The short version
- What changed: carrier reviewers read your website before they approve a 10DLC campaign. A site that does not match your registration is a common reason for rejection.
- Who it affects: any business registering a 10DLC brand or campaign, or resubmitting one that was sent back.
- What to do: show your business name and contact details, a privacy policy, SMS terms, and an opt-in form with clear consent wording.
- When: before you submit, and again whenever you change your opt-in form or policies.
10DLC website requirements come down to one test: can a reviewer confirm who you are and how people agree to your texts? Your site needs your legal business name, real contact details, a privacy policy, SMS terms, and an opt-in form whose consent wording matches the campaign you register.
What does a reviewer look for on your website?
Proof that your business is real and that your texting program matches what you registered. Start with identity:
- A live site with real content. Not a parked domain or a page under construction.
- The same business name you registered. Use your legal name, or show your brand name together with the legal entity behind it.
- Ways to reach you. A phone number, an email address and a postal address. CTIA’s Messaging Principles and Best Practices (May 2023, section 5.3.2) say websites linked from messages should clearly identify the owner and include contact information, such as a postal mailing address.
- Content that fits the use case. If you register a lending campaign, the site should show that business.
These items also make up the brand side of 10DLC registration requirements. Our A2P 10DLC registration guide covers the brand and campaign steps.
What does a 10DLC privacy policy need?
CTIA (section 5.2.1) says senders should keep a clear, easy-to-find privacy policy that explains how they collect, use and share consumer information, linked from the opt-in. Reviewers commonly also look for a plain statement about phone numbers. Example wording to review with your counsel:
“We do not share mobile phone numbers or SMS opt-in consent with third parties or affiliates for their marketing purposes.”
Make sure the policy matches what you actually do with the numbers you collect. CTIA says the same: your handling of information should be consistent with your policy.
What goes in your SMS terms?
A short SMS section in your terms, or a separate SMS terms page, that tells people:
- What you send: the program name and the kinds of messages.
- How often: for example “message frequency varies.”
- Costs: “Message and data rates may apply.”
- How to stop: “Reply STOP to opt out.”
- How to get help: “Reply HELP for help,” plus a support phone number or email.
- Where the privacy policy is: a link to it.
CTIA (section 5.1.2.1) expects the same items in the confirmation text a person gets right after opting in to recurring messages.
What should the opt-in form and consent checkbox look like?
This is where most rejections start. Reviewers commonly expect:
- An optional, unchecked consent box. Texting consent should not be a condition of submitting the form.
- Clear wording next to the box that names your business, says what messages they will get, and includes frequency, message and data rates, STOP and HELP.
- Links to your SMS terms and privacy policy right at the box.
- No buried details. CTIA (section 5.1.1) says opt-in details should not be obscured in terms and conditions.
For marketing texts, the TCPA standard is prior express written consent. The FCC’s definition (47 CFR 64.1200(f)(9)) requires a signed written agreement that names the seller and says consent is not a condition of purchase. Electronic signatures can count where the law recognizes them.
Keep a record of every opt-in. CTIA (section 5.1.2) lists what to keep: the timestamp, the opt-in method, the exact wording and action shown, the campaign, the IP address, the phone number and who consented.
Do your sample messages have to match the website?
Yes. Reviewers compare them. Each sample should name your business, fit the use case shown on your site, and include opt-out wording such as “Reply STOP to opt out.” A sample that promotes something your site never mentions is a red flag.
What about lead generation and affiliate sites?
They get closer review. CTIA (section 5.1.2.2) says an opt-in applies only to the sender and campaign it was given for and cannot be transferred, and section 5.1.4 says senders should not use opt-in lists that were rented, sold or shared. A form that says “our partners may text you” is a weak record for any one sender. If you buy leads, keep the consent record for every number: where, when and the exact language.
The 10DLC website checklist
- The site is live and has real content about your business.
- Your legal business name (or brand plus legal entity) matches your registration.
- Phone, email and postal address are easy to find.
- A privacy policy is linked in the footer and at the opt-in.
- The privacy policy says mobile numbers and SMS consent are not shared with third parties for marketing.
- SMS terms cover what you send, frequency, message and data rates, STOP and HELP.
- The opt-in form has an optional, unchecked consent box.
- The consent wording names your business and the kinds of messages.
- SMS terms and the privacy policy are linked at the consent box.
- Sample messages name your business and include opt-out wording.
- Every opt-in is recorded with time, method, wording and number.
- Nothing on the site contradicts the use case you register.
Want a fast read before you submit? Our free 10DLC compliance checker reads your site the way a reviewer does and gives you a fix list. If a campaign was already sent back, see our guide to 10DLC campaign rejection.
What to check with your counsel
- Does your consent wording cover every type of text you plan to send?
- Does your privacy policy match how you actually use and share phone numbers?
- If you collect leads for others or buy leads, whose name does each consent show?
- Do any states you text into require more in your disclosures?
Frequently asked questions
Do I need a website for 10DLC registration?
Plan on one. Reviewers use your website to confirm your business and see how people opt in. Without a live site that matches your registration, they have little to verify.
What should a 10DLC privacy policy say?
How you collect, use and share information, plus a plain statement that mobile numbers and SMS consent are not shared with third parties or affiliates for marketing. Link it from your opt-in form.
Does the SMS consent checkbox have to be unchecked?
Reviewers commonly expect an optional, unchecked box, so the person takes an action to agree. A pre-checked box makes the consent record weaker.
What are the 10DLC registration requirements for a website?
A live site with your business name, contact details, a privacy policy, SMS terms, and an opt-in form with clear consent wording that matches the campaign you register.
How can I check my website before I submit?
Use the checklist above, or run your site through our free 10DLC compliance checker for a readiness score and a fix list. A high score is not a promise of approval. Carriers make the final call.
This article is general information, not legal advice. Talk to your own counsel about how these rules apply to your business.
Sources
- CTIA, Messaging Principles and Best Practices (May 2023), sections 5.1.1, 5.1.2, 5.1.2.1, 5.1.2.2, 5.1.4, 5.2.1 and 5.3.2: https://api.ctia.org/wp-content/uploads/2023/05/230523-CTIA-Messaging-Principles-and-Best-Practices-FINAL.pdf
- 47 CFR 64.1200 (current text, eCFR): https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200