SMS Marketing Rules in 2026: What’s Actually Enforceable Now

Is SMS marketing legal in 2026? Yes, but the ground under it shifted twice in two years, and plenty of teams built processes around a rule that never actually took effect.

The Federal Communications Commission (FCC) one-to-one consent requirement was scheduled to launch in January 2025, then a federal appeals court vacated it days before the deadline. That reversal left lifecycle and customer relationship management (CRM) teams holding compliance frameworks designed for a rule that quietly disappeared.

This piece is for US-based lifecycle, CRM, and growth marketers at ecommerce and direct-to-consumer (DTC) brands who own SMS programs and need to know what’s enforceable right now, not what almost happened.

We’ll separate the settled law from the growing patchwork of state legislation and carrier requirements, then walk through the operational guardrails, consent documentation, opt-out handling, and quiet-hours enforcement that keep a program defensible as it scales.

The 2026 TCPA landscape: what changed and what didn’t

The one-to-one consent rule is gone, but the underlying consent standard it tried to replace never left. Understanding that distinction is the difference between an outdated compliance strategy and one built on solid ground.

In December 2023, the FCC proposed a rule requiring one-to-one consent, meaning a consumer’s agreement to receive marketing texts would apply to a single seller rather than a batch of loosely related “partners” hidden inside one opt-in checkbox.

It was aimed at closing the lead-generation loophole that let a single signup fuel dozens of unrelated campaigns under the Telephone Consumer Protection Act (TCPA).

The rule was set to take effect on January 27, 2025. Days before that deadline, the Eleventh Circuit Court of Appeals vacated it, ruling the FCC had exceeded its statutory authority. No replacement rule has taken its place.

Practically, that means prior express written consent, the standard that predates the 2023 proposal, remains the operative baseline for marketing texts today.

That reversal doesn’t lower the bar for consumer protection; it only means the specific one-to-one mechanism failed judicial review.

Any team that paused consent cleanup work assuming a stricter federal standard was imminent should treat the pre-2023 baseline as fully enforceable, not as a temporary placeholder.

Consent rules that actually hold up under scrutiny

Prior express written consent for marketing texts and prior express consent for transactional messages are not interchangeable, and treating them as one category is where many programs create exposure.

Marketing vs. transactional consent thresholds

Marketing messages, promotions, sale announcements, and win-back campaigns require prior express written consent: a signed or electronically signed agreement that clearly discloses the consumer will receive automated marketing texts and that consent isn’t a condition of purchase.

Transactional messages, like order confirmations or shipping updates, need only prior express consent, a lower bar typically satisfied when someone provides their number during a transaction.

Mixing promotional content into a transactional thread without the higher consent standard is a common, avoidable mistake.

What a defensible consent record includes

A consent record that survives a regulatory inquiry or a plaintiff’s discovery request needs more than a checkbox. At minimum, document:

• A timestamp showing exactly when consent was captured
• The full disclosure language the consumer saw at the moment of opt-in
• The specific channel and source (web form, keyword text-in, point of sale) where consent originated
• The phone number and any associated campaign or brand identifier tied to that consent event

Without those four elements, a brand is relying on memory instead of evidence when a dispute surfaces months later.

State mini-TCPA laws and carrier rules marketers can’t ignore

Federal law sets the floor, not the ceiling, and state legislatures have been busy raising it. Brands that only monitor the FCC are missing where the real enforcement risk now sits.

Virginia and the state law patchwork

Virginia’s amended Telephone Privacy Protection Act requires businesses to honor opt-out requests for a defined multi-year period and imposes its own penalty structure separate from federal TCPA damages.

Other states are pursuing similar mini-TCPA statutes with their own consent, retention, and enforcement mechanics. A national SMS program now effectively operates under a patchwork of overlapping state obligations, which means a single, federally compliant policy is no longer sufficient on its own.

10DLC registration and CTIA content rules

Separate from statutory law, wireless carriers enforce their own rules through 10-digit long code (10DLC) registration, which requires brands to register their business identity and use case with carriers before sending at volume.

Unregistered or misclassified traffic gets throttled or blocked outright, regardless of legal compliance. Carriers also enforce content restrictions from CTIA, the wireless industry trade group, commonly summarized as SHAFT categories: sex, hate, alcohol, firearms, and tobacco content, which trigger filtering or outright rejection even from fully consented lists.

Opt-out handling, quiet hours, and frequency guardrails

Consent gets a program started; how it handles exit requests and timing decides whether that consent stays clean. Opt-out and quiet-hours enforcement are where day-to-day operational discipline matters as much as legal review.

Honoring opt-outs beyond STOP

Consumers have the right to opt out through any reasonable method, not only by replying STOP.

A customer who says “please stop texting me” during a live chat exchange or calls a support line has still exercised a valid opt-out request, and it needs to be processed within a defined window, typically treated as immediate for automated stop keywords and promptly for manual channels.

Programs that only listen for the exact keyword STOP are building a gap a complaint or lawsuit can exploit.

Quiet hours and frequency caps

Most jurisdictions restrict marketing texts to a window roughly between 8 a.m. and 9 p.m. in the recipient’s local time zone, not the sender’s.

A brand messaging a national list needs quiet-hours logic that adjusts by time zone automatically, because a single blanket schedule will inevitably violate the rule somewhere in the country.

Frequency caps that limit how often any one subscriber receives messages also reduce complaint volume, and complaint volume is one of the strongest predictors of regulatory and carrier scrutiny.

Turning compliance into a growth advantage

Compliance work that lives in spreadsheets and legal memos is compliance work that fails quietly under volume.

The brands managing this well have moved consent capture, audit trails, and opt-out logging into the platform layer, where every event is timestamped and retrievable without a manual reconstruction project.

That starts with unifying consent and preference data inside a single customer data platform rather than scattering it across a point solution and a spreadsheet.

Customer Data Management centralizes consent events, channel source, and opt-out status alongside behavioral data, so a compliance question doesn’t require pulling records from three systems. Reporting and analytics then makes that audit trail retrievable on demand instead of reconstructed after the fact.

The second half of the growth case is subtler: relevance reduces complaint-driven opt-outs faster than any policy update. Segmenting by recency, frequency, and monetary value, and pacing send cadence to match actual engagement, keeps subscribers on the list because the messages earn their place in the inbox.

Journey Orchestration lets teams apply quiet-hours logic and frequency caps automatically across a journey rather than policing each individual campaign by hand.

For teams building or rebuilding a program from scratch, our guide on how to build a winning SMS marketing strategy walks through the sequencing, and our SMS marketing tips for teams getting started covers the fundamentals worth revisiting even for mature programs.

Conclusion

The regulatory headline that dominated 2024 and 2025 didn’t survive, but the underlying consent standard, and the quieter patchwork of state laws and carrier rules, absolutely did. Programs that keep chasing the last proposed federal rule are missing where the real enforcement risk now lives: documentation, opt-out speed, and carrier registration. Compliance built into the platform, not bolted on afterward, is what lets an SMS program scale without becoming a legal liability.

To evaluate the fit of Customer Data Management for your use case, book a personalized demo to review your goals, data requirements, and implementation constraints with the Insider One team.

Frequently Asked Questions