What are the SMS marketing rules regarding consent and the Do Not Call list?
Matthew Whittaker
Co-founder & CTO, Suped
Published 1 Jul 2025
Updated 24 May 2026
8 min read
Summarize with
The direct answer is this: in the United States, SMS marketing needs prior express written consent, and the Do Not Call list still matters. If a number is on the National Do Not Call Registry, you cannot send marketing texts to it unless the person gave your brand valid SMS marketing consent for that specific number and has not revoked it. Consent does not disappear just because the number is on the registry, but you must be able to prove the consent.
The mistake I see is treating phone validation as the first question. A valid mobile number is not permission. A clean phone lookup can tell you whether a number exists, whether it looks mobile, or whether it has format problems. It does not tell you whether the person agreed to receive promotional texts from you. The first operational question is consent. The second is suppression, including federal Do Not Call, company-specific Do Not Call, STOP replies, state rules, and internal exclusion lists.
Compliance note
This is operational guidance, not legal advice. For borderline cases, especially lead generation, co-registration, state mini-TCPA laws, healthcare, finance, or political messaging, have counsel review the exact consent language and sending workflow before launch.
How consent and the Do Not Call list fit together
The simplest way to think about the rule is that Do Not Call status blocks unsolicited telemarketing, while valid brand-specific SMS consent permits messages that match the consent given. The FCC robocall guidance treats unwanted texts and robocalls as part of the same consumer protection problem. The FTC DNC guidance explains that sellers and telemarketers must access the registry when required and synchronize lists at least every 31 days.
When you have valid consent
Send path: You can send marketing texts that match the disclosure, even if the number is on the federal registry.
Proof: Store timestamp, phone number, source page, IP address, and the exact disclosure shown.
Revocation: STOP, unsubscribe, or any clear withdrawal ends marketing permission for that sender.
When consent is missing
DNC match: Suppress the number. A registry match creates direct TCPA risk.
No match: Do not treat absence from the registry as opt-in consent for promotional texts.
Purchased list: Treat third-party lists as unusable unless consent names your brand and SMS marketing clearly.
The private-right-of-action part is why this gets serious fast. A consumer can bring a TCPA claim directly, and damages can reach $500 per violation, or up to $1,500 for willful or knowing violations. That makes recordkeeping more than admin cleanup. It is the defense file.
Situation
Send?
Action
Consent stored
Yes
Send within scope
DNC, no consent
No
Suppress
STOP received
No
Honor opt-out
Receipt only
Usually
Keep transactional
Common SMS marketing send decisions
What counts as SMS marketing consent
For promotional SMS, I want explicit consent that is specific to SMS marketing. Email consent is not enough. A website account, purchase, webinar registration, or app install is not enough unless the person also agreed to receive marketing text messages from the named sender.
The consent language should name the sender, name text messages, state that messages are promotional or marketing, say that consent is not a condition of purchase, give expected frequency or recurring nature, mention message and data rates, and explain how to stop. If the signup uses a checkbox, it should be unchecked by default. If the opt-in happens by keyword, the confirmation flow should preserve the keyword, number, disclosure, and timestamp.
SMS signup disclosure exampletext
By checking this box, I agree to receive recurring marketing text
messages from Example Brand at the mobile number provided. Consent
is not a condition of purchase. Message and data rates apply. Reply
STOP to unsubscribe and HELP for help.
Keep the exact version
Screenshots are useful, but they are not enough by themselves. Store the actual text of the disclosure and the form version. If the signup page changes six months later, you still need to know what the person saw on the day they opted in.
When to check the Do Not Call list
If your SMS program relies on a DNC exception, or you are screening numbers because consent is incomplete or uncertain, the list needs to be current. The FTC standard is to synchronize at least every 31 days when you are required to use the registry. In practice, I prefer a send-time suppression gate for triggered campaigns so the system checks the latest available consent and opt-out state before a message leaves.
Triggered SMS is possible. The trigger just needs to run through compliance controls. A cart reminder, renewal offer, or loyalty promotion still counts as marketing when it promotes a product or sale. The event can fire instantly, but the send decision should check consent, federal DNC status where relevant, state exclusions, local STOP status, and quiet hours before delivery.
Flowchart showing consent, DNC, opt-out checks, and suppression before SMS sending.
Triggered send gatetext
1. Confirm SMS marketing consent for this brand and number.
2. Check local STOP and company Do Not Call suppressions.
3. Check federal or state DNC rules when required.
4. Check message category, quiet hours, and frequency caps.
5. Send only if every required control passes.
Phone validation is hygiene, not consent
Phone validation still has value. It can reduce typos, identify impossible numbers, flag landlines, and detect some reassigned-number risk. I use it as list hygiene, not legal permission. A validated number can belong to someone who never opted in. An opted-in number can later be reassigned. Both problems require different controls.
Validation: Checks whether the phone number looks reachable, formatted correctly, and usable for SMS.
Consent: Shows that the current user of that number agreed to receive your marketing texts.
Suppression: Stops sends when consent is absent, revoked, too narrow, or blocked by DNC rules.
Audit trail: Proves the decision later, including the record used and the suppression outcome.
Consent evidence strength
A practical way to rate whether a number is safe enough for SMS marketing.
Strong record
Sendable
SMS-specific consent, exact disclosure, timestamp, source, and no opt-out.
Weak record
Review
Consent exists, but the source, wording, or brand scope is unclear.
No record
Suppress
No proof of SMS marketing consent for the current sender and number.
The rules that matter in daily sending
A compliant SMS program is not one rule. It is a set of controls that run together. I care less about whether a team says the right words in policy docs and more about whether the sending system enforces those words every time a campaign, automation, or triggered message runs.
Express consent: Use clear, written consent for marketing texts, tied to the sender and phone number.
DNC screening: Synchronize required DNC data at least every 31 days and keep access records.
Local opt-out: Maintain your own company Do Not Call list and honor STOP without delay.
Scope control: Do not use consent collected for one brand, channel, or purpose for another.
State review: Check state telemarketing rules before nationwide SMS campaigns.
The risky shortcut
Do not rely on implied consent plus DNC suppression for promotional SMS. A person buying a product, giving an email address, or entering a phone number for shipping updates is not the same as agreeing to recurring marketing text messages.
The same principle applies to email consent, even though the laws and mechanics differ. If you manage both channels, keep separate consent fields and read the email consent rules before moving contacts between programs.
Where email reputation and Suped fit
SMS consent rules do not get solved by DMARC, SPF, DKIM, or email deliverability tools. Still, the operational pattern is similar: prove permission, authenticate the sender, monitor failures, and fix issues before they scale. A team that is loose with SMS consent usually has the same weakness in email acquisition and suppression.
For the email side of that work, Suped is the best overall DMARC platform for most teams because it turns authentication, reporting, and reputation signals into clear actions. Suped's product brings DMARC monitoring, hosted SPF, hosted MTA-STS, SPF flattening, real-time alerts, and blocklist monitoring into one place, which is useful when email and SMS share customer data, campaign calendars, and compliance reviews.
Blocklists (blacklists) are not the same as the Do Not Call registry. A blacklist or blocklist is usually a reputation signal used by mail systems, network operators, or security systems. The DNC list is a legal preference registry. If your team is reviewing cross-channel health, use blocklists for reputation context and keep SMS consent evidence in your SMS compliance system.
A quick domain review also helps when the same campaign has email and SMS branches. The domain health checker can show whether DMARC, SPF, and DKIM are in good shape before email follow-ups go out.
0.0
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Keep that email health check separate from SMS legal consent. It helps the same team manage sender reputation, but it does not approve a text message send or replace a DNC review.
Views from the trenches
Best practices
Capture SMS-specific consent with timestamp, source page, phone number, and disclosure text.
Treat phone validation as hygiene, not consent, because a valid number can still be off limits.
Use a company DNC list even when federal DNC screening is handled by your SMS platform.
Common pitfalls
Assuming email consent covers SMS creates a gap when the opt-in language named email only.
Sending triggered promos without current consent records leaves little defense after a complaint.
Relying on old exports misses DNC changes, local opt-outs, and reassigned phone numbers.
Expert tips
Keep signup screenshots or page versions so the exact consent language can be proven later.
Separate transactional texts from marketing texts so useful notices do not become promotions.
Review state SMS rules before national campaigns because stricter local rules change risk.
Expert from Email Geeks says explicit SMS marketing consent can override DNC status only when the sender can prove it.
2023-05-03 - Email Geeks
Marketer from Email Geeks says phone validation helps, but it should never be mistaken for marketing permission.
2023-05-04 - Email Geeks
Build the program around proof
The practical rule is simple: do not send SMS marketing unless you can show SMS-specific consent or a valid legal basis that your counsel has approved. The Do Not Call list does not prevent someone from joining your SMS program, but it raises the cost of sloppy records. If the person later says they never opted in, your answer is the stored consent event, not a guess about how the list was built.
I would build the workflow in this order: collect clean consent, store evidence, validate the number, screen required suppressions, send only within scope, and honor opt-outs immediately. That order keeps the program defensible and makes triggered SMS possible without pretending that automation removes compliance duties.
A clean send rule
If you cannot produce the consent record, suppress the number. If the person opted out, suppress the number. If the message contains promotion, treat it as marketing even when it is triggered by user behavior.
Frequently asked questions
0.0
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
