CAN-SPAM Act Text Message Rules: TCPA, 10DLC, and Penalties

Under the CAN-SPAM Act, text message rules treat marketing texts sent to wireless devices as a special category called a “mobile service commercial message,” and they carry stricter consent requirements than regular email plus civil penalties of $53,088 per noncompliant message.¹ CAN-SPAM is only half the picture. The Telephone Consumer Protection Act (TCPA) runs alongside it with its own consent requirements and lets individual recipients sue for $500 to $1,500 per unwanted text.² If you send marketing texts, both laws apply, and so do carrier-level registration rules that can silently block your messages before they arrive.

Which Texts CAN-SPAM Covers

CAN-SPAM defines a mobile service commercial message as a commercial electronic mail message transmitted directly to a wireless device used by a mobile service subscriber.³ The statute directed the FCC, in consultation with the FTC, to write the rules protecting consumers from these messages.⁴

Whether a text qualifies as commercial turns on its primary purpose. If the main point is advertising or promoting a product or service, the commercial rules apply. When a message mixes promotional content with other information, the FTC applies a two-part test: if a reasonable person reading the subject line would conclude the message is an ad, or if the promotional content appears before any transactional content in the body, the whole message is treated as commercial.⁵ Senders don’t get a pass for not realizing a destination was a wireless number. Identifying that is your responsibility.

Texts That Are Exempt

Not every business text triggers full compliance. Messages whose primary purpose is transactional or relationship-based are exempt from most requirements, though they still cannot contain false or misleading routing information.⁶ The exempt categories are:

Transaction confirmations completing or confirming a purchase the recipient already agreed to.
Product safety notices, including warranty information, recall alerts, or security updates for something the recipient bought.
Account updates about changes to terms, features, or the recipient’s standing in an ongoing subscription, membership, or loan.
Regular periodic account balance statements.
Employment-related messages about a job or benefits the recipient is currently enrolled in.
Delivery of goods or services the recipient is entitled to under an existing transaction.

The FTC reads these categories narrowly. If a reasonable consumer wouldn’t understand the message’s main purpose as fitting one of them, the message has to comply with everything CAN-SPAM requires.⁶ A common mistake is tacking a promotional offer onto an order confirmation and assuming the whole message stays exempt. If the promo appears prominently or dominates the message, you’ve converted a transactional text into a commercial one.⁵

What Every Commercial Text Must Include

Three elements are required. First, the message must clearly identify itself as an advertisement or solicitation. The FTC gives senders flexibility in how to do this, but the disclosure has to be obvious enough that a recipient immediately recognizes the commercial intent.⁶ Disguising a marketing text as a personal message or urgent notification violates this requirement.

Second, the message must include a working opt-out mechanism. Most senders use a “Reply STOP” command, but whatever the method, it has to be clear and easy to use. Hidden links, tiny text, or multi-step processes that bury the opt-out option are prohibited. Once someone opts out, you have ten business days to stop sending them messages.⁶

Third, you must provide a valid physical postal address. This can be a street address, a registered P.O. box, or a private mailbox registered with a commercial mail receiving agency under Postal Service regulations.⁶ Given the character constraints of texting, linking to a landing page that displays this information is the practical approach.

Express Prior Authorization for Texts to Wireless Numbers

CAN-SPAM requires more than implied consent for texts to wireless devices. Before you send a mobile service commercial message, you need express prior authorization from the recipient.⁴ The bar is higher than traditional email marketing, where an existing business relationship can sometimes justify contact. For mobile messages, the recipient must affirmatively agree.

FCC rules require that consent be documented through a clear act: a written signature, an electronic form submission, or a recorded verbal agreement.⁷ The consent request has to tell the consumer they’ll receive commercial texts from your company on their wireless device, that the messages involve marketing, and that agreeing is not a condition of any purchase. Vague or bundled language won’t cut it.

Since January 2025, the FCC’s one-to-one consent rule has tightened this further. If a consumer fills out a form that shares their information with multiple companies, each company needs separate, explicit consent. Blanket consent obtained through lead generators no longer satisfies the requirement.⁷ Businesses buying leads from third-party aggregators are the ones this catches most often.

Keep detailed records of every consent: the date, the exact disclosure language shown, IP addresses for web sign-ups, and timestamped logs for verbal confirmations. Maintain these records for as long as the marketing relationship exists. If a regulator or recipient challenges you, this documentation is your only defense.

Handling Opt-Outs

The ten-business-day window to honor opt-outs under CAN-SPAM applies to all commercial messages, including texts.⁶ The parallel TCPA rules impose the same ten-business-day requirement. As of April 2026, an additional FCC rule takes effect requiring that a consumer’s revocation for one type of message be treated as revoking consent for all future robocalls and robotexts from that sender on unrelated matters. If someone replies “STOP” to your promotional text, you’ll need to stop all automated messages to that person, not just the campaign they responded to.

Some states are pushing further. Retention periods for opt-out records reach as long as ten years in some jurisdictions. Building your opt-out systems to the strictest standard protects you across all markets.

How the TCPA Runs Alongside CAN-SPAM

Most senders underestimate this overlap. CAN-SPAM governs content and opt-out procedures. The TCPA governs the method of delivery, specifically the use of automated dialing systems and prerecorded messages to wireless phones. Most marketing text campaigns trigger both, and the TCPA is the one with real teeth for individual recipients.

A person who receives an unauthorized marketing text sent via an autodialer can sue directly and recover $500 per message. If the sender knowingly or willfully violated the law, the court can treble that to $1,500 per text.² CAN-SPAM has no private right of action. The TCPA does. A campaign sending 10,000 unauthorized texts faces up to $15 million in potential TCPA liability alone, before any CAN-SPAM penalties.

The statute defines an autodialer as equipment capable of storing or producing numbers using a random or sequential number generator and dialing them. Several federal appeals courts have read this to include any system that can automatically dial numbers stored in a list without human intervention. If your texting platform sends messages automatically from a contact list, assume it qualifies.

Carrier Registration Under 10DLC

Even with perfect CAN-SPAM and TCPA compliance, your messages won’t arrive if you haven’t registered with wireless carriers. Since February 2025, all major U.S. carriers block 100% of unregistered traffic sent from standard 10-digit phone numbers (called 10DLC, for 10-digit long code). Unregistered messages don’t get throttled. They disappear.

Registration requires linking your business identity to each messaging campaign through The Campaign Registry, and carriers verify your brand information against IRS records. Vague campaign descriptions get rejected; carriers want specifics about what you’re sending and to whom. They also require live, accessible URLs showing your opt-in flows. Sole proprietors need an EIN for new registrations, and anyone registering on behalf of another business must provide a reseller ID.

Once you’re registered, carriers use AI to compare your live messages against the samples you submitted. Messages that drift significantly from your registered patterns get flagged or blocked. High opt-out rates trigger automatic filtering. Carrier penalties for non-compliance can reach $10,000 per violation, entirely separate from federal fines. Rotating through multiple numbers to evade detection, known as “snowshoe” messaging, is explicitly banned and results in immediate blocking.

Penalties for Noncompliance

CAN-SPAM Civil Penalties

Each noncompliant message is a separate violation. As of 2025, the inflation-adjusted penalty is $53,088 per message, and this figure increases annually.¹ More than one party can be held responsible for the same violation, so both the company that hired the campaign and the vendor that sent it can face separate penalties.⁶

State attorneys general can also bring civil actions on behalf of their residents. Statutory damages in those cases run up to $250 per violation, capped at $2 million. If the sender committed aggravated violations, including harvesting email addresses from websites, generating addresses through automated permutations, or using scripts to create fake accounts for sending, the court can triple the damages to $6 million.⁸

Criminal Exposure

CAN-SPAM violations involving fraud can carry criminal charges under 18 U.S.C. § 1037. Using false identities, unauthorized computer access, or sending messages through hijacked accounts can result in up to five years of imprisonment along with criminal fines. These provisions target the most egregious spam operations rather than ordinary marketing missteps, but they matter if you’re evaluating vendors whose practices you don’t fully control.

TCPA Damages Stack on Top

TCPA liability stacks. Individual recipients can sue for $500 per unauthorized text, or $1,500 if the violation was willful, and these cases are often brought as class actions.² A growing number of states have their own telemarketing laws with per-message damages ranging from $100 to $20,000, sometimes with treble damages for willful violations. Combined federal and state exposure for a single noncompliant campaign can be staggering.

Vicarious Liability for Vendors

Hiring a marketing agency or texting vendor doesn’t insulate you. The FCC has ruled that companies can be held vicariously liable for TCPA violations committed by third-party telemarketers under standard agency principles. If you authorized the vendor to market your products, gave them access to your customer data, or let them use your brand name, you share liability even without personally approving specific messages. Audit your vendors, require contractual indemnification, and don’t assume outsourcing the sending outsources the risk.

Who Enforces the Rules

Individual consumers cannot sue under CAN-SPAM. Enforcement is handled by the FTC, which treats violations as unfair or deceptive trade practices, and by a range of other federal agencies that oversee specific industries such as banking, securities, and insurance.⁹ State attorneys general can bring actions on behalf of their residents and seek injunctions, statutory damages, and attorney’s fees.⁸ The absence of a private right of action under CAN-SPAM is precisely why the TCPA matters so much for texting: it gives every person on your recipient list standing to sue you individually or through a class.

Reporting Unwanted Commercial Texts

If you receive a commercial text that violates these rules, three channels are available. The fastest is forwarding the message to 7726 (which spells “SPAM” on a phone keypad). This alerts your wireless carrier, which uses the data to identify and block the sender across its network. No personal information is shared with the sender.¹⁰

You can also file a report with the FTC at ReportFraud.ftc.gov, providing the sender’s phone number, message content, and the time you received it.¹⁰ The FCC accepts formal complaints through its Consumer Complaint Center for issues related to wireless service. Take a screenshot of the message before reporting, including any links or phone numbers in the text. Federal agencies rely on consumer reports to spot patterns and build cases, so individual reports genuinely contribute to enforcement.

1
Federal Trade Commission. FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025
2
Office of the Law Revision Counsel. 47 USC 227: Restrictions on Use of Telephone Equipment
3
LII / Legal Information Institute. 15 USC 7712(d) – Definition: Mobile Service Commercial Message
4
Office of the Law Revision Counsel. 15 USC 7712: Application to Wireless
5
eCFR. 16 CFR 316.3 – Primary Purpose
6
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
7
Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions
8
Office of the Law Revision Counsel. 15 USC Chapter 103: Controlling the Assault of Non-Solicited Pornography and Marketing
9
Office of the Law Revision Counsel. 15 USC 7706 – Enforcement Generally
10
Federal Trade Commission. How to Recognize and Report Spam Text Messages