The Complete SMS Compliance Guide.

Overview

SMS marketing and mass texting has become a foundational component for businesses and organizations looking to engage with their audiences. Laws and regulations governing text messaging are also far different than those of other channels. Penalties for non-compliance are much greater which is why understanding SMS compliance is critical.

While maintaining a compliant text messaging program may seem difficult, it’s really not. The purpose of this guide is to provide a detailed overview of text messaging compliance and lay the foundation for a solid SMS marketing strategy.

Please note that all information found in this guide is for informational purposes only and is not intended to constitute legal advice.

Who Makes The Rules

Before diving into the texting laws and compliance guidelines, it’s helpful to understand where they come from and who’s responsible for maintaining them. In the United States, there are two core entities that you should be aware of.

Text Message Laws

While both TCPA and CTIA guidelines should be strictly followed, it’s important to draw the distinction between what’s law and what’s regulation. There’s a lot of overlap between the two however you can view the TCPA as federal laws preventing unsolicited text messages and CTIA guidelines as carrier regulations further protecting consumers.

When it comes to texting laws, however, TCPA legislation is what matters. The major theme of the TCPA is that you must obtain express written consent from people before sending them promotional text messages. Failure to do so can trigger large class-action lawsuits and penalties of up to $500 per text. The good news is that getting consent isn’t that hard.

Express Written Consent

As defined in the TCPA, express written consent is permission given by someone on paper or electronically to receive promotional messages via an autodialer.

Now you might be thinking, “What’s an autodialer? I’m not using an autodialer?” Our perspective is that there’s too much hands-on involvement when using SMS marketing software like SlickText for it to be considered an autodialer. The problem is that TCPA legislation was written over 20 years ago and courts today struggle to understand how software like SlickText applies to such an old definition. For this reason, it’s generally recommended to err on the side of caution and assume that whatever service you’re using to send text messages is an autodialer and that you need express written consent.

Obtaining Express Written Consent

Obtaining express written consent really isn't that hard. Remember, the TCPA definition allows for permission to be given electronically. This could be in the form of recorded verbal consent, checking a box on a web form, or simply texting a keyword to a phone number (provided the keyword call to action has some specific verbiage.) This opens up several options for capturing consent in a compliant way.

Collecting opt-ins via text to join and web forms are the two most popular ways to obtain express written consent. We’ll cover those opt-in methods in more detail below.

Messaging Types

Now that we understand basic texting laws and the concept of express written consent, we’ll cover the three types of text messaging content. These are important concepts as each requires a different level of consent provided by the consumer.

Collecting Opt-Ins

Now that we understand the various types of messaging and the required consent level associated with each, we can dive into how to collect opt-ins in a lawful and compliant manner. As mentioned above, it’s best to assume all of your text messaging to be promotional and that you need express written consent.

Let’s take a look at the two most common ways that SMS marketers collect opt-ins and the best practices for doing so in a compliant way.

A very important thing to note is that while this flow is technically CTIA compliant, it still opens up opportunities for bad actors to create problems. In this scenario, someone could input any phone number they want into your form and subscribe random people to your text messaging program. For this reason, we highly recommend a double opt-in process when using web forms.

Double opt-in requires an additional confirmation text message to be sent by the consumer after filling out the web form. This confirms that the person is who they say they are. The final opt-in flow looks like this…

1. Consumer fills out the form and submits.
2. Consumer is sent a text message asking to confirm their subscription.
3. Consumer replies YES to confirm.
4. Consumer is subscribed and receives the final confirmation text message.

Required Verbiage

Now that you’ve read through the guidelines for collecting opt-ins, you’ve probably noticed some common verbiage used throughout. Each is key to ensuring compliance with the TCPA, CTIA and obtaining proper express written consent.

Each of the following components are required wherever you’re collecting opt-ins. Let’s take a deeper look at each and how they all come together.

Terms & Conditions Requirements

In order to be compliant with TCPA and CTIA guidelines, you’ll need to have a set of terms and conditions for your text messaging program. Yes, we know what you’re thinking… “Nobody ever reads this stuff.” While you’re probably right, it’s still required.

The link to your terms and conditions must be clearly visible and not buried where they’ll never be found. This is what’s considered by the TCPA as the “written agreement” between you and the consumer.

When it comes to the actual content of the terms and conditions, the CTIA requires specific information to be disclosed. This information includes:

• Business name
• Text Program name
• The number used for the program
• Opt-in instructions
• Opt-out instructions
• Help instructions
• A list of supported wireless carriers
• Messaging frequency
• Message and data rates disclosure
• Link to privacy policy

Privacy Policy Requirements

Unlike your terms and conditions, the TCPA nor the CTIA have specific requirements for the content although there needs to be some material content within. While most people don’t read privacy policies, it puts consumers at ease knowing that the business they're interacting with maintains one.

We recommend, at the very least, making a statement about the protection of consumer information and your company’s perspective on it. Additionally, for your protection, you should also include some information about the limits of your abilities and liability.

Controlled Content

The CTIA has additional requirements for SMS programs that pertain to adult content or controlled substances. While content of this nature is normally subject to scrutiny by the wireless carriers, some is allowed with proper functionality in place; particularly age-gating.

An age gate is functionality that requires and confirms a person’s age at the point of opt in. For example, when texting to join, after texting the keyword, instead of immediately receiving the confirmation auto-response, you’d receive a message asking for your date of birth. Once the person has replied with their age and they meet the age requirements, they would then be opted in.

Note that the CTIA has a zero-tolerance policy for referencing the abuse of controlled substances and will take action on any text programs that are in violation.

Prohibited Content

The CTIA and cellular carriers bluntly disallow certain types of messaging content. There’s also content types that while not specifically called out, are also disallowed.

Violations & Audits

There are a few different things that can happen if you’re in violation of the TCPA or CTIA guidelines. Remember, TCPA legislation is law and violations are punishable by the federal government. CTIA guidelines, while not law, can result in the suspension or termination of your short code, phone number and text messaging program.