SMS compliance basics: TCPA and A2P 10DLC

Two different jobs get mashed together under 'texting.' Replying to someone who just called, filled out a form, or DM'd you is one job. Sending a promo, a flash sale, or a 'we miss you' blast is another. The first is how you book the consult. The second is regulated marketing. Mixing them up is how a useful tool becomes a complaint.

Marketing texts need written consent

If the text is an ad, get prior express written consent before you send it. That means a clear, unchecked box or a keyword they text on purpose, naming your spa, saying you will send marketing texts, and saying they can opt out. Consent for a Botox reminder is not consent for a laser sale next month if you wrote it that narrowly. Write what you will actually send.

The FCC's tighter 'one-to-one consent' rule did not stick. In July 2025 the Commission removed the version of the rule a court had nullified and put the prior written-consent definition back. You still need written consent for marketing autodialed or prerecorded calls and texts. You do not get to skip consent because a headline said the new rule died. Read the FCC's consumer-policy note and have counsel confirm what applies to your campaign.

Replying is not a campaign

• Someone submits a lead form or misses a call: a single informational reply about that inquiry is the response. Keep it about the thing they asked.
• Do not bolt a promo onto that first text. 'We got your Botox question, and also 20% off filler this weekend' is how a reply becomes an ad.
• If they reply STOP, or 'unsubscribe,' or 'leave me alone,' you stop. All of it. Don't argue and don't wait for the next business day.
• Federal quiet hours for telemarketing are generally 8 a.m. to 9 p.m. in the recipient's time zone. Some states are tighter. Campaigns go inside that window. A reply to a message they just sent is a different posture. When you are unsure, wait until morning.

AI voices are still 'artificial voices'

In February 2024 the FCC confirmed that AI technologies that generate a human voice count as an artificial voice under the TCPA. Outbound calls that use that voice need the same consent as a prerecorded call, unless an exception applies. Answering your own inbound line is not the same thing as dialing a list with an AI. Do not let a vendor turn on outbound AI calling to old leads because the demo was impressive. No outbound AI voice without the consent the rule describes.

A2P 10DLC, in plain language

US carriers require businesses texting from local 10-digit numbers to register a brand and a campaign. This is called A2P 10DLC. Unregistered traffic gets filtered or blocked, which looks like 'the texts randomly stopped' and is actually the carrier. Register before you turn marketing texts on. Voice can go live while you wait. Approval is often a week or two and is not something you can rush the day of a sale.

• Register the spa, not your agency's brand, if the spa is the sender patients will recognize.
• The sample messages in the registration should match what you really send. A campaign registered as 'appointment reminders' that then sends promo blasts is how you get suspended.
• Twilio's A2P quickstart is the clearest public walkthrough of the steps. The fees are on Twilio's fee pages and they change. Don't budget from a number you saw in a group chat. Confirm the current brand, vetting, and monthly campaign fees before you file.
• Ignitara and some other front-desk vendors say they file this for you. That is worth money if your team will not do paperwork. You still need the legal name, EIN, and website to match.

A minimum you can hand the front desk

• Every marketing text identifies the spa.
• Every marketing text tells them how to stop (STOP is the one carriers expect).
• New promo campaigns wait until the 10DLC campaign is approved.
• Clinical questions and anything that sounds like a complication leave the automation and go to a person.
• You keep the consent record: when they opted in, what they were shown, and which number.