Ecommerce SMS compliance tools: what you need before the first campaign

An online store needs five ecommerce SMS compliance tools before its first campaign: consent capture at checkout and in popups, quiet hours based on each recipient's time zone, opt-out sync across every tool that texts, DNC and litigator scrubbing, and A2P 10DLC registration. If any one of the five is missing, you either get filtered by carriers or exposed under the TCPA, which carries roughly $500 to $1,500 per text.

This post works through each item as a checklist. For each one it covers what the tool has to do, where the job usually breaks for stores, and what it costs on Ready with the math shown. Some of these jobs belong to your storefront and not to your SMS provider. We say so where that applies, because a provider that claims to do all of it is overselling.

The checklist at a glance

The sections below go through each row in order.

Consent capture at checkout and in popups

Consent is the item most stores get wrong, and no SMS provider can fix it after the fact. Your record that a person agreed to texts is created at the moment they agree, so the tooling has to live where they agree. For a store, that means two places: the checkout and the signup popup.

What a checkout opt-in needs

• An unchecked box. A pre-checked box is not consent. The shopper has to take an action.
• Separate from the purchase. The disclosure has to say consent is not a condition of purchase.
• The right disclosure text, next to the box. For example: "Check this box to get recurring automated marketing texts from [Store] at the number provided. Consent is not a condition of purchase. Msg frequency varies. Msg & data rates may apply. Reply STOP to cancel, HELP for help."
• A stored record per contact: phone number, timestamp, the exact wording shown, the page URL, and ideally the IP address or session ID.

Popups have their own trap

A popup that collects an email address and a phone number on one screen often has one submit button and one disclosure that only covers email. If the phone field sits under email-only consent language, you have phone numbers you can't text for marketing. Give the phone field its own SMS disclosure, or move it to a second step.

We cover how to keep these records in a form that holds up in How to document SMS consent.

What Ready does and doesn't store

Ready records the sender's attestation on every bulk send and every API send that sets consent_attested: who sent it, to how many recipients, and when. On the API, that attestation is the consent_attested: true field on POST /v1/messages. This record is an audit trail of your promise to have consent. It is not a per-contact consent record. Ready does not store a recipient's opt-in time, wording or page URL, and a keyword reply does not create one. Your store, or your popup app, keeps that record. Treat the two records as a pair. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)

Consent also does not last forever. If you are reactivating a list from a store you haven't texted in a year, read why SMS consent decays faster than email consent before you send anything.

Quiet hours by recipient time zone

The window most often cited federally is 8 AM to 9 PM in the recipient's local time. Some states are stricter on hours and on how many texts you can send per day. Scheduling a campaign for "10 AM" in your store's time zone is not enough. A store in New York that sends at 9 AM Eastern reaches Los Angeles customers at 6 AM.

What the tool has to do

• Work out each recipient's local time instead of using the sender's.
• Hold texts that would arrive outside the window, then release them when the window opens.
• Handle long campaigns. A campaign that starts at 8:30 PM Eastern and runs for two hours finishes in quiet hours for the East Coast.

On Ready, quiet hours follow the recipient's area. A reply to someone who texted you in the last 24 hours can go out at any hour. Campaigns, drip campaigns and automations wait up to 24 hours for the recipient's permitted window. A one-to-one, inbox or API text (bulk API included) is held only if the window opens within 6 hours; otherwise it is refused with 409 QUIET_HOURS_BLOCK and has to be sent again later. A held text is charged only when it sends.

One honest limitation: recipient location is inferred from the phone number. A customer who moved from Boston to Denver and kept their 617 number is treated as Eastern. Quiet hours lower your exposure, but they can't know where a person physically is. For the multi-time-zone scheduling details, see the time-zone-aware quiet-hours fix.

Opt-out sync across every tool that texts

When someone replies STOP to your abandoned-cart text, they should stop getting your weekly promo, your back-in-stock alert and your win-back drip campaign. Inside one platform, that is the minimum. Stores tend to fail the next step: they run two or three tools that can text, and the STOP only reaches one of them.

Where opt-outs leak for stores

• Your SMS marketing app and your helpdesk both send from different systems.
• A Shopify SMS app handles marketing, while a separate tool sends shipping updates.
• You migrated providers, and the old suppression list stayed with the old provider.

On Ready, inbound STOP and UNSUBSCRIBE are honored automatically, and the opt-out propagates across every campaign on the account. A send to an opted-out number is refused up front and not charged. To carry those opt-outs into your other tools, suppress the contacts GET /v1/opt-outs lists on a schedule. That list leaves out a STOP from a deleted contact, a dialer do-not-call entry and a STOP sent to your agency account or another of its sub-accounts, so before a send from another tool, check the number with GET /v1/opt-outs/:phone. The opt-out API reference is at docs.tryready.com/api/opt-outs.

Customers also reply with words other than STOP, such as "cancel" or "no more". Read every reply in the inbox, and treat a clear request to stop as an opt-out even if it doesn't use a keyword.

DNC and litigator scrubbing

Consented lists still need scrubbing. Some customers who opted in will later file DNC complaints. A small group of serial TCPA plaintiffs also signs up specifically to collect. A scrub checks each number against known TCPA-litigator lists and DNC-complainer lists, then flags the matches before the send. We explain the difference between these lists, and why a DNC check alone misses litigators, in TCPA litigator scrubbing explained.

Ready offers scrubbing two ways:

1. Standalone scrub: $0.005 per contact. You pay for each number you check, once. Use GET /v1/scrub/:phone for a single number.
2. Scrub on send: $0.003/segment, charged on top of the send when you switch it on for the account. It is off by default.

Landline validation works the same way. It is $0.003/segment when switched on and also off by default. Ready already refuses, free, any number its own sends have seen as a landline, on every account. With it switched on, Ready also looks up numbers it has not seen and refuses the landlines it finds (that lookup is billed). GET /v1/validate/:phone checks a single number.

Scrubbing reduces risk. It does not make you lawsuit-proof, and compliance stays the sender's responsibility. Its value is that it removes the numbers most likely to sue, at a fraction of a cent each.

10DLC registration

US carriers filter unregistered application-to-person traffic. Registration ties your store's brand and a described campaign to your numbers, so carriers know who is sending and why. If you need the basics, start with what 10DLC is.

What registration costs on Ready

• At submit: $25, which covers the first month. There is no setup fee.
• Monthly after that: $25 for registration + $2 per number. A store with one number pays $27 a month.
• Timing: most approvals take 2 to 7 days.

An unregistered account can send up to 500 texts a month at its normal per-text rate. After that, it has to register. If you buy a number before you register, you send on Ready's shared registration at the same per-text rate while your own registration is in review. The first 20 texts are free, they are one-to-one sends, and they end as soon as a registration is paid for. Use them to test before you register. A campaign is paid from its first text. To send, you add a card and get a number, which is $2 a month with the first month charged when you get it.

Pick the use case that matches what you send

Order confirmations and shipping updates are a different use case from promos. If your sample messages show discount codes and your registered use case says "account notifications," expect a rejection or filtering. Register for what you actually send, and use your real checkout opt-in wording as the consent description.

Ecommerce SMS compliance tools: what they cost on a real campaign

Here is an example with stated assumptions: a store with 8,000 opted-in subscribers sends one promo.

Version A: 150 characters, plain text, no emoji. That is 1 segment per text.

• 8,000 × $0.0075 = $60, plus 8,000 × $0.0045 in carrier fees.

Version B: 175 characters with one emoji. The emoji switches the message to unicode, so 175 characters becomes 3 segments.

• 24,000 segments × $0.0075 = $180, plus 24,000 × $0.0045 in carrier fees.

That one emoji tripled the bill. Ready replaces curly quotes, long dashes and ellipses with plain characters before sending, so those don't change the count. Emoji do.

The scrub choice also depends on segment count:

• Scrub on send for Version B: 24,000 × $0.003 = $72 for this one campaign, and it applies again on every later campaign.
• Standalone scrub of the list once: 8,000 × $0.005 = $40.

For a store that sends multi-segment campaigns, scrubbing the list on a cadence often costs less than per-segment scrubbing on every send. For short, single-segment campaigns the two come out closer. The rates above are our all-in rates, $0.0075/segment plus the $0.0045 carrier fee. "All-in" here excludes the compliance surcharges, which you only pay if you switch them on. Customer replies are billed like a sent text, so budget for replies on a promo that asks a question. The rate card is at tryready.com/pricing.

Throughput affects quiet hours

Assume a fresh standard campaign at 3 segments per second. Version B's 24,000 segments then take about 8,000 seconds, a little over two hours. A brand with the lowest T-Mobile trust score is also capped at roughly 2,000 messages a day on that carrier. Carriers publish these limits only as approximations, but an 8,000-subscriber campaign can easily run into them. Brand vetting ($79 Standard or $179 Enhanced, one-time) can raise the daily cap if it moves your trust score up a tier. It does not change the per-second rate. Smaller stores usually don't need it.

Where Ready fits, and where it doesn't

There are tradeoffs:

• If you're on Shopify with an SMS app that already handles checkout consent, that app's consent capture is good. Ready doesn't provide a checkout checkbox or a popup builder. Keep your consent capture where it works now.
• On price per segment, raw carrier APIs such as Twilio (about $0.0083/segment) and GoHighLevel's LeadConnector (about $0.0083 per message) charge less per message. What Ready includes is the compliance layer around the send: in-app registration, quiet hours, opt-out propagation, scrubbing and landline refusal, plus an inbox, contacts, automations and drip campaigns.
• If you're a platform that texts on behalf of many stores, each store gets its own sub-account with its own numbers and registration. The quickstart is at docs.tryready.com/guides/quickstart.

The practical takeaway

Before the first campaign, check these five items in order. Consent records live in your store with the exact wording and a timestamp. Quiet hours follow the recipient's clock, not yours. A STOP reaches every tool that can text. The list is scrubbed against litigators and DNC complainers. Your 10DLC registration describes what you actually send. Then do the segment math on your real message before you add an emoji.

If you want to test the send side, sign up, use your 20 free one-to-one texts, and register once your consent wording is final.

Frequently asked questions

Do I need consent to send abandoned cart texts?

Yes. An abandoned cart text is marketing, so you need prior express written consent. A shopper typing a phone number into checkout is not consent unless there was an unchecked opt-in box with an SMS disclosure.

What hours am I allowed to send marketing texts to customers?

The window most often cited federally is 8 AM to 9 PM in the recipient's local time, and some states are stricter. Schedule by the recipient's time zone, and use a platform that holds texts that would land outside the window.

Do I need 10DLC registration for a small online store?

Yes, for any real volume. Carriers filter unregistered business texts. On Ready, an unregistered account can send up to 500 texts a month, and after that it has to register, which costs $25 at submit and then $25/mo for registration + $2 per number.

Is DNC scrubbing necessary if everyone on my list opted in?

It is still worth doing. Consented contacts can later file DNC complaints, and known TCPA litigators do opt in to collect. A standalone scrub at $0.005 per contact costs little next to TCPA exposure of $500 to $1,500 per text.

What happens if a customer texts STOP but I use more than one SMS tool?

The STOP usually stops only the tool that received it. You need to sync opt-outs across every system that can text. On Ready, GET /v1/opt-outs lists the account's opted-out contacts for your other tools to suppress, but not every blocked number, so check a number with GET /v1/opt-outs/:phone before another tool texts it.