SMS Compliance for Service Businesses

Read this first: what this guide is and is not

This is a plain-language overview written to help a small service business understand the landscape and ask better questions. It is not legal advice, and it is not a substitute for talking to an attorney or to your messaging provider and carrier. Telecom rules change, courts overturn regulations, states pass their own stricter laws, and carrier policies are updated without much public notice.

That matters more than usual with SMS, because the penalties are not theoretical. The federal Telephone Consumer Protection Act (TCPA) carries statutory damages per violating message, and there is an active plaintiff bar that looks for texting programs with sloppy consent records. Several states have passed their own mini-TCPA laws with tighter rules and their own private rights of action. A small business sending a few hundred texts a month can still end up on the wrong side of it.

Two rules of thumb will keep you out of most trouble. First, only text people who asked to hear from you, and keep the proof. Second, honor opt-outs immediately and without exception. Nearly every problem in this area starts with a failure of one of those two. Before you launch any automated texting, confirm your specific setup with your carrier or provider and with counsel.

TCPA basics and the two kinds of consent

The TCPA governs calls and texts to mobile numbers, and courts have long treated a text as a call for these purposes. The core concept is consent: you generally need the recipient's permission before sending, and the level of permission required depends on what the message is for.

Informational or transactional messages, meaning messages about a transaction the customer already initiated, generally require prior express consent. In practice that usually means the customer gave you their mobile number in connection with that transaction. An appointment confirmation, an on-the-way notice, an invoice link, or a reply to a customer who just called you sits in this category.

Marketing or promotional messages, meaning anything advertising or promoting your services, generally require prior express written consent, which is a higher bar. That means a clear written agreement (an electronic checkbox or a keyword opt-in counts) that discloses you will send automated marketing texts, that consent is not a condition of purchase, and that message and data rates may apply. A customer handing you their number to book a job is not, by itself, permission to send them a spring promo blast.

The practical implication for service businesses: keep your operational texting and your marketing texting mentally separate, and collect explicit marketing opt-in as its own step. Do not assume that having a customer relationship covers promotional messaging. And be aware that the regulatory details here have been in flux, including an FCC consent rule that was set aside in court before it took effect, so confirm the current state of the rules rather than relying on an article, including this one.

Capturing and storing consent so you can prove it

In a dispute, the burden is generally on the sender to show consent existed. Verbal assurances and memory are not evidence. What you want is a record you can produce for any given number: what the person agreed to, the exact wording they saw or were read, when, and through what channel.

Concretely, for a web form, store the timestamp, the IP address, the page URL, and a snapshot of the exact consent language displayed next to the submit button. For a keyword opt-in, the inbound message itself is your record. For a phone or in-person opt-in, log the date, who took it, and the script that was read. Whatever system you use, make sure these records survive changing software, because the relevant lookback period is measured in years, not months.

Write the consent language so it stands alone and is not buried. It should name your business, say what kind of messages will be sent and roughly how often, state that consent is not required to buy anything, and note that message and data rates may apply, with STOP to opt out and HELP for help. Do not pre-check the box. Do not bundle SMS consent into a general terms-of-service acceptance, and never make SMS consent a requirement for getting a quote.

Never buy, rent, or scrape phone number lists, and do not text numbers pulled from a public directory or an old customer list you cannot document. Purchased lists are the single fastest route to a complaint, and consent given to somebody else does not transfer to you.

A2P 10DLC registration, and why unregistered texting quietly fails

Separate from the law, US carriers impose their own requirements on application-to-person (A2P) messaging, meaning any texting sent by software rather than typed by a human on a handset. If you are sending automated texts from a standard 10-digit local number, you are in the A2P 10DLC framework, and it requires registration.

Registration has two parts. First you register your brand: legal business name, EIN or the sole-proprietor equivalent, address, website, and contact details, all of which must match your official records or vetting fails. Then you register a campaign, which describes your use case (customer care, appointment reminders, two-way conversational, marketing), provides sample messages, and shows where and how you collect opt-in, including a link to the page with your consent language and to a published privacy policy and terms. Carriers do check that opt-in link, and a missing or mismatched consent page is one of the most common rejection reasons.

There is a sole-proprietor path for businesses without an EIN, with lower throughput limits and a phone-verification step. Toll-free numbers use a different process called toll-free verification, and short codes are a separate, far more expensive track. Whichever you use, expect per-message carrier fees and daily throughput limits tied to your trust score.

The consequence of skipping registration is not a warning letter, it is silence. Unregistered or misregistered A2P traffic gets filtered or blocked, often without any error visible to you. Your messages simply never arrive, customers assume you ignored them, and you find out weeks later. If your texts stopped landing, registration status is the first thing to check.

Quiet hours, frequency, and state rules

Federal rules restrict telemarketing calls and texts to the window between 8:00 a.m. and 9:00 p.m. in the recipient's local time, not yours. That distinction matters for any business serving multiple time zones: an 8:15 a.m. blast from the Eastern time zone lands at 5:15 a.m. on the West Coast. Store the number's likely time zone, or simply choose a send window that is safe everywhere you operate, such as mid-morning to early evening Pacific-safe hours.

Several states impose stricter windows and additional restrictions through their own mini-TCPA statutes, and some limit how many messages you may send in a period or restrict certain days entirely. If you operate in or text into multiple states, ask counsel which state rules apply to you rather than assuming the federal window is the ceiling.

Frequency is both a legal and a practical matter. Carriers watch for patterns that look like spam, and recipients opt out or complain when volume is high. For most service businesses the honest answer is that operational messages tied to a real job are welcome, and promotional messages should be rare. If you cannot say what value a given blast delivers to the recipient, it is costing you more in opt-outs than it earns.

STOP, HELP, and honoring opt-outs

Every messaging program must honor opt-out requests. The standard keywords are STOP, END, QUIT, UNSUBSCRIBE, and CANCEL, and HELP or INFO should return your business name and contact information. Most reputable messaging platforms handle these keywords automatically at the carrier level, but you should verify that yours does rather than assuming it, and test it with a real handset.

Regulators have made clear that opt-out is not limited to magic words. If a customer replies in plain language, saying stop texting me or take me off this list, that is a revocation and it must be honored. The FCC has set a standard requiring senders to honor revocation within a defined period measured in business days; in practice a modern system should process it instantly, and there is no good reason for a small business to use the full grace period.

Once someone opts out, suppress the number across your systems, not just in the one tool that received the STOP. A common and expensive failure is a customer who opts out of marketing texts and then keeps receiving them from a second platform, a spreadsheet import, or a re-uploaded contact list. Keep one suppression list that everything checks against, and never re-add a number because it appeared in a fresh export.

Do not try to talk someone out of it, and do not send a follow-up asking why. Send the single required confirmation that they have been unsubscribed, and stop.

Message content rules the carriers enforce

Carriers filter on content as well as registration. Identify your business by name in the first message of any conversation and in any message sent to a number that has not been in an active exchange with you. Recipients should never have to guess who is texting them.

Avoid public URL shorteners such as the free generic ones. Shared shortener domains are heavily abused by spammers and are aggressively filtered; use your own domain or a branded link. Avoid all-caps shouting, excessive punctuation, and the classic spam triggers, and be careful with content in the categories carriers restrict, generally summarized as SHAFT: sex, hate, alcohol, firearms, and tobacco. Certain regulated verticals such as lending, debt collection, and cannabis have their own restrictions or outright prohibitions.

Include opt-out language in the initial message and periodically thereafter in recurring programs. It costs a few characters and it demonstrates good faith. Also keep messages relevant to the campaign use case you registered; sending marketing offers over a campaign you registered as appointment reminders is a registration violation even if every recipient consented.

A practical compliance checklist

Work through this before you send anything automated. Is your brand and campaign registered for A2P 10DLC (or is your toll-free number verified)? Does your intake form show clear, unbundled, unchecked consent language, and do you store the timestamp and the exact wording? Do you have a published privacy policy and terms page that the registration links to? Do STOP and HELP work on a real phone, tested by you?

Then: do you have one suppression list checked by every system that can send? Are you inside the permitted hours for the recipient's local time, and have you asked whether any stricter state rules apply to you? Do your messages name your business? Do your links use your own domain? Are marketing messages going only to people who gave written marketing consent, separate from customers who simply gave you a number to book a job?

Finally, keep a one-page written record of your program: what you send, to whom, on what consent, and who is responsible for it. If a complaint ever arrives, having that document and the underlying consent records is the difference between a quick resolution and an expensive one. And repeat the point this guide opened with: confirm your specific setup with your provider or carrier and with a qualified attorney before you rely on any of this.