Text-to-Pay Compliance: TCPA, 10DLC Registration and the Consent You Need

Four rulebooks apply to one text

A payment-link text has to satisfy four separate authorities, and they care about different things:

The good news is that a payment-link text is transactional: it completes a transaction the customer already agreed to. Transactional messages have a lighter consent standard than marketing under the TCPA and are the most favored category under carrier rules. The bad news is that the lighter standard still requires consent, and that the line between transactional and marketing is easy to cross by adding one sentence.

The TCPA: what consent you need and when

The TCPA restricts calls and texts made to mobile numbers using an automatic telephone dialing system or an artificial or prerecorded voice without the called party's prior express consent. Almost every business texting platform sends messages through software, and although the Supreme Court narrowed the definition of an autodialer in 2021 (Facebook v. Duguid, holding that the system must use a random or sequential number generator), plaintiffs still litigate the question, several states define automated dialing more broadly, and the carriers require consent regardless. The practical rule for a business is to obtain consent for every mobile number you text, and to document it.

Two levels of consent

Under the FCC's rules, a message that contains any advertisement or telemarketing content is treated as marketing in its entirety.

For text-to-pay, the message must stay purely transactional to stay under the lighter standard. "Your invoice #1042 for $1,240.00 is ready. Pay here: link" is transactional. The same message with "and ask about our spring maintenance plan" on the end is marketing, and needs written consent it probably does not have.

Revocation

Consent can be withdrawn at any time, by any reasonable means. FCC rules effective in 2025 spell this out: a customer can revoke by replying with words such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE, or in any other message that a reasonable person would understand as a request to stop, and the business must honor the request within ten business days. Businesses may send one confirmation text after an opt-out, and it must not contain marketing. Since a payment text is transactional, a customer who opts out of texts has not cancelled their invoice, only the channel; the invoice moves to email or phone.

Timing

The TCPA's calling-hour restriction of 8 a.m. to 9 p.m. in the recipient's local time applies to telephone solicitations. Payment texts are not solicitations, but several state laws are broader (Florida restricts to 8 a.m. to 8 p.m.), carriers frown on late-night traffic, and a payment reminder at 11 p.m. is bad for approval rates anyway. Send between 9 a.m. and 8 p.m. local time and you never have to think about it.

Reassigned numbers

Mobile numbers are recycled. Consent belongs to the person who gave it, not the number, so texting a number that has since been reassigned is a violation even with a valid consent record. The FCC maintains a Reassigned Numbers Database; querying it before texting a number that has been silent for a long time gives a safe-harbor defense. For payment links, the practical control is not to text stored numbers that have not transacted recently without re-confirming.

Carrier registration: 10DLC, toll-free and short codes

Regardless of the law, the carriers decide whether your message is delivered. Since 2023 the three major US carriers block application-to-person (A2P) traffic from ordinary ten-digit long codes that is not registered. Registration goes through The Campaign Registry (TCR), usually via your messaging provider, in two steps.

1. Brand registration. Your legal business name, EIN, address, website and a contact. The registry verifies the business and assigns a trust score that determines your daily message limits and throughput. Sole proprietors have a separate, lower-volume path. A one-time fee of a few dollars applies, and optional vetting for a higher score costs more.
2. Campaign registration. A description of the use case, sample messages, how customers opt in, how they opt out, and how HELP is handled. The use case for text-to-pay is typically Account Notification or Customer Care; a business that also sends marketing registers a Mixed or Marketing campaign or, better, a separate one. Campaign vetting takes days, costs a small fee, and carries a monthly fee per campaign in the low single dollars, plus per-message carrier surcharges of a fraction of a cent.

What the reviewers look for, and what gets campaigns rejected:

• Opt-in description and evidence. A precise account of where the customer agrees to texts: the verbal script, the checkout checkbox, the form. Screenshots or the script text help. "Customers give us their number" is rejected.
• Sample messages that match the use case and include the business name. A payment-notification campaign with a sample that says "50% off this week" is rejected.
• A privacy policy and terms on your website that mention SMS, state that mobile information will not be shared with third parties for marketing, and describe opt-out. Reviewers check the URL.
• Opt-out and HELP language in the samples and in the flow.
• No public URL shorteners. Links through bit.ly and similar are a filtering signal. Use your own domain, or a branded short domain.

The alternatives to 10DLC are toll-free numbers, which have their own verification process, moderate throughput and no per-campaign fee, and short codes (five or six digits), which cost hundreds of dollars a month, take weeks to provision, and offer the highest throughput and the least filtering. Most businesses sending payment links are well served by a registered 10DLC number, which also lets customers reply and call.

The CTIA principles: what every campaign must do

The CTIA Messaging Principles and Best Practices are the standard the carriers and messaging platforms enforce contractually. They are short and specific:

• Consent before the first message, appropriate to the message type, with a clear description at the point of opt-in of what the customer will receive, how often, that message and data rates may apply, and how to opt out.
• Sender identification in the first message and periodically after: the business name.
• STOP handling. Recognize the standard keywords (STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) in any case, stop immediately, and send one confirmation.
• HELP handling. Reply to HELP with the business name, a contact method and how to opt out.
• Content restrictions. No content relating to sex, hate, alcohol, firearms or tobacco (the SHAFT categories) and nothing illegal, deceptive or that evades filtering. Cannabis, gambling and some lending are restricted or prohibited on 10DLC regardless of local legality.
• No snowshoeing. Spreading the same traffic over many numbers to evade limits.
• Message frequency matching what was disclosed.

For a payment-link program, all of this fits in the consent language and two automated replies. The section after next shows the text.

State laws to know about

Several states have passed their own telephone solicitation laws with broader definitions and their own damages. They target marketing, but the definitions can catch messages that combine a transaction with a pitch, and a few reach further.

As of the time of writing; state telemarketing law changes every year and you should check the states where your customers live.

The safe posture is the same everywhere: keep payment texts purely transactional, keep them inside 9 a.m. to 8 p.m. local time, keep the count low, and honor opt-outs instantly.

Consent language that satisfies all four

Consent for a transactional payment text needs to be knowing and specific. The customer must understand that they are agreeing to receive a text, from whom, about what, roughly how often, that carrier charges may apply, and how to stop. The three formats below cover the ways a customer typically gives a number to a business.

1. Verbal consent on a phone order

Read the same script every time and record the answer. This is the form FloPay uses in its own consent policy:

Record the customer's name, the mobile number, the agent, the date and time, and the fact of a yes. If the answer is no, take payment another way and send nothing.

2. A checkbox at online checkout or on an application form

An unchecked box, separate from the terms-of-service acceptance, next to the phone field:

Store the checkbox state, the timestamp, the IP address and the page version with the customer record.

3. Keyword opt-in

Where the customer initiates by texting a keyword (from a sign, an invoice, a website), the reply completes the disclosure:

If you also want to send marketing

Use a second, separate checkbox with prior-express-written-consent language: it must say marketing or promotional messages, name the business, say that automated technology may be used, and say that consent is not a condition of purchase. Register a separate campaign for it. Never bundle marketing consent into the transactional consent; it invalidates neither, but it invites the argument that the transactional consent was not knowing.

The messages themselves

With consent in hand, the messages have their own rules: identify yourself, say what the customer is paying, link to a hosted page, and never ask for card data in the text.

Three things to avoid in every message: public URL shorteners (filtered), all-capitals and exclamation marks (filtered and off-putting), and any request for card numbers, security codes or bank details in the text itself. Card data in an SMS is unencrypted in transit, stored on the customer's phone and your provider's logs, and puts your business in scope for the strictest PCI requirements. The link takes the customer to a hosted payment page where the card is entered, tokenized and never seen by you.

Records: what to keep and for how long

In a TCPA claim, the business must prove consent; the customer does not have to prove its absence. The statute of limitations is four years, so the record-keeping horizon is at least that long after the last message.

For every mobile number you text, keep:

• The consent event: date, time, method (verbal script, checkbox, keyword), who captured it, and the exact language shown or read, with a version identifier.
• For web consent, the IP address, user agent and page URL; for verbal, the agent and, if you record calls, the recording reference.
• Every message sent: timestamp, content, the number it went to, delivery status.
• Every inbound reply, especially anything that could be an opt-out, and the timestamp you processed it.
• The opt-out list itself, checked before every send, and never overwritten by a new consent unless the customer re-opts in explicitly.
• Your campaign registration, the samples you submitted, and the privacy policy and SMS terms as they stood when consent was given.

Most messaging platforms keep the message logs. The consent record is usually the business's responsibility, and it is the one that decides a case.

A launch checklist

1. Decide what you will send: payment links, reminders and receipts only, or marketing too. Register separate campaigns if both.
2. Write the consent language for each capture point (phone, web, form, keyword) using the templates above, and version it.
3. Update the website privacy policy and add SMS terms: message types, frequency, rates, opt-out, and a statement that mobile information is not shared with third parties for marketing.
4. Register the brand and campaign through your messaging provider. Have the consent screenshots and script ready for the reviewer.
5. Configure STOP and HELP auto-replies and confirm STOP writes to a suppression list checked before every send.
6. Set sending hours of 9 a.m. to 8 p.m. in the customer's local time (use the area code when you have nothing better), and a cap on reminders per invoice.
7. Use your own domain for payment links, pointing at a hosted, tokenized payment page.
8. Set the statement descriptor to the name customers know and put it in the receipt text.
9. Store consent records with the customer, and set a retention period of at least four years after the last message.
10. Test the whole path with your own phone: opt in, receive the link, pay, receive the receipt, reply STOP, confirm silence.

Where FloPay fits

FloPay's text to pay sends only transactional messages: payment links, reminders and receipts, with the business name, an opt-out instruction, and a link to a hosted checkout on which the card is tokenized. Consent is captured with the verbal script and the checkout checkbox published in the SMS consent policy, and recorded against the customer. STOP and HELP are handled automatically. Reminder timing and frequency are set per business in customer messaging. The rules in this guide are the reason the product is built the way it is.