SMS compliance means sending business texts only to people who agreed to receive them, identifying yourself, honouring opt-out requests quickly, and following each country's registration and content rules. The core is the same almost everywhere: clear opt-in before marketing, a working opt-out such as "Reply STOP", and records that prove both.
What is SMS compliance?
SMS compliance is the set of legal and operator rules that apply to application-to-person (A2P) messages. It has three layers: privacy and marketing laws (consent and opt-out), telecom rules (sender registration, traffic categories, sending hours), and operator or industry codes (content standards, approved use cases). Breaking them can mean blocked traffic, suspended sender IDs or numbers, and in some countries significant fines or lawsuits.
What are the SMS opt-in rules?
For marketing messages, most jurisdictions require prior consent that the person actively gave, for the specific sender and purpose. Pre-ticked boxes, bought lists and consent hidden in general terms usually do not count. Transactional messages (OTP, order and account notices) generally rely on the customer relationship but still must not include marketing content.
A compliant opt-in collects and stores:
- Who gave consent (phone number), when, where (form, keyword, checkout) and the exact wording shown.
- The brand that will send, the type of messages and expected frequency.
- A statement that message and data rates may apply (expected in the US) and how to opt out.
Sample opt-in language: "I agree to receive marketing text messages from [Brand] at the number provided, up to 4 messages per month. Consent is not a condition of purchase. Reply STOP to unsubscribe, HELP for help. Message and data rates may apply."
See transactional vs promotional SMS for how the two categories are treated.
What are the SMS opt-out requirements?
Every marketing message should tell recipients how to stop, and opt-outs must be processed fast and across all your systems. In the US, the FCC's consent revocation rule, in force since April 2025, requires businesses to treat replies such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE as a valid revocation, and to honour revocations made by any reasonable means within 10 business days. Many carriers and industry codes expect a single confirmation message and nothing more after that.
- Include "Reply STOP to opt out" (or the local equivalent) in marketing messages.
- Process keyword opt-outs automatically, in every language you send in.
- Sync opt-outs across all numbers, sender IDs and providers you use.
- Respect national do-not-disturb or preference registries where they exist.
SMS compliance by region (overview)
| Region | Main rules | Key points |
|---|---|---|
| United States | TCPA and FCC rules, CTIA guidelines, carrier registration | Written consent for marketing texts, STOP handling, 10DLC or toll-free verification |
| European Union | GDPR and national ePrivacy laws | Opt-in for marketing, limited exceptions for existing customers, right to object |
| United Kingdom | UK GDPR and PECR | Opt-in or soft opt-in for existing customers, opt-out in every message |
| India | TRAI commercial communication rules and DLT | Registered entity, header and template; customer preference (DND) applies |
| Many other markets | Telecom regulator rules | Sender ID registration, promotional sending hours, content categories |
Country details: US 10DLC and toll-free SMS, India DLT registration, UK SMS sender ID rules. This overview is not legal advice; check with counsel for your use case.
A2P compliance guidelines for senders
- Register before sending: sender IDs, numbers, brands, campaigns and templates where required. See SMS sender ID registration.
- Match traffic to the declared use case. Do not send marketing on an OTP route or campaign.
- Avoid restricted content or get the required approvals. See SMS content restrictions.
- Identify the brand in every message.
- Respect quiet hours and frequency limits for promotional traffic.
- Keep evidence of consent and opt-outs for as long as local law and your carriers expect.
- Never send through unauthorised routes to avoid registration. Grey routes are filtered and expose the sender. See grey SMS route risks.
SMS compliance checklist
- Opt-in form with brand, purpose, frequency and opt-out instructions
- Consent records stored with timestamp and source
- Automatic STOP and HELP handling
- Opt-out list shared across all providers
- Sender IDs, numbers and templates registered per country
- Promotional and transactional traffic separated
- Quiet hours configured per time zone
Compliant traffic also delivers better: registered, consented messages are less likely to be filtered. See why SMS is not delivered.
VoIPMatcher sources A2P SMS routes for registered, compliant traffic from its carriers and manages them. Request a compliant SMS route.
Frequently asked questions
Do I need consent to send transactional SMS?
Transactional messages such as OTP codes, order updates and account alerts usually rely on the customer relationship and the customer providing their number for that purpose. They must stay purely transactional: adding promotions turns them into marketing, which needs marketing consent. Some countries still require registration of transactional templates and sender IDs.
What is double opt-in for SMS?
Double opt-in means the person first signs up, for example on a web form, and then confirms by replying to a text message. It proves the number belongs to the person who signed up and gives a strong consent record. It is not mandatory everywhere, but it is a recognised good practice for marketing lists.
Can I text customers who bought from me before?
For transactional messages about their purchase, generally yes. For marketing, it depends on the country: some laws allow a limited soft opt-in for similar products if the customer was offered an opt-out when giving their number, while others, including US rules for marketing texts, require explicit prior consent. Check the destination country's rules.
What happens if I send SMS without consent?
Consequences range from blocked messages and suspended sender IDs or numbers by carriers to regulatory fines and, in the US, class action lawsuits under the TCPA. Complaints also hurt delivery for your compliant traffic. The cost of collecting and storing proper consent is far lower than any of these outcomes.
Do I need to include STOP in every SMS?
For marketing messages, including opt-out instructions in every message is expected or required in many jurisdictions and by US carrier guidelines. Transactional messages often do not need it, though some countries and carriers expect opt-out handling anyway. Either way, you must honour any opt-out request you receive.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.