Understanding US SMS compliance laws

You will learn

Learn about the compliance laws governing the SMS channel. When getting started with SMS marketing, it's important to have a grasp on the corresponding legislation. As with email, to avoid spam violations, it’s important to understand what spam is, the laws that regulate telemarketing spam (TCPA), and the organizations that protect consumers from spam (CTIA). Please note that Klaviyo cannot provide legal advice regarding US SMS compliance laws, and if you have questions about any of the points outlined in this guide, we recommend contacting legal counsel.

Text messaging laws vary by country. The laws covered in this guide are specifically around US laws. If your business is located in another country, or you have customers in other countries, follow all SMS laws and legal requirements in the areas where you do business.

Text spam

Like spam emails, spam texts are any unwanted messages sent from an individual or company, often containing irrelevant, inappropriate, or untimely content. They are often sent to a large number of recipients, but this isn't a necessary qualification — any unwanted message can be classified as spam. In addition to generally being a bad practice, it is also illegal to send unsolicited text messages to people without their consent, and the fines can be heavy. This is why obtaining consent is so important.

The penalties for violating the TCPA can be severe. Private TCPA lawsuits can seek $500 in statutory damages per violation or actual monetary losses, whichever is greater. Courts may increase the award up to 3 times for knowing or willful violations. Some settlements have reached into the tens of millions of dollars. These violations can add up fast, which is why having concrete processes in place is of paramount importance. If you think of how many people you have on your list, imagine if you texted all of them without express consent at $500 per person. You should always have an attorney review your entire texting policy and process. This will help ensure you remain in compliance.

SMS compliance guidelines

While we recommend that you consult an attorney to ensure that your text messaging program and policies comply with US SMS laws and carrier guidelines, there are some general guidelines and best practices you can follow:

Get express consent

Always obtain express consent before texting anybody. Even if they have opted into your email list and you have their phone number from a signup form, this does not mean they consent to receive text messages from you. The consent you obtain must contain explicit language indicating that the individual agrees to receive recurring marketing messages at the mobile phone number they provided you, that your messages may involve the use of an automatic telephone dialing system or "autodialer," and that consent is not a condition of any purchase.

Consent must be obtained in writing via a physically signed agreement, a digitally signed agreement, or an SMS opt-in, such as a sign-up form or a subscribe keyword. With double opt-in, the subscriber must confirm their subscription after signing up before you send marketing texts. Sending a confirmation request alone does not complete double opt-in.

A single consent cannot be provided to multiple brands or organizations. Customers must provide consent to receive messages from your company explicitly. Lead generation, affiliate related, or purchased lists are not valid SMS consent.

Give recipients a way to opt out

It's important to provide an automated way for recipients to opt out at any time. This can be as simple as replying "stop" to a text message that you sent them. Think of this as a way to "unsubscribe" from text marketing. Opt-out instructions should be provided at regular intervals and at least once per month. Certain carriers like T-Mobile also recommend providing explicit opt out instructions in every fifth message.

Explain what someone is opting into

You must be clear about what subscribers are opting into. If they’re opting in to receive shipping confirmations, don’t send them marketing collateral about unrelated products they haven’t purchased.

Comply with time of day restrictions

The TCPA prohibits any telephone solicitation (including text messages) anytime before 8 a.m. and after 9 p.m. in the recipient's time zone (known as "quiet hours"), but certain states have more restrictive rules.

Plan your sends around the state restrictions that apply to your recipients, including any restrictions on Sundays and public holidays. A 9 a.m. to 8 p.m. sending window does not meet every state’s requirements. If you have customers in different time zones, you’ll need to take multiple time zones into consideration. A “Good Morning, [name]” text sent at 11 a.m. Pacific Time won’t make sense to somebody reading it on the east coast at 2 p.m.

Klaviyo offers quiet hours for flows and quiet hours for campaigns to help prevent texts from sending during restricted times. The sending window and time zone depend on your quiet hours settings and the recipient’s location. Review your account’s quiet hours settings and the linked guidance before sending.

Other best practices

• Provide value — if your text messages aren’t helpful, your subscribers will probably opt out. Provide something of value, whether it’s a discount code, a link to helpful content, or notifications relevant to something they’ve purchased.
• Avoid acronyms and shorthand because not everyone will be savvy to common acronyms that you may use in text conversations (e.g., "lol" or "lmk").
• Cap your frequency. Use Smart Sending to prevent recipients from receiving too many text messages within a short timeframe. If you’re sending individuals more than 1 or 2 texts per day, or 4–5 a week, you’re likely sending too many and risk that person opting out.
• Measure your results. Review every text campaign or flow to see whether subscribers are taking the desired action and whether unsubscribe rates are increasing. While SMS open rates aren’t available, you can measure click rates for messages with links. Compare your results with the SMS click-rate benchmarks for campaigns and flows, keeping your industry and audience in mind.

SMS compliance FAQs

What is TCPA?

TCPA stands for the Telephone Consumer Protection Act. The telemarketing law dates back to 1991 and covers the use of automated telephone communications, including phone calls, voicemails, fax machines, and text messages. Text messages are considered transactions similar to phone calls, which is why they are covered under the TCPA. TCPA violations can lead to private lawsuits for $500 in statutory damages per violation, with awards of up to 3 times that amount for knowing or willful violations.

For SMS marketing, obtain express written consent before sending texts. Klaviyo recommends using double opt-in to confirm recipients' subscriptions to SMS. Double opt-in text messages help:

• Confirm the phone number provided by the recipient is legitimate and correct.
• Capture an electronic record of the recipient’s consent.
• Provide a way for the person to opt out.

What is CTIA?

CTIA is the Cellular Telecommunications Industry Association. The CTIA is a trade organization run by wireless companies such as AT&T, Verizon, and many more. It is not a law or government-run organization like the FCC, and has no legal authority. You cannot be sued for not following CTIA guidelines; however, there can be other ramifications for not following their rules. If found to be in violation of these rules, the CTIA will report you to the mobile carriers, who may shut down or suspend your access to their customers until you resolve the issue.

In addition, the CTIA established the common short code system, one option for sending marketing texts. SMS content relating to sex, hate, alcohol, firearms, or tobacco (SHAFT) is restricted. Klaviyo supports some age-gated use cases, including US alcohol messaging to subscribers aged 21 or older, subject to content restrictions. Review the SMS and MMS prohibited-content requirements for supported use cases and restrictions.

What is the best way to acquire proper consent?

Firstly, it's important to understand that you cannot and should not text anybody without their express permission to receive text messages from you. So, if you have their phone number because they were required to submit it at checkout, but do not have their explicit consent to receive messages from you, then you should NOT send them text messages.

Once you have their permission, you should always send a message confirming their opt-in status, and provide an explanation for how they can opt out. This can be as simple as telling them to reply “STOP” if they ever choose to stop receiving texts from you.

Use these 4 steps when collecting SMS consent and communicating with subscribers.

1. Obtain express written consent through a physically signed agreement, a digitally signed agreement, or an SMS opt-in, such as a sign-up form or a subscribe keyword. If you use double opt-in, wait for the subscriber to confirm before sending marketing texts.
2. The consent you obtain must contain explicit language indicating that the individual agrees to receive recurring marketing messages at the mobile phone number they provided you, that your messages may involve the use of an automatic telephone dialing system or "autodialer," and that consent is not a condition of any purchase.
3. Disclose the type of content they will receive and the frequency of messages.
4. In subsequent text messages, it is considered a best practice to mention your company by name, the frequency of messages, possible carrier costs and fees, and an option for them to request help or opt out of future texts.

Learn more about how you can use Klaviyo to properly collect consent from your subscribers.

If my customers already consent to receive email, can I skip this?

No. If somebody is on your email list, it does not necessarily mean you have consent to send them text messages as well, even if they provide their phone number when they subscribe to your emails. Vice versa, if somebody consents to receive text messages from you, it does not necessarily imply email consent. Your email list and text list consent are treated separately by Klaviyo.

What if my customers opt out of future SMS text messages? How long do I have to honor opt-out requests?

It’s important to note that the most common way for people to remove consent is to reply “STOP” to any text message you send. However, you should be aware that some people may request to remove consent via other avenues, such as by emailing or calling your customer support team, or even contacting you via social media channels.

Honor opt-out requests as soon as possible. Federal rules require requests to be honored within a reasonable time, no later than 10 business days after receipt. For requests received outside SMS, remove SMS consent from the person’s profile; removing them from a list is not enough. If they request an end to all texts, remove both marketing and transactional consent.

In Klaviyo, a STOP reply automatically removes both SMS marketing and transactional consent. Apart from a non-promotional opt-out confirmation, do not send further texts unless the person opts back in.

Additional resources