Businesses looking to send SMS/MMS messages in the US and Canada must adhere to specific regulations and guidelines. Some content types, such as alcohol, gambling, firearms, and adult material, are either not allowed or only approved in specific circumstances. Other categories require extra steps like age verification, campaign registration, or supporting documents before you can send anything.

This guide takes you through each regulated category, lists what is and isn’t allowed, and the actions you must take to stay compliant. We’ve also included examples of permitted and prohibited messages, as well as notes on special conditions for short codes, toll‑free numbers, and 10DLC.

Our team is here to help you through this process, but if you are interested in more information around these regulations and best practices, you can read more about them here CTIA Messaging Principles and Best Practices.

Our brand and campaign verification form

Once you are ready to begin setting up your SMS/MMS marketing, you're given a brand and campaign verification form. This form is intended to register both your company and your SMS traffic with the mobile network operators. Fines for unlawful messaging in the US can be as high as $2,000 per text message, so it is important that this form is completed accurately.

Our form has been created to make it as easy as possible for you. We take care of completing all of the STOP/HELP/OPT-IN messaging that is required for compliance, so that you can focus on creating your marketing campaigns.

You're also provided with the language required for your CTA, so that you are 100 per cent sure you are collecting opt ins in a legal and compliant way. Based on the type of messaging you plan to send (marketing and/or transactional) you are required to present either one or two separate CTA opt ins. We help you identify what your use case(s) require and get you the appropriate wording.

We also provide you with a completed terms and conditions paragraph that must be added to your current wording in order to be compliant in the US/CAN. This copy is automatically generated for you once you have completed the brand and campaign verification form.

Opt-in form

This is an example of a simple visual layout for promotional SMS (and email) only. You can find additional guidance on compliant opt-in language in the compliance generator linked in the verification form.

Privacy policy

One thing that must remain your responsibility is the required language that must be added to your privacy policy. To offer some guidance, we’ve added templates for you below:

Important

Not every company collects and utilises cookies in the same way. It is important that you customise the relevant template to suit your particular policies.

If you ARE NOT using abandoned cart messaging:

“{Brand} will not sell or share any information collected via their SMS/MMS campaigns to any third parties for marketing purposes. Additionally, while {brand} does use cookies on their website, these are not used for anything other than to match you up with your information and provide the best experience while using {website}”

If you ARE using abandoned cart messaging:

“{Brand} will not sell or share any information collected via their SMS/MMS campaigns to any third parties for marketing purposes. Additionally, {Brand} automatically collects information when visiting our website, which may include cookies, third-party tracking technologies, and server logs. A cookie is a string of information that a website stores on a visitor's computer, and that the visitor's browser provides to the website each time the visitor returns. {Brand} uses cookies to determine when a visitor's cart has been abandoned and to keep track of the items placed in the cart, as well as to perform other crucial ecommerce capabilities.

Shortened URLs

United States – a shortened URL is required to ensure best delivery rates. Anonymous URLs such as bit.ly, ow.ly, and similar are not allowed. We recommend using the Dotdigital link shortener, for example https://dd2.io when sending.

Canada – the full website URL is required in Canadian messaging. In order to ensure best delivery rates, do not use any type of URL shortener for Canadian traffic.

Quiet hours

The quiet hours for SMS marketing are between 9pm and 8am.

If you don't know the location of your customers, marketing should be complete by 6pm EST and not start before 11am EST.

Age-gated content and unique use case requirements

The following sections detail specific restricted or regulated categories for U.S. and Canadian messaging campaigns, including the rules, exceptions, and documentation required for each.

SHAFT-C requirements

These programs are reviewed on a case-by-case basis and are not guaranteed for approval by the US operators on any sender.

All programs in this category must include a robust age gate:

Requires a user reply through MT with their birthdate (MM/DD/YYYY) or a user to enter their birthdate MM/DD/YYYY on a web form field.
Asking a user to Reply YES/AGREE to confirm they are over a certain age" is not considered robust age verification.
Having a web form that asks if a user is over 18/21 YES/NO is not considered robust age verification.
**Any age gated traffic is prohibited in Canada without explicit approval from the Canadian radio-television and telecommunications commission. Ask your account manager for additional information**

Sex

As a standard, direct promotion of sexual products or adult items is not typically allowed.

Example: Use code SEX15% for 15% off our newest sex toys.

Indirect promotion of items like cart reminders, shipping notifications, and exclusive coupon codes for the website are approved on a case-by-case basis.

Examples:
- Brand: Hey, did you leave something in your cart? Complete your checkout now by clicking www.website.com.
- Brand: Hey, we’ve got an exclusive discount just for you, check out our new products.

Hate

The compliance guidelines related to hate speech are the same across all senders in the US. This is a disallowed practice.

For purposes of this compliance guidance, hate speech also includes profanity and depictions or endorsements of violence, all of which are expressly disallowed.

Alcohol

As a standard, direct promotion of the sale or consumption of alcohol is not typically allowed.

Example: Use code DRINK15% for 15% off our newest vodka.

Indirect promotion of items like cart reminders, shipping notifications, and exclusive coupon codes for the website.

Examples:
- Brand: Hey, did you leave something in your cart? Complete your checkout now by clicking www.website.com.
- Brand: Hey, we’ve got an exclusive discount just for you, check out our new products.

For brands that do not directly sell alcohol but sell items related to alcohol (brew kits, wine accessories), or locations that primarily sell alcohol but offer other services (vineyards, breweries with restaurants) while an age gate may not be required if the main content is not legally age restricted it is recommended for campaign registration. Or it is recommended to add a disclaimer in the campaign summary that the campaign will only be to send messaging related to other products or services and no alcohol or age restricted content will be sent.

Firearms

As a standard, direct promotion of the sale or use of firearms is not typically allowed.

Example: Use code GUNS15% for 15% off our newest Glock.

Indirect promotion of items like cart reminders, shipping notifications, and exclusive coupon codes for the website are approved on a case-by-case basis.

Examples:
- Brand: Hey, did you leave something in your cart? Complete your checkout now by clicking www.website.com.
- Brand: Hey, we’ve got an exclusive discount just for you, check out our new products.

Tobacco

Toll-free number and 10DLC not available for this use case.

As a standard, direct promotion of the sale or use of Tobacco/Vape is not typically allowed.

Example: Use code VAPE15% for 15% off our newest HealthVape.

Indirect promotion of items like cart reminders, shipping notifications, and exclusive coupon codes for the website are approved on a case-by-case basis.

Examples:
- Brand: Hey, did you leave something in your cart? Complete your checkout now by clicking www.website.com.
- Brand: Hey, we’ve got an exclusive discount just for you, check out our new products.

Cannabis

Toll-free number and 10DLC not available for this use case.

As a standard, any promotion of cannabis is strictly prohibited.

Some use cases related to cannabis advocacy may be approved on a case-by-case basis.

Example: Contact your local congressmen regarding the CannAct.

Certain use cases for cannabis brands may be considered on a case-by-case basis.
Account notifications:

Example: You have a new message in your account, log in to see.
Example: We have an important update for you. Read it here: [link to verification and age-gated landing page].

Two Factor Authentication:

Example: Your verification code is 55555.

Such use cases are strictly monitored and may require additional vetting. Only templated messaging, which has been pre-approved by carriers, is allowed. Other messaging that is related to cannabis may be subject to filtering or content violations. Expect longer review/provisioning times.

Debt collection

Toll-free number and 10DLC not available for this use case.

Debt collection, debt consolidation, debt reduction, debt forgiveness or repair programs are considered disallowed content. However, programs for payment reminders and/or account notifications related to an outstanding debt are allowed.

Short code and 10DLC

Messages formatted as payment reminder programs with no debt collection language are allowed.

Example: You have an upcoming bill of $ XX.XX due on XX/XX.

Consent must be granted to the direct owner of the debt, pass through consent is NOT allowed.

Implied consent cannot be granted for such programs.

Third party debt collection is only allowed for programs sending payment reminders and that have obtained direct consent.

Not all operators in the US support IVR/Phone opt-in for this use case.

Loan campaigns

Toll-free number not available for this use case.

Short code and 10DLC

Only programs for the direct lender are considered, and the message sender must be the loan originator.

The mobile call-to-action (CTA) or web opt-in must be separate from the end user signing up for the application or loan.

As keyword opt-in is generally not how these campaigns run, provide a complete description of the process and screenshots for review.

Verbal opt-in is not allowed for loan-type campaigns.

End-user information must not be shared with third parties or affiliate marketers

Marketing of high risk (1) type loans is not allowed.

Programs for high-risk type loans may be considered on case-by-case basis for certain use cases (2FA, account notifications).

Cryptocurrency

The compliance guidelines related to cryptocurrency are the same across all senders in the US. This is a disallowed practice.

Certain use cases that support Cryptocurrency brands may be considered on a case-by-case basis (2FA, account notifications).

Messaging related to the marketing promotion or transactions is not permitted.

Gambling

Toll-free number not available for this use case

Short code and 10DLC

Promotion of gambling is strictly prohibited.

Any campaigns related to gambling or casinos must include a robust age gate.

Lottery programs related to results are allowed.

Examples:
- Powerball jackpot results are allowed, such as Powerball jackpot results are XXXX
- Play Powerball jackpot at www.website.com to win now is not allowed

For lottery programs, confirmation that the company is an official affiliate partner of the lottery is required.

Two-factor authentication for gambling programs is approved on a case-by-case basis.

Direct promotion of casinos is not allowed; however, SMS may be used to promote events inside a casino.

Programs for loyalty programs related to gambling may be approved on a case-by-case basis.

Political campaigns

If Soliciting Donations:

Short code

Political campaigns require a call-to-action (CTA) or opt-in policy that is clear and applied consistently. Additionally, short codes require a Campaign Verify token.

If the political campaign also support donations, the following must be provided:

Politician or organization name.
Politician or organization website.

FEC ID, required if the candidate or organization is involved in a federal-level election and donations will be solicited.

State Committee ID, required if the candidate or organization is involved in a state-level election and donations will be solicited. In place of the State Committee ID, official documentation from a state institution can also be provided as proof that the candidate or organization is engaged in a state-level election.

A valid call-to-action (CTA) and clear product description within the terms of service, which clearly discloses that donations will be solicited.

Example MT for donation messaging, including the URL.

End-user information must not be shared with third parties or like-minded organizations, and should be confirmed in the privacy policy page. It is suggested to add the approved carrier language to the privacy policy page: The above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

10DLC

Available only to Non-profit entities with a Campaign Verify token or Aegis Political Vet, or Non-Profit entities with a verified 501(c)(3/4/5/6) tax-exempt status

Political campaigns require a call-to-action (CTA) or opt-in policy that is clear and applied consistently.

If the political campaign also support donations, the following must be provided:

A valid call-to-action and clear product description within the SMS terms of service, which clearly discloses that donations will be solicited.

Example MT for donation messaging, including the URL.

Toll-free number

Available only to entities that have a Campaign Verify Token.

Campaigns must submit: FEC ID, required if the candidate or organization is involved in a federal-level election, and State Committee ID, required if the candidate or organization is involved in a state-level election

If not soliciting donations:

Short code

Political campaigns require a call-to-action (CTA) or opt-in policy that is clear and applied consistently. Additionally, short codes require a Campaign Verify token.

There must be additional transparency on the political entity: Politician or organization name, and Politician or organization website.

10DLC

Available only to Non-Profit entities with a Campaign Verify token or Aegis Political Vet, or Non-Profit entities with a verified 501(c)(3/4/5/6) tax-exempt status.

Political campaigns require a call-to-action (CTA) or opt-in policy that is clear and applied consistently.

If a Political campaign will not be soliciting donations, then it is not required that this is stated in the CTA.

Toll-free number

Available only to entities that have a Campaign Verify Token.

How to Acquire a Campaign Verify Token

To obtain token:

Login to Campaign Verify and click on Select a Channel.
Choose one of the three channels and click Create an authorization Token.

If the political committee already has an unexpired token for 10DLC - The Campaign Registry channel, the user can log in to the account and simply create additional tokens.

Once an entity is verified in Campaign Verify, and the submitter successfully enters the six-digit PIN code, users can create tokens for each of the three channels, and more than one token for each channel as needed at no extra cost.

Entities that have been previously verified do not need to be re-verified but instead can generate additional tokens for each channel they need.

Learn more at https://www.campaignverify.org/

Sweepstakes and contests

Toll-free number and 10DLC not available for this use case.

Short code

For sweepstakes, you must provide a copy of all official rules and guidelines, and the in-market call to action that was used. Sweepstakes and contest rules must be present on the website, and must include, but are not limited to:

Rules must be prominently located on the website associated with the sweepstakes.
Rules cannot be generic, covering multiple sweepstakes of a type that may run in connection with a program, but must relate to an actual sweepstake.
Name and contact information for the sponsor.
Any eligibility restrictions applicable to participants or winners, such as state of residence.
Description of means of entry.
Date(s) the prizes will be awarded.
Description of prize(s).
Method of awarding prize(s).
Description of how the winner(s) will be contacted and method for obtaining a list of winners.
Who is eligible for sweepstakes and how the winner is selected.
Age restrictions.
Free method of entry.

Affiliate marketing and lead generation

The compliance guidelines related to affiliate marketing and lead generation are the same across all senders in the US. This is a disallowed practice.

The submission of campaigns with a supporting website that was created as a white labelled website, and used only to collect opt in or for promotion of affiliate marketing is a disallowed campaign type.

Websites created to mislead users to opt in to unrelated or unauthorized campaign is strictly prohibited.

Campaigns submitted with supporting websites that have mention of affiliate marketing or lead generation will also be rejected.

Job Alerts (Recruitment messages)

The compliance guidelines for job alert programs are the same across all sender types in the US.

As keyword opt-in is generally not how these campaigns run, a complete description of the process and screenshots for review must be provided.

The content provider must be the direct hiring agency or head-hunting firm.

End-user information must not be shared with third parties or affiliate marketers.

The following alerts are disallowed:

Work-from-home programs
Job alerts from third-party recruiting firms
Risk investment opportunities.

Abandoned Cart notifications

The compliance guidelines for abandoned shopping cart notifications are the same across all sender types in the US.

The call to action and terms and conditions must disclose that this messaging program includes ASCN.

A double opt-in is required, and the double opt-in message content must clearly inform the user that this includes abandoned cart.

The privacy policy must explicitly state how information is captured by the e-commerce site to determine when a consumer cart has been abandoned, for example, website cookies, plugins, and more.

No more than one abandoned cart messages per event and it must be sent within 48 hours after abandonment.

Abandoned cart message must not result in the completion of a transaction on behalf of the customer.

Abandoned cart message must not collect payment information or accept approval for purchase using keyword confirmation from the consumer.

Consumers must complete the transaction by processing payment themselves using a direct URL link to the e-commerce website.

Send SMS and MMS in the US and Canada 3: Compliance

Our brand and campaign verification form

Opt-in form

Privacy policy

Important

Shortened URLs

Quiet hours

Age-gated content and unique use case requirements

SHAFT-C requirements

Sex

Hate

Alcohol

Firearms

Tobacco

Cannabis

Debt collection

Loan campaigns

Cryptocurrency

Gambling

Political campaigns

Short code

10DLC

Toll-free number

If not soliciting donations:

Short code

10DLC

Toll-free number

How to Acquire a Campaign Verify Token

Sweepstakes and contests

Affiliate marketing and lead generation

Job Alerts (Recruitment messages)

Abandoned Cart notifications

See also