SMS Compliance Checklist for Ecommerce Brands

SMS is the only owned channel where a mistake is a legal exposure rather than a performance problem. This is the checklist we run on a client account before we send anything, and again before peak season.

This is a practical operator checklist, not legal advice. Rules differ by state and change; have counsel review your programme before launch.

Consent

Every number in the programme should have a stored, timestamped consent record showing exactly what the subscriber saw when they opted in.

Consent should be express written consent for marketing, captured separately from email and separately from terms acceptance. There should be no pre-ticked boxes anywhere.

Consent must not be a condition of purchase, and the form should say so clearly.

Numbers collected for transactional purposes, such as shipping notifications, should not enter the marketing programme unless the subscriber opted in separately.

Do not use purchased, rented, or imported lists, and do not inherit numbers from an acquired brand without obtaining fresh consent.

The exact wording to use is covered in SMS opt-in examples.

Message Mechanics

Every message should identify the brand.

The first message after opt-in should confirm the subscription and state expected message frequency and how to stop receiving messages.

STOP, END, CANCEL, UNSUBSCRIBE, QUIT, and their common misspellings should all process an opt-out automatically. That opt-out should be honoured immediately and permanently until the subscriber actively re-opts in.

HELP should return the brand name and relevant contact details.

Opt-outs should also sync back to the platform holding the email profile, so someone who leaves SMS does not accidentally re-enter the programme through another integration.

Timing

Send messages inside local quiet-hour limits using the subscriber’s own time zone rather than your brand’s time zone.

Several US states apply stricter sending windows than the federal standard, which means a national campaign scheduled on one clock can create compliance problems in stricter jurisdictions.

Promotional sends should also be held on dates where state-specific rules impose tighter restrictions.

The safest approach is to build quiet-hour controls directly into the platform instead of relying on the person scheduling each send.

Registration and Infrastructure

The brand and each applicable campaign should be registered for 10DLC with carriers, with the declared use case matching the messages you actually send.

Toll-free numbers should be verified.

The number you send from should be the same number you publish to subscribers.

Link shortening should use a branded domain rather than a shared shortener. Shared shorteners can become a filtering signal, creating a deliverability problem even when the legal compliance position is otherwise sound.

Records and Audit

Consent records should be exportable at the individual profile level.

Opt-out records should be retained.

The SMS programme should have a named owner responsible for compliance and operational review.

Every message template currently in rotation should be reviewed against the checklist at least once per quarter, while every new template should be reviewed before it enters rotation.

Run the Audit Before Peak, Not During It

The pattern that creates problems is a brand that runs a clean programme for eleven months, then reaches November and suddenly adds a legacy list, increases frequency, and sends at the same hour to every subscriber in the country.

Attentive’s analysis of peak-week opt-outs found that 81% of subscribers who opted out had never made a purchase, while another 15% had purchased only once Attentive BFCM frequency guidance.

The people who leave are often the people the brand added without first earning enough engagement.

Volume across the SMS channel is also increasing, which raises the stakes. Klaviyo reported that its brands increased text send volume by 34% year over year while text revenue grew 25% Klaviyo BFCM report, 2 December 2025.

A programme that appears compliant at low volume can become much riskier at high volume simply because more of the wrong people have entered the send.

We run this audit on every SMS account we take over as part of our SMS marketing services.

If you are deciding which platform should run the programme, Attentive versus Postscript compares two of the most common options for DTC brands.