SMS Marketing Laws: Federal, Carrier, and State Rules for 2026

SMS marketing laws decide who you can text, when, and what you have to include. Get them wrong and the cost shows up as filtered messages, suspended numbers, or a class action. Get them right and compliance stays in the background where it belongs.

SMS marketing laws are the federal statutes, carrier rules, and state laws that govern commercial text messages. In the US, the Telephone Consumer Protection Act (TCPA) and FCC rules set the federal floor for consent, opt-outs, and send times. Carrier rules from CTIA and 10DLC registration decide whether messages get delivered, and a growing list of states adds stricter hours, caps, and penalties.

This guide walks through each layer, the court rulings that changed the picture in 2025 and 2026, and a checklist you can run your program against. It’s general information, not legal advice, so have counsel review your consent language before you launch.

What are the three layers of SMS marketing law?

Every marketing text has to satisfy three separate rulebooks at once. Each one has its own enforcer and its own penalty.

Layer	Who sets it	What it controls	What happens if you break it
Federal law	Congress, FCC, FTC	Consent, opt-outs, quiet hours, Do Not Call	Private lawsuits, class actions, regulator fines
Carrier rules	CTIA, wireless carriers, The Campaign Registry	Registration, opt-in flow, restricted content	Filtered messages, rejected campaigns, suspended numbers
State law	State legislatures and attorneys general	Stricter hours, frequency caps, consent scope, extra damages	State fines and lawsuits on top of federal exposure

Passing one layer doesn’t clear the others. A fully TCPA-compliant message can still get blocked by a carrier, and a carrier-approved campaign can still break Florida’s 8 PM cutoff.

What do federal SMS marketing laws require?

Federal law requires consent before marketing texts, a working opt-out, and sends only between 8 AM and 9 PM in the recipient’s time zone. The TCPA carries most of that weight, with the FTC’s Telemarketing Sales Rule and CAN-SPAM covering narrower cases.

The TCPA

The TCPA covers consent, quiet hours, the National Do Not Call Registry, and opt-outs. The FCC treats texts as calls for most TCPA purposes. Its rules limit telephone solicitations to 8 AM to 9 PM recipient local time under 47 CFR 64.1200(c)(1). Consumers can sue directly, which is why TCPA class actions are common.

The FCC opt-out rule

Since April 2025, consumers can revoke consent by any reasonable method. That includes a STOP reply, but also an email, a phone call, or a reply like “please stop texting me.” You have 10 business days to honor the request.

A second piece, the “revoke-all” provision, would make one opt-out apply to every type of message you send that person. The FCC has delayed it again, and Burr & Forman reports the new effective date is January 31, 2027.

The one-to-one consent rule is gone

The FCC once planned to require consent for one named seller at a time. The Eleventh Circuit struck that rule down in January 2025, and the FCC removed it from the regulations effective August 29, 2025. Lead generators can still collect consent for multiple sellers, as long as the disclosure is clear.

Courts now read the TCPA for themselves

In McLaughlin Chiropractic v. McKesson (June 2025), the Supreme Court held that district courts don’t have to follow the FCC’s reading of the TCPA. Since then, appeals courts have started reaching their own answers:

• Bradford (Fifth Circuit, February 2026). The court held that the TCPA itself doesn’t require written consent, so oral consent can work in Texas, Louisiana, and Mississippi. Nixon Peabody’s summary covers the details.
• Steidinger (Seventh Circuit, July 2026). The court held that a text isn’t a “telephone call” under the TCPA’s Do Not Call private right of action. That limits DNC text claims in Illinois, Indiana, and Wisconsin. Read the opinion.

These rulings narrow federal exposure in some circuits, but they don’t change carrier rules or state laws. We still recommend documented written consent everywhere, because carriers expect it and several states require it.

CAN-SPAM

CAN-SPAM covers commercial email. It reaches text messaging only when you send to a wireless email address (like a number@carrier domain), under 47 CFR 64.3100. Texts sent to a phone number fall under the TCPA and state laws instead. Our TCPA and CAN-SPAM guide covers the overlap.

The Telemarketing Sales Rule

The FTC enforces the Telemarketing Sales Rule against deceptive and abusive telemarketing, including some text campaigns. Civil penalties reach up to $53,088 per violation under 16 CFR 1.98.

What do carriers require for business texting?

Carriers require registered sending numbers, a clear opt-in flow, and content that stays out of restricted categories. These rules aren’t laws, but carriers enforce them directly by filtering or blocking messages, so they often hit faster than any lawsuit.

CTIA Messaging Principles

The CTIA Messaging Principles and Best Practices set the expectations carriers check campaigns against. The main ones:

• Get opt-in before you send, and send a confirmation text right after.
• Respond to HELP with your business name and contact details.
• Stop messaging when someone replies STOP, and send one final confirmation.
• Identify your business in messages.
• Use links on your own domain or a branded shortener, not a public one.

Our CTIA Messaging Principles breakdown goes through each section.

Restricted content (SHAFT)

Carriers restrict content about sex, hate, alcohol, firearms, and tobacco, often shortened to SHAFT. Some of these categories, such as alcohol, need age verification at opt-in. Others get blocked outright on standard 10DLC routes.

A2P 10DLC registration

If you text from a regular 10-digit US number, you must register your brand and each campaign with The Campaign Registry. Carriers filter unregistered traffic. Brand approval often takes about a day, while campaign review can take up to two weeks in our experience, so register before your launch date. Our 10DLC registration guide walks through the forms.

Which states have their own SMS marketing laws?

At least eight states add rules on top of federal law, usually stricter hours, daily frequency caps, written consent, or higher damages. The table below covers the ones marketers ask about most.

State	Law	Consent	Send hours	Frequency cap	Penalties
Florida	Telephone Solicitation Act (Fla. Stat. 501.059, 501.616)	Written consent for automated sales texts	8 AM to 8 PM	3 per 24 hours, same topic	$500 per violation, up to $1,500 if willful
Oklahoma	Telephone Solicitation Act of 2022	Written consent for automated sales texts	8 AM to 8 PM	3 per 24 hours, same topic	$500 per violation, up to $1,500 if willful
Maryland	Stop the Spam Calls Act (effective Jan. 1, 2024)	Written consent for automated sales calls, with texts named in the consent definition	8 AM to 8 PM	3 per 24 hours, same topic	Enforced under the Maryland Consumer Protection Act
Connecticut	Conn. Gen. Stat. 42-288a (amended 2023)	Written consent for telephone sales calls, including app-based messages	9 AM to 8 PM	None	Up to $20,000 per violation, plus consumer suits
Virginia	Telephone Privacy Protection Act, amended by SB 1339 (effective Jan. 1, 2026)	Honor STOP and UNSUBSCRIBE for at least 10 years	8 AM to 9 PM unless the person consented	None	$500, then $1,000, then $5,000 per violation
Washington	Commercial Electronic Mail Act (RCW 19.190)	Clear consent in advance	Not set	None	$100 per text for suits filed on or after June 11, 2026 (was $500)
Texas	SB 140 (effective Sept. 1, 2025)	Unchanged by SB 140	9 AM to 9 PM Mon to Sat, noon to 9 PM Sun (application to texts unclear)	None	Private suits under the Deceptive Trade Practices Act
Arizona	A.R.S. 44-1282	No sales texts to Do Not Call numbers without permission	Not set	None	Up to $1,000 per violation

A few details change how these play out:

• Florida’s cure period. Since 2023, a recipient has to reply STOP and keep receiving texts for 15 days before suing over unsolicited texts, according to the Florida Senate bill summary. The 8 PM cutoff and the daily cap still apply.
• Texas registration. SB 140 brought texts under the state’s telemarketing registration law, which carries a $200 fee and a $10,000 security deposit. The Texas attorney general said in November 2025 that consent-based texts don’t need registration, as Nixon Peabody explains. Courts don’t have to follow that view, so keep consent records tight.
• Washington’s damage cut. HB 2274 lowered statutory damages from $500 to $100 per text, per Morgan Lewis. A violation still counts under the state’s Consumer Protection Act.

Tracking every state separately gets messy fast. A simpler approach is one baseline that satisfies the strictest common rules:

1. Require documented written consent for every marketing text.
2. Send only between 9 AM and 8 PM in the recipient’s local time.
3. Cap same-topic messages at three per day.
4. Suppress a number the moment it opts out, and keep that record for at least 10 years.

What about SMS marketing laws outside the US?

Other countries use consent-first models too, and most also require sender identification and a working unsubscribe.

• Canada (CASL). Requires express or implied consent, sender identification, and a working unsubscribe in every commercial electronic message, texts included. CASL section 20(4) sets administrative penalties up to CAD $1 million per violation for individuals and CAD $10 million for businesses.
• UK and EU. The UK’s PECR and the EU’s ePrivacy rules generally require opt-in consent for marketing texts. GDPR then governs how you store and use the phone numbers.
• Australia. The Spam Act 2003 requires consent, sender identification, and a working unsubscribe in commercial texts.

SMS marketing compliance checklist

Use this list to audit an existing program or set up a new one. For a printable version, see our SMS compliance checklist for marketing teams.

Consent – [ ] Opt-in language names your business, describes the messages, states frequency, says consent isn’t a condition of purchase, and explains STOP and HELP. – [ ] Consent checkboxes start unchecked. – [ ] You store when, where, and how each person opted in, plus the exact wording they saw.

Registration – [ ] Your brand and every campaign are registered for 10DLC. – [ ] Campaign descriptions and sample messages match what you actually send. – [ ] An age gate is in place for any alcohol, tobacco, or firearms content.

Opt-outs – [ ] STOP and common variations suppress the number automatically. – [ ] Opt-outs by phone, email, or in person get logged within 10 business days, and sooner if you can. – [ ] People who opt out get one confirmation text with no marketing in it. – [ ] Suppression applies across every tool and team that texts.

Send timing – [ ] Scheduled sends follow the recipient’s time zone. – [ ] National marketing sends stay between 9 AM and 8 PM. – [ ] Frequency caps apply to Florida, Oklahoma, and Maryland numbers.

Content – [ ] Every marketing text identifies your business. – [ ] Links use your own domain or a branded shortener. – [ ] Messages match the registered campaign.

List hygiene – [ ] You check long-inactive numbers against the FCC Reassigned Numbers Database before texting them.

Getting the consent wording right does most of the work. Our TCPA consent language guide has sample disclosures for web forms and keyword opt-ins.

Where does your SMS platform fit?

Software can’t make a program legal. You still decide who to text and what to say. A good platform makes the compliant path the default, though, and keeps the records you’d need if anyone asks.

Look for a platform that does these things:

• Stores consent and opt-out status on the same contact record your team already uses.
• Suppresses opted-out numbers automatically across every list, workflow, and user.
• Checks outgoing messages for opt-out language before they send.
• Handles 10DLC brand and campaign registration as part of setup.
• Reports delivery at the carrier level, so you can see whether a text reached the phone.

For HubSpot teams, we built Message IQ to keep this data inside HubSpot. Opt-outs sync to the contact record as they arrive, so your lists and workflows skip anyone who replied STOP. Message IQ 3.0 also scans outgoing messages for missing opt-out language and adds it, and our team handles 10DLC registration during onboarding. See how it works on our HubSpot SMS integration page.

FAQ

What are the main SMS marketing laws in the US?

The TCPA and FCC rules set federal requirements for consent, opt-outs, quiet hours, and Do Not Call. Carrier rules based on CTIA guidelines, including 10DLC registration, control whether messages get delivered. States such as Florida, Oklahoma, Maryland, Connecticut, Virginia, and Washington add stricter rules on top.

Do I need written consent to send marketing texts?

FCC rules call for prior express written consent before autodialed marketing texts, and Florida, Oklahoma, Maryland, and Connecticut require written consent too. In February 2026, the Fifth Circuit held that oral consent can satisfy the TCPA in Texas, Louisiana, and Mississippi. Carriers and many states still expect documented opt-in, so written consent remains the safe default everywhere.

What hours can I send marketing texts?

Federal rules allow telephone solicitations between 8 AM and 9 PM in the recipient’s local time. Florida, Oklahoma, and Maryland end at 8 PM, and Connecticut runs 9 AM to 8 PM. Sending only between 9 AM and 8 PM recipient time satisfies all of them.

How fast do I have to honor an opt-out?

FCC rules give you 10 business days to honor an opt-out, and consumers can opt out by any reasonable method, not only a STOP reply. Virginia requires you to honor STOP replies for at least 10 years. Suppressing the number as soon as the request arrives is the safest approach.

Does CAN-SPAM apply to text messages?

Only in a narrow case. CAN-SPAM covers commercial email, and FCC rules extend it to messages sent to wireless email addresses. Texts sent to a phone number fall under the TCPA and state telemarketing laws instead.

Do I need to register for 10DLC?

Yes, if you send business texts from a regular 10-digit US number. Carriers require brand and campaign registration through The Campaign Registry and filter unregistered traffic. Campaign review can take up to two weeks, so register well before your launch date.

Do SMS marketing laws apply to B2B texts?

Yes. The TCPA has no B2B exemption, and texting a cell phone triggers the same consent and opt-out rules whether or not the owner uses it for work. Several state laws also cover texts to numbers with that state’s area code.

Building on a compliant setup

Compliance work pays off when it stops being a separate task and becomes part of how your team sends. If you run marketing in HubSpot, that means consent, opt-outs, and delivery records living on the contact record next to everything else.

Message IQ plans start at $49 a month, month-to-month with no contract. You can compare plans on our pricing page, and once your setup is ready, our guide on how to send mass text messages covers the first campaign.

Talk to an SMS Expert