10DLC approval kit: the disclosures, messages and policies carriers look for.

This kit is not legal advice. It shows the wording that Twilio and the wireless industry's published guidelines ask for, with the source for each requirement listed at the end of the page. Following it does not make a texting program legal on its own. Have a lawyer review your sign-up form, privacy policy and terms, especially if you work in a regulated field such as healthcare, lending or politics.

What the carriers review

10DLC is the carriers' registration system for business texting from a standard 10-digit phone number. A registration has two parts: the brand, which is your business, and the campaign, which describes what you will send and how people agree to receive it. A business cannot register with The Campaign Registry directly. A messaging provider files both parts for it, and CampaignCNX+ files them through Twilio.

Twilio's documentation lists what the campaign part must contain:

Twilio announced that new campaigns registered through its API from June 30, 2026 must include links to both a privacy policy and terms, and that campaigns without them are rejected at review. The sections below cover each item in the order you will need it.

Message and data rates may apply: what it means and where it goes

"Message and data rates may apply" tells a person that their own mobile carrier may charge them for the texts, under the terms of their phone plan. It does not mean that your business charges for the messages, and it is not a warning that something is wrong.

The wireless industry's guidelines ask senders to tell people about "any associated fees or charges" when they sign up and again in the message that confirms they have joined. Twilio's guidance names the phrase itself. Put it in four places:

• Next to the sign-up box on your website or paper form, as part of the disclosure people read before they agree.
• In the opt-in confirmation, the first text a new subscriber receives.
• In your texting terms and in the texting section of your privacy policy.
• In the reply to HELP. CampaignCNX+'s automatic HELP reply already includes it.

In a text message, where space is short, it is often shortened to "Msg&data rates may apply", the form CampaignCNX+'s HELP reply uses. On a web page, write it out in full.

SMS opt-in message examples

An opt-in has three pieces of wording: the disclosure people see where they sign up, the description of that sign-up you give the carriers, and the confirmation text a new subscriber receives. All three should say the same thing about who is texting, how often, and how to stop.

The sign-up form

The wireless industry's guidelines say the sign-up should make clear what the program is, which number the texts come from, who is sending them, any fees, and how to get help and opt out, with links to your terms and privacy policy. Twilio adds that the consent checkbox must not be checked in advance. The federal definition of written consent for marketing messages also calls for the disclosure to say that agreeing is not a condition of buying anything.

Change the frequency to match what you will really send. If the number of messages varies from month to month, say "Msg frequency varies" instead.

The message flow you give the carriers

The registration asks you to describe every way people opt in, with the address of the page where they do it. Reviewers visit the page, so the form has to be live and public when you file. If people can join in more than one way, describe each one.

Opt-in confirmation messages

The confirmation is the first text a new subscriber receives. Twilio asks that it include your business name, confirm that the person has joined a recurring program, and say how to get help and how to opt out. Add the frequency and the rates disclosure as well. Four examples:

If people join by texting a keyword such as JOIN, the confirmation is the automatic reply to that keyword. On CampaignCNX+, keyword replies are part of the keywords add-on.

Sample messages for the registration

The registration needs at least two sample messages. Twilio asks that they match what you will really send, name your business, and show any part that changes from person to person in square brackets.

Opt-out message examples

Opt-out wording appears in two places: the line in your messages that tells people how to stop, and the reply sent when they do. The wireless industry's guidelines say a sender should send one final message confirming the opt-out and nothing after it, and should honor plain-language requests such as "please opt me out", not only the word STOP.

The opt-out line in your messages

The CampaignCNX+ composer checks every campaign for an opt-out line before it can be sent. Any of these works:

• Reply STOP to opt out
• Reply STOP to unsubscribe
• Txt STOP to cancel
• STOP to end

Opt-out confirmation messages

Twilio asks that the reply to STOP acknowledge the request and confirm that no further messages will be sent, and recommends that it name your business. The first example is the reply CampaignCNX+ sends when you have not filed your own.

Help messages

The reply to HELP should name your business and say how to reach a person. The first example follows the reply CampaignCNX+ sends when you have not filed your own.

What CampaignCNX+ does with the replies

• Opt-out words. STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT and REVOKE opt a contact out, in any capitals and with punctuation around them. So does a short reply of five words or fewer that contains one, such as "please stop".
• HELP is not an opt-out. HELP and INFO get the help reply, and the contact stays subscribed.
• Opting back in. START and UNSTOP subscribe a contact again. YES does too, for a contact who has opted out.
• Your filed wording wins. Once your registration is filed, the replies to HELP and STOP use the messages you filed with it, because carriers compare what you send with what you registered.
• Every send checks the list. A contact who opted out is left out of every later campaign, scheduled message and drip message.

SMS privacy policy template

You do not need a separate privacy policy for texting. Add a texting section to the privacy policy you already have, and make sure the page can be opened by anyone without signing in. Twilio's guidance asks that the policy:

• say that mobile information will not be shared with third parties or affiliates for marketing or promotional purposes;
• give the message frequency and the "message and data rates may apply" disclosure;
• contain nothing elsewhere that says phone numbers or consent may be sold, rented or shared with other companies.

Twilio lists the last point among the causes of rejection. A general sentence such as "we may share your information with our partners" can contradict the texting section, so read the whole policy, not only the part you add.

SMS terms and conditions template

Your texting terms can be their own page or a section of your existing terms. Following the industry's guidelines, they should describe the program, say how often you send, include the rates disclosure, explain how to opt out and how to get help, give a way to reach your business, and link to your privacy policy.

Link the terms from the sign-up form, and give the same address in the message flow when you register. If you change the frequency or the kind of messages you send later, update the terms, the sign-up form and the registration together.

Before you file

1. Publish the privacy policy section and the texting terms, and check that both open without signing in.
2. Put the sign-up form live, with the box unchecked and the disclosure beside it.
3. Write the message flow, naming every way people join and the address of each sign-up page.
4. Write two or more sample messages that match what you will really send.
5. Write the opt-in, opt-out and help replies, each between 20 and 320 characters.
6. Check that the business name, frequency and rates wording are the same everywhere.

For the legal side of texting, including consent records and quiet hours, see TCPA compliant texting. For what 10DLC registration is and how it compares with toll-free numbers, see 10DLC registration explained.

Sources

Each requirement on this page comes from one of these, read on October 16 and 17, 2026.

• CTIA, Messaging Principles and Best Practices, May 2023, sections 5.1.1 to 5.1.4 and 5.2.1.
• Twilio, UsAppToPerson resource, the API reference for registering a 10DLC campaign.
• Twilio, Troubleshooting and rectifying A2P campaigns.
• Twilio, error 30909 (message flow or call to action incomplete) and error 30932 (privacy policy must not allow sharing).
• Twilio changelog, A2P 10DLC campaign registration will require privacy policy and terms and conditions URLs, April 6, 2026.
• Twilio, Improving your chances of A2P 10DLC registration approval, March 28, 2025.
• The Campaign Registry, on who registers brands and campaigns.
• 47 CFR 64.1200(f)(9), the federal definition of prior express written consent, at the Legal Information Institute.