<\/p>\n
Summary<\/h2>\n\n- The FCC\u2019s planned one-to-one consent rule for SMS marketing was canceled in 2025, so brands still need prior express written consent before sending promotional texts.<\/li>\n
- State SMS laws are becoming more important, with different rules for opt-outs, consent records, and data retention that brands need to monitor.<\/li>\n
- Carrier requirements like 10DLC registration and content guidelines affect whether SMS messages are delivered, even if brands have customer consent.<\/li>\n
- Customers can opt out through any reasonable method, not just by replying to STOP, and brands must respect local time zones for sending messages.<\/li>\n
- Using a platform to manage consent, preferences, and opt-outs helps brands stay compliant while scaling SMS campaigns.<\/li>\n<\/ul>\n<\/div>\n
Is SMS marketing<\/a> legal in 2026? Yes, but the ground under it shifted twice in two years, and plenty of teams built processes around a rule that never actually took effect.<\/p>\nThe Federal Communications Commission (FCC) one-to-one consent requirement was scheduled to launch in January 2025, then a federal appeals court vacated it days before the deadline. That reversal left lifecycle and customer relationship management (CRM) teams holding compliance frameworks designed for a rule that quietly disappeared.<\/p>\n
This piece is for US-based lifecycle, CRM, and growth marketers at ecommerce and direct-to-consumer (DTC) brands who own SMS programs and need to know what\u2019s enforceable right now, not what almost happened.<\/p>\n
We\u2019ll separate the settled law from the growing patchwork of state legislation and carrier requirements, then walk through the operational guardrails, consent documentation, opt-out handling, and quiet-hours enforcement that keep a program defensible as it scales.<\/p>\n
The 2026 TCPA landscape: what changed and what didn\u2019t<\/h2>\n
The one-to-one consent rule is gone, but the underlying consent standard it tried to replace never left. Understanding that distinction is the difference between an outdated compliance strategy and one built on solid ground.<\/p>\n
In December 2023, the FCC proposed a rule requiring one-to-one consent, meaning a consumer\u2019s agreement to receive marketing texts would apply to a single seller rather than a batch of loosely related \u201cpartners\u201d hidden inside one opt-in checkbox.<\/p>\n
It was aimed at closing the lead-generation loophole that let a single signup fuel dozens of unrelated campaigns under the Telephone Consumer Protection Act (TCPA).<\/p>\n
The rule was set to take effect on January 27, 2025. Days before that deadline, the Eleventh Circuit Court of Appeals vacated it, ruling the FCC had exceeded its statutory authority. No replacement rule has taken its place.<\/p>\n
Practically, that means prior express written consent, the standard that predates the 2023 proposal, remains the operative baseline for marketing texts today.<\/p>\n
That reversal doesn\u2019t lower the bar for consumer protection; it only means the specific one-to-one mechanism failed judicial review.<\/p>\n
Any team that paused consent cleanup work assuming a stricter federal standard was imminent should treat the pre-2023 baseline as fully enforceable, not as a temporary placeholder.<\/p>\n
Consent rules that actually hold up under scrutiny<\/h2>\n
Prior express written consent for marketing texts and prior express consent for transactional messages<\/a> are not interchangeable, and treating them as one category is where many programs create exposure.<\/p>\nMarketing vs. transactional consent thresholds<\/h3>\n
Marketing messages, promotions, sale announcements, and win-back campaigns require prior express written consent: a signed or electronically signed agreement that clearly discloses the consumer will receive automated marketing texts and that consent isn\u2019t a condition of purchase.<\/p>\n
Transactional messages, like order confirmations<\/a> or shipping updates, need only prior express consent, a lower bar typically satisfied when someone provides their number during a transaction.<\/p>\n![\"\"\/](\"https:\/\/insiderone.com\/assets\/media\/2026\/08\/doc-image-0-24.png\")
<\/figure>\nMixing promotional content into a transactional thread without the higher consent standard is a common, avoidable mistake.<\/p>\n
What a defensible consent record includes<\/h3>\n
A consent record that survives a regulatory inquiry or a plaintiff\u2019s discovery request needs more than a checkbox. At minimum, document:<\/p>\n
\n- A timestamp showing exactly when consent was captured<\/li>\n
- The full disclosure language the consumer saw at the moment of opt-in<\/li>\n
- The specific channel and source (web form, keyword text-in, point of sale) where consent originated<\/li>\n
- The phone number and any associated campaign or brand identifier tied to that consent event<\/li>\n<\/ul>\n
Without those four elements, a brand is relying on memory instead of evidence when a dispute surfaces months later.<\/p>\n
State mini-TCPA laws and carrier rules marketers can\u2019t ignore<\/h2>\n
Federal law sets the floor, not the ceiling, and state legislatures have been busy raising it. Brands that only monitor the FCC are missing where the real enforcement risk now sits.<\/p>\n
Virginia and the state law patchwork<\/h3>\n
Virginia\u2019s amended Telephone Privacy Protection Act requires businesses to honor opt-out requests for a defined multi-year period and imposes its own penalty structure separate from federal TCPA damages.<\/p>\n
Other states are pursuing similar mini-TCPA statutes with their own consent, retention, and enforcement mechanics. A national SMS program now effectively operates under a patchwork of overlapping state obligations, which means a single, federally compliant policy is no longer sufficient on its own.<\/p>\n
10DLC registration and CTIA content rules<\/h3>\n
Separate from statutory law, wireless carriers enforce their own rules through 10-digit long code (10DLC) registration, which requires brands to register their business identity and use case with carriers before sending at volume.<\/p>\n
Unregistered or misclassified traffic gets throttled or blocked outright, regardless of legal compliance. Carriers also enforce content restrictions from CTIA, the wireless industry trade group, commonly summarized as SHAFT categories: sex, hate, alcohol, firearms, and tobacco content, which trigger filtering or outright rejection even from fully consented lists.<\/p>\n
Opt-out handling, quiet hours, and frequency guardrails<\/h2>\n
Consent gets a program started; how it handles exit requests and timing decides whether that consent stays clean. Opt-out and quiet-hours enforcement are where day-to-day operational discipline matters as much as legal review.<\/p>\n
Honoring opt-outs beyond STOP<\/h3>\n
Consumers have the right to opt out through any reasonable method, not only by replying STOP.<\/p>\n
A customer who says \u201cplease stop texting me\u201d during a live chat exchange or calls a support line has still exercised a valid opt-out request, and it needs to be processed within a defined window, typically treated as immediate for automated stop keywords and promptly for manual channels.<\/p>\n
Programs that only listen for the exact keyword STOP are building a gap a complaint or lawsuit can exploit.<\/p>\n
Quiet hours and frequency caps<\/h3>\n
Most jurisdictions restrict marketing texts to a window roughly between 8 a.m. and 9 p.m. in the recipient\u2019s local time zone, not the sender\u2019s.<\/p>\n
A brand messaging a national list needs quiet-hours logic that adjusts by time zone automatically, because a single blanket schedule will inevitably violate the rule somewhere in the country.<\/p>\n
Frequency caps<\/a> that limit how often any one subscriber receives messages also reduce complaint volume, and complaint volume is one of the strongest predictors of regulatory and carrier scrutiny.<\/p>\n![\"\"\/](\"https:\/\/insiderone.com\/assets\/media\/2026\/08\/doc-image-1-24.png\")
<\/figure>\nTurning compliance into a growth advantage<\/h2>\n
Compliance work that lives in spreadsheets and legal memos is compliance work that fails quietly under volume.<\/p>\n
The brands managing this well have moved consent capture, audit trails, and opt-out logging into the platform layer, where every event is timestamped and retrievable without a manual reconstruction project.<\/p>\n
That starts with unifying consent and preference data inside a single customer data platform rather than scattering it across a point solution and a spreadsheet.<\/p>\n
Customer Data Management<\/a> centralizes consent events, channel source, and opt-out status alongside behavioral data, so a compliance question doesn\u2019t require pulling records from three systems. Reporting and analytics<\/a> then makes that audit trail retrievable on demand instead of reconstructed after the fact.<\/p>\nThe second half of the growth case is subtler: relevance reduces complaint-driven opt-outs faster than any policy update. Segmenting by recency, frequency, and monetary value, and pacing send cadence to match actual engagement, keeps subscribers on the list because the messages earn their place in the inbox.<\/p>\n
Journey Orchestration<\/a> lets teams apply quiet-hours logic and frequency caps automatically across a journey rather than policing each individual campaign by hand.<\/p>\n![\"\"\/](\"https:\/\/insiderone.com\/assets\/media\/2026\/08\/doc-image-2-23.png\")
<\/figure>\nFor teams building or rebuilding a program from scratch, our guide on how to build a winning SMS marketing strategy<\/a> walks through the sequencing, and our SMS marketing tips for teams getting started<\/a> covers the fundamentals worth revisiting even for mature programs.<\/p>\nConclusion<\/h2>\n
The regulatory headline that dominated 2024 and 2025 didn\u2019t survive, but the underlying consent standard, and the quieter patchwork of state laws and carrier rules, absolutely did. Programs that keep chasing the last proposed federal rule are missing where the real enforcement risk now lives: documentation, opt-out speed, and carrier registration. Compliance built into the platform, not bolted on afterward, is what lets an SMS program scale without becoming a legal liability.<\/p>\n
Is SMS marketing<\/a> legal in 2026? Yes, but the ground under it shifted twice in two years, and plenty of teams built processes around a rule that never actually took effect.<\/p>\n The Federal Communications Commission (FCC) one-to-one consent requirement was scheduled to launch in January 2025, then a federal appeals court vacated it days before the deadline. That reversal left lifecycle and customer relationship management (CRM) teams holding compliance frameworks designed for a rule that quietly disappeared.<\/p>\n This piece is for US-based lifecycle, CRM, and growth marketers at ecommerce and direct-to-consumer (DTC) brands who own SMS programs and need to know what\u2019s enforceable right now, not what almost happened.<\/p>\n We\u2019ll separate the settled law from the growing patchwork of state legislation and carrier requirements, then walk through the operational guardrails, consent documentation, opt-out handling, and quiet-hours enforcement that keep a program defensible as it scales.<\/p>\n The one-to-one consent rule is gone, but the underlying consent standard it tried to replace never left. Understanding that distinction is the difference between an outdated compliance strategy and one built on solid ground.<\/p>\n In December 2023, the FCC proposed a rule requiring one-to-one consent, meaning a consumer\u2019s agreement to receive marketing texts would apply to a single seller rather than a batch of loosely related \u201cpartners\u201d hidden inside one opt-in checkbox.<\/p>\n It was aimed at closing the lead-generation loophole that let a single signup fuel dozens of unrelated campaigns under the Telephone Consumer Protection Act (TCPA).<\/p>\n The rule was set to take effect on January 27, 2025. Days before that deadline, the Eleventh Circuit Court of Appeals vacated it, ruling the FCC had exceeded its statutory authority. No replacement rule has taken its place.<\/p>\n Practically, that means prior express written consent, the standard that predates the 2023 proposal, remains the operative baseline for marketing texts today.<\/p>\n That reversal doesn\u2019t lower the bar for consumer protection; it only means the specific one-to-one mechanism failed judicial review.<\/p>\n Any team that paused consent cleanup work assuming a stricter federal standard was imminent should treat the pre-2023 baseline as fully enforceable, not as a temporary placeholder.<\/p>\n Prior express written consent for marketing texts and prior express consent for transactional messages<\/a> are not interchangeable, and treating them as one category is where many programs create exposure.<\/p>\n Marketing messages, promotions, sale announcements, and win-back campaigns require prior express written consent: a signed or electronically signed agreement that clearly discloses the consumer will receive automated marketing texts and that consent isn\u2019t a condition of purchase.<\/p>\n Transactional messages, like order confirmations<\/a> or shipping updates, need only prior express consent, a lower bar typically satisfied when someone provides their number during a transaction.<\/p>\n Mixing promotional content into a transactional thread without the higher consent standard is a common, avoidable mistake.<\/p>\n A consent record that survives a regulatory inquiry or a plaintiff\u2019s discovery request needs more than a checkbox. At minimum, document:<\/p>\n Without those four elements, a brand is relying on memory instead of evidence when a dispute surfaces months later.<\/p>\n Federal law sets the floor, not the ceiling, and state legislatures have been busy raising it. Brands that only monitor the FCC are missing where the real enforcement risk now sits.<\/p>\n Virginia\u2019s amended Telephone Privacy Protection Act requires businesses to honor opt-out requests for a defined multi-year period and imposes its own penalty structure separate from federal TCPA damages.<\/p>\n Other states are pursuing similar mini-TCPA statutes with their own consent, retention, and enforcement mechanics. A national SMS program now effectively operates under a patchwork of overlapping state obligations, which means a single, federally compliant policy is no longer sufficient on its own.<\/p>\n Separate from statutory law, wireless carriers enforce their own rules through 10-digit long code (10DLC) registration, which requires brands to register their business identity and use case with carriers before sending at volume.<\/p>\n Unregistered or misclassified traffic gets throttled or blocked outright, regardless of legal compliance. Carriers also enforce content restrictions from CTIA, the wireless industry trade group, commonly summarized as SHAFT categories: sex, hate, alcohol, firearms, and tobacco content, which trigger filtering or outright rejection even from fully consented lists.<\/p>\n Consent gets a program started; how it handles exit requests and timing decides whether that consent stays clean. Opt-out and quiet-hours enforcement are where day-to-day operational discipline matters as much as legal review.<\/p>\n Consumers have the right to opt out through any reasonable method, not only by replying STOP.<\/p>\n A customer who says \u201cplease stop texting me\u201d during a live chat exchange or calls a support line has still exercised a valid opt-out request, and it needs to be processed within a defined window, typically treated as immediate for automated stop keywords and promptly for manual channels.<\/p>\n Programs that only listen for the exact keyword STOP are building a gap a complaint or lawsuit can exploit.<\/p>\n Most jurisdictions restrict marketing texts to a window roughly between 8 a.m. and 9 p.m. in the recipient\u2019s local time zone, not the sender\u2019s.<\/p>\n A brand messaging a national list needs quiet-hours logic that adjusts by time zone automatically, because a single blanket schedule will inevitably violate the rule somewhere in the country.<\/p>\n Frequency caps<\/a> that limit how often any one subscriber receives messages also reduce complaint volume, and complaint volume is one of the strongest predictors of regulatory and carrier scrutiny.<\/p>\n Compliance work that lives in spreadsheets and legal memos is compliance work that fails quietly under volume.<\/p>\n The brands managing this well have moved consent capture, audit trails, and opt-out logging into the platform layer, where every event is timestamped and retrievable without a manual reconstruction project.<\/p>\n That starts with unifying consent and preference data inside a single customer data platform rather than scattering it across a point solution and a spreadsheet.<\/p>\n Customer Data Management<\/a> centralizes consent events, channel source, and opt-out status alongside behavioral data, so a compliance question doesn\u2019t require pulling records from three systems. Reporting and analytics<\/a> then makes that audit trail retrievable on demand instead of reconstructed after the fact.<\/p>\n The second half of the growth case is subtler: relevance reduces complaint-driven opt-outs faster than any policy update. Segmenting by recency, frequency, and monetary value, and pacing send cadence to match actual engagement, keeps subscribers on the list because the messages earn their place in the inbox.<\/p>\n Journey Orchestration<\/a> lets teams apply quiet-hours logic and frequency caps automatically across a journey rather than policing each individual campaign by hand.<\/p>\n For teams building or rebuilding a program from scratch, our guide on how to build a winning SMS marketing strategy<\/a> walks through the sequencing, and our SMS marketing tips for teams getting started<\/a> covers the fundamentals worth revisiting even for mature programs.<\/p>\n The regulatory headline that dominated 2024 and 2025 didn\u2019t survive, but the underlying consent standard, and the quieter patchwork of state laws and carrier rules, absolutely did. Programs that keep chasing the last proposed federal rule are missing where the real enforcement risk now lives: documentation, opt-out speed, and carrier registration. Compliance built into the platform, not bolted on afterward, is what lets an SMS program scale without becoming a legal liability.<\/p>\nThe 2026 TCPA landscape: what changed and what didn\u2019t<\/h2>\n
Consent rules that actually hold up under scrutiny<\/h2>\n
Marketing vs. transactional consent thresholds<\/h3>\n
<\/figure>\nWhat a defensible consent record includes<\/h3>\n
\n
State mini-TCPA laws and carrier rules marketers can\u2019t ignore<\/h2>\n
Virginia and the state law patchwork<\/h3>\n
10DLC registration and CTIA content rules<\/h3>\n
Opt-out handling, quiet hours, and frequency guardrails<\/h2>\n
Honoring opt-outs beyond STOP<\/h3>\n
Quiet hours and frequency caps<\/h3>\n
<\/figure>\nTurning compliance into a growth advantage<\/h2>\n
<\/figure>\nConclusion<\/h2>\n