SMS Compliance: What It Is & How to Stay Compliant

Mobile messaging has proven itself to be one of the most effective ways for brands to engage with their audience, with the SMS marketing size in the U.S. growing at a CAGR of 20.5%, expecting to reach $15.86B by 2033.

Before you integrate this powerful practice into your marketing strategy it’s important to understand that mobile messaging comes with text message compliance rules, which are a regulatory set of laws and requirements that businesses must follow when using SMS or RCS to communicate with your customers to ensure nobody receives a text message from you that they did not want or sign up to receive.¹

What Is SMS Compliance? 

SMS compliance are regulatory rules and laws established by several organizations and legislatures across the country that are to be abided by when sending out marketing text messages. These rules break down into two key sets of SMS compliance regulations: CTIA & Carrier compliance and Legal compliance.

SMS compliance exists to protect consumers' privacy rights and to prevent them from receiving unsolicited text messages from businesses. It emphasizes consumer privacy by requiring explicit, documented consent to be provided by every consumer to a business before text message communication can begin.

The Importance of SMS Compliance

No one wants phone calls, emails, direct mail, or text messages they didn’t sign up to receive.

SMS marketing compliance requirements elevate the effectiveness and credibility of text message marketing. Consumers know they can trust the businesses they receive SMS messages from, and businesses know they’re reaching consumers who want to hear from them.

If SMS marketing compliance isn’t followed, steep penalties such as fines or legal action may follow.

Industry rules and regulations establish specific parameters regarding what businesses can and cannot do with their text message marketing. They include:

• Who you can contact via mobile marketing—and when
• What potential subscribers need to know before they opt in
• How to manage opt-out requests

As SMS regulations change over time, it’s important to do your research to make sure you comply with the latest laws and requirements. Trusted mobile marketing partners who understand the importance of SMS marketing compliance can support your mobile efforts by keeping you informed on the changing carrier, CTIA, federal and state regulations. 

Who Makes the Rules for SMS Compliance?

There are several key parties that establish U.S. mobile marketing laws and regulations.

FCC

The Federal Communications Commission (FCC) is a government agency that monitors and regulates communications. It serves as the primary regulator for U.S. communications laws and technological innovation. 

State-specific 

Since a Supreme Court decision regarding text message solicitations (more on that in a moment), we’ve seen several states adopt their own sets of laws that apply to mobile messaging for the residents of those states. More states are expected to pass similar legislation in the near future.

CTIA

Formerly known as the Cellular Telecommunications and Internet Association, CTIA is a nonprofit that develops and monitors rules, regulations, and voluntary best practices to guide the mobile industry.

Wireless carriers

Wireless carriers like AT&T, T-Mobile, and Verizon may choose to impose their own guidelines for customers to follow when sending business-to-consumer marketing messages via text. While carriers can’t legally enforce laws, they can choose to take their own course of action if marketers violate their policies.

Companies are required to follow these carrier rules to be approved to send text messages on their network, which is one of the reasons why it is very advantageous to partner with mobile marketing companies who have direct carrier connections.

Google

When it comes to the use of Rich Communication Services, or RCS, Google has an Acceptable Use Policy that applies specifically to RCS agents. RCS violations of Google's AUP include but are not limited to explosive materials, weapons, partial nudity, gambling, and other restricted content categories that require special approval from Google, such as fireworks.

SMS Compliance Terms to Know

As you become familiar with SMS compliance rules, you’ll encounter several terms that are helpful to understand.

Call-to-action (CTA)

‍A CTA tells the consumer what steps they should take that will result in a text message. All mobile marketing programs must display a clear call to action that explains what consumers are signing up to receive—and how to proceed if they agree to these terms. Program terms must be fully listed within the displayed CTA, which includes:

• Product description & program name
• A disclosure that message & data rates may apply
• Message frequency (e.g. messages are recurring)
• Customer support contact information (e.g. customer support email)
• Opt-out instructions (e.g. Reply STOP to quit)
• Privacy statement or link to the privacy policy

Opt-in / opt-out messages

Opt-in messages give consumers an easy way to indicate that they agree to receive messages from a brand. Opt-out messages give consumers an easy way to decline further communication from the brand. Once a consumer joins your SMS program, explain how they can opt out. Consumers must be able to easily opt in and opt out whenever they choose.

Privacy Policy

‍A privacy policy is a legal document that discloses what kinds of personal information is being gathered from the consumer, how the information is used, and how it’s protected.

Terms & Conditions

‍Terms & conditions outline the relationship between the consumer and the business, including duties, rights, roles, and responsibilities.

Be straightforward and transparent about your program’s terms and conditions and privacy policy. Provide links to these documents in the call-to-action or opt-in prompt to ensure consumers are agreeing to those terms when they complete their signup into your mobile program. 

SMS Marketing Consent Requirements & Recommendations

When it comes to opt-in and consent requirements for SMS subscription programs, which are defined as programs that send text messages out to existing SMS subscribers on a recurring basis, the backbone that guides the elements involved in signing up for these programs is clear and explicit consumer consent. This spans from program CTAs being clear enough to ensure consumers understand what they're signing up for, to the initial text messages they receive on their mobile device after they take the action to interact with a brand via SMS.

Here's a breakdown of the SMS opt-in requirements and recommendations to include in a program's SMS messages:

Subscription prompt

A subscription prompt with a response command (e.g. reply Y) is a strongly recommended element of an SMS opt-in flow, which includes:

• Your brand name or program description
• A link to your mobile terms & conditions
• Prior Express Written Consent (PEWC) disclosures (more on this shortly)

Subscription prompts are only required by the CTIA for abandoned shopping cart reminder messages (more on this shortly as well).

Welcome message

Also referred to as an opt-in confirmation message, it is required to be sent before you begin sending subsequent messages to your subscribers. It must include:

• Your program name and/or product description
• Message frequency
• "Message and data rates may apply" disclosure
• Text STOP to cancel
• Customer support contact information

Ongoing messages

There are two key requirements for the ongoing text messages you send to your subscribers:

• You must always identify the product and/or program name
• Opt-out instructions and customer support information must be included in at least 1 marketing message per month

‍

‍

SMS Compliance Legal Considerations 

Marketers must not only be aware of the authorities when it comes to SMS compliance, but also recognize the regulations and laws these authorities put in place. 

TCPA

The Telephone Consumer Protection Act (TCPA) of 1991 established required national requirements for telemarketers and the use of automated telephone dialing equipment. Since then, it has been updated to include regulations for text message marketing as well. 

The TCPA requirements include but are not limited to:

• SMS participants must be able to easily opt out through any reasonable means, such as texting the word STOP to the number (known as a short code) they no longer want to receive messages from  

• Messages must be sent only within commercial texting times (8 a.m. to 9 p.m. local to the recipient’s time zone) 

• No more than one (1) message is allowed in response to an opt-out request, and further communication is prohibited unless that consumer signs up again

State-specific "mini" TCPA² 

These acts that apply only to residents of the states who've enacted their own include regulations such as:

• Residents cannot be contacted before 8 a.m. or after 8 p.m. local time in the recipient’s time zone

• The frequency of contacting residents is limited to no more than 3 messages or calls in a 24-hour period regarding the same subject matter or issue

• PEWC must be obtained before sending any commercial or marketing-based messaging

GDPR

Put into law in 2018, to protect privacy and personal data, General Data Protection Regulation (GDPR) applies to any country that wants to do business in the European Union or use its citizens’ personal data.

It maps out requirements about:

• Obtaining consent to send text messages
• Reporting security breaches to consumers right away
• Allowing consumers to access their personal data, reuse their personal data outside the business, and completely erase their data if they choose
• Deploying appropriate security measures to protect consumer data

Prior Express Written Consent (PEWC)

Before you can legally send marketing text messages, PEWC requires you to provide written disclosure in a clear, conspicuous location that outlines the following three points:

• The participant understands that “opting in” means they permit delivery of autodialed marketing messages to their mobile device
• The participant agrees to receive texts at the phone number they provide
• The participant understands that they’re not required to enter the agreement as a condition of making a purchase

PEWC also requires you to obtain the user’s written consent in agreement to the program terms prior to sending any commercial or marketing-based messages. Consent cannot be given verbally.

Users must opt in either through a text message or by filling out an online form, where PEWC language can be included so that written consent is properly established.

As shown below, the process of obtaining PEWC through a text message involves asking users to text a specific keyword (e.g. reply Y) to their brand’s short code:

‍

‍

We recommend asking your legal team to determine whether you should obtain PEWC for your mobile marketing programs, and here are a few considerations to keep in mind if you will be obtaining PEWC for them:

• Include PEWC language in a clear, conspicuous location, such as in your call to action or in the message that prompts the user to reply “Y” to complete their opt-in
• Consider an opt-in process like a text message or filling out an online form, where PEWC language can be included so that written consent is properly established
• Track the dates for any changes made to consent disclosures for new and existing programs, keeping a record of what has changed within the terms

Short Code Monitoring Handbook

Created by the CTIA, the Short Code Monitoring Handbook is a set of best practices that must be met to launch a mobile program on a wireless carrier’s network.

If these best practices are not followed, then it’s very likely that your program will not be approved to launch or may be shut down if already live.

The guidelines include recommendations about:

• Displaying clear calls-to-action to ensure consumers are aware of what they are signing up for
• Gathering consent for the messages consumers agree to receive, such as capturing consent via online forms or opt-in buttons
• Sending opt-in confirmation messages before sending subsequent messages to consumers
• Giving consumers an easy way to stop receiving messages

It's also a requirement to include customer support information and opt-out instructions in at least 1 SMS marketing message per month - most often this information is in the form of "text HELP for help, STOP to cancel".

‍

‍

Although they're required to be sent at least once per month, brands have the liberty to put customer support information and opt-out instructions in different messages. We recommend sending the opt-out instructions in a message with highly engaging content to help retain your customers, such as a monthly promotion or targeted content relevant to their preferences.

Real-World Consequences of Noncompliance

Every non-compliant text message sent that is considered a violation can collect damages of $500 to $1,500 per violation. If you’re sending text messages to your customers multiple times a week, the fines add up quickly.

National news about major companies across a variety of industries paints a true picture of the consequences of noncompliance, where consumers who didn’t opt into SMS marketing were receiving text messages and - in some situations - the messages continued after those consumers followed the appropriate steps to opt-out of further SMS communication.

These companies are now dealing with the impacts of noncompliance as they face class-action lawsuits that seek to help users recover damages from frequent unauthorized text messages.

Incidents like these can be avoided when you work with a trusted partner to ensure that every SMS marketing message you send complies with laws and regulations.

Uncommon SMS Compliance Mistakes You Should Know

Some SMS compliance mistakes seem more obvious than others.

For example, common SMS compliance mistakes often include actions that blatantly violate the law, such as sending messages without explicit consent, texting outside business hours, or not providing a simple way for users to opt out.

Other mistakes aren’t quite as obvious, but they can still result in company fines and penalties. Here are a few examples. 

Sending reminder messages about abandoned shopping carts.

All retailers struggle with managing online shopping cart abandonment and enticing those sales later.

When a shopper puts items in their online cart but never initiates a purchase, it makes sense to follow up with a text message to remind them to complete their order—right?

But many retailers don’t realize that some carriers have established guidelines detailing the dos and don’ts of sending cart-recovery reminder messages. In short: abandoned cart reminders can’t be sent on the carrier network unless it's explicitly stated in the call-to-action and opt-in process so that customers know they are giving clear consent on their willingness to receive these reminders.

To comply with these carrier rules, businesses must adjust their opt-in processes, update their privacy policies and terms & conditions, and follow specific rules about text content and frequency when sending cart recovery messages such as:

• Incorporating a double opt-in mechanism via a text message subscription prompt
• Explicitly stating the program includes shopping cart recovery reminders in the call-to-action, double opt-in subscription prompt, privacy policy and terms & conditions
• Collecting payment information from abandoned cart alerts via SMS or accepting approval for purchase via keyword confirmation (e.g. Reply PAY to confirm your purchase) is prohibited
• Sending reminder messages within a 48-hour period, with messages limited to one reminder per unique abandoned cart session

‍

‍

Promoting age-restricted products or services without verifying age.

Wireless carriers have strict restrictions on certain types of content. The most common content that's prohibited on one or more carriers is illegal or inappropriate content, such as sex, hate or firearms.

There are some exceptions when it comes to marketing any age-restricted products or services, such as alcohol or tobacco: a process called “age gating”, which is required when sending SMS messages. This includes messages that promote wineries, wine clubs, breweries, bars, nightclubs, tobacco sales, alcohol sales, liquor stores, etc. This ensures that the users who see and receive these messages meet the appropriate age requirements.

If your business sends alcohol or tobacco-related messages of any kind, then age verification needs to be part of the SMS program opt-in process. This is typically done through either the use of an age-gate opt-in process or by only disclosing program opt-in instructions in promotional placements that have already been age gated. Common “tap-to-join” functionality doesn't typically comply with these rules unless a step to capture and verify age information is included.

When it comes to marketing to and communicating with customers about cannabis or gambling, wireless carriers have strict restrictions around what they will allow on their network concerning the promotion of anything that is not legal at the federal level. Certain carriers will not support these messages, regardless of any prior approvals.

Assuming that a third-party texting service transfers liability.

Even when you outsource an outside vendor to send your text messages for your business, you are still responsible for the content of those text messages.

By law, for example, your business is liable for ensuring your SMS marketing messages comply with all SMS compliance rules. If something goes wrong, then you must contend with the consequences—including fines and penalties. 

SMS Compliance Checklist

Now that you have a general overview of what SMS compliance entails, we've put together the below checklist for you to follow (and to help make you a rock star in your legal team's eyes).

1. Display clear calls-to-action.

Make sure the call-to-action (CTA) - i.e. where consumers are told how to take an action that will result in a text message - to sign up for your mobile program is clear and easy to follow, to ensure consumers are aware of what they're signing up for.

2. List your full program terms within the CTA.

The program terms that must be included are:

• Product description & program name
• "Message and data rates may apply" disclosure
• Message frequency
• Customer support contact information (e.g. email agent@company.com)
• Opt-out instructions (e.g. Reply STOP to quit)
• Privacy statement or link to privacy policy
• PEWC disclosures (recommended)

If you're planning to run an abandoned cart reminder SMS program, all of the above applies along with the following nuances:

• Product description / program name must state that shopping cart reminders will be sent
• You must also link to the program's full terms & conditions

3. Confirm with your legal team if you should obtain PEWC for your SMS marketing program.

The U.S. Supreme Court’s Facebook, Inc. v. Duguid (141 S. Ct. 1163; 2021) decision regarding autodialer definitions may affect whether TCPA requirements apply to you, which is why we always recommend that you seek the advice of your legal team to determine whether you should obtain PEWC for your mobile marketing programs. If the answer is yes, here are a few considerations to keep in mind:

• Include PEWC language in a clear, conspicuous location, such as in your CTA or in the text message that prompts the user to reply “Y” to complete their opt-in
• Consider an opt-in process like a text message or filling out an online form, where PEWC language can be included in a manner that written consent is properly established
• Track the dates for any changes made to consent disclosures for new and existing programs, keeping a record of what has changed within the terms

NOTE: Abandoned shopping cart reminder SMS programs are currently required by the CTIA to obtain PEWC.

4. Follow these additional rules for abandoned shopping cart reminder SMS programs.

In addition to the above requirements already stated for abandoned shopping cart reminders:

• You also must explicitly state your program includes shopping cart reminders in privacy policies and terms & conditions
• Abandoned cart alerts cannot collect payment information via SMS or accept approval for purchase via keyword confirmation (e.g. Reply PAY to confirm your purchase)
• Reminder messages must be sent within a 48-hour period, and messages are limited to one reminder per unique abandoned cart session

5. Send an opt-in confirmation message.

The CTIA requires an opt-in confirmation be sent to every consumer who completes signing up for your program before sending them subsequent messages. This opt-in confirmation or "welcome" message must include:

• Program and/or product name
• Message frequency
• "Message and data rates may apply" disclosure
• Opt-out instructions
• Customer support contact information

6. Include program name, "HELP" and "STOP" instructions in your recurring messages.

Product and/or program name should be included in every text message you send to your SMS subscribers, and both customer support information and opt-out instructions must be included in at least one message per month. You can choose to include HELP and STOP in separate messages or within the same message, and you can vary how you choose to execute this each month.

7. Send your messages only during approved hours.

Per the TCPA, you should refrain from sending messages outside of 8am - 9pm local to every recipient's time zone. If unsure of where your subscribers reside, consider limiting your SMS messages to the hours of 11am - 6pm Central Standard Time.

8. Give SMS subscribers an easy way to stop receiving messages.

Allow SMS participants to easily opt out of your program through any reasonable means, like texting the word STOP to your program's short code. When a participant takes this action, also be sure to send no more than one (1) message in response to their request and cease further communication unless that participant signs up again.

How to Stay SMS Compliant

Here are a few best practices for how to ensure SMS compliance is followed within your larger SMS go-to-market strategy.

• Ask your current vendors lots of SMS compliance questions. They should know this subject matter inside and out. Find out how well they understand federal and state laws as well as specific carrier requirements. If they don’t have clear and confident answers, then it may be time to look for new partners.

• Use a mobile technology partner with SMS compliance guardrails. The most trusted SMS marketing vendors are not only subject matter experts, but they also have safeguards embedded directly into their technology, such as text message frequency management and subscriber opt-in/opt-out management. Be sure to find out what they have built in order to better protect you.

• Consult with the right legal counsel. Because of the level of complexity involved, there are law firms that specialize in TCPA compliance. Building a relationship with these professionals can provide you with valuable counsel, advice, and best practices. If a violation occurs, they can also help you navigate the process to achieve the best possible outcome.

For more SMS compliance resources download Vibes' comprehensive Guide to US SMS Compliance here.

Find A Reliable SMS Compliance Partner

Staying on top of mobile compliance helps you stay on the safe side of lawsuits—and builds trust with your customers at the same time.

With over 25 years of SMS compliance expertise, Vibes is the most trusted mobile marketing partner for compliant SMS, MMS and RCS messaging, helping our customers navigate the various guidelines and regulations in place - from newer state-specific laws to the CTIA and filings & presentations in front of the FCC.

Vibes also gives our customers peace of mind with a variety of compliance controls directly integrated into our SMS marketing platform, including:

• 100+ recognized opt-out words or phrases
• Double opt-in entry for obtaining PEWC
• Message frequency capping options for SMS programs that have a set maximum number of messages a subscriber agreed to receiving per month
• Real-time management of opt-ins and opt-outs, with immediate removal of the mobile number from any and all subscription lists on a customer's sender ID, like a short code
• Send by time zone feature to comply with federal and state time restrictions, ensuring that messages won't be delivered too early or late in the day
• AI-powered auditing for our Vibes Connect customers that automatically polices bad traffic and shuts down non-compliant short and long codes

Plus Vibes' trusted, longtime carrier connections as a Tier 1 aggregator means we know everyone's rules, resulting in 2x faster approvals of program briefs vs. our competitors and a 90%+ program approval rate with carriers on first submission. It's part of our commitment to our customers to ensure their text campaigns run smoothly and correctly while keeping them informed as any laws, rules and regulations in the industry change.

Ready to learn more? We'd love to chat with you further about how we can partner with you to deliver your messages quickly, consistently and reliably. Let's talk!

‍

¹This article serves to provide general guidance on mobile compliance only and is not legal counsel. Companies must work directly with their own legal teams to determine what is required for their mobile program.

²Any state with a mini-TCPA enacted may have a slightly different definition of PEWC from the TCPA, so it’s recommended that you review both the TCPA’s language and the state-specific TCPA's definition to ensure you’re meeting all of the necessary requirements.