Navigating SMS marketing compliance can feel overwhelming. Between the Telephone Consumer Protection Act (TCPA), Cellular Telecommunications Industry Association (CTIA) guidelines, and varying state regulations, staying compliant requires careful attention to detail.
​

As a leading SMS marketing solution, TxtCart has compiled the most common compliance questions from our merchants, along with expert answers to help you navigate these complex requirements.
​

Double opt-in requires subscribers to confirm their subscription by responding "YES" or entering a verification code after their initial signup. This process is essential because:

We recommend using this standard disclosure language (ensure "Terms of Service" and "Privacy Policy" link to your actual pages):
​

By checking the checkbox above, you agree to receive recurring automated messages from [INSERT STORE NAME HERE], including cart reminders, at the phone number provided. Consent is not a condition of purchase. Reply STOP to unsubscribe. Reply HELP for help. Message frequency varies. Msg & data rates may apply. View our {{ privacy_policy_link }} and {{ terms_of_service_link }}.
​

Yes, absolutely. Pre-checked boxes violate consent requirements. Subscribers must actively check the box to provide explicit consent. This manual action demonstrates a clear intent to receive messages.
​

Compliance disclosures are required anywhere you collect SMS opt-ins, including:

For TCPA compliance:

No, you're not required to state specific message counts. However, we recommend setting clear expectations about message frequency and content in your welcome series. Consider asking new subscribers about their preferred message frequency and content types to enable better segmentation.

We recommend directing QR codes to a compliant landing page where full disclosure language appears alongside the signup form.

If you insist on a direct QR code signup, you must:

No, TCPA consent cannot be obtained verbally during phone calls. Instead, direct callers to a compliant landing page where they can complete the opt-in process with proper disclosure language visible.

This is not compliant unless each message is sent individually by a human (not automated) and all numbers are scrubbed against the National Do Not Call Registry. Even if technically compliant, this approach:

No. Valid consent must come directly from the person who will receive the messages. They must personally view the disclosure language and provide their own consent.

Unless you include complete compliance disclosure language in the social post, we recommend sharing a link to your compliant opt-in landing page instead. This approach provides stronger compliance protection.

No. Each brand must collect separate, explicit consent using individual opt-in forms, even if hosted on the same page. Shared consent does not meet compliance requirements.

Absolutely not. Purchased lists lack proper consent from recipients for your specific brand, making any marketing messages to those numbers non-compliant and legally risky.

Cart abandonment messaging has strict limitations:

Yes, browse abandonment follows identical rules:

Follow-up messages are only permitted if the subscriber responds to your initial abandonment message, creating a conversational exchange. For example:

Yes, this is compliant. For example: "Reply SAVE for a 10% discount on your abandoned cart items." The follow-up discount message would be triggered by the subscriber's keyword response (a separate action), not the original abandonment event.
​

Non-abandonment flows (welcome series, order updates, promotional campaigns, post-purchase sequences, etc.) can include multiple messages as long as they comply with:

If you're only changing your business name while maintaining the same products and services, you can continue messaging existing subscribers. However, include information about the name change in your next message to keep subscribers informed.

If your products or services are changing along with the name, you must collect fresh opt-ins.

No. Each brand requires separate opt-in consent, even if you own multiple brands. You cannot cross-promote between different brands using SMS. However, you could send an email from your current brand linking to an SMS opt-in page for your other brand.
​

We strongly advise against this practice as it creates poor customer experience and complex compliance management. Each brand should maintain its own dedicated SMS number.

SHAFT refers to content related to Sex, Hate, Alcohol, Firearms, and Tobacco (including CBD). Carriers actively filter messages containing SHAFT-related content, which can result in message blocking, account suspension, or permanent filtering.
​

While carriers don't publish complete lists, avoid these commonly flagged terms:
​

Sex-related: Aroused, arousal, sensual, sexual, intimate terms Alcohol: Booze, brewery, whiskey, vodka, tequila, wine, beer Firearms: Ammunition, rifle, handgun, gun, weapon, shooting Tobacco: Tobacco, cigarette, smoking, vaping terms Cannabis: CBD, marijuana, cannabis, hemp, weed, THC, vape, bong General flags: Profanity, "watch now," inappropriate content.
​

Products related to but not directly including SHAFT items (like holsters for firearms) carry filtering risk. Exercise extreme caution with messaging and avoid trigger words. Consider whether SMS marketing is worth the deliverability risks for your specific business.

Quiet hours protect subscribers from receiving messages during inappropriate times:
​

Federal Requirements (TCPA):

Penalties can be severe:

Additional consequences include higher unsubscribe rates, spam reports, carrier filtering, and customer complaints.
​

No, manual one-on-one customer service responses are exempt from quiet hours restrictions, provided they don't contain marketing content.

Transactional messages:

Promotional messages:

Generally, NO. Keep transactional messages focused on their primary purpose. Small amounts of promotional content might be acceptable (like a brief signature line), but the message's primary purpose should remain transactional.

Yes, CTIA regulations and many state laws require sender identification in each message. This prevents deliverability issues and ensures subscribers know who's messaging them.
​

We advise against linking to domains that don't match your business domain, as carriers may flag these as fraudulent. Instead, encourage subscribers to search for your brand on the platform rather than providing direct links.
​

You can collect customer content through SMS, but obtain signed releases before using photos, videos, or testimonials in broader marketing campaigns. Consult legal counsel for appropriate release forms.
​

No, SMS consent is specifically limited to automated text message marketing. Using phone numbers for Facebook advertising, calling campaigns, or other purposes violates the limited scope of SMS opt-in consent.
​

Your legal documents should clearly explain:

Consider using dynamically hosted terms that automatically update with regulatory changes to ensure ongoing compliance.

Your opt-in forms must meet accessibility standards:

Yes, we employ industry-standard security measures, including technical, administrative, and physical safeguards, to protect subscriber information based on data sensitivity levels.

​

Still, Have questions?
Please feel free to reach out to our wonderful Support team at support@txtcartapp.com or via Live Chat.
​

​