What the CTIA Short Code Monitoring Handbook requires

Any company that texts people from a short code in the United States works under a set of rules that no statute wrote. CTIA, the trade association of the wireless carriers, publishes them as the Short Code Monitoring Handbook, and every carrier has reviewed and accepted what it says. The edition in force this spring is version 1.5.2, effective October 1, 2015. It covers standard-rate SMS, MMS and free-to-end-user programs. Programs that bill the phone account, such as premium subscriptions and text-to-donate campaigns, still answer to the older Handbook v1.3 and to CTIA’s separate donation guidelines.

The document is careful about its own limits. Following it does not make a program legal, since the Telephone Consumer Protection Act and the FCC’s rules apply regardless, and any carrier may add requirements of its own. CTIA also reserves the right to act against a program that harms consumers even when it meets every listed rule, because the handbook treats the spirit of its principles as binding too.

The four principles

Everything else grows out of four baseline rules. The advertisement has to tell people plainly what they are signing up for. Consent has to be real: typing a phone number into a form does not count as an opt-in by itself, because the person must understand that texts will follow and agree to receive them. A confirmation text goes out after every opt-in, and for ongoing programs that text includes the way out. Finally, every opt-out request is acknowledged and honored, and the monitoring team checks that it is.

Consent

Unsolicited messages may not travel over a short code at all. The handbook counts two kinds: anything sent without the account holder’s prior express consent, and anything sent after that person has opted out. The only exception is the single text confirming the opt-out.

A person can opt in through a web form, a button on a mobile page, a keyword texted to the code, a sign-up at a store counter or an automated phone call. Whatever the route, the call to action has to be accurate, and the opt-in terms cannot be buried in the fine print of some unrelated service. One consent covers one program. Enrolling someone in two programs off a single opt-in is banned even when both run on the same number.

Marketing texts carry an extra federal layer. Where a program counts as telemarketing under 47 C.F.R. § 64.1200, the consent must meet the FCC’s standard of prior express written consent. In practice that means telling the person clearly that they are authorizing marketing texts sent by an autodialer, and that agreeing is not a condition of buying anything. The older double opt-in, where the subscriber confirms by replying from the phone, remains an acceptable way to collect consent.

HELP and STOP

Every program must respond to the standard opt-out words: STOP, END, CANCEL, UNSUBSCRIBE and QUIT. Extra words, punctuation or capital letters around the keyword must not stop it from working, and it has to work whether it arrives as SMS or MMS. The program answers with one message confirming the opt-out, and after that nothing more may be sent. Providers are also expected to read their incoming message logs and cancel anyone who clearly asked to leave in their own words, a reply such as “please stop texting me”, even when no keyword matched.

HELP is the other half. A HELP text must come back with at least the program’s name and a way to reach someone, and the program must answer it whether or not the sender is subscribed. Recurring programs have to repeat both the opt-out instructions and the customer care contact at sign-up and then at least once a month.

What the ad and the texts must say

The handbook sorts programs by use case, and the required disclosures depend on which one applies.

A single-message program sends one text in answer to one request, such as a receipt, a delivery notice or a two-factor login code. Its call to action needs a product description, the line “message and data rates may apply”, and links to full terms and a privacy policy. It does not have to advertise HELP and STOP, though it should still answer both.

A recurring-messages program carries the heaviest load. News alerts, flight updates and loyalty clubs fall here. On top of the single-message list, the ad must say how often messages arrive or that they recur, and the terms must show the opt-out instructions in bold type. The confirmation text has to name the program, give the opt-out and customer care details, state the message frequency and repeat the rates disclosure.

Free-to-end-user programs follow nearly identical rules but may leave out the rates line, since the recipient pays nothing. Machine-to-machine codes, which never talk to people, only need a current program brief on file with the registry and the carriers.

Content and records

Carriers bar content that depicts or endorses violence, adult material, profanity and hate speech, and anything promoting illegal drugs. Campaigns for hard liquor and tobacco brands need age verification at opt-in or must stay inside age-checked venues such as bars. Sweepstakes need explicit carrier approval before launch and must offer a free way to enter. Programs aimed at children under 13 can expect extra review.

Behind the scenes, providers keep each opt-in and opt-out on record until at least six months after the person leaves the program. When a carrier reports a number as deactivated or recycled, the provider has three business days to act on it. Someone who ports a number to another carrier has to opt in again, and selling opt-in lists is forbidden. The program running in public must match the one the carriers approved and the record kept in the Common Short Code Administration’s registry.

How the audits work

CTIA does not rely on reading program briefs. Its monitoring team captures live programs as they run in the market, ads and message flows alike, so the audit reflects what a real subscriber sees. Audits apply to standard-rate codes leased through the registry, and the results are available to all the major carriers.

Notices go out weekly. They are compiled on Monday for the previous week’s findings and published on Tuesday at 2:00 a.m. Eastern, and noon that Tuesday is the official notice time from which deadlines run. Each violation carries a severity. Severity 0 means extreme consumer harm: there is no grace period, and the code can be suspended in the registry at once, with carriers free to suspend or terminate it as well. Severity 1 covers serious harm and Severity 2 moderate harm, and both allow five business days to fix. An unsolicited message or a failed STOP response is a Severity 1 finding; a missing rates disclosure is Severity 2.

The provider or its aggregator confirms the fix on the notice itself. For TV and print ads with long run times, it can ask for a retest on a later date instead. An appeal goes by email to the CTIA Compliance Care Team and must arrive before the cure date. The team explains violations and how to close them, but it will not approve a design in advance.

Since then, CTIA has issued a wider rulebook for business texting, the Messaging Principles and Best Practices (January 2017, revised in 2019 and 2023), and the handbook itself reached version 1.9 in August 2023.