SMS Compliance for Service Businesses: A Pre-Launch Guide

Texting is the fastest way to reach a service business's customers, which is exactly why the rules around it are strict. If you text leads and customers in the United States, three different layers apply: federal law (the TCPA, enforced by the FCC), carrier requirements (A2P 10DLC and toll-free verification), and your provider's own policies. This guide walks through what each layer expects, in plain English, so you can launch a text program without creating a legal problem.

This article is general information, not legal advice. Rules change, and enforcement depends on the specifics of your situation. Have a qualified attorney review your consent language and messaging flows before you launch.

Key takeaways

• Commercial text messages require written consent; informational texts may rely on oral consent, per the FCC's consumer guidance.
• US carriers require senders to register for A2P 10DLC, and unregistered traffic is filtered and charged additional fees.
• Toll-free numbers must complete toll-free verification before they can send SMS to US and Canadian recipients.
• Opt-outs are honored in any reasonable manner, and you must process them within a reasonable time not to exceed 10 business days.
• Keep a record of every consent: who, what they agreed to, when, and how. Four years is the retention period practitioners commonly recommend.

Consent: the three situations you will actually face

Almost every texting question reduces to one of three situations. Know which one you are in before you type a message.

Marketing texts require written consent

The FCC's consumer guide is direct: "Commercial texts require written consent; for informational texts, your consent may be oral." If your message promotes a service, a discount, a promotion or a re-engagement offer, it is commercial, and you need prior express written consent.

Informational texts need consent too, but a different kind

Appointment confirmations, reminders and service updates are typically informational. The consent standard is lower — the FCC says oral consent can be enough — but it still has to exist, and it has to cover text messages specifically. A phone number left for a callback is not a text program opt-in.

You cannot text first and ask later

The classic mistake is buying a list or importing old contacts and texting them "just once to see." Without consent, that message is the violation, not the fix. The same consent-first logic applies to every channel you add later, each with its own rules stacked on top of the law; if you are considering WhatsApp for service conversations, we explain how the channel works in WhatsApp automation for service businesses. The FCC is equally clear that even where consent exists, a person can revoke it "at any time and in any reasonable manner," and your program has to respect that.

What consent should actually look like

The FCC's guidance says written consent can be collected on paper or electronically — including through website forms or a telephone keypress. In practice, a defensible opt-in captures four things:

• Who is asking. Your business name, clearly, at the point where the number is collected.
• What they are agreeing to. Text messages, including marketing texts where applicable, with message frequency noted.
• The number that will receive them. Recorded as part of the consent record, not presumed.
• That consent is not a condition of purchase. The consumer can still buy without agreeing to texts.

Legal analyses of TCPA consent (for example, Klein Moynihan Turco's primer on consent language) add two practical elements: the opt-in should require an affirmative act — an unchecked box or a clearly labeled button, not a pre-checked box — and the consumer should be told how to opt out from the start. Carrier vetting for toll-free numbers expects the same things: Twilio's verification checklist requires an opt-in that is voluntary, not pre-checked, with STOP and HELP instructions adjacent to the phone field.

One recent development worth knowing: the FCC adopted stricter "one-to-one" consent rules in 2023, but the Eleventh Circuit vacated them in January 2025, so the requirements reverted to the prior written-consent standard. This is an area where the law has moved recently — another reason to confirm your current obligations with counsel rather than trusting any article, including this one.

A2P 10DLC: registration is mandatory

A2P means application-to-person: messages sent from software rather than typed by a human. 10DLC means a standard 10-digit local number. According to Twilio's A2P 10DLC documentation, US carriers implemented 10DLC registration to verify senders and reduce spam, and anyone sending SMS over a 10DLC number to US recipients must register.

Registration has two parts:

• A brand. Who is sending: your legal business identity.
• A campaign. What you are sending, how people opted in, how they opt out, and how they get help.

The costs of skipping registration are concrete, not theoretical: unregistered traffic receives lower throughput, more carrier filtering, and additional carrier fees. If you text from a platform like Twilio, the platform will walk you through registration, and the campaign details you provide must match what your website's opt-in actually says. Inconsistency between the two is one of the most common reasons campaigns get rejected.

Toll-free verification: a separate process

If you use a toll-free number (800, 888, 877, 866, 855, 844 or 833), that is not part of the 10DLC system — it has its own process. Twilio's onboarding guide states plainly that toll-free numbers "can't send SMS messages to the United States and Canada until you've completed toll-free verification and Twilio approved your verification."

Verification is a vetting exercise. You submit your business identity, your opt-in flow, and sample messages. Twilio's required-information checklist shows what reviewers look for:

• A real business website with a live privacy policy and terms of service.
• An opt-in that is voluntary and unchecked by default, with separate consent for different message types.
• The exact disclosures next to the phone field: business name, message type, frequency, "Message and data rates may apply," and STOP/HELP instructions.
• A privacy policy that states text messaging opt-in data is not shared with third parties.

If any of that sounds like work, that is because it is: verification exists precisely to keep casual senders out. Budget a few days of preparation, and fix your website's opt-in before you submit, not after a rejection.

Quiet hours, frequency and expectations

FCC rules prohibit telemarketing calls to residential subscribers before 8 a.m. and after 9 p.m. local time. Texts are legally "calls" under the TCPA — the FCC's 2024 order states that a text message sent using an autodialer is a call subject to the TCPA — so treat the 8-to-9 window as applying to your text program. Schedule sends in the recipient's time zone, and be conservative around weekends for non-urgent marketing.

Frequency discipline is not just legal hygiene, it is carrier hygiene. Carriers and consumers both punish high-volume messaging with complaints, and complaints feed filtering. A practical default: confirmations and reminders as needed, marketing messages no more than a few per month, and an instant stop on any negative reply.

STOP handling: the mechanics that matter

The FCC's 2024 order, published in the Federal Register, is precise about revocation:

• Consumers can revoke consent in any reasonable manner. Reply words like STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE are "a reasonable means per se" — you cannot require a different method.
• You must honor revocation within a reasonable time, not to exceed 10 business days.
• You may send one confirmation text acknowledging the opt-out. It must contain no marketing or promotional content, and if it goes out within five minutes it is presumed to fall within the consumer's prior consent.

In practice, this means your platform should process STOP and similar keywords automatically and immediately, and your team should know that a "please stop texting me" in a reply thread counts too. Every opt-out goes on a permanent suppression list — not a per-campaign one.

HELP handling matters as well. Standard messaging requires that a consumer who texts HELP receives a response telling them who you are and how to reach a human. The Twilio checklist lists STOP and HELP keyword behavior as part of verification for a reason: it is one of the first things reviewers and consumers test.

Record-keeping: your defense is your documentation

If a consent dispute arises, the burden of proof generally falls on the business, not the consumer — which makes records your most important compliance asset. Practitioners commonly recommend retaining consent records for at least four years, matching the federal limitations period for TCPA actions. A consent record worth having includes:

• The phone number and the exact disclosure the consumer saw.
• The date, time and mechanism of consent (form submission, checkbox, keypress).
• A copy or screenshot of the opt-in page as it looked when they consented.
• The message history, including every opt-out and how quickly it was processed.

The FCC also requires telemarketers to record do-not-call requests at the time they are made, so "we think they opted out somewhere" is not a record. If your CRM cannot store consent artifacts today, that is a data-model gap worth fixing before the first campaign, not after.

Pre-launch checklist

• Confirm your consent language with an attorney for your specific use case.
• Make sure your opt-in is unchecked by default, names your business, and states the message type and frequency.
• Register your A2P 10DLC brand and campaign, and keep the details consistent with your website.
• If using a toll-free number, complete toll-free verification before sending.
• Verify STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE all trigger an immediate opt-out in your platform.
• Set quiet hours: nothing before 8 a.m. or after 9 p.m. in the recipient's time zone.
• Configure HELP to return your business name and contact info.
• Build a permanent suppression list and confirm it is checked before every send.
• Store consent records for at least four years, including page screenshots and timestamps.
• Write down your escalation path: who handles a complaint, and how fast.

Our email and SMS follow-up setup builds these guardrails into the system rather than bolting them on later, and the speed-to-lead SMS and SMS nurture workflows are designed around consent-aware sending. If you are re-engaging contacts you have not spoken to in a while, pair this guide with the reactivation playbook — old lists are where consent gaps tend to hide.

FAQ

Can I text a lead who filled out my website form?

Only if your form included clear consent language for text messages. A phone number submitted for a callback is not automatically permission to send marketing texts. The safest pattern is an unchecked checkbox that names your business, the message type and the opt-out instructions.

Do I need A2P 10DLC registration to text customers?

Yes, if you send application-to-person texts over a standard 10-digit US number. US carriers implemented A2P 10DLC registration to verify senders, and unregistered traffic gets filtered and charged additional carrier fees. Toll-free numbers follow a separate verification process.

How fast must I honor a STOP request?

FCC rules require that revocation requests be honored within a reasonable time not to exceed 10 business days. In practice, modern messaging platforms can process STOP instantly, which is the safer standard, and you may send one confirmation text that does not include marketing.

Is it illegal to text at night?

FCC rules prohibit telemarketing calls to residential subscribers before 8 a.m. or after 9 p.m. local time, and the FCC has confirmed that an autodialed text is a call under the TCPA. Treat the same window as applying to your text programs.

This article is general information about US messaging rules as of September 2026 and is not legal advice. Consult a qualified attorney about your specific situation before launching or changing a messaging program.