The 2026 SMS Compliance Checklist for US Marketing Managers

summary: A compliant US SMS program needs documented prior express written consent, 10DLC brand and campaign registration, working STOP/HELP handling, recipient-local-time quiet hours, and monthly Reassigned Numbers Database scrubs. TCPA statutory damages run $500 to $1,500 per violating message.

Disclaimer: This is general information for marketing teams, not legal advice. Rules vary by state, industry, and message type. Have qualified counsel review your program. Five things are non-negotiable in 2026: documented prior express written consent, 10DLC brand and campaign registration, working STOP and HELP handling, delivery only inside recipient-local quiet-hour windows, and monthly scrubbing against the FCC Reassigned Numbers Database.

Federal rules are the floor, not the ceiling. Several states are moving toward treating texts the way they treat voice telemarketing, and this page does not settle those. Anything state-level is a question for your counsel.

Prior express written consent is the TCPA standard requiring a signed, documented agreement before a business sends automated marketing text messages to a consumer.

The consent piece is where most programs are weakest, and it is weak in a specific way: the checkbox exists, but nobody can reconstruct what the subscriber saw. A consent record that says “opted in via webform, March 2025” is close to worthless in litigation, because the question is never whether someone clicked — it is whether the disclosure next to the click met the standard. Capture the exact disclosure text, the timestamp, the source IP, and the method, and store them with the contact rather than in a separate marketing system that gets migrated or sunset. Suppression records deserve separate treatment: keep them forever, and make sure they survive vendor changes, because an opt-out that gets lost in a CRM migration converts a suppressed contact back into a live one, and that is exactly the fact pattern that turns a single violation into a class. The mechanics are unglamorous and they are where programs actually fail. A contact opts out in 2024, the company migrates from one ESP to another in 2025, the suppression list does not make the trip because it lived in a field nobody mapped, and in 2026 the same number receives a promotional send from a completely new team that had no idea the opt-out existed. Nothing about that sequence requires bad intent. It only requires that nobody owned the suppression list as infrastructure rather than as data.

The federal floor

Requirement	Standard	Source + verified
Consent	Prior express written consent for automated marketing texts	47 CFR 64.1200 · 2026-10-14
Statutory damages	$500 per violation; up to $1,500 for willful violations	47 CFR 64.1200 / FCC · 2026-10-14
Registration	10DLC brand and campaign via The Campaign Registry	Bandwidth 10DLC guide · 2026-10-14
Opt-out	STOP/HELP handling and clear opt-out language in the first message	CTIA Messaging Principles · 2026-10-14
Quiet hours	8 PM–8 AM recipient local time, recommended for promotional and non-promotional content	CTIA · 2026-10-14
Unregistered routing	Closed February 3, 2025 — unregistered 10DLC traffic is blocked	Industry registration guidance · 2026-10-14

Comparison basis: US federal requirements for A2P SMS marketing, excluding state-level overlays and industry-specific rules such as HIPAA.

State-level items to confirm with counsel (not verified here)

Two developments are being discussed in US compliance commentary. Both are listed here as items to raise with counsel — not as established requirements, and no dollar figures or holdings are quoted below, because we could not verify them against primary state or court sources as of 2026-10-14.

Texas. A bill has been reported that expands “telephone solicitation” to include text messages, which would pull SMS toward voice-telemarketing registration and bonding. Whether consented opt-in SMS is exempt is contested in commentary.
Illinois. A federal district court decision has been reported holding that SMS qualifies as a “call” under the TCPA’s do-not-call subsection.

We are deliberately not naming the bill, the case, or any dollar figure here. Both items reached us only through secondary compliance commentary, and we could not tie them to a primary state or court source.

Read them as directional: state treatment of SMS is converging with voice telemarketing. Do not budget against them.

Sourcing note: these items appeared only in secondary compliance commentary as of 2026-10-14. We deliberately omit statutory citations, fee amounts, and case outcomes until they can be verified against primary sources. Do not cite this section externally without counsel review.

The Reassigned Numbers Database is the FCC-administered lookup, operated by Somos, that tells a sender whether a phone number was permanently disconnected after the date consent was obtained.

A safe harbor is a legal defense that shields a sender from TCPA liability for a reassigned number when a documented RND query returned “no” before the message was sent.

Number hygiene: RND scrubbing

Item	Value	Source + verified
Launch date	November 1, 2021	reassigned.us / FCC · 2026-10-14
Administrator	SomosGov, Inc. under FCC contract	reassigned.us · 2026-10-14
Safe harbor rule	47 CFR 64.1200(l)–(m); only a “no” response supports the defense	eCFR · 2026-10-14
Pricing (effective April 28, 2025)	Tier 1: $8/month for 1,000 queries ($0.008 each); Tier 2: $60/month for 10,000 queries ($0.006 each); top tier: $28,000/month for 50,000,000 queries ($0.00056 each)	reassigned.us · 2026-10-14

Comparison basis: published FCC rate schedule, per query, US, excluding middleware vendor markup and excluding taxes.

Note the asymmetry. A “no” response supports the defense. A “no data” response supports nothing at all, and it is the response you get most often on older records.

Keep every query result. The defense only exists if you can prove the query happened.

Quiet hours are a recipient-time problem

National brands that schedule at sender-local time systematically hit Mountain and Pacific subscribers outside permitted windows. The fix is recipient-time scheduling: store a time zone per contact, or resolve it from area code with a fallback, and gate sends on a single window such as 10 AM–7 PM recipient-local.

The evidence file

Per contact, store five fields: consent timestamp, consent method, source IP, the exact disclosure text shown, and the keyword or form used. That is the evidentiary floor.

Suppressions are different. Keep them forever. An opt-out is permanent, and it has to survive a CRM migration and a vendor change, which is exactly when these files get lost.

Monthly compliance cadence

Re-verify TCR campaign status is active for every live workflow.
Run RND scrubbing on at-risk records; log query results.
Scrub against federal and state DNC lists and your internal suppression list.
Audit a sample of sent messages for STOP/HELP/branding disclosure presence.
Review opt-out rate per cohort and per carrier.
Confirm send windows remain recipient-local after any daylight-saving change.

FAQ

What is the penalty for sending SMS without consent under the TCPA? Statutory damages of $500 per violating message, rising to $1,500 for willful violations, plus class-action exposure.

Do I need 10DLC registration for transactional texts? Yes for A2P traffic from 10-digit long codes. Carriers closed unregistered routing on February 3, 2025; toll-free numbers require separate toll-free verification.

How often should I scrub against the Reassigned Numbers Database? Monthly is the practical cadence for active lists, and before any large send to older records.

Do US states impose extra SMS rules beyond federal law? Some are moving that way. We do not quote specific state requirements because we could not verify any against a primary source — have counsel confirm the position in every state you send to.

What quiet hours apply to SMS in the US? CTIA recommends 8 PM to 8 AM recipient local time, including non-promotional content.

How long should I keep opt-in records? Retain consent evidence for the life of the relationship plus a documented tail period, and retain suppression records indefinitely.