ARTICLE ·

Bulk SMS compliance for advocacy groups: opt-outs, STOP, HELP and 10DLC in practice

Advocacy groups run on turnout, and a text still gets read when an email doesn’t. So at some point every group asks the same question: can we just text our whole supporter list?

You can. But the part everyone underestimates isn’t the sending, it’s the compliance. I built compliance into Clarion, my bulk-SMS platform for advocacy groups, and most of what I learned applies no matter what tool you use. Here’s the practical version.

None of this is legal advice; it’s what US carriers and the TCPA expect in practice.

The TCPA is the US law that matters here. The short version: you need the recipient’s prior consent to text them, and having someone’s phone number is not the same as having their consent.

A spreadsheet of numbers collected at events three years ago is a risk, not an asset. Keep a record of how each contact opted in (a form, a keyword, a signup sheet that mentions texting), and when. If you can’t say where a number came from, don’t text it.

Everyone knows to write “Reply STOP to opt out”. Fewer people think about what happens after someone does.

An opt-out has to be stored against the phone number and checked on every single send, forever. The failure mode I designed against in Clarion is the re-import: a volunteer exports the contact list, cleans it up in a spreadsheet, and imports it again. If your tool treats that import as fresh contacts, everyone who opted out is suddenly back in the audience, and now you’re texting people who told you to stop. That’s the exact situation that turns into complaints and carrier filtering.

So imports dedupe by phone number, opt-outs live on the number and survive re-imports, and every campaign skips them automatically. The person composing the message shouldn’t have to remember any of this; the system should make the wrong send impossible.

STOP and HELP have to actually work

STOP, and its variants like UNSUBSCRIBE and CANCEL, must immediately stop messages to that number and send one final confirmation. HELP must reply with who you are and how to reach you. These aren’t optional niceties; carriers test for them, and Twilio handles the keyword layer if you configure it properly.

One detail worth checking on whatever platform you use: the STOP handling and your own opt-out records have to agree. If the carrier blocks the number but your database still counts the person as active, your delivery numbers lie to you and your audience counts are wrong.

Register for A2P 10DLC before you send anything

If you’re sending application-to-person messages from a normal 10-digit US number, carriers expect your organization (the brand) and your use case (the campaign) to be registered under A2P 10DLC. Unregistered traffic gets filtered aggressively, and you often won’t be told. Your dashboard says sent, the phone shows nothing.

Registration goes through your provider, takes days rather than minutes, and asks for real organizational details. Do it before launch, not after the first campaign silently under-delivers.

Own your sender

Clarion is bring-your-own-Twilio: each group connects its own Twilio account, so the phone number, the 10DLC registration, and the sender reputation belong to the organization, not to my platform.

I’d push you to want that from any tool. Sender reputation accumulates on the number and the registration. If it belongs to your vendor and you ever leave, you start over from zero, and if another tenant on a shared setup behaves badly, you can inherit their problems.

Send from a queue, and keep the receipts

Sending thousands of texts from a browser page that must stay open is fragile, and fragility becomes a compliance problem: a send that dies halfway leaves you with no clean record of who got the message, and retrying it naively double-texts half your list.

Campaigns in Clarion run on a background queue. Closing the tab changes nothing, and each recipient gets a per-message status back from the carrier: delivered, failed, or skipped because of an opt-out. That per-recipient record is what lets you answer, with evidence, exactly who was sent what and when.

The checklist

  1. Written proof of consent for every contact, or don’t send.
  2. Opt-outs stored on the phone number, checked on every send, and safe against re-imports.
  3. STOP and HELP configured and tested, and synced with your own records.
  4. A2P 10DLC brand and campaign registered before the first real send.
  5. The number and registration owned by your organization.
  6. Sends running in the background, with per-recipient delivery records.

None of this is exotic. It’s ordinary, careful engineering applied to a domain where the penalty for sloppiness is your messages quietly not arriving, or a fine. If you’re evaluating a texting tool, ask these six things; if the answers are vague, keep looking.

START
Tell me what you're building.

Or what's breaking. I reply within 24 hours on weekdays.

© 2026 Priyank Maniar · Independent software developer ← Back to the surface