SMS Marketing for Small Business: TCPA, 10DLC and Texts That Work

A text from a business you trust feels personal. "Your table is ready." "We had a cancellation at 3pm, want it?" "Your furnace tune-up is due." Those short messages fill chairs, tables and calendars in a way few other channels can. They land on the one device your customers never put down.

But texting is also the most tightly policed marketing channel in the US. A federal law, a set of FCC rules, carrier registration systems and a growing list of state laws all shape what you can send, when, and to whom. Get it wrong and your texts quietly stop delivering, or you end up on the wrong end of a class action.

This guide covers the consent you need, the hours you can send, how opt-outs work after the 2025 rule changes, how to register for A2P 10DLC, and what good texts look like for restaurants, salons, dental offices, contractors, shops and realtors. It is practical guidance for owners, not legal advice.

Why SMS works so well for local businesses

Texting works for local businesses for simple reasons. It is short, it is immediate, and it feels like a conversation. Most people read texts soon after they arrive, while an email can sit unopened for days.

It also fits how customers already behave. They text their stylist to move an appointment and send the plumber a photo of the leak. SMS marketing formalizes that habit.

Where SMS earns its keep

• Time-sensitive offers. A same-day cancellation slot or a "slow Tuesday" lunch special only works if people see it today.
• Reminders. Appointment and service reminders cut no-shows and are the texts customers thank you for.
• Two-way service. Customers can reply with a question, which turns a broadcast into a booking.

SMS is a poor fit for long stories or detailed menus. Texting is also personal space. Treat it like a billboard and people opt out fast.

The TCPA in plain English

The Telephone Consumer Protection Act (TCPA) is the federal law behind most texting rules. The FCC treats a text message as a "call" under the TCPA, so the same rules apply. The core FCC rules live in 47 CFR 64.1200.

The law matters because it lets individuals sue. Damages are set by statute at $500 per violation, and a court can increase that up to $1,500 if the violation was willful or knowing. Each text can count as a separate violation, which is why TCPA class actions get expensive quickly.

Prior express written consent for marketing texts

For marketing texts sent with automated tools, the FCC requires prior express written consent. In practice, that means a clear, signed agreement in which the person:

• agrees to receive marketing texts from your business specifically,
• provides the phone number you will text,
• is told plainly that they are agreeing to automated marketing messages, and
• is told that agreeing is not a condition of buying anything.

"Signed" does not mean ink. Electronic signatures recognized under the federal E-SIGN Act count, such as checking an unchecked box on a web form or texting a keyword to opt in. Carriers expect this level of consent anyway, so use it for every promotional text.

Informational messages, such as a reminder for a booking the customer made, face a lower consent bar. But a reminder with a coupon attached is marketing. When in doubt, collect written consent.

Quiet hours

Federal rules ban telephone solicitations before 8am or after 9pm, in the recipient's local time. That last part trips people up. If your Tampa salon texts a client who moved to Denver, her clock is the one that counts.

Some states are stricter, as covered below. A simple safe window nationwide is 9am to 8pm local time.

The Do Not Call Registry applies to texts

In late 2023, the FCC codified that National Do Not Call Registry protections extend to text messages. You need the person's prior permission before sending a marketing text to a wireless number on the registry. Proper opt-in consent covers this. A list of numbers you collected for some other purpose does not.

Opt-outs after the 2025 FCC revocation rules

In 2024 the FCC adopted new rules on revoking consent. Most took effect on April 11, 2025.

What took effect in April 2025

• Any reasonable method counts. Replies like STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE are valid revocations. So is "please don't text me anymore."
• Ten business days, at most. You must honor a revocation within a reasonable time, not to exceed ten business days. Most platforms process STOP instantly.
• One confirmation text is allowed. You may send a single confirmation message within five minutes. It cannot contain any marketing.
• You can ask for clarity. You may ask which types of messages the person wants to stop. If they do not answer, all non-emergency messages must stop.

The details are in the rule text at 47 CFR 64.1200(a)(10).

What is still delayed: "revoke all"

One piece has been pushed back twice. It would make a STOP to one type of message stop all your unrelated messages, such as marketing and reminders together. The FCC first delayed it to April 2026, then extended the waiver again to January 31, 2027 while it considers changes.

The practical advice: treat STOP as STOP for everything except truly essential transactional messages. That keeps you safe whichever way the rule lands.

What about "one-to-one consent"?

You may have read about a 2023 FCC rule that would have required consent to name a single seller, ending the "you agree to hear from our partners" checkbox. On January 30, 2025, the Eleventh Circuit vacated that one-to-one consent rule in Insurance Marketing Coalition v. FCC. The FCC did not continue to fight it and later formally dropped the rule.

For a local business collecting its own opt-ins, nothing changes: get consent directly, for your business, and never buy or share lists.

State mini-TCPA laws to know

Several states have their own "mini-TCPA" texting laws. Many apply when you text a number from that state, even if your business is elsewhere.

Texas lets consumers sue directly, so a quick review with counsel is worthwhile if you text Texans who are not yet customers.

Other states have passed or debated rules too, so follow the strictest common standard everywhere.

CTIA guidelines: the rules carriers actually enforce

Laws set the floor. Carriers decide whether your messages get delivered, based on guidance from the industry group CTIA in its Messaging Principles and Best Practices.

What CTIA expects

• A clear call to action. Every opt-in point should name your business, describe what you will send, say how often, mention possible fees, and explain how to opt out and get help.
• A confirmation text. Send your program name, frequency, "Msg & data rates may apply," and HELP and STOP instructions.
• STOP and HELP keywords. STOP unsubscribes, as do "end," "cancel," "quit" and "unsubscribe." HELP returns your name and contact details.
• No shared or bought lists. CTIA says opt-in lists that have been rented, sold or shared should not be used. Consent is not transferable.

SHAFT content

Carriers apply extra scrutiny to SHAFT content: sex, hate, alcohol, firearms and tobacco. Hate content is not allowed at all. Alcohol, firearms and tobacco or vape messages typically need age gating and may be rejected outright. Cannabis is federally illegal and is blocked even in states where it is legal.

A brewery taproom or cigar lounge in Columbus will face tougher review than a bakery. Carriers can also pass penalties through your provider. Twilio's page on US carrier penalties lists T-Mobile fees of $2,000 for phishing, $1,000 for illegal content, and $500 for other violations including SHAFT.

A2P 10DLC registration, step by step

If you send business texts from a regular 10-digit number, you are using what the industry calls A2P 10DLC: application-to-person messaging over a 10-digit long code. US carriers require these numbers to be registered. As Twilio's A2P 10DLC documentation puts it, the standard ensures that traffic over long codes is "verified and consensual."

What happens if you skip it

Twilio has blocked unregistered US 10DLC messages since September 2023, and carriers block A2P traffic from unregistered numbers. In plain terms, your customers simply never receive the text.

How registration works

Registration runs through The Campaign Registry (TCR), an industry hub the carriers use. You almost never deal with TCR directly. Your SMS provider submits the details for you.

1. Register your brand. Your legal name, EIN, address and website. Name and EIN must match IRS records exactly, or you will be rejected.
2. Pick a brand type. Very small senders without an EIN may qualify as a sole proprietor brand, which has tight daily limits and allows one campaign. Most businesses register as a standard brand, and low-volume options exist.
3. Register a campaign. Describe what you will send, such as marketing, appointment reminders or customer care. Include sample messages and explain exactly how people opt in, opt out and get help.
4. Show your opt-in. Reviewers check that your website or opt-in form displays the consent language. A missing privacy policy is a common rejection reason.
5. Wait for approval. Campaigns are reviewed by your provider and carriers. Plan for days to a few weeks, not hours.

Tips that prevent rejections

• Make sure your website is live and its privacy policy says you will not share mobile numbers or consent.
• Write sample messages that match your real use, with your business name and opt-out language.
• Never make texts a condition of booking. Consent must be optional.

10DLC vs toll-free vs short codes

You have three main number types for business texting.

For a single-location restaurant in Austin or a dental office in Denver, a registered 10DLC number is usually right. It looks local and can take calls. Toll-free is a reasonable alternative if 10DLC approval stalls. Twilio's error reference notes that unverified toll-free numbers are blocked.

How to collect SMS opt-ins the right way

Every compliant program starts with clean opt-ins. There are three common methods, and you can use all of them.

Keyword opt-in

Customers text a word to your number, such as "JOIN" or "TACOS." You reply with a confirmation that includes the full disclosures. Signage at the counter or on the table works well:

Website form checkbox

Add a separate, unchecked checkbox to your booking or contact form. Never pre-check it, and never bundle it with your terms of service. Put the full disclosure right next to the box:

Store the timestamp, the phone number, the form page and the exact wording shown. If a dispute arises, that record is your proof. More local search traffic means more form fills, which is one reason to work through our local SEO checklist.

Point of sale and in person

Staff can offer texts at checkout, but a verbal "sure" is hard to prove. Ask the customer to confirm by text, or by tapping a consent screen on a tablet. Then send the confirmation:

Sample texts by business type

Good texts are short and clearly from you. Put your business name first, give one reason to act, and include an opt-out. Adapt these seven.

Restaurant

Salon

Dental practice

Medical and dental practices should keep health details out of texts entirely, and check HIPAA obligations with a compliance advisor.

Home services

Retail

Real estate

Review request

Frequency, timing and measuring results

How often to text

There is no magic number, but restraint wins. Most local businesses do well with two to four marketing texts per month, plus transactional messages like reminders. Whatever you choose, state it in your opt-in ("up to 4 msgs/mo") and stick to it. Florida and Oklahoma also cap you at three messages on the same subject in 24 hours.

When to send

• Restaurants: late morning for lunch, mid-afternoon for dinner.
• Salons: the moment a cancellation opens, within quiet hours.
• Home services: early in the week and before seasonal changes.
• Retail and dental: a day or two before the weekend or the visit.

Always use the recipient's time zone, not yours.

What to measure

Open rates are not a reliable SMS metric, so focus on actions.

An opt-out spike is a signal, not a disaster. Check what changed: time, offer, frequency or audience. For a structured way to test channels, our 30-day marketing plan shows how to slot SMS alongside everything else.

SMS vs email vs WhatsApp

Most small businesses use more than one direct channel. Each has a job.

WhatsApp is especially popular in many US immigrant communities and with customers who have family abroad. A Columbus grocery serving South Asian families, or a Tampa salon with many Latin American clients, may find customers reply far more readily there. Our WhatsApp Business API guide covers setup and template rules.

Common mistakes that cost money

1. Texting without written consent. Old invoices and POS exports are not opt-ins.
2. Ignoring time zones. A 9:15pm text one zone over breaks federal quiet hours. 8:15pm can break Florida's.
3. Slow opt-outs. Ten business days is the legal maximum. Do it instantly.
4. Skipping registration. Unregistered 10DLC and unverified toll-free messages are blocked, so you pay for silence.
5. Sharing or buying lists. It breaks CTIA rules and consent law.
6. SHAFT surprises. A brewery or vape shop running a standard campaign risks rejection and carrier penalties.
7. Texting too often. Frequency beyond what you promised drives opt-outs and complaints.

Keep consent records in one place

Clean consent records are the best insurance you can buy. Growvia does not send SMS, but its website forms record consent with a timestamp, and its one inbox keeps email and WhatsApp replies next to your other leads.

Frequently asked questions

Do I need consent to send marketing texts to my existing customers?

Yes. Being a customer does not equal consent to marketing texts. For promotional messages, collect prior express written consent, such as an unchecked web form box or a keyword opt-in, and keep a record of it.

What is A2P 10DLC registration and do I really need it?

A2P 10DLC is the carrier system for business texting from regular 10-digit numbers. You register your brand and your campaign through your SMS provider, which submits them to The Campaign Registry. Unregistered traffic is blocked, so if you text customers from a local number, you need it.

What hours can I send text messages?

Federal rules ban telephone solicitations before 8am or after 9pm in the recipient's local time. Florida and Oklahoma limit sales texts to 8am to 8pm. A safe nationwide window is about 9am to 8pm local time.

How fast do I have to honor a STOP request?

Under FCC rules, within a reasonable time not to exceed ten business days. You may send one confirmation text within five minutes, with no marketing in it. In practice, set your platform to unsubscribe people instantly.

Can I text people who filled out my contact form?

Only if the form included a clear, optional consent checkbox for texts with the right disclosures. Asking for a phone number to call someone back is not the same as consent to marketing texts. Add a separate, unchecked box and record when it was checked.

Is WhatsApp a good alternative to SMS in the US?

It can be, especially if many of your customers already use it, which is common in many immigrant communities. It has its own opt-in and template rules. Many businesses run both and let customers choose.