Yes, SMS marketing is legal for a small business in the US, as long as you have each person's prior express written consent, tell them what they're signing up for (including how often you'll text and that message and data rates may apply), honor STOP right away, respond to HELP, text only at reasonable hours, and send from a registered or verified number. Most of the risk comes from texting people who never actually opted in.
This guide covers the rules as of October 2026, including what changed in court and at the FCC in 2025 and 2026, and shows how we set up SMS consent for Elume Medspa, a med spa in Fairfax, Virginia. We're precise about one thing up front: Elume's consent collection is live and its toll-free number is approved, but it has not sent an SMS marketing campaign yet. Everything below is the groundwork that has to exist before the first text.
Watch out: This is general information, not legal advice. Texting laws vary by state and change often. If you're unsure about your program, talk to a lawyer who handles TCPA matters.
- Marketing texts need prior express written consent, given on its own, never as a condition of buying anything.
- Your opt-in wording should name your business, say messages are recurring and automated, give the frequency, mention message and data rates, and explain STOP and HELP.
- The FCC's "one-to-one consent" rule never took effect. A court vacated it in January 2025 and the FCC removed it in July 2025.
- Carriers block unregistered 10DLC traffic and heavily filter unverified toll-free numbers. Register or verify before you send.
- Collect consent on every surface where customers give you a number, and keep SMS consent separate from email consent.
Is SMS marketing legal? The federal rules
The main federal law is the Telephone Consumer Protection Act (TCPA), enforced by the FCC and through private lawsuits. The FCC treats texts as calls under it. The FCC's rule at 47 CFR 64.1200 defines prior express written consent as a signed written agreement (an electronic signature or checkbox counts under the E-SIGN Act) that:
- clearly authorizes the seller to send advertising or telemarketing messages using automated technology,
- names the phone number those messages can go to, and
- tells the person they are not required to agree as a condition of buying anything.
Marketing texts from platforms like Klaviyo, Attentive or Postscript are sent automatically, so treat written consent as the standard for every promotional text. That means no texting a list you bought, no texting numbers from old invoices, and no assuming that a customer who gave you their number for an appointment wants offers.
What happened to the one-to-one consent rule?
In 2023 the FCC adopted a rule that would have required consent to be given to one seller at a time, with every message "logically and topically" related to the original sign-up. It was aimed at lead generators who collected one consent for dozens of companies. On January 24, 2025, days before it was due to take effect, the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC. The FCC then removed the rule from its regulations on July 14, 2025, restoring the earlier definition.
For a small business collecting consent on its own website, this changes little. Your consent was always one-to-one in practice: one person agreeing to hear from your business. Don't treat the ruling as permission to share or buy consent from someone else.
Opt-outs: STOP has to work every time
Under the same FCC rules, people can revoke consent in any reasonable way, and words like "stop," "quit," "end," "revoke," "opt out," "cancel" and "unsubscribe" all count. You must honor a revocation within a reasonable time, no more than ten business days. In practice, your SMS platform should process STOP instantly and send one final confirmation.
The FCC is still adjusting these revocation rules. In September 2026 it took up an order on consent revocation that would let senders treat an opt-out as applying only to the category of informational messages it was aimed at and designate an exclusive opt-out method. It also asks for comment on further changes, including the time allowed to honor opt-outs. None of it loosens consent for marketing texts. Check the final text and its effective date before changing your process because of it.
Opt-in language and frequency disclosure
Carriers expect the industry standard set by CTIA's Messaging Principles and Best Practices. Your call to action should make clear who is texting, what the program is, any fees, and how to opt out and get help. Your first message after opt-in should confirm the sign-up, say messages are recurring and how often, and explain how to opt out.
A sample checkbox disclosure for a local business:
[ ] Text me offers and last-minute openings. By checking this box, I agree to receive recurring automated marketing texts from [Business Name] at the number provided. Consent is not a condition of purchase. Message frequency varies (up to 4/month). Msg & data rates may apply. Reply HELP for help, STOP to cancel. See our [Messaging Terms] and [Privacy Policy].That is our template, not a quote from any law, and the frequency should match what you'll actually send. A few rules for the checkbox itself:
- Unticked by default. The customer has to take the action.
- Separate from email. One box for email, one for SMS. Bundling them muddies whether the person agreed to texts at all.
- Next to the phone field, not buried in terms the person never opens.
Then publish a messaging terms page. The one we built for Elume at /messaging-terms/ covers every element toll-free verification checks: recurring automated messages, frequency varies, message and data rates, carriers not liable, STOP and HELP, "consent is not a condition of purchase," and a link to the privacy policy.
Quiet hours: when you can text
The FCC's rules bar telephone solicitations before 8 a.m. or after 9 p.m. in the recipient's local time. Some state laws set a narrower window. Florida's telephone solicitation statute, for example, ends it at 8 p.m. Your list spans time zones and states, so set quiet hours in your platform rather than relying on staff to remember.
Tip: Leave yourself margin. Elume's Klaviyo quiet hours stop sending at 8 p.m. and resume at 11 a.m. Eastern, with state-level frequency limits switched on. A text that arrives at 7:55 p.m. is legal in most places and still annoying.
10DLC vs toll-free verification in 2026
You can't text customers at scale from a regular cell phone, and a business text number has to be approved before carriers will deliver its messages reliably. The two common options for a small business:
| 10DLC (local number) | Toll-free number | |
|---|---|---|
| Looks like | A local 10-digit number | An 800, 833, 844 (and similar) number |
| Approval | Brand and campaign registration through The Campaign Registry | Toll-free verification of your business and use case |
| If you skip it | Carriers block unregistered traffic | Carriers heavily filter unverified numbers |
| Good for | Businesses whose platform offers it, and a local feel | Small to mid senders on platforms that default to it |
Which one you use often depends on your platform. Klaviyo's US default is a toll-free number, and its toll-free verification guide says verification typically takes 2 to 5 business days, your website must be live, and you'll need your legal business name, address and business registration number. Since early 2026, new toll-free verifications across the industry require a business registration number (your EIN in the US). Klaviyo also notes that carriers expect a verified number to keep sending consistently, and that long pauses can cause problems.
From our work: We submitted Elume's toll-free number on September 20, 2026, and it was approved the next day, with US and Canada records active. Elume uses toll-free, not 10DLC, and there is no 10DLC registration. Before the number existed, the forms collected a phone number only, with no SMS consent, because you can't honestly collect consent for a channel that can't send yet. When we audited the settings on September 21, STOP, HELP and START keywords were active, litigator scrubbing was on, state frequency limits were on and quiet hours were set. We also caught that the SMS sender prefix still carried an old spelling of the brand name, and fixed it before any message went out.
Content rules: SHAFT and what carriers filter
Even with perfect consent, carriers can filter or block messages based on content. CTIA's Short Code Monitoring Handbook defines "SHAFT" content as anything that contains or promotes sex, hate, alcohol, firearms or tobacco. Federally illegal SHAFT content is prohibited, and legal SHAFT content needs a working age gate. Gambling and sweepstakes carry extra carrier requirements too.
Beyond SHAFT, keep messages clean:
- Identify your business in every message.
- Use links on your own domain. CTIA's principles ask that links not hide who is sending, and that any link shortener be dedicated to your business, so skip public shorteners.
- Don't make claims you couldn't make in an ad. Truth-in-advertising rules still apply in 160 characters.
- For med spas: keep any individual's treatment details out of marketing texts entirely. A text can be seen on a lock screen by anyone.
How to collect SMS consent on every surface
Consent has to be collected wherever customers hand you their number. If one surface is missing, your list grows from the others and the gap stays invisible. Here are the four surfaces we set up for Elume, all live by September 22, 2026:
- Website signup forms. Two steps: email first, then phone with the SMS disclosure, using double opt-in for SMS. Declining the text step still gets the email coupon.
- Online booking. All 10 Calendly event types carry a separate, optional "Text me offers and last minute openings?" checkbox. It's kept apart from the email checkbox, because bundling the two would not be valid express written consent for texts.
- Checkout. The Shopify checkout's SMS opt-in.
- The front desk. A "text JOIN" card at the counter, so the client opts in from their own phone and staff never type in anyone's number.
Watch out: Don't send old customers a "Reply YES to get our texts" message. The invitation is itself a marketing text, sent without consent. We ruled that out for Elume. Also check your form builder: in Klaviyo, adding a phone field to a form defaults it to SMS consent and quietly adds an autodialer disclosure block. Review every form before it goes live.
SMS marketing ideas for local businesses and med spas
Texts get read, so they work best for messages that are short, timely and useful. Good fits:
- Last-minute openings. A cancellation tomorrow at 2 p.m. is the perfect text: urgent, specific and easy to act on. This is why Elume's booking checkbox asks about "last minute openings" by name.
- Limited-availability days. Med spas that offer certain treatments only on set injector days can announce the dates to people who opted in.
- Back in stock or new arrivals for shops, with a direct product link.
- Event reminders for open houses, classes or seasonal events people signed up for.
- Appointment reminders. These are informational, a different category from marketing. Keep promotions out of them.
Things SMS is bad at: long stories, newsletters, and anything you'd send more than a few times a month. Use email for those. If you're moving your email platform at the same time, our Mailchimp to Klaviyo migration guide shows how we kept email and SMS consent separate in one account.
A pre-launch checklist
- Pick a platform and number type (toll-free or 10DLC), and gather your legal business name, address and EIN.
- Publish a messaging terms page and make sure your privacy policy covers mobile numbers.
- Add a separate, unticked SMS checkbox with full disclosure to every surface that collects numbers.
- Submit verification or registration. Your website must be live, and your opt-in must be visible to the reviewer.
- Set quiet hours, state frequency limits and STOP/HELP/START keywords. Test each keyword from a real phone.
- Write the opt-in confirmation message with program name, frequency, rates, STOP and HELP.
- Plan the first month of sends before you collect a single number, so consent never sits unused for long.
If you'd rather not run this yourself, our email and SMS team sets it up inside your own account. And if texting doesn't fit your business, that's a fine answer too: a well-run email list does most of the same jobs with less legal exposure.
Frequently asked questions
Do appointment reminder texts need the same consent as marketing texts?
Generally no. A pure reminder is informational, not marketing, and the FCC's rules set a lower bar for it than the written consent marketing texts need. Keep reminders free of offers and promotions, though, or they become marketing messages.
What are the penalties for breaking the TCPA with texts?
The TCPA lets people sue for $500 per violating message, and a court can triple that to $1,500 if the violation was willful or knowing. Because damages are per message, a small campaign to a few hundred people can add up fast. Some states add their own penalties.
Can I text customers whose number I got at checkout?
Not marketing texts, unless they also agreed to receive them. A phone number given for an order or a booking is not consent to marketing. Ask with a separate, unticked SMS checkbox and clear disclosure.
How often should a small business send marketing texts?
There is no single federal cap, but tell people the expected frequency up front and stay close to it. Some states limit how often you can contact someone. In our email work, 10 sends in 11 days roughly tripled the unsubscribe rate, and texts feel more intrusive than email.