Definitions

Short Code Laws and Compliance

Short answer: There is no single statute titled “Short Code Law.” US short code programs must still follow TCPA/FCC consent rules in 47 CFR § 64.1200, carrier/CSP acceptable use policies, and CTIA industry monitoring principles such as the Messaging Principles and Short Code Monitoring Handbook. Short codes are not registered through The Campaign Registry’s 10DLC Brand/Campaign model.

Short Codes vs 10DLC vs Toll-Free

Twilio notes toll-free and short codes are not part of the A2P 10DLC system (A2P overview). Choosing a short code does not remove TCPA duties.

The Legal Layer (TCPA / FCC)

Whether you send from a short code or 10DLC:

• Marketing/telemarketing texts using covered technologies generally need prior express written consent
• Consumers may revoke consent by reasonable methods including STOP-style replies recognized in § 64.1200
• State laws may add requirements

“Short code laws” questions are usually TCPA questions plus program-specific carrier rules.

The Industry / Monitoring Layer (CTIA)

CTIA documents are best practices / monitoring standards, not statutes, but they heavily influence whether programs stay approved:

• Clear, program-specific opt-in
• Confirmation messages identifying brand/program, frequency, help path, opt-out, and rates language when applicable
• Robust STOP and HELP handling
• Accurate, non-deceptive content
• Documented consent records

CSP explainers (for example Telnyx’s HELP/STOP summary) echo these norms. Read the current CTIA handbook version your provider cites—handbooks revise over time.

Commercial / Provisioning Layer

Short codes typically involve:

• Leasing a random or vanity code through aggregators/CSPs
• Provisioning timelines measured in weeks (ask your CSP for current estimates—do not rely on blog folklore)
• Ongoing lease fees higher than typical 10DLC number rents (get a quote; fees change)
• Program brief / sample flows reviewed before launch

This article intentionally omits invented fee tables and universal SLAs.

Compliance Program for Short Codes

1. Classify content — marketing vs informational templates
2. Design PEWC where marketing applies; keep audit trails
3. Implement keywords — STOP family + HELP with correct auto-replies
4. Single opt-in ≠ multi-program enrollment — CTIA materials caution against enrolling consumers into multiple programs from one opt-in without proper consent design
5. Monitor complaint and opt-out rates; remediate content quickly
6. Keep terms & privacy publicly reachable

If volume does not justify short code cost/complexity, evaluate 10DLC or toll-free instead—see comparison drafts and MyTCRPlus video on 10DLC vs toll-free.

Common Myths

• “Short codes are exempt from TCPA.” False.
• “Short codes skip consent because they’re approved.” Approval ≠ consent.
• “Vanity codes are legally safer.” Branding ≠ legal safe harbor.
• “Migrating to 10DLC removes CTIA expectations.” 10DLC still expects consent, STOP/HELP, and truthful samples.

When to Prefer Short Code vs 10DLC

Lean short code when brand needs a memorable code, very high volume, or CSP advises it for the use case.

Lean 10DLC when local identity matters, volumes are moderate, or you want Brand/Campaign flexibility across multiple programs.

Either path: soft-check disclosures and samples with tools such as MyTCRPlus before launch reviews—no guarantees.

Program Brief Essentials

When your CSP asks for a short-code program brief, include:

• Brand legal name and consumer-facing name
• Program description and message frequency
• Opt-in mechanisms with URLs/screenshots
• Opt-out and help flows with exact auto-replies
• Example messages (including link domains you will use)
• Customer care contact path
• Privacy policy and terms URLs

Inconsistent briefs vs live traffic are a primary monitoring failure mode. Update the brief when marketing calendars change—not only at lease renewal.

Transfer and Sunset

If you retire a short code:

• Stop outbound traffic
• Keep STOP/consent archives
• Communicate alternate channels to customers
• Follow CSP lease termination steps so the code is not reused against your brand unexpectedly

Document sunsets in your compliance calendar alongside 10DLC Campaign reviews.

Operating Model and RACI

Treat compliance as an operating system. Assign owners who remain accountable after launch:

When ownership is ambiguous, shadow IT sending tools appear and registered Campaigns drift from production copy. Reconfirm the RACI every quarter and after any CSP migration. Document escalation contacts for rejection codes and who may edit live templates during incidents.

Evidence Binder and Audit Readiness

Maintain a living binder with Brand submission payloads or console screenshots (secrets redacted); formation and EIN documents used during verification; dated archives of website, privacy policy, and SMS terms URLs; opt-in journey screenshots or recordings; Campaign description, message_flow, and versioned samples; CSP approval or rejection emails and reason codes; STOP and HELP response templates; and monthly exports of opt-out volume and complaint tags. These artifacts accelerate CSP remediations and support legal holds. Align retention with counsel because message logs are frequently discoverable. Index the binder by Campaign ID so on-call staff can find evidence in minutes.

Technical Controls Matrix

Engineering should treat Campaign-not-active as a hard failure, not a warning. Pair controls with runbooks that name the first three debugging steps for the most common CSP error codes.

Governance Cadence

Weekly: deliverability and error-code review; spot-check Brand identification and STOP language on random outbound messages. Monthly: consent QA for every new lead source; confirm privacy and SMS URLs still load without login. Quarterly: full Campaign-to-production alignment; refresh training; read the CSP 10DLC changelog end to end. Annually: reconfirm legal name, tax ID, and authorized representatives; renew vendor diligence. Publish a one-page leadership scorecard covering share of traffic on registered Campaigns, opt-out rate, open remediations, and time-to-suppress after STOP.

Vendor and ISV Diligence

If an agency, ATS, EHR, CRM, or ISV sends on your behalf, contract for your organization as Brand of record unless a deliberate reseller model applies; notice within an agreed window of Campaign rejection or suspension; shared dashboards or weekly status exports; STOP propagation into your system of record within minutes; prohibition on mixing unrelated customers onto your Campaign; and an annual security and compliance questionnaire. Many filtering events originate in reseller infrastructure. Diligence is cheaper than silent non-delivery during peak season. Keep a vendor inventory that lists every system capable of emitting SMS.

Legal Overlay (Not Legal Advice)

Registration and consent are related but distinct. An approved Campaign does not prove TCPA consent for a particular send; perfect consent records do not move unregistered traffic through carrier blocks. Coordinate with counsel on when prior express written consent is required, how revocation must be honored under 47 CFR section 64.1200 and related FCC guidance, which state mini-TCPA rules apply to your footprint, retention periods for consent artifacts, and vendor liability terms. Do not invent statutory penalty figures in training decks—cite primary sources and counsel memos instead. Revisit the overlay whenever marketing launches a new list source or message purpose.

Soft CTA

Prepare Brand packets, public SMS disclosures, and pre-submission diagnostics with MyTCRPlus tools at https://mytcrplus.com/tools/ and related microsite options. They help you organize evidence for your CSP—they do not guarantee approval, throughput, or legal compliance. Pair preparation with the step-by-step TCR registration guide at https://mytcrplus.com/how-to-register-with-tcr-the-complete-step-by-step-process-for-10dlc/ and troubleshooting pages for unregistered traffic blocks when deliverability collapses.

Change-Control Playbook

When templates, vendors, or CSP rules change: log the source URL and timestamp; classify impact across Brand, Campaign, consent UX, billing, and API; freeze related sends if resubmission is likely; assign one incident owner with a clear due date; notify support and marketing with non-speculative language; retest major US carriers after the fix; and write a short postmortem that updates the runbook. Controlled change beats reactive copy edits during an outage. Store playbook outcomes beside the evidence binder so audits show both prevention and response.

Launch and Scale Checklist

Do not skip the smoke test. A Campaign can show approved while a single MNO still has not provisioned the share, producing carrier-specific failures that look like random filtering to marketers.

Decision Framework Recap

1. Confirm you are sending US A2P over local 10DLC (vs toll-free or short code).
2. Map each template to marketing or operational purpose.
3. Assemble accurate Brand identity and public website evidence.
4. Write Campaign narratives and samples that match production truth.
5. Submit through your CSP and wait for Brand eligibility before Campaign create.
6. Attach numbers only after Campaign approval and provisioning.
7. Enforce STOP globally and monitor error codes.
8. Audit consent artifacts and sample drift on a fixed calendar.
9. Escalate CSP reason codes with evidence—not guesses.
10. Keep TCPA counsel in the loop for new message purposes.

This framework applies whether you run healthcare reminders, staffing shift fills, nonprofit fundraising, or retail promotions.

Operating Model and RACI (continued 10)

Treat compliance as an operating system. Assign owners who remain accountable after launch:

When ownership is ambiguous, shadow IT sending tools appear and registered Campaigns drift from production copy. Reconfirm the RACI every quarter and after any CSP migration. Document escalation contacts for rejection codes and who may edit live templates during incidents.

Evidence Binder and Audit Readiness (continued 11)

Maintain a living binder with Brand submission payloads or console screenshots (secrets redacted); formation and EIN documents used during verification; dated archives of website, privacy policy, and SMS terms URLs; opt-in journey screenshots or recordings; Campaign description, message_flow, and versioned samples; CSP approval or rejection emails and reason codes; STOP and HELP response templates; and monthly exports of opt-out volume and complaint tags. These artifacts accelerate CSP remediations and support legal holds. Align retention with counsel because message logs are frequently discoverable. Index the binder by Campaign ID so on-call staff can find evidence in minutes.

Technical Controls Matrix (continued 12)

Engineering should treat Campaign-not-active as a hard failure, not a warning. Pair controls with runbooks that name the first three debugging steps for the most common CSP error codes.

Governance Cadence (continued 13)

Weekly: deliverability and error-code review; spot-check Brand identification and STOP language on random outbound messages. Monthly: consent QA for every new lead source; confirm privacy and SMS URLs still load without login. Quarterly: full Campaign-to-production alignment; refresh training; read the CSP 10DLC changelog end to end. Annually: reconfirm legal name, tax ID, and authorized representatives; renew vendor diligence. Publish a one-page leadership scorecard covering share of traffic on registered Campaigns, opt-out rate, open remediations, and time-to-suppress after STOP.

Vendor and ISV Diligence (continued 14)

If an agency, ATS, EHR, CRM, or ISV sends on your behalf, contract for your organization as Brand of record unless a deliberate reseller model applies; notice within an agreed window of Campaign rejection or suspension; shared dashboards or weekly status exports; STOP propagation into your system of record within minutes; prohibition on mixing unrelated customers onto your Campaign; and an annual security and compliance questionnaire. Many filtering events originate in reseller infrastructure. Diligence is cheaper than silent non-delivery during peak season. Keep a vendor inventory that lists every system capable of emitting SMS.

FAQ

Are there specific “short code laws”?

No single dedicated federal “Short Code Act.” Compliance is TCPA/FCC + carrier/CTIA program rules + contracts.

Do short codes use TCR?

Not for the 10DLC Brand/Campaign registry model. Different provisioning path.

Is CTIA’s handbook binding law?

No—but ignoring it risks program suspension via monitoring/carrier action.

Can I use the same consent for short code and 10DLC?

Only if disclosures clearly authorize the channels/programs you actually use. Do not assume portability without review.

Key Takeaways

• Meet both carrier registration duties and consent/legal duties—neither replaces the other.
• Keep Brand identity, website evidence, Campaign samples, and production traffic aligned.
• Document who messages are for and how consumers opted in; honor STOP quickly.
• Use CSP reason codes and primary sources when remediating—not rumor threads.
• Avoid inventing fees, fines, or throughput guarantees in policies or marketing.
• Audit quarterly for consent drift, template drift, and vendor sprawl.
• Escalate legally sensitive launches to qualified counsel.
• MyTCRPlus tools can help organize evidence; they do not guarantee approval or delivery.

Disclaimer

This article is for informational purposes only and is not legal advice. CTIA handbooks, carrier rules, TCPA interpretations, and fees change. Confirm requirements with your CSP and qualified counsel.