CTIA messaging guidelines: the carrier rulebook for business texts
16 min readCTIA PDFs read 2026-10-22
For the owner or ops lead whose campaign came back rejected, or who wants it right the first time: what CTIA's Messaging Principles and short code handbook ask of a business that texts, why a voluntary industry document still decides whether your texts arrive, and where it differs from the TCPA. Every rule is quoted from the CTIA PDFs or a provider's own pages, read on 2026-10-22.
The short answer
“CTIA guidelines” usually means two documents from the US wireless industry's trade association: the Messaging Principles and Best Practices, which cover business texts from ordinary phone numbers, and the Short Code Monitoring Handbook, which covers five- and six-digit short codes. Neither is a statute. Both decide whether your texts get delivered.
The two CTIA documents
The Principles are the general rulebook; the Handbook is the stricter, audited version for short codes. CTIA says the Principles “are meant to supplement, and not replace” the Handbook, and the Handbook keeps pointing back to the Principles for consent. Most small businesses text from a local or toll-free number, so the Principles are the document their provider reads them against.
| Document | Edition | Covers | What it sets | Checked by |
|---|---|---|---|---|
| Messaging Principles and Best Practices | May 2023; replaced the 2019 edition | SMS, MMS and RCS between 10-digit numbers: 10DLC and toll-free | Consent levels, calls-to-action, opt-in confirmation, opt-out, privacy, content, links, number rules | Each provider's own policies and vetting |
| Short Code Monitoring Handbook | v1.9, effective 2023-08-02 | Five- and six-digit short codes leased through the Common Short Code Administration | The same consent rules plus message-by-message checklists, SHAFT, sweepstakes, cart reminders | CTIA's weekly in-market audits, then each wireless provider |
We checked for anything newer on 2026-10-22. CTIA's own page says “The current version of the CTIA Messaging Principles and Best Practices is available here” and links the May 2023 PDF; the Common Short Code Administration's site links Handbook v1.9. Many top-ranking summaries still describe the 2019 edition, which used the terms P2P and A2P; the 2023 text speaks of Consumer and Non-Consumer messaging and says a business, or anyone texting on its behalf, is always Non-Consumer.
CTIA also publishes Messaging Security Best Practices, which the Principles cite for snowshoeing and grey routes. This page does not cover them. For how short codes compare with local and toll-free numbers, read 10DLC vs toll-free vs short code.
Industry rules, enforced by your provider
The Principles say plainly what they are not:
“As a set of voluntary best practices, CTIA’s Principles and Best Practices do not impose, prescribe, or require contractual or technical implementation on messaging ecosystem stakeholders, including Service Providers.”
The next sentence is the one that matters to a sender: “Stakeholders may choose to implement modified and additional requirements through their individual guidelines, policies, and contracts.” That is what happens. Twilio's Messaging Policy, part of its Acceptable Use Policy, requires senders to tell recipients what “industry policies and standards (e.g., CTIA Messaging Principles and Best Practices)” require, and the carriers check the rest. The enforcement comes in four forms:
- Rejection at registration. 10DLC campaigns are vetted before they can send. Bandwidth publishes its rejection codes: a missing opt-in path, no STOP or HELP wording, a public link shortener in a sample, or SHAFT content (code 4100: “Do NOT resubmit”). The fixes, item by item, are in the 10DLC registration checklist.
- Filtering and blocking. The Principles let providers “block or filter message traffic to protect Consumers”, and texts that look unwanted simply do not arrive.
- Suspension. Twilio lists campaign-to-traffic mismatch, spam, controlled substances, phishing, gambling and a missing age gate as reasons carriers suspend a campaign; a suspended campaign “cannot be used to send messages.”
- Short code audits. CTIA audits short codes weekly in the market. A Severity 0 finding brings “Registry suspension until modified to comply with applicable law”, and the wireless providers decide what else follows.
Consent and the call-to-action
CTIA asks for consent whether or not the TCPA reaches a given text:
“Regardless of whether these rules apply … Non-Consumer Message Senders are expected to:
- Obtain a Consumer’s consent to receive messages generally;
- Obtain a Consumer’s express written consent to specifically receive marketing messages; and
- Ensure that Consumers have the ability to revoke consent.”
Exhibit II of the Principles sets three levels, and the level follows the content of the text, not the tool you send it from:
| Message type | When it applies | Consent CTIA expects | Example |
|---|---|---|---|
| Conversational | The customer texts first and you answer that question | Implied: “no verbal or written permission is expected” | “What time do you close?” and your reply |
| Informational | The customer gave you the number and asked to hear from you | Express consent, for that specific purpose, given by text, form, website or out loud | Appointment reminders, order updates, alerts |
| Promotional | You send a sales or marketing message | Express written consent: a signed form, a ticked box online | Sales, coupons, new-product news |
The call-to-action
The sign-up point (a web form, a keyword on a poster, a checkbox at checkout, a script read on the phone) is the call-to-action. Under § 5.1.1 it should make sure people know “(1) the program or product description; (2) the telephone number(s) or short code(s) from which messaging will originate; (3) the specific identity of the organization or individual being represented in the initial message; (4) clear and conspicuous language about opt-in and any associated fees or charges; and (5) other applicable terms and conditions (e.g., how to opt-out, customer care contact information, and any applicable privacy policy).” Opt-in details “should not be obscured in terms and conditions”.
Two more rules sit under consent. An opt-in “should apply only to the campaign(s) and specific Message Sender for which it was intended or obtained” (§ 5.1.2.2), and senders “should not use opt-in lists that have been rented, sold, or shared” (§ 5.1.4). That is why a texting platform will not let you import a bought list, and why cold texting fails both CTIA and the law (prior express written consent explains the law's side). The SMS opt-in language builder writes a call-to-action that carries all five parts.
The opt-in confirmation text
A recurring program sends one confirmation as its first message, “before any additional messaging is sent”. The TCPA has no such rule, and 10DLC reviewers check for it in the campaign's opt-in message.
“The confirmation message should include: (1) the program name or product description; (2) customer care contact information (e.g., a toll-free number, 10-digit telephone number, or HELP command instructions); (3) how to opt-out; (4) a disclosure that the messages are recurring and the frequency of the messaging; and (5) clear and conspicuous language about any associated fees or charges and how those charges will be billed.”
The Handbook's version asks for a “message and data rates may apply” disclosure and adds that the confirmation must go out “immediately after the Consumer opts into the Program”, or as soon as reasonably possible after a point-of-sale or paper sign-up. Bandwidth rejects a campaign whose opt-in message lacks the brand name, the frequency, the rates line, HELP or the opt-out keyword (codes 5104 to 5108). A confirmation that covers all five:
Harbor Dental: you're signed up for appointment reminders and offers. Up to 4 msgs/month. Msg & data rates may apply. Reply HELP for help, STOP to cancel.
STOP and HELP
§ 5.1.3 asks senders to let people leave “at any time”, by “phone call, email, or text”, and to “state in the message how and what words effect an opt-out.”
“Standardized “STOP” wording should be used for opt-out instructions, however opt-out requests with normal language (i.e., stop, end, unsubscribe, cancel, quit, “please opt me out”) should also be read and acted upon by a Message Sender except where a specific word can result in unintentional opt-out.”
Spelling does not rescue a sender: “The validity of a Consumer opt-out should not be impacted by any de minimis variances in the Consumer opt-out response, such as capitalization, punctuation, or any letter-case sensitivities.” Senders “should acknowledge and honor all Consumer opt-out requests by sending one final opt-out confirmation message per campaign”. For HELP, the Handbook sets the floor at short codes, and 10DLC reviewers apply it too: reply “with the Program name and further information about how to contact the Message Sender.”
| Customer texts | CTIA expects | What reviewers look for | A reply that passes |
|---|---|---|---|
| STOP | One final confirmation per campaign, then nothing | Brand name and that no further messages will be sent (Bandwidth 5100, 5102) | Harbor Dental: you're unsubscribed and will get no more texts. |
| HELP | The program name and how to reach you, even for people not subscribed | Brand name plus a phone number, email or website (Bandwidth 5109, 5110) | Harbor Dental: call (555) 010-0199 or email care@harbordental.example. Reply STOP to cancel. |
Twilio's policy adds that the first message you send must include “Reply STOP to unsubscribe,” or an equivalent keyword. Federal law now reaches further than the keyword list, with any reasonable method and a 10-business-day limit; the word-by-word handling is in SMS opt-out keywords.
Content rules: SHAFT, age gates, links and numbers
The Principles ask senders to screen out content that is unlawful, deceptive, harassing or violent, that invades privacy, spreads malware or threatens people, and, ninth on the list in § 5.3.1, content that “does not meet age-gating requirements.” The Handbook names the categories behind that last item.
“Content that contains or promotes sex, hate, alcohol, firearms, or tobacco.”
Content must “Be age-gated appropriately for controlled substances and adult content”, and SHAFT, gambling, and sweepstakes and contests are listed as categories that are “either explicitly prohibited or [have] additional Wireless Provider requirements.” In the audit tables, SHAFT content that is federally illegal, or legal SHAFT content “without a functioning age gate”, is Severity 0, the highest. The Handbook never names cannabis; it bars the “Endorsement of illegal drugs or controlled substances” and says “Reference to the abuse of controlled substances is prohibited.”
Providers draw the lines tighter than CTIA does. Twilio's forbidden-categories page, for US texting:
Bandwidth's vetting rejects SHAFT sample messages under code 4100 with the instruction “Do NOT resubmit”. If your business sells any of these, ask your provider for its written rules before you collect a single opt-in.
Links and phone numbers inside the text
Links must not “conceal or obscure the Message Sender's identity”. Under § 5.3.2, “Where a web address (i.e., Uniform Resource Locator (URL)) shortener is used, Message Senders should use a shortener with a web address and IP address(es) dedicated to the exclusive use of the Message Sender”, and the site a link opens should name its owner and give contact information such as a postal address. Bandwidth rejects public shorteners in samples and replies (codes 6106 to 6108, 8201). Phone numbers follow § 5.3.3: none that are “assigned to or forward to unpublished phone numbers” unless the text names the number's owner.
Check a draft text against the content rules
The checker matches words and links. It cannot read context, so a lawn-care text about weeds will flag, and it does not look for hate speech at all.
3 to fix
- Fix
The brand name is missing
Reviewers expect each message to say who is texting; Bandwidth rejects samples without the brand name.
CTIA § 5.1.1Bandwidth 8101
- Fix
No opt-out instruction
CTIA asks senders to state in the message how to opt out; Twilio requires it in the first message and Bandwidth wants it in at least one sample. Add “Reply STOP to opt out.”
CTIA § 5.1.3Bandwidth 8100
- Fix
Public link shortener
Matched: bit.ly/hd-white
CTIA wants a shortener dedicated to your business; Bandwidth rejects public shorteners in samples and replies. Use your full link or a branded short domain.
CTIA § 5.3.2Bandwidth 6106–6108, 8201
- Check
Contains a phone number
Matched: (555) 010-0199
Mark the campaign as sending embedded phone numbers. A number that forwards to an unpublished line needs its owner named in the text.
CTIA § 5.3.3Twilio has_embedded_phone
- Check
Reads as marketing
Matched: % off
A promotion needs express written consent and a campaign registered with a marketing use case; one coupon can make a reminder promotional.
CTIA § 5.1, Exhibit IIBandwidth 2101, 8200
Rules read 2026-10-22 from CTIA, Bandwidth and Twilio
Consent records to keep
§ 5.1.2 lists what to keep for each opt-in “where applicable”. It is the most detailed record list in the texting rules, and it doubles as the evidence a TCPA claim turns on.
Then keep the other half. “Message Senders should retain and maintain all opt-in and opt-out requests in their records to ensure that future messages are not attempted (in the case of an opt-out request) and Consumer consent is honored”, and process carrier deactivation files “regularly (e.g., daily)”, removing disconnected numbers. On short codes the Handbook sets a floor: keep opt-ins and opt-outs until “a minimum of six months after the Consumer has opted out”, and process deactivated numbers “within three business days of receipt.” Twilio's policy asks for proof of consent “at least until a recipient withdraws their consent” and on request.
How CTIA maps to your 10DLC campaign
10DLC registration is where the Principles turn into form fields. Twilio's campaign form asks for each item below, and Bandwidth publishes the rejection code that fires when one falls short, so a campaign written to CTIA passes on the first try more often than one written to the form alone.
| Campaign field (Twilio) | CTIA section | What to put in it | Bandwidth codes if it fails |
|---|---|---|---|
| message_flow | § 5.1.1 call-to-action, § 5.1.2 opt-in | Where and how people sign up, with the full disclosure wording and a link to the form | 2100–2142 (no opt-in, missing brand, frequency, rates, HELP or STOP) |
| message_samples | § 5.3 content, § 5.1.3 opt-out wording | Real examples: brand name in each, STOP in at least one, any link or number you will send | 8100, 8101, 8201, 4100 |
| has_embedded_links, has_embedded_phone | § 5.3.2 links, § 5.3.3 numbers | Tick them if any text will carry a link or number, and show one in the samples | 3105, 3109 |
| opt_in_message | § 5.1.2.1 confirmation | Brand, enrollment, how to get help, how to opt out, frequency and rates | 5104–5108 |
| opt_out_message, help_message | § 5.1.3 opt-out, Handbook § 3.4 HELP | One final confirmation with the brand; a HELP reply with a phone, email or site | 5100–5103, 5109, 5110 |
| Privacy policy link | § 5.2.1 privacy policy from the call-to-action | A public policy saying opt-in data is not shared | 7100–7103 |
Field limits, the brand side and the order to file in are in the 10DLC registration checklist; how the registry itself works is in what is 10DLC. The privacy line can be drafted with the SMS privacy policy generator.
CTIA vs the TCPA, rule by rule
The two overlap on consent and part ways almost everywhere else. CTIA is stricter on what a text says and what a sign-up shows; the law is stricter on revocation and is the only one that pays damages.
| Rule | CTIA says | The law says | Who enforces |
|---|---|---|---|
| Marketing texts | Express written consent, “regardless of whether these rules apply” | Prior express written consent for marketing sent with an autodialer or prerecorded voice (§ 64.1200(f)(9)) | Provider vetting; courts for the law |
| Reminders and alerts | Express consent for that specific purpose | Prior express consent when sent with an autodialer (§ 64.1200(a)(1)); the written form is for marketing | Provider vetting; courts |
| Opt-in confirmation | One text with program, help, opt-out, frequency, fees (§ 5.1.2.1) | No such rule | Provider vetting only |
| Opting out | STOP plus plain words; one final confirmation per campaign | Any reasonable method; seven reply words count on their own; honoured within 10 business days; one confirmation, presumed fine within 5 minutes | Providers; FCC and courts |
| Quiet hours | Not covered | Solicitations only between 8 a.m. and 9 p.m., recipient's time (§ 64.1200(c)(1)) | Courts |
| Content | SHAFT, age gates, links, numbers, no rented lists | Not covered by the TCPA (other laws apply to the product itself) | Carriers and providers |
| Records | Seven opt-in data points; keep opt-ins and opt-outs | No retention period, but the seller bears the burden of proving consent (FCC 12-21) | You, when challenged |
| If you break it | Rejection, filtering, suspension, carrier fees | $500 per call or text, up to $1,500 if willful or knowing | — |
Passing one does not pass the other. An approved campaign proves nothing about a given customer's consent, and a perfect consent record will not get a vape promotion past a carrier. The law side in full is in TCPA rules for text messages, and the written-consent wording in prior express written consent.
Questions owners ask
Are the CTIA messaging guidelines law?
No. CTIA calls its Messaging Principles and Best Practices "a set of voluntary best practices", and the document says it does not "impose, prescribe, or require" anything on carriers or providers. They bite anyway because providers write them into their own terms: Twilio's Messaging Policy points to the CTIA principles, and carriers reject, filter or suspend traffic that ignores them. The law on business texts is the TCPA and the FCC's rules under it.
What is the latest version of the CTIA guidelines?
The Messaging Principles and Best Practices dated May 2023, which replaced the 2019 edition, and the Short Code Monitoring Handbook version 1.9, effective August 2, 2023. On 2026-10-22 CTIA's own page still linked the May 2023 PDF as the current version, and the short code administrator's site linked handbook v1.9. We found no later edition of either.
What does SHAFT stand for in texting?
Sex, hate, alcohol, firearms and tobacco. CTIA's short code handbook defines SHAFT content as content that "contains or promotes" those five things, requires age gates for controlled substances and adult content, and treats federally illegal SHAFT content, or legal SHAFT content without a working age gate, as a Severity 0 violation, its most serious level.
Can a cannabis or CBD business send text messages?
Not through most providers. CTIA's handbook does not name cannabis, but it bars endorsing illegal drugs or controlled substances, and providers go further: Twilio says cannabis, CBD, kratom and paraphernalia businesses may not use its SMS or MMS in the US and Canada at all, for any use case and regardless of state legality. Check your own provider's prohibited-content list before you build a texting program.
Do the CTIA rules apply to a small business texting from a local number?
Yes. The principles cover any business, organization or agent texting consumers from a 10-digit number, from "large-to-small businesses" to medical practices and nonprofits. A local number used from software also has to be registered for 10DLC, and the registration review reads your opt-in, sample messages and replies against these rules.
What happens if I break the CTIA guidelines?
CTIA itself fines no one. The consequences come from the providers and carriers: a 10DLC campaign rejected at vetting, messages filtered or blocked, a suspended campaign or number, and pass-through fees. Twilio lists T-Mobile fees of up to $10,000 per content violation after a warning, and $1,000 for evasion such as snowshoeing. On short codes CTIA audits weekly and can suspend a code in the registry.
Sources
- CTIA, Messaging Principles and Best Practices (May 2023)fetched 2026-10-22
- CTIA, Short Code Monitoring Handbook v1.9 (effective 2023-08-02)fetched 2026-10-22
- CTIA: Messaging Principles and Best Practices page (links the current version)fetched 2026-10-22
- Common Short Code Administration: US Short Codes (links Handbook v1.9)fetched 2026-10-22
- Bandwidth: Vetting rejection reasons (page dated 2026-09-18)fetched 2026-10-22
- Twilio Messaging Policy (last updated 2026-04-13)fetched 2026-10-22
- Twilio: Regulatory guidelines for SMS, United States (T-Mobile non-compliance fees)fetched 2026-10-22
- Twilio: Forbidden message categories for SMS and MMS in the US and Canadafetched 2026-10-22
- Twilio: A2P 10DLC, gather the required business information (campaign fields)fetched 2026-10-22
- Twilio: Troubleshooting and rectifying Campaigns (suspensions)fetched 2026-10-22
- 47 U.S.C. § 227 (govinfo, 2023 edition)fetched 2026-10-22
- 47 CFR § 64.1200 (eCFR, current as of 2026-10-20)fetched 2026-10-22
- FCC 12-21, Report and Order (Feb. 15, 2012)fetched 2026-10-22