SMS compliance rules by state: Texas, Florida and carrier standards

Most compliance checklists for business texting stop at "get consent and honor STOP." That covers the federal floor and nothing else. A US business text has to clear four layers: the federal TCPA, a growing set of state "mini-TCPA" laws, the carrier rulebook (CTIA guidelines plus 10DLC registration through The Campaign Registry), and the content of the message itself. Each layer has its own enforcer, and each one can hurt you independently. A text that is fine under federal law can still break a Florida rule, pass Florida, and still get filtered by T-Mobile.

This post maps those four layers for a compliance lead who needs to know what applies, where the strictest rule sits, and what to change in the send process. It is a map, not legal advice. State laws are amended often, so confirm the current text with counsel before you build policy on any single row below.

Layer 1: the federal floor (TCPA and the DNC registry)

The Telephone Consumer Protection Act covers texts. Courts and the FCC have treated a text as a "call" for TCPA purposes for years. Our plain-English TCPA explainer covers the details. The parts that matter for a map are these:

• Consent. Marketing texts sent with an autodialer need prior express written consent. Purely informational texts (order updates, appointment reminders) need prior express consent, which is a lower bar. Our guide to documenting consent covers what a record needs to hold.
• Quiet hours. Federal rules bar telephone solicitations before 8 AM or after 9 PM in the recipient's local time.
• National DNC registry. Marketing texts to numbers on the registry need consent or an existing business relationship that qualifies.
• Damages. $500 per violating text, up to $1,500 if willful. A 2,000-contact campaign that goes out without valid consent carries a theoretical exposure of $1 million to $3 million. That is why plaintiffs' firms watch this law closely.

The federal rules are the floor. Every state rule below adds to them and never replaces them.

Layer 2: state mini-TCPAs and why Texas changed the map

Several states have passed their own telemarketing laws. Some are stricter than the TCPA, and some give consumers a private right of action that does not depend on federal autodialer definitions. After the Supreme Court narrowed the federal autodialer definition in 2021, plaintiffs shifted toward these state laws.

Texas (SB 140, effective September 1, 2025)

Texas is the reason many compliance teams are reopening their texting policies. SB 140 expanded the state's telephone solicitation law so it explicitly covers text messages. It also made violations of the telephone solicitation chapter actionable under the Texas Deceptive Trade Practices Act, which gives consumers a direct path to sue.

What that means in practice:

• Registration. Businesses that make telephone solicitations into Texas, now including marketing texts, may need to register with the Texas Secretary of State. The filing fee is $200, and a security deposit and annual renewal also apply. The statute lists exemptions, and some commonly cited ones cover businesses texting current or former customers. Whether an exemption fits your program is a question for counsel. Do not assume one applies.
• Hours. The Texas Business & Commerce Code limits solicitations to 9 AM to 9 PM Monday through Saturday and noon to 9 PM on Sunday. That window is narrower than the federal one on Sunday mornings.
• Private suits. The DTPA route is the big change. Before SB 140, Texas exposure was mostly regulatory. Now it is litigation exposure too.

Florida, Oklahoma, Maryland, Washington

Other states have their own telemarketing rules on top of these, and more bills come up every session. Treat this table as the starting point for a review with counsel, not a finished list.

How to build one policy out of five

A national sender rarely wants five separate rulebooks. The common approach is to adopt the strictest overlap as company policy:

• Hours: 9 AM to 8 PM recipient-local, with no Sunday sends before noon. That one window satisfies every row above.
• Frequency: no more than three marketing texts per contact per 24 hours on the same subject.
• Consent: prior express written consent for anything promotional, kept for every contact.
• Texas: a documented decision, made with counsel, on whether you register or which exemption you rely on.

Applying the window by recipient time zone matters more than most teams expect. A 9 AM Eastern send reaches Pacific numbers at 6 AM. Our post on timezone-aware quiet hours walks through the scheduling fix.

Layer 3: carrier standards, CTIA and TCR registration

Carriers are not regulators, but for day-to-day sending they act like one, and they enforce faster than any court. Their rulebook has three parts.

CTIA Messaging Principles and Best Practices

This is the industry guidance carriers point to. It covers:

• consent tied to the specific program;
• clear opt-in disclosures;
• honoring STOP and HELP;
• no content that falls under SHAFT (sex, hate, alcohol, firearms, tobacco) without age gating and an approved use case.

Breaking these rules gets your messages filtered, not fined. For a business, losing delivery can cost more than a fine would.

10DLC registration through The Campaign Registry

Every business sending application-to-person texts from a standard 10-digit number registers two things through The Campaign Registry (TCR): a brand (who you are) and a campaign (what you send and how people opt in). Registration is a carrier requirement, not a law. We explain the difference in is 10DLC a law?. Unregistered traffic still gets filtered or blocked. Our 10DLC rules post covers what reviewers check.

From a compliance view, the campaign record is a sworn statement. The use case, the sample messages and the opt-in description you submit should match what you actually send. If a campaign is registered as "customer care" but sends promotions, it is out of compliance with its own registration.

Throughput is a compliance signal too

A brand's trust score sets its daily cap on T-Mobile, roughly ~2,000 messages a day at the lowest tier up to ~200,000 at the highest. A fresh standard campaign usually gets about 1 to 4 segments per second. These are approximations, because carriers publish no official rate card. Spam complaints and mismatched content pull your standing down. Clean consent practice protects deliverability as well as legal exposure.

Layer 4: what every message has to say

Message-level disclosures are where audits most often find gaps. They are also the cheapest gaps to close.

At opt-in (the form, keyword reply or checkout box), state:

1. the program or brand name;
2. what kind of messages they will get;
3. message frequency ("up to 4 msgs/month" or "msg frequency varies");
4. "Msg & data rates may apply";
5. how to get help (reply HELP) and how to stop (reply STOP);
6. links to your terms and privacy policy, and a statement that consent is not a condition of purchase.

In the first message after opt-in: confirm the enrollment and repeat the brand name, frequency, rates, HELP and STOP.

In ongoing messages: identify the brand in every text, and include opt-out language regularly. Many teams put "Reply STOP to opt out" in every promotional message. It costs a few characters and removes any argument that the contact could not find the opt-out.

HELP response: reply with the brand name, a support contact and the STOP instruction.

Where Canada and the UK/EU differ

If your list includes non-US numbers, the US map does not apply to them.

• Canada (CASL): commercial electronic messages need express or implied consent, sender identification and a working unsubscribe mechanism. Implied consent from a past purchase expires, so a customer list ages out of eligibility.
• UK and EU (PECR and GDPR): marketing texts generally need opt-in consent. A narrow "soft opt-in" exception covers existing customers, as long as every message offers an opt-out. GDPR adds data-handling duties on top of that.

The simplest operational rule is to segment by country code and apply the matching consent standard. Do not send one campaign across borders under US rules.

What the platform can do and what stays your job

We make Ready, so here is the straight split between what software can handle and what it cannot.

What Ready handles:

• Registration in-app. Brand registration is $10/mo, campaign registration is $20/mo, and each number is $2/mo. The charge at submit is the first month, $25. Most approvals take 2 to 7 days.
• Automatic STOP handling. Opt-outs propagate across campaigns. Opt-outs and numbers on your Ban list are refused up front and not charged.
• Quiet-hours enforcement. Ready holds sends outside 8 AM to 9 PM recipient-local time, with Connecticut numbers held to 9 AM to 8 PM and Florida and Oklahoma numbers to 8 AM to 8 PM. It does not apply the Texas or Maryland windows above or any Sunday rule, so if your policy is the stricter window, schedule campaigns inside it yourself. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.
• Litigator and DNC scrubbing. Known TCPA-litigator and DNC-complainer numbers can be screened before a send.
• Attestation logging. Ready records who sent each bulk or API send, to how many recipients, and when.

What stays your job: Ready's attestation log is not a per-contact consent record. It does not store a recipient's opt-in time, wording or page URL. Your store, form tool or CRM has to keep that. Texas registration, exemption decisions and state frequency caps are also decisions for you and your counsel. Compliance stays the sender's responsibility. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)

Worked example: what scrubbing adds to a send

These numbers are assumptions for illustration. Take a 10,000-contact opted-in list and a 150-character message with no emoji, which is one segment.

• Messages: 10,000 × $0.0075 = $75
• Carrier fees: plus 10,000 × $0.0045 in carrier fee
• Scrub surcharge: if scrubbing is switched on for the account (it is off by default), add 10,000 × $0.003 = $30

That totals $250 plus carrier fees. Any "all-in" per-segment rate we quote excludes that compliance surcharge. Landline validation, if you switch it on, is another $0.003 per segment.

If you would rather scrub a list once before importing it, the standalone TCPA and DNC litigator scrub costs $0.005 per contact. Against $500 to $1,500 of exposure per violating text, $50 is cheap risk reduction. It does not make a sender lawsuit-proof.

The practical takeaway

Treat compliance as four layers and write policy to the strictest rule in each:

1. Federal TCPA consent standards.
2. The 9 AM to 8 PM recipient-local window with no Sunday mornings, and three marketing texts per 24 hours.
3. Registered 10DLC campaigns that match what you actually send.
4. Full disclosures at opt-in and in every message.

Then make a written decision on Texas registration with your counsel, because that is the newest and least-understood exposure on the map.

If you want registration, STOP handling, quiet hours and scrubbing handled in one place, you can create an account. The first 20 one-to-one texts are free, so send them before you submit registration.