# US A2P SMS compliance in 2026: 10DLC registration and the TCPA, explained

> Two separate systems govern US A2P SMS and they are constantly confused. 10DLC is carrier registration and decides whether your traffic is delivered. The TCPA is federal law and decides whether sending it was lawful at all.

- Canonical URL: https://www.broadnet.me/blog/us-10dlc-tcpa-compliance-a2p-sms-2026
- Language: en
- Last updated: 2026-09-10
- Publisher: BroadNet (https://www.broadnet.me)

- Published: 2026-09-10
- Author: BroadNet Compliance

Almost every US messaging problem we are asked to diagnose turns out to be a confusion between two different systems. 10DLC is a carrier registration regime: it decides whether your messages get delivered and at what throughput. The TCPA is federal law: it decides whether sending them was lawful, and it carries statutory damages per message. You can be perfectly registered and still unlawful, and you can be perfectly lawful and still undelivered.

> Registration is a delivery question. Consent is a legal question. Passing one tells you nothing about the other.

## What 10DLC actually is

10DLC — ten-digit long code — is the framework US carriers use to permit application-to-person traffic over ordinary ten-digit numbers. Before it existed, A2P traffic on long codes was tolerated rather than sanctioned, and filtering was arbitrary. Registration made the arrangement explicit: identify the business, describe the use case, accept throughput assigned to that combination.

It runs in two layers. Brand registration identifies the legal entity behind the traffic and is vetted against public business records. Campaign registration describes a specific use case — one-time passcodes, appointment reminders, marketing — and each campaign is separately reviewed and separately rated for throughput. One brand, many campaigns, each with its own approval.

## Trust score, throughput and why your rate changed

Registered brands are scored, and that score drives the per-carrier message throughput assigned to campaigns underneath it. The inputs are the verifiability of the business details, the history of the traffic, and complaint and opt-out rates observed in the wild. It is not fixed: sustained complaints can lower it, and a clean record over time can raise it.

This is why a sender sometimes finds their throughput reduced without any change on their side. The score moved. The remedy is almost always the same — reduce complaints by tightening consent and honouring opt-outs faster, because those are the signals that produced the change.

## The TCPA, in the parts that matter to a sender

The Telephone Consumer Protection Act governs calls and texts to mobile numbers in the United States. For an A2P sender it sets three obligations that shape system design more than any registration form does.

1. Consent before sending, at a standard that depends on the message. Informational messages need prior express consent. Marketing needs prior express WRITTEN consent, which means a clear disclosure and an affirmative act — a pre-ticked box is not consent.
2. An opt-out that works immediately and permanently, honoured across every campaign the consumer would reasonably consider the same relationship.
3. A restriction on when you may send: no calls or texts to a consumer before 8am or after 9pm in the recipient's local time.

The last one deserves emphasis because it is where the largest number of otherwise careful senders trip. The time that matters is the recipient's local time, not the sender's, and not the time in the office that scheduled the campaign. A national US campaign fired at 8:05am Eastern reaches Pacific recipients at 5:05am. That is a violation, at scale, with statutory damages attaching per message.

## Opt-out keywords are literal

STOP, UNSUBSCRIBE, CANCEL, END and QUIT must all be honoured. They are literal strings a subscriber texts back, and treating only STOP as valid is a common and expensive shortcut. The suppression must apply immediately, must persist, and must not be quietly reversed by a later re-import of a marketing list.

Two implementation details cause most of the failures we see. First, suppression scoped to a campaign rather than a relationship: a consumer who opts out of one programme and keeps receiving another from the same brand will complain, and complaints feed the score that governs your throughput. Second, race conditions in bulk sends — a queue built before the opt-out arrived that keeps draining afterwards. The suppression check belongs at send time, not at queue time.

## How the two regimes interact

| Question | 10DLC | TCPA |
|---|---|---|
| What is it | Carrier registration programme | Federal statute |
| Decides | Whether traffic is delivered, and how fast | Whether sending was lawful |
| Enforced by | Carriers and the registry | Regulators and private litigation |
| Consequence of failure | Filtering, reduced throughput, campaign suspension | Statutory damages per message |
| Fixed by | Accurate registration, lower complaint rate | Provable consent, working opt-out, correct hours |

## What good consent records look like

The practical test is whether you can reconstruct, for any individual number, what that person agreed to and when. That means storing the timestamp, the source, the exact disclosure text shown at the moment of opt-in, and the version of that text — because the wording will change over the life of a programme and the record needs to reflect what was actually presented.

A consent record that says only 'opted in: true' is not a record. It cannot be audited, and in a dispute it demonstrates nothing.

## Where senders most often get caught

- Quiet hours computed in the sender's timezone rather than the recipient's.
- Purchased or scraped lists, which cannot carry provable consent no matter how they are described.
- Opt-out honoured for one campaign but not for the brand relationship the consumer perceives.
- Marketing content sent under a campaign registered as transactional — a registration mismatch and a consent mismatch at once.
- A consent record with no disclosure text, making the standard of consent impossible to prove afterwards.
- Suppression applied when the queue is built rather than when the message is sent.

## Frequently asked questions

### Is 10DLC registration the same as TCPA compliance?

No, and conflating them is the most common mistake in US messaging. 10DLC is carrier registration that governs delivery and throughput. The TCPA is federal law governing consent, opt-out and timing. Registering a campaign does not make its content lawful, and holding good consent does not get unregistered traffic delivered.

### What are the TCPA quiet hours?

No calls or texts before 8am or after 9pm in the recipient's local time. The recipient's timezone is what counts, which for a national campaign means the send window is bounded by the earliest and latest zones you are sending into — not by the hours of the team running the campaign.

### Which opt-out keywords must I honour?

STOP, UNSUBSCRIBE, CANCEL, END and QUIT at minimum. They are literal words the subscriber texts. Suppression should be immediate, durable, and scoped to the relationship the consumer would recognise rather than to a single campaign identifier.

### Does an area code tell me the recipient's timezone?

Not reliably. US numbers are portable and people move without changing them, so an area code is a hint rather than a fact. Where the risk matters, use the timezone you hold from the customer relationship, and where you have none, choose a send window that is safe across the continental zones.

### What is a 10DLC trust score and why did my throughput drop?

It is a rating of the registered brand that drives per-carrier throughput for its campaigns. It reflects how verifiable the business details are and how the traffic behaves — particularly complaint and opt-out rates. It moves over time, which is why throughput can change with no configuration change on your side.

### Does the TCPA apply to one-time passcodes?

A passcode a user has just requested is the clearest case of a message the recipient asked for, and the consent standard for informational messages is lower than for marketing. That does not exempt it from the rest of the framework: it still needs registration to be delivered reliably, and the number still must not be used to send marketing on the strength of a login.

### How long should consent records be kept?

For as long as you are sending, plus the period in which a claim could be brought — which in practice means years rather than months. The record must include when consent was given, through what channel, and the exact disclosure text presented at the time.

## Getting it right

Treat registration and lawfulness as two separate programmes with two separate owners. Register accurately and keep campaign descriptions matched to what you actually send. Capture consent you could show a regulator, suppress at send time rather than queue time, and compute quiet hours in the recipient's timezone. Do those four things and the rest of US messaging compliance is mostly bookkeeping.

Related reading: [what TCPA compliance means for SMS](https://www.broadnet.me/answers/what-is-tcpa-compliance), [SMS quiet hours by market](https://www.broadnet.me/answers/what-are-sms-quiet-hours), and our [A2P consent and opt-in guide](https://www.broadnet.me/blog/a2p-sms-consent-optin-compliance-guide).