, you can ensure you're reaching the right customer at the right time.

What are TCPA and CTIA guidelines?

TCPA requires five things before and during every marketing text: prior express written consent, clear disclosure of what the subscriber is agreeing to, sender identification in your messages, a working opt-out honored promptly, and records proving each subscriber consented. CTIA guidelines add carrier-enforced requirements on top, including message frequency disclosure and restrictions on prohibited content.

Requirement	Set by	What it means in practice
Prior express written consent	TCPA (law)	A deliberate, documented action — a checked box, a submitted form, a texted keyword. A phone number given for another purpose is not consent.
Clear disclosure at opt-in	TCPA + CTIA	Say what kinds of texts they'll get, roughly how often, that message and data rates may apply, and how to stop.
Sender identification	CTIA (carrier policy)	Your brand name appears in the message. Required in the first message and good practice in all of them.
Working opt-out	TCPA + CTIA	STOP must work, every time, and take effect promptly. Include the instruction in your messages.
Proof of consent	TCPA (law)	Records of who consented, when, and how. In a dispute the burden of proof is yours, not the complainant's.
Quiet hours	TCPA + state law	8 am to 9 pm in the recipient's time zone federally. Several states are stricter.
Content restrictions	CTIA (carrier policy)	Carriers block categories known as SHAFT — sex, hate, alcohol, firearms, tobacco — plus loans, cannabis, and gambling.

The practical difference between the two is who comes after you. Violate TCPA and you face regulatory penalties and private lawsuits, assessed per message — which is why a single bad campaign to a large list gets expensive quickly. Violate CTIA guidelines and carriers simply stop delivering your messages, often without telling you why. The second happens faster and is far more common. For a working list of what to verify before you send, see our TCPA compliance checklist.

Cold texting is illegal, so it's never a good idea to send text message marketing to customers who haven't agreed to receive them.

In addition, SMS compliance prohibits the use of purchased contact lists from a third party, finding customers' phone numbers online, and obtaining someone's phone number using methods they haven't approved of.

Several regulatory bodies determine SMS compliance guidelines, but two of the most important to understand are TCPA and CTIA. The Telephone Consumer Protection Act (TCPA) is a decades-old legislation ensuring telemarketing compliance.

As the Act was written in 1991, it doesn't contain any language specifically about SMS marketing, but texts are treated as calls to protect individuals from receiving unsolicited messages.

The Cellular Telecommunications Industry Association (CTIA) is a group of wireless carriers and other industry businesses that maintains guidelines for SMS marketing to protect consumers from receiving unsolicited text messages.

The CTIA takes their guidelines a bit further to provide marketers with instructions to improve their customer experience when using SMS marketing, with rules such as:

• Displaying a clear call to action to ensure customers understand what they're signing up for (marketing communications via text)
• Having a clear opt-out process
• All texts to customers must include your brand's name

Guidelines from both governing bodies should be followed to ensure you're compliant when sending marketing messages to your customers.

TCPA is a federal law that requires you to obtain express written consent from customers before sending them marketing text messages. If you fail to comply, you can be sued and receive penalties in the form of fines per text sent.

When can you send marketing texts? Quiet hours and state rules

Federally, you may send marketing texts between 8 am and 9 pm in the recipient's local time zone. The deciding factor is where your subscriber is, not where your business is — so a 9 am send from New York reaches a California subscriber at 6 am and breaks the rule.

Three situations change the answer:

• Your list spans multiple time zones. Segment by time zone and schedule per segment, or confine sends to a window that is safe everywhere — 11 am to 9 pm ET covers the continental US.
• You have subscribers in stricter states. Several states impose narrower windows or additional registration requirements, and a few treat Sunday sends differently. Check the rules where your subscribers actually live, not just where you operate — our guide to text messaging laws by state breaks these down.
• You're sending transactional rather than marketing messages. Order confirmations, shipping updates, and appointment reminders are generally not subject to marketing quiet hours, because they're responses to something the customer did. The line matters: adding a promotion to a shipping notification can reclassify the whole message as marketing.

If you send outside the US, assume nothing carries over. Mailchimp SMS Marketing is currently available in 37 countries and territories globally, including 34 in Europe, and the consent and timing rules differ in each one.

Common mistakes to avoid for SMS marketing compliance

SMS compliance is fairly easy as long as you understand how to obtain consent. However, new business owners or those trying SMS marketing for the first time are prone to make mistakes.

Unfortunately, any mistake you make can result in fines that can affect your business's bottom line, so it's crucial to know what they are and how to avoid them. Common mistakes to avoid include the following:

Age-restricted products

Brands must verify their subscribers' ages if they plan to send promotions about age-restricted products. For example, if you're an alcohol company, you must verify that a subscriber is 21 years of age in the US before sending them promotional texts.

Alcohol, tobacco, and firearms fall into the carrier category known as SHAFT, which carriers filter aggressively. Age verification is what keeps a legitimate campaign in this category deliverable — without it, you risk a SHAFT violation and the carrier blocking that follows.

Shopping cart recovery texts

Shopping cart recovery emails are a crucial part of any digital marketing strategy for eCommerce businesses because they remind your customers they've left something behind and encourage them to return to your site and finish checking out, ultimately increasing your sales.

Unfortunately, you can't use this same strategy with texts. Many wireless carriers have rules about shopping cart recovery texts. For example, you may not comply if you don't mention that these types of texts can be sent during the opt-in process.

Customers may not be willing to receive these reminders via text, so it's crucial to be clear about the types of text messages they might receive when they opt in.

Not offering an opt-out option

According to all current SMS compliance guidelines, your text messages must provide an opt-out for subscribers that allows them to cease communication with your brand.

Your opt-out requests process might be asking them to reply "STOP" to stop receiving messages, or you might send them hyperlinks to opt out of text messages while personalizing other settings like determining the types of texts or emails they want to receive from your business.

Opt-outs are normal and not a sign of a failing program. Mailchimp SMS Marketing has an average unsubscribe rate of 1.3%.1 A rate far above that usually points at frequency or relevance rather than a compliance fault — but a rate of zero is worth investigating, because it often means opt-outs aren't being processed correctly.

Not getting consent

This is probably one of the biggest mistakes most businesses new to SMS marketing make. Email and SMS compliance are relatively new concepts. Just a few years ago, businesses could purchase emails and phone numbers from third parties, and there wouldn't be any consequences, even though this practice is technically prohibited.

However, as mobile carriers, email providers, and the federal government crack down on consumer privacy, not getting consent before communicating directly with your customers is considered illegal.

You must get express written consent that ensures customers understand what they're opting into. If your policy isn't clear, you may be fined for sending the wrong types of texts without getting your subscribers' consent.

For example, you can get consent to send marketing text messages to your customers only to find out that certain types of marketing messages are prohibited because you didn't include them in the opt-in call-to-action or description.

Consumers are well practiced at both ends of this. Among US consumers surveyed, 64.9% had opted in to texts from a brand in the past two years — and 50.5% had replied STOP to a brand's texts in the same period.3 People know how to leave. How you collect SMS opt-ins determines whether they stay.

How to obtain consent for SMS marketing

As we've mentioned, one of the most crucial components of SMS compliance is ensuring you have express written consent to send your subscribers promotional or transactional text messages.

Again, as we've mentioned numerous times (because we can't highlight the importance enough), you should never send SMS campaigns to anyone without their express permission. Ultimately, you want to make sure people actually want to receive SMS messages from your business.

Just because you have a customer's phone number doesn't mean you can add it to your text message marketing contacts list. Customers often provide businesses with their mobile phone numbers for a variety of reasons, so don't automatically assume they want to be a part of your marketing SMS program.

Maybe you require a phone number as part of the checkout process, or maybe your customer has called your business before.

Regardless of how you've obtained it, if you haven't explicitly told your customer that providing your business with their personal information gives you permission to text them, you can't do it.

Consider your opt-in process, form, and various policies on your website as contracts. These contracts protect both you and the subscriber by ensuring both parties agree to the terms and conditions. For example, if a customer has not agreed in writing to allow your business to text them, it's illegal to do so.

Your subscribers' consent must be obtained in writing, but that doesn't mean they have to sign an agreement like a contract. Instead, you can create an opt-in process with a form that describes the types of text messages subscribers may receive from the brand.

Forms are typically the easiest way to obtain consent, and most SMS marketing platforms allow you to create forms you can embed on your website with automation enabled that add the new contact directly to your lists.

Here are some tips to ensure SMS compliance and obtain express written permission from subscribers:

Use clear language

TCPA text message compliance requires an opt-in process, whether it's a form or a page on your site, to explain what subscribers agree to.

For instance, you can list the types of texts they might receive, such as abandoned cart texts, promotional, and company news texts. You should also include the text message frequency, data rate messaging, and opt-out instructions according to CTIA guidelines.

Provide a checkbox that is unchecked by default

The easiest way to ensure you have a customer's express consent to send them promotional texts is to provide a checkbox that's unchecked by default. Making the customer check the box ensures they've read everything on the page and have made the conscious decision to agree to it.

It might be tempting to make the box checked by default to grow your subscriber list, but this can leave you open to penalties because it doesn't follow compliance guidelines.

Ultimately, your customers must be the ones to check the box, which is an action of agreeing to the terms set forth by the opt-in page or form.

Offer an easy opt-out

Consent doesn't just focus on opt-ins; you must provide an easy method for opting out of SMS communications.

This is a legal requirement of any brand using SMS marketing, so ensuring your customers can opt-out at any time is crucial. You can include information on how to opt-out on your form and in your text messages.

For example, many brands allow certain language for opt-outs, such as STOP, CANCEL, and UNSUBSCRIBE. You can choose which of these you want to use and inform your customers of the right word to use when they no longer want to receive your text messages.

Then, you should include this information in every text you send. For example, you can end every promotional text with "Reply STOP to unsubscribe from marketing communications."

Once a customer opts out, you should ensure they're actually opted out and will no longer receive text messages. If you're using a reliable SMS marketing platform, this option should be enabled for you, which will remove customers who have unsubscribed from any active contact lists.

Use a double opt-in process

A double opt-in process will protect your business from any compliance issues.

For example, it's possible for someone not to realize they're signing up for text message marketing if they're not paying attention while filling out a form on your site. Someone might enter any random phone number, so you might be texting someone who didn't actually opt-in to receive text messaging.

The message might say something like, "Welcome to [Brand Name] texts! Reply YES to confirm you want to receive promotional offers and updates. Msg & data rates may apply. Reply STOP to opt out."

To avoid these issues, you should always use a double opt-in process, which consists of sending a text to the phone number that opted in and confirming that they want to receive your texts.

Keep records of consent

Keeping records of consent will ensure you remain in compliance at all times.

Since the penalties for noncompliance are steep and can open your business up to a class-action lawsuit, obtaining proof is crucial. Therefore, your SMS marketing platform should keep a record of everyone who has consented to receive your texts and how they consented.

If you collect phone numbers for marketing purposes using another method, you should keep written records. For example, if you talk to your customers on the phone regularly, you should make a note of any that have agreed in person or via phone.

In those cases, it's especially crucial to use a double opt-in process to obtain written documentation of their consent.

How to create compliant SMS campaigns

While consent is one of the most significant components of remaining SMS compliant, the content within your text messages can be non-compliant.

Even if you obtain consent, your actual SMS campaigns must also remain in compliance to ensure customer privacy, avoid prohibited content, and ensure you're avoiding "quiet times" determined by regulatory bodies.

Content guidelines for SMS messages

There are several types of messages you can send to your customers, and each has different compliance requirements.

• Transactional messages: These communicate important information about a customer's relationship with your business, like order confirmations, shipping notifications, and appointment reminders. Make sure your opt-in form mentions that subscribers may receive these types of texts.
• Conversational messages: These are back-and-forth communications between customers and your business, often used for customer service. When a customer texts you first, they've already given consent for you to reply.
• Promotional messages: These are regular marketing texts that promote your brand, products, services, and deals. They usually include a call to action with a link to your website. You need written consent to send promotional text messages, so describe this clearly in your opt-in process.
• Prohibited content: Wireless carrier guidelines restrict certain types of content. You can't send promotional texts about sex, hate, alcohol, firearms, loans, cannabis, gambling, and several other topics.

Frequency and timing of SMS messages

As we've mentioned, you're restricted to the times you can send SMS campaigns. Unlike emails, which you can send any time of day, the TCPA has guidelines for quiet hours. Ultimately, you can send messages between the hours of 8 am and 9 pm.

Anything before or after that is illegal, so it's crucial to determine your subscribers' time zones. If you have customers throughout the nation or world, you should consider segmenting them based on where they're located.

Opt-out options for recipients

As we've mentioned, having opt-out options is just as crucial as having consent. Your subscribers must be allowed to opt out of text messaging at any time, and you should have clear instructions for how they can do this. You should continuously provide these instructions throughout your SMS campaigns and have information about opting out on your website.

SMS compliance checklist

Run through this before your first send, and again whenever you change how you collect numbers.

Check	What good looks like
Consent is documented	Every number traces to a dated, recorded opt-in action. No purchased lists, no numbers collected for another purpose.
Your opt-in language is complete	Message types, frequency, "message and data rates may apply", and how to stop — all visible before the person opts in.
The checkbox starts unchecked	Consent is an action the subscriber takes, never a default they fail to undo.
STOP works and is tested	Send yourself a test, reply STOP, confirm you stop receiving messages. Review your SMS opt-out language for clarity.
Your brand name is in the message	Recipients can tell who is texting them without opening a link.
Sends respect local time	8 am to 9 pm in the recipient's time zone, with stricter state rules applied where relevant.
Content clears SHAFT and carrier rules	No restricted categories, or age verification in place where the category allows it.
Records are retrievable	You can produce proof of consent for any subscriber, on request, without reconstructing it.

For wording that makes opting out unmistakable, see our guide to SMS opt-out language.

What about WhatsApp? Compliance for business messaging

WhatsApp is governed by Meta's own Business Messaging Policy rather than by TCPA, but the underlying obligation is the same: you need opt-in before you message someone, and you must honor opt-outs. What differs is who enforces it and how fast. Meta can restrict or remove a business account directly, with no regulator involved.

Three rules matter most if you're adding WhatsApp alongside SMS:

• Opt-in is channel-specific. Consent to receive texts is not consent to receive WhatsApp messages. You need a separate, documented opt-in that names WhatsApp specifically, and the phone number being the same does not carry permission across.
• Template messages need approval before you send them. Business-initiated messages outside an active conversation window must use a template Meta has reviewed. Plan for review time, and expect promotional templates to face more scrutiny than transactional ones.
• Quality ratings are enforced automatically. Meta scores accounts on how recipients respond — blocks and reports lower your rating, and a low rating cuts your messaging limits. There's no equivalent in SMS, where carrier filtering is less visible and less reversible.

The channel is worth the extra process for many businesses. According to Meta, 80% of people globally already message with a business weekly on WhatsApp.4 If you're weighing it against SMS, our comparison of WhatsApp Business accounts covers how the two differ in practice.

One caveat: WhatsApp's rules are set by Meta and change more often than TCPA does. Treat any compliance checklist for WhatsApp — including this one — as a starting point to verify against Meta's current policy, not as a settled answer.

Where Mailchimp helps with SMS compliance, and where it doesn't

A platform can automate parts of compliance and cannot touch others. Being clear about the split is what keeps you out of trouble.

Mailchimp handles	You remain responsible for
Processing STOP replies and removing opt-outs from active lists	Whether your original opt-in was valid in the first place
Storing consent records captured through our forms	Consent collected offline, by phone, or on another platform
Signup forms and popups that can carry compliant opt-in language	Writing that language to match what you actually send
Scheduling and audience segmentation	Knowing which quiet-hours rules apply to each segment
Delivery infrastructure and carrier relationships	Message content, and whether it clears carrier restrictions

No SMS platform can make a non-compliant program compliant, and any vendor who tells you otherwise is selling something. What a platform does is remove the mechanical failure points — the missed STOP, the lost consent record — so the judgment calls are the only thing left for you to get right.

Running both channels together is also where the operational case sits: Mailchimp users saw up to a 2x higher click rate when they used both Email and SMS.2

Stay up-to-date with SMS regulations

SMS compliance laws can help businesses stay compliant and ensure their customers receive their texts and have the best experiences with their brands. It's crucial to stay up to date with SMS compliance regulations to review changes to TCPA and CTIA guidelines and understand the consequences of noncompliance.

In practice, that means a scheduled review rather than a reaction to bad news. Check your opt-in language and consent records once a quarter, and re-check whenever you add a collection point, enter a new state, or change what you send. Most compliance failures aren't a misread rule — they're a form someone added two years ago that nobody updated.

Ensure text message compliance with Mailchimp. Create opt-in forms, terms and conditions, privacy policies, and more with our website and form builders. Then use our text messaging options to communicate with your customers.

Disclaimers

1 SMS Marketing unsubscribe rate: Based on the average weekly rate of SMS Marketing messages sent by Mailchimp users from 10/27/24 to 10/12/2025.

2 Up to 2x Higher Click Rate: Based on US Mailchimp users who sent both email and SMS campaigns compared to users who sent email-only campaigns from 8/1/23 to 7/28/26. Individual results may vary.

3 Consumer figures from The Art of the Opt-In, an Intuit Mailchimp consumer survey (total n=6,192 across the United States, Canada, the United Kingdom, and Australia/New Zealand; US base n=1,637). Figures cited are for US respondents.

4 Based on a 2024 global study commissioned by Meta and conducted by Kantar. Individual engagement may vary.

Article Metadata & Publishing Requirements

.com	Title: Hero, Recirc title, H1	SMS Compliance Made Easy: Tips for Business Owners
	Dek: .com Hero	Learn how to stay compliant with SMS marketing regulations and avoid costly fines. Our easy tips will help business owners maintain SMS compliance.
	Article hero image:	N/A
	Route/URL:	https://mailchimp.com/resources/sms-compliance/
Meta	Title: Search engine results	SMS Compliance: TCPA and CTIA Rules Explained | Mailchimp
	Description: Recirc and search desc.	SMS compliance means getting express written consent, honoring opt-outs, and texting only between 8 am and 9 pm. Here's what TCPA and CTIA require.
	OG Title: Social "| Mailchimp" displays after title automatically	SMS Compliance: TCPA and CTIA Rules Explained | Mailchimp
	OG Desc: Social	SMS compliance means getting express written consent, honoring opt-outs, and texting only between 8 am and 9 pm. Here's what TCPA and CTIA require.
	Image: Social, Recirc, Meta
	Image Alt text: Social, Recirc
CTA	Button copy: ( 25 char ) Below article	N/A
	URL:	N/A