SMS Marketing Compliance in 2026: TCPA, Opt-Outs & SHAFT Rules

Q: Is 'Reply STOP' still enough to handle opt-outs?

You must still honor STOP, but as of the FCC opt-out rule that took effect April 11, 2025, consumers can revoke consent by any reasonable method — including a reply in plain words, an email, or a phone call. You may send one confirmation text within five minutes, then you must stop.

Bulk SMS is the highest-engagement channel in direct marketing — but it is also the most heavily policed. A single non-compliant text blast can expose you to TCPA damages of $500 to $1,500 per message, and that math gets ugly fast when you send to tens of thousands of numbers. This is a plain-English guide to SMS marketing compliance in 2026: what the rules actually require, what changed in the last year, and a checklist to run before you hit send.

There are two rulebooks, and you have to follow both. Get them right and bulk SMS is one of the safest, most profitable channels you can run. Get them wrong and you are looking at class actions, blocked numbers, and dead campaigns.

The two rulebooks: TCPA vs CTIA

Most compliance confusion comes from not knowing that two different systems govern your texts:

The TCPA (the law). The Telephone Consumer Protection Act is a federal law enforced by the FCC. It sets the legal requirements for consent and opt-outs, and it carries a private right of action — meaning any recipient can sue you directly for $500–$1,500 per text, with no cap on class size.
CTIA guidelines (the carrier rules). The CTIA is the wireless industry trade association. Its messaging guidelines are technically voluntary, but the major carriers enforce them. Break them and carriers will filter, throttle, or block your traffic — no court order required. You usually find out only when your reply rates collapse.

TCPA violations cost you lawsuits. CTIA violations cost you deliverability. You need to satisfy both at once.

Consent: the one rule that matters most

Consent is the foundation of every compliant SMS program. The standard you need depends on the kind of message you send:

Marketing / promotional texts — discounts, product launches, flash sales, anything designed to sell — require prior express written consent (PEWC), the higher standard.
Transactional / informational texts — order confirmations, shipping updates, appointment reminders, account alerts — require only prior express consent, which can be verbal. These messages must not contain promotional content.

Prior express written consent is not a vague checkbox. To hold up, your opt-in needs to include, clearly and conspicuously:

Your business name as the sender
That the person agrees to receive automated marketing texts
A "message and data rates may apply" notice
Expected message frequency
Opt-out instructions (e.g. "Reply STOP to cancel")
A link to your terms and privacy policy

Two more rules trip people up. First, the consent checkbox cannot be pre-checked, and agreeing to texts cannot be a condition of purchase. Second, consent is brand-specific and tied to the owner of the phone number — opting in to one of your brands does not cover another, and you cannot inherit consent when a number changes hands.

You may have heard about the FCC's "one-to-one consent" rule that was meant to close the lead-generator loophole. An appeals court vacated it in early 2025, so it is not in effect. That said, the safe practice has not changed: capture clear, specific, documented written consent for your own brand. Do not rely on shared or third-party lists.

Opt-outs got stricter in 2025

The biggest recent change is how people can opt out. Under the FCC opt-out rule that took effect April 11, 2025:

Consumers can revoke consent using any reasonable method — not just the keyword "STOP." A reply in plain words ("please stop texting me"), an email, or a phone call all count, and you must honor them.
You may send one confirmation message within five minutes of an opt-out to confirm it. After that, the conversation is over.
Opt-outs must be processed promptly. Continuing to text someone who revoked consent is a fresh violation per message.

On the carrier side, the standard keywords that must always work are STOP, UNSUBSCRIBE, QUIT, CANCEL, and END. A good platform recognizes and suppresses these automatically — but the legal duty to honor broader revocation requests is on you.

Quiet hours and message frequency

Timing is a compliance issue, not just a strategy one. Marketing texts should only land between 8 a.m. and 9 p.m. in the recipient's local time zone — not your office's time zone. A 7 p.m. send from California hits East Coast numbers at 10 p.m., which is a violation. Several states impose stricter windows or limit Sunday and holiday sends, so always schedule by the recipient's local time.

Frequency matters too. Even subscribers who opted in will report you or hit STOP if you over-text them. High opt-out and complaint rates are exactly the signals carriers watch before they throttle a sender, so cap your frequency and earn each send.

Content: the SHAFT rules

The CTIA restricts certain content categories in marketing texts, summarized by the acronym SHAFT:

Sex — adult content is prohibited or must be age-gated
Hate — hate speech and violence are banned outright
Alcohol — permitted only with age verification (21+)
Firearms — generally prohibited over SMS
Tobacco — including vaping and CBD — generally prohibited

Carriers filter SHAFT content automatically, along with profanity, phishing, and anything that looks like a scam. If your campaign touches a regulated category, confirm the rules before you build the creative.

Don't confuse compliance with 10DLC registration

One last point that causes confusion: 10DLC registration is separate from consent. 10DLC (10-digit long code) is the carrier system for registering your brand and campaigns so your A2P traffic is approved to send at volume. Registering for 10DLC does not give you permission to text anyone — you still need TCPA consent for every number. They are two different requirements that both have to be satisfied. We cover the registration side in detail in our 10DLC registration guide.

The pre-send compliance checklist

Before any bulk SMS campaign goes out, confirm:

Every number on the list gave documented opt-in (written consent for marketing).
Your opt-in language named your brand, message type, frequency, rates, and STOP instructions.
The list contains no purchased, rented, or scraped numbers.
People who previously opted out have been scrubbed.
Your message includes clear opt-out instructions.
The send is scheduled inside 8 a.m.–9 p.m. recipient local time.
The content is SHAFT-clean and free of scam-like patterns.
Your 10DLC brand and campaign are registered and approved.

Run compliant campaigns at scale

Smarterblast handles carrier-grade delivery, opt-out suppression, and SHAFT filtering so your bulk SMS lands and stays compliant — from a few thousand contacts to millions.

See Pricing & Packages

Frequently asked questions

Is SMS marketing legal in 2026?

Yes. SMS marketing is legal in the United States when you have proper consent and follow the TCPA and CTIA rules. The law does not ban texting customers — it bans texting people who never agreed to hear from you, and texting in ways carriers prohibit.

Do I need written consent to send marketing texts?

For promotional or marketing texts, yes — the TCPA requires prior express written consent. Transactional messages like order or appointment alerts only need prior express consent, which can be verbal. When in doubt, get documented written opt-in; it is the standard that protects you in a dispute.

Is "Reply STOP" still enough to handle opt-outs?

You must still honor STOP, but since the opt-out rule that took effect April 11, 2025, consumers can revoke consent by any reasonable method — a plain-language reply, an email, or a phone call. You may send one confirmation text within five minutes, then you must stop messaging them.

What are SMS quiet hours?

Marketing texts should only be sent between 8 a.m. and 9 p.m. in the recipient's local time zone, not yours. Several states are stricter, limiting hours further or restricting Sundays, so always schedule by the recipient's time zone.

Can I buy a phone list and text it?

No. Consent cannot be bought, rented, or transferred — it is tied to the person who agreed and is specific to your brand. Texting a purchased list is the fastest way to trigger TCPA lawsuits and get your numbers blocked by carriers.