CTIA Rules, 10DLC, and Short Codes: How They Shape a TCPA Defense

The wireless industry describes its own texting rulebook as “a set of voluntary best practices,” and that phrase is the place to start. The CTIA Messaging Principles and Best Practices, 10DLC campaign registration, and short code audits set the terms carriers expect before they’ll carry business texts. They aren’t the Telephone Consumer Protection Act, and a consumer can’t sue under them. But the records they make a business keep are often its strongest evidence when a TCPA claim arrives.

What do CTIA’s messaging principles ask a business to do?

Get consent before texting, make opting out easy, and keep proof of both.

CTIA is the wireless industry’s trade association. Its current principles are dated May 2023, and they say that “This version of the Principles and Best Practices replaces the 2019 CTIA Messaging Principles and Best Practices” in the document itself.

CTIA expects consent in three tiers. A reply to a customer who texted first needs no further permission (CTIA calls it implied consent), as long as the business only answers with relevant information. An informational text, such as an appointment reminder, calls for express consent, which can be oral. A promotional text calls for express written consent, such as a checked box on a form. The principles apply those expectations “Regardless of whether these rules apply,” meaning the TCPA and the FCC’s rules, in section 5.1. That matters, because the TCPA’s consent requirement in § 227(b) reaches texts mainly when an autodialer sends them, and after Duguid, many platforms that text only stored lists may not qualify as autodialers. The Do Not Call rules still apply to marketing texts either way. For more on that, see our post on autodialer defenses after Duguid.

The rest is mechanics. The sign-up language should describe the program and explain how to opt out, and recurring programs should confirm enrollment by text. On opt-outs, the principles say “Message Senders should acknowledge and honor all Consumer opt-out requests by sending one final opt-out confirmation message per campaign to notify the Consumer that they have opted-out successfully,” per section 5.1.3. Senders should read plain-language replies like “end” or “unsubscribe” as opt-outs, too, except where a particular word could trigger an accidental opt-out.

Two more rules hit lead buyers hardest. The principles say “Message Senders should not use opt-in lists that have been rented, sold, or shared to send messages,” and “A Consumer opt-in to receive messages should not be transferable or assignable,” in sections 5.1.4 and 5.1.2.2.

What are 10DLC registration and The Campaign Registry?

10DLC means business texting from an ordinary 10-digit long code, the kind of number a person has. Those campaigns go through a registry before they’re allowed to send.

The registry is run by The Campaign Registry, known as TCR. Its site describes the channel this way: “Sanctioned 10DLC is an A2P messaging channel in which Brands and Campaign Service Providers (CSPs) are verified prior to being allowed to send messages,” on TCR’s home page. A2P means application-to-person, or business texting. A business doesn’t register itself. The same page says, “Currently, direct registration with TCR is not available for Brands.” Your texting platform, the campaign service provider, registers your brand and each campaign for you. According to TCR’s about page, the registry offers “transparency into messaging origins and content.” In plain terms, the carriers learn who you are and what you said you’d send.

Short codes, the five- or six-digit numbers used for high-volume programs, have their own system. The principles explain that “the Common Short Code Administration (CSCA) operates the cross-carrier short code registry” in section 5.5.4, and that CTIA’s separate handbook offers guidelines for short code programs. That Short Code Monitoring Program Handbook, version 1.9, effective August 2, 2023, adds live monitoring: “CTIA issues compliance audits weekly for Short Codes leased with the CSCA.”

Can someone sue a business for breaking carrier texting rules?

Not under the TCPA. Carrier rules are contract terms and industry guidance, not law. A consumer has no claim for breaking them, though carriers and platforms can enforce their own contracts.

The TCPA’s private claims are written narrowly. A person may sue over “a violation of this subsection or the regulations prescribed under this subsection,” under 47 U.S.C. § 227(b)(3), and the Do Not Call claim in § 227(c)(5) likewise runs to violations of “the regulations prescribed under this subsection.” CTIA’s principles are neither. They say they “do not impose, prescribe, or require contractual or technical implementation on messaging ecosystem stakeholders,” in section 2.3. The handbook says “Each Wireless Provider makes the ultimate decision about its own Short Code Program requirements, which may differ from the Guidelines,” in its introduction. The penalty for breaking them is commercial: filtering, suspension, or losing the number.

The FCC hasn’t made the industry’s rules its own, either. When it first required carriers to block certain texts in 2023, it noted the industry’s principles and said, “The rules we adopt here are not inconsistent with the measures that the industry has taken already,” in footnote 80 of FCC 23-21. Not inconsistent with the rules isn’t the same as being the rules.

Carrier rules and the TCPA still overlap. What carriers police, like texting without consent or ignoring STOP, is often a TCPA violation too. The National Do Not Call Registry is the federal list of numbers whose owners don’t want telemarketing, and the FCC said in FCC 23-107 that “we codify that the National DNC Registry’s protections apply to text messages.” A plaintiff doesn’t need a CTIA claim when the same facts support a TCPA claim.

Carrier rules can also ask for more than the law does. In January 2025, the Eleventh Circuit vacated the FCC’s one-to-one consent rule, which would have limited each consent to a single seller, holding that “the FCC exceeded its statutory authority under the TCPA” in Insurance Marketing Coalition Ltd. v. FCC. CTIA’s bar on transferable opt-ins wasn’t part of that case. A lead buyer can win the legal argument and still lose the carrier’s approval.

How do carrier compliance records help a TCPA defense?

They’re usually the proof of consent and opt-out handling that the business has to produce anyway.

Consent is the defendant’s burden. The Ninth Circuit held that “Express consent is not an element of a plaintiff’s prima facie case but is an affirmative defense,” one the defendant must prove, in Van Patten v. Vertical Fitness Group, LLC (2017). The same opinion says “the transactional context matters in determining the scope of a consumer’s consent to contact,” so what the customer was told at sign-up matters as much as the checkbox.

CTIA asks senders to keep almost exactly that. Section 5.1.2 of the principles lists, where applicable, the timestamp of consent, how it was collected, a capture of the sign-up language, the campaign, the IP address, the phone number, and the identity of the person who agreed. I’d treat that list as the minimum evidence file for every number you text, whether or not a carrier ever asks for it.

Opt-out records matter more since April 11, 2025, when the FCC’s revocation rules took effect. They cover autodialed texts and marketing texts to numbers on the Do Not Call Registry. Under 47 C.F.R. § 64.1200(a)(10), a consumer may revoke consent “by using any reasonable method to clearly express a desire not to receive further calls or text messages from the caller or sender.” For other wording, a sender “must treat that reply text as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent,” and revocations “must be honored within a reasonable time not to exceed ten business days from receipt of such request,” under the same paragraph. One piece, applying a revocation to unrelated message streams, was delayed “until April 11, 2026” by DA 25-312. When the FCC adopted these rules, it confirmed that reply-text opt-out isn’t itself mandated but cited the CTIA principles for the point that a reply text is “a reasonable and widely recognized means for text recipients to revoke prior consent to text messages,” in paragraph 14 and footnote 29 of FCC 24-24. Platform logs showing each STOP and its timing answer a revocation claim.

Confirmation texts need care. Under § 64.1200(a)(12), a confirmation with no marketing is allowed only if it’s the one additional message sent after the request, and “If the confirmation text is sent within five minutes of receipt, it will be presumed to fall within the consumer’s prior express consent.” CTIA asks for one confirmation per campaign, so a sender running several campaigns should send a single confirmation to stay inside the rule. The platform’s timestamp is the proof.

Compliance records also bear on liability and on how big a claim gets. A Do Not Call defendant has a defense if it “has established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations in violation of the regulations prescribed under this subsection,” under § 227(c)(5). And the statute lets a court raise damages up to three times only if the violation was willful or knowing. In my view, a documented carrier compliance program, with registrations, audits passed, and opt-outs honored, can be useful evidence against a willfulness finding. It won’t cure a bad consent record, but it changes how a judge sees the company.

For the separate recordkeeping rules the FTC imposes on telemarketers, see our post on the Telemarketing Sales Rule.

How can a carrier audit or block preview a plaintiff’s case?

A carrier’s complaint about your texts usually names the same defect a plaintiff’s lawyer would plead.

CTIA designs its short code audits to see what consumers see. The handbook says that “compliance audits reflect the user experience that actual Consumers encounter when they interact with Short Code Programs in market,” in section 4.1. Under sections 1.2 and 4.2 of the same handbook, each audit notice identifies the violation and gives a cure date. The principles add that “Service Providers may block or filter message traffic to protect Consumers, their networks, and the messaging ecosystem from Unwanted Messages,” in section 7.2.3.

So an audit finding that the sign-up page hid its terms, or that STOP didn’t work, is a free preview of a consent or revocation claim. The campaign registration itself can be used against you, too. If a campaign was registered as account notifications and later carried promotions, I’d expect a plaintiff to use the registration to argue the business knew the difference between informational and marketing texts. That’s a willfulness argument, not just a consent argument.

I’d handle a carrier audit notice, suspension, or block like a demand letter. Preserve the notice and the messages it covers, fix the problem and document the fix, and bring in counsel early, because the business’s correspondence with carriers and aggregators isn’t likely to be privileged. A quick cure on the record helps. A string of ignored notices before a lawsuit hurts.

Carrier rules and TCPA claims side by side

What to pull together when a texting claim or carrier notice arrives

1. Put a litigation hold on platform send logs, message content, and the consent records for every number involved, including sign-up page captures.
2. Export every opt-out and STOP reply with its receipt date, the confirmation text, and the date the number was suppressed.
3. Pull the Do Not Call Registry scrub records and the registry version dates used for any marketing campaign.
4. Collect the 10DLC brand and campaign registrations, short code program briefs, carrier audit notices, and the vendor contracts and message templates.
5. Talk to a lawyer before answering a demand letter, contacting the person who complained, or offering anything to settle.

For claims involving marketing texts and opt-out handling, the firm’s California TCPA defense page sets out what the defense looks at first.

Questions businesses ask about carrier texting rules and the TCPA

Does 10DLC registration prove we had consent?

No. Registration tells the carriers who you are and what you plan to send, but it isn’t proof that any one person agreed to receive texts. Consent is proved number by number, with the sign-up record, the language shown, and the date. A registration that matches how the campaign actually ran helps your credibility. One that doesn’t match can hurt it.

Is a short code safer than a 10-digit number for TCPA purposes?

Not legally. The TCPA doesn’t care what kind of number sends the text. Short codes come with upfront vetting and weekly CTIA audits, which can catch problems earlier. The tradeoff is that audit history becomes part of the record, so an unresolved audit finding can show a business knew about a defect before the lawsuit.

Do we have to honor “please stop texting me,” or only STOP?

Both, for autodialed texts and marketing texts to numbers on the Do Not Call Registry. Since April 11, 2025, the FCC’s rule treats a reply in other words as a revocation if a reasonable person would read it that way, and a sender can’t make one method the only way to opt out. CTIA’s principles say the same thing about normal-language replies. I’d set the platform to route any reply that isn’t a plain question to a person for review.

Defending text-message claims

If your company is accused of texting without consent or after a STOP reply, the platform logs and the consent records you kept for the carriers usually decide the case. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving marketing texts and opt-out handling. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on June 1, 2025.

The FCC materials are FCC 23-21 (Mar. 17, 2023), FCC 23-107 (Dec. 18, 2023), FCC 24-24 (Feb. 16, 2024), and DA 25-312 (Apr. 7, 2025).

The industry materials are CTIA’s Messaging Principles and Best Practices (May 2023), CTIA’s Short Code Monitoring Program Handbook (version 1.9, effective Aug. 2, 2023), and The Campaign Registry’s home page and about page.

The court decisions are Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017), and Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025).

This post is general information about the Telephone Consumer Protection Act and related laws as of June 1, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.