SMS Marketing Laws: Federal, Carrier, and State Rules for 2026

SMS marketing laws decide who you can text, when you can text them, what the message has to say, and what happens when someone replies STOP. Get them wrong and a single campaign can turn into a class action. Get them right and they mostly fade into the background of a well-built program.

SMS marketing laws are the federal statutes, FCC rules, state “mini-TCPA” laws and carrier requirements that apply to commercial text messages in the US. The Telephone Consumer Protection Act (TCPA) sets the federal floor for consent, opt-outs and send times. Carriers add their own registration and content rules. On top of that, more states are adding stricter hours, frequency caps and penalties. 

This guide takes you through each layer, explaining how the rules changed in 2025 and 2026 and finishing with a checklist you can run against your own program. This information is general and not legal advice. Send the rules. Have your counsel review your consent language. 

The three layers of SMS marketing law

Every US text marketing program answers to three sets of rules at once. Passing one layer doesn’t excuse you from the others.

Layer	Who sets it	What it controls	What happens if you break it
Federal law	Congress, the FCC, the FTC	Consent, opt-outs, quiet hours, Do Not Call	Private lawsuits, class actions, regulator penalties
Carrier rules	CTIA guidelines, wireless carriers, The Campaign Registry	Registration, message content, opt-in flow, restricted content	Filtered messages, rejected campaigns, suspended numbers
State law	State legislatures and attorneys general	Stricter hours, frequency caps, consent scope, extra damages	State lawsuits and fines on top of federal exposure

Federal SMS marketing laws

The TCPA

In 1991, Congress passed the Telephone Consumer Protection Act, long before text messaging was even a thing. The FCC and federal courts apply the autodialer and prerecorded-message rules to texts, which is why the TCPA drives most SMS compliance decisions today. .

The core requirements for marketing texts:

• Consent before you send. FCC rules require express written consent before sending telemarketing texts using an autodialer. Your business must be identified in the consent, the number being texted must be masked and it must be clear that agreeing is not a condition of purchase. Signature may be a check box on a web form or a keyword text. 
• Quiet hours. FCC rules bar telephone solicitations before 8 AM or after 9 PM in the recipient’s local time (47 CFR 64.1200(c)(1)).
• Do Not Call. You can’t send telemarketing texts to numbers on the National Do Not Call Registry unless you have the person’s consent or an established business relationship.
• Opt-outs. You must stop texting people who ask, through whatever reasonable method they use.

The TCPA lets consumers sue directly, which is what makes it expensive. Our guide to TCPA and CAN-SPAM for SMS breaks down the penalties and the patterns behind recent settlements.

The FCC opt-out rule that took effect in 2025

As of April 11, 2025, FCC rules permit consumers to withdraw consent through any reasonable method. An automatic acknowledgment is required for a reply of “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe,” or a phone call, an email, or a note to your staff. You must respond to this request within 10 business days. You can send one text to confirm — and it can’t be a marketing text. Confirmation within 5 minutes is considered acceptable. 

One piece of the rule hasn’t started yet. The “revoke-all” provision, which would apply an opt-out from one type of message to all your unrelated messages, was delayed twice. The FCC moved its start date to January 31, 2027 (Burr & Forman).

The one-to-one consent rule is gone

In December 2023, the FCC adopted a rule that would have required consent to name each seller individually, which was aimed at lead-generation sites that collected one consent for many companies. It was struck down by the Eleventh Circuit on Jan. 24, 2025 in Insurance Marketing Coalition v. FCC . The FCC removed it from its rules effective Aug. 29, 2025 .  (Federal Register). Buying “shared” consent from a lead seller still carries risk, but this particular rule no longer applies.

Courts now read the TCPA for themselves

In *McLaughlin Chiropractic Associates v. McKesson Corp.* (June 20, 2025), the Supreme Court held that district courts aren’t bound by the FCC’s interpretations of the TCPA (Cornell LII). Courts give the FCC’s views respect, but they decide what the statute means. Two appeals courts have already used that freedom:

• Fifth Circuit (Texas, Louisiana, Mississippi). In *Bradford v. Sovereign Pest Control* (February 25, 2026), the court held that the TCPA requires only prior express consent, which can be oral, and rejected the FCC’s written-consent rule for telemarketing (Nixon Peabody).
• Seventh Circuit (Illinois, Indiana, Wisconsin). In *Steidinger v. Blackstone Medical Services* (July 14, 2026), the court held that texts aren’t “telephone calls” under the TCPA’s Do Not Call private right of action (opinion).

Neither ruling is a reason to loosen your program. They apply only in those circuits, other courts disagree, state laws still require written consent in many places, and carriers require documented opt-in no matter what any court says. Keep collecting written consent.

CAN-SPAM

The CAN-SPAM Act of 2003 covers commercial email. It reaches text-style messages only when they go to a wireless email address, such as a number at a carrier’s email domain. For those “mobile service commercial messages,” FCC rules require express prior authorization (47 CFR 64.3100). Texts sent to a phone number fall under the TCPA instead.

The Telemarketing Sales Rule

The FTC enforces the Telemarketing Sales Rule and the National Do Not Call Registry. FTC civil penalties currently run up to $53,088 per violation (eCFR, 16 CFR 1.98). Scrub your list against the registry if you text anyone who hasn’t given you consent.

Carrier rules: CTIA and 10DLC

Carrier rules aren’t laws, but they control whether your messages arrive at all. Carriers can filter or block your traffic without a lawsuit or a regulator getting involved.

CTIA Messaging Principles

CTIA, the wireless industry trade group, publishes the Messaging Principles and Best Practices that carriers enforce. The main expectations:

• Get clear opt-in consent for the type of message you send
• Send a confirmation message after opt-in with your program name, message frequency, a “message and data rates may apply” note, and how to get help or opt out
• Respond to HELP and STOP keywords
• Identify your business in your messages
• Use a link shortener tied to your own domain, not a free public one (CTIA, section 5.3.2)

Our overview of the CTIA Messaging Principles covers each one in more detail.

Restricted content (SHAFT)

Carriers block content involving sex, hate, alcohol, firearms and tobacco, often shortened to SHAFT, with cannabis usually added to the list. Hate content is not allowed. Alcohol, tobacco & firearms content is allowed only with age verification at opt-in. In practice, carriers and registration vendors expect an age gate 21+ on your website and sign up flow, and they reject alcohol campaigns without it. 

A2P 10DLC registration

If you are texting from a regular 10-digit number (“10DLC”), you must register your brand and each campaign with The Campaign Registry, according to US carriers. Registration tells you who you are, what you send and how people opt in. Not registered traffic is filtered. Registration of a brand can be cleared in a day but campaign approval usually takes about two weeks. See our facebook  A2P 10DLC registration guide for the steps.

State SMS marketing laws

States can go further than the TCPA, and several have. These “mini-TCPA” laws matter even if your business sits in another state, because most apply based on where the recipient lives or their area code. The table below covers the state laws with the clearest impact on marketing texts as of October 2026.

State	Law	Texts covered	Consent	Hours	Frequency cap	Damages or fines
Florida	Telephone Solicitation Act, Fla. Stat. 501.059 and 501.616	Yes	Prior express written consent for unsolicited automated sales texts	8 AM to 8 PM	3 per 24 hours on the same subject	$500 per violation, up to $1,500 if willful
Oklahoma	Telephone Solicitation Act of 2022	Yes	Prior express written consent for automated sales texts	8 AM to 8 PM	3 per 24 hours on the same subject	$500 per violation, up to $1,500 if willful
Maryland	Stop the Spam Calls Act (2023), effective Jan. 1, 2024	Consent definition names texts	Prior express written consent for automated sales calls	8 AM to 8 PM	3 per 24 hours on the same subject	Enforced through the Maryland Consumer Protection Act
Connecticut	Conn. Gen. Stat. 42-288a, as amended in 2023	Yes, including app-based messages	Prior express written consent for any telephonic sales call	9 AM to 8 PM	None	Fines up to $20,000 per violation; consumer suits under CUTPA
Virginia	Telephone Privacy Protection Act, as amended by SB 1339, effective Jan. 1, 2026	Yes	A STOP or UNSUBSCRIBE reply must be honored for at least 10 years	8 AM to 9 PM unless the person consented	None	$500 first violation, $1,000 second, $5,000 each after
Washington	Commercial Electronic Mail Act, RCW 19.190	Yes	Clear, affirmative consent in advance	Not set by CEMA	None	$100 per text for suits filed on or after June 11, 2026 ($500 before)
Texas	SB 140, effective Sept. 1, 2025	Yes, for telephone solicitation registration	Not changed by SB 140	9 AM to 9 PM Mon to Sat, noon to 9 PM Sun (whether these apply to texts is unsettled)	None	Private suits under the Deceptive Trade Practices Act
Arizona	A.R.S. 44-1282 (HB 2498, 2023)	Yes	Bans sales texts to Do Not Call numbers without permission	Not set	None	Attorney general fines up to $1,000 per violation

A few details that trip people up:

• Florida’s cure period. Since 2023, a Florida recipient must reply STOP and keep receiving texts for 15 days before they can sue over unsolicited texts (Florida Senate). The 8 PM cutoff and three-per-day cap still apply during that window.
• Texas registration. SB 140 brought text messages into the state’s telephone solicitation registration law, which carries a $200 fee and a $10,000 security deposit. The Texas attorney general’s position, stated in a November 2025 court filing, is that registration doesn’t apply to texts sent with the recipient’s consent (Nixon Peabody). That position isn’t binding on courts, so keep consent records tight.
• Washington’s damages cut. HB 2274 lowered statutory damages under the state’s anti-spam law from $500 to $100 per text after a wave of retail lawsuits (Morgan Lewis). A violation still counts as a Consumer Protection Act violation.

The easiest way to deal with variation in the state is to create a single program that conforms to the most restrictive common rules: consent required all the time, messaging between 9 a.m. and 8 p.m. in the recipient’s time zone, no more than three marketing texts to the same person on the same topic per day, and immediate, permanent action on STOP requests. 

SMS marketing laws outside the US

If you text customers in other countries, their laws apply.

• Canada. Canada’s Anti-Spam Legislation (CASL) requires express or implied consent, sender identification, and a working unsubscribe mechanism in every commercial electronic message, including texts. Administrative penalties reach CAD $1 million per violation for individuals and CAD $10 million for businesses (CASL, s. 20(4)).
• UK and EU.In the UK, the Privacy and Electronic Communications Regulations (PECR) and in the EU, the ePrivacy rules generally mean you need opt-in consent for marketing texts, with GDPR governing how you store and use the phone numbers. 
• Australia. The Spam Act 2003 requires consent, sender identification, and a functional unsubscribe in commercial texts.

SMS marketing compliance checklist

Run your program against this list. Our SMS compliance checklist for marketing teams goes deeper on each item.

Consent

• Opt-in language names your business, describes the messages, states frequency, notes that consent isn’t required to buy, and explains STOP and HELP
• Checkboxes start unchecked
• You store when, where, and how each person opted in, plus the exact language they saw

Registration

• Brand and every campaign registered for 10DLC
• Campaign descriptions and sample messages match what you actually send
• Age gate in place if you mention alcohol, tobacco, or firearms

Opt-outs

• STOP and common variations suppress the number automatically
• Opt-outs that arrive by phone, email, or in person get logged within 10 business days, faster if possible
• One confirmation text only, with no marketing
• Suppression applies across every tool and team that texts customers

Send timing

• Scheduled sends respect the recipient’s time zone, not yours
• Marketing sends stay inside 9 AM to 8 PM if you text nationally
• Frequency caps in place for Florida, Oklahoma, and Maryland numbers

Content

• Every marketing text identifies your business
• Links use your own domain or a dedicated branded shortener
• Messages match the campaign you registered

List hygiene

• Numbers that haven’t engaged in a long time get checked against the FCC’s Reassigned Numbers Database before you text them again

Writing opt-in language? Our TCPA consent language guide has sample text you can adapt.

Where your SMS platform fits

Software alone cannot make a program legal. You still get to choose who you text and what you say A good platform does control the things that break most often when people do them by hand: • Opt-out suppression • Consent records • Registration • Send timing .

Message IQ keeps compliance data on the contact record for HubSpot teams. Unsubscribes are automatically synced to the HubSpot contact record, so your workflows and lists can avoid anyone who replied STOP. Message IQ 3.0 also scans all outgoing messages for opt-out language and inserts the needed wording when it’s missing. We get your 10DLC brand and campaign registered, and carrier-level delivery reporting lets you know if each text actually made it to the phone. See how it fits into your workflows on our  HubSpot SMS integration page.

Frequently asked questions

What are the main SMS marketing laws in the US?

The federal requirements for consent, opt-outs, quiet hours, and Do Not Call are found in the Telephone Consumer Protection Act and the FCC’s rules thereunder. Carrier rules based on CTIA guidelines, including 10DLC registration, govern message delivery. They layer tougher rules on top like Florida, Oklahoma, Maryland, Connecticut, Virginia and Washington. 

Do I need written consent to send marketing texts?

The FCC rules require prior express written consent for autodialed telemarketing texts , and Florida , Oklahoma , Maryland and Connecticut require written consent . In 2026, the Fifth Circuit ruled that oral consent can meet the TCPA in Texas, Louisiana and Mississippi, but carriers and many states still expect documented opt-in. Take out a written consent wherever you go. 

What hours can I send marketing texts?

Federal rules permit telephone solicitations between 8 a.m. and 9 p.m. in the recipient’s local time zone. Connecticut allows from 9 AM to 8 PM, and Florida, Oklahoma, and Maryland close the window at 8PM. So sending between 9am and 8pm recipient time keeps a national program in all of them. 

How fast do I have to honor an opt-out?

The FCC rules require that you honor an opt-out within 10 business days. Consumers may opt-out by any reasonable method, not just a STOP reply. Virginia requires a business to honor a STOP reply for at least 10 years. Most platforms will hide the number as soon as the reply comes in, which is the safest way. 

Does CAN-SPAM apply to text messages?

Only in a narrow instance. CAN-SPAM applies to commercial email and its FCC rule applies to messages sent to wireless email addresses. The TCPA and state telemarketing laws apply to texts sent to a phone number. 

Do I need to register for 10DLC?

Yes if you are sending business texts from a regular 10 digit phone number in the US. Carriers must register brands and campaigns through the Campaign Registry, and any unregistered traffic is filtered out. Campaign approvals usually take about two weeks, so make sure to sign up before your launch date. 

Do SMS marketing laws apply to B2B texts?

Business to business texts are not exempt from the TCPA. Same goes for texting a cell phone. “Whether they own a company or not, the same rules of consent and opt-out apply. Several state laws also govern texts to any number with an area code that is in state. 

Building on a compliant setup

If your team runs marketing in HubSpot, Message IQ adds two-way texting with opt-out syncing, automatic compliance language, and 10DLC registration support. Plans start at $49 a month, billed month-to-month with no contract, for businesses in the US and Canada. Compare plans to find the right message volume.

Talk to an SMS Expert