SMS Marketing for Ecommerce: What to Send and the Rules That Apply

SMS marketing for ecommerce works when the text arrives at the right moment and the customer asked for it. Get either part wrong and the cost shows up fast: opt-outs, carrier filtering, and in the US, lawsuits that count damages per message. This guide covers the texts worth sending, how to collect phone numbers and consent, and the US and EU rules behind every send. For supplement and skincare brands: SMS flows for supplement brands and SMS flows for skincare brands.

What is SMS marketing for ecommerce?

SMS marketing for ecommerce is sending text messages to customers who opted in, either to sell (offers, launches, cart reminders) or to inform (order, shipping, subscription and payment updates). The type of message matters more than the channel: it decides what consent you need. CTIA, the US wireless industry association, sorts business texts into three categories:4CTIA, Messaging Principles and Best Practices, May 2023

SMS or email: which message goes where

Most brands run both channels. Each one has a job.

Use email for anything the customer may need to find again. Use SMS for short, time-bound actions. For what each payment email must contain, see our guide to the payment confirmation email.

The texts worth sending

These are the flows that earn their place in a DTC SMS program, with the consent each one needs. Most of them start from a checkout or payment event, not from a marketing calendar.

Welcome. The first text after opt-in is a confirmation that CTIA expects anyway (more on that below). It's also where the sign-up incentive gets delivered, which is why it tends to be read.

Abandoned checkout. Send one reminder, not a series. A shopper who typed a phone number at checkout and left has not opted in to marketing texts. Only those who ticked the SMS marketing box can get this message. The causes behind abandonment and the fixes on the checkout side are in how to reduce cart abandonment.

Order and shipping. These are informational texts. Keep them free of offers, or they become promotional.

Back in stock. Only to customers who asked for the alert on that product. The request is the reason they'll read it.

Replenishment. Time it from the product's real usage: a 30-day supply bought 24 days ago. A refill reminder that arrives after the customer has reordered elsewhere is wasted.

Subscription reminders. For card subscriptions, the reminder is sometimes required. Visa's rules make merchants notify cardholders at least 7 days before the first charge after a trial or promotional period ends, by email or another agreed method, with a simple way to cancel online or by SMS.12Visa Core Rules and Visa Product and Service Rules, April 18, 2026 The full set of recurring billing rules is in negative option billing. A customer surprised by a renewal is more likely to dispute it than to reply: see chargeback prevention.

Failed payment. A short text right after a declined renewal often gets the card updated before the next retry. It's one step of a wider dunning process, and it only works if the link opens a page where the customer can update the card without logging in. Why renewals fail in the first place is covered in subscription payment failures.

How to write a text that gets read and not reported

• Start with your brand name. CTIA expects the sender to be identified, and it's the first thing the customer looks for.4CTIA, Messaging Principles and Best Practices, May 2023
• Count segments, not words. A standard SMS holds 160 characters in GSM-7 encoding. One emoji or a curly quotation mark switches the whole message to UCS-2, where the limit drops to 70 characters. Longer messages are split into segments of 153 or 67 characters, and each segment is billed.8Twilio Docs, SMS character limit and segments
• One message, one link. If you shorten links, CTIA says to use a shortener whose web address and IP addresses are dedicated to your brand, and the destination site should clearly identify its owner.4CTIA, Messaging Principles and Best Practices, May 2023
• Say how to stop. "Reply STOP to opt out" in the first message and regularly after that.
• Write the price and the date. In payment and subscription texts, the amount and the date answer the two questions the customer has.

How to collect phone numbers and consent

The checkout is where most ecommerce brands collect SMS subscribers, because the customer is already typing a phone number for delivery. Keep the two things apart: the phone number field is for the order; the SMS marketing box is for consent.

Here is a disclosure you can adapt:

When does the consent count? It depends on your tool. With Shopify and Klaviyo, for example, Klaviyo says consent syncs once the shopper enters a phone number, ticks the SMS marketing box and clicks "Continue to shipping", without having to finish the order.11Klaviyo Help Center, How to collect SMS consent at checkout on Shopify That's what makes an abandoned checkout text possible for someone who never paid. Klaviyo also recommends double opt-in, where the customer confirms by text before being added.11Klaviyo Help Center, How to collect SMS consent at checkout on Shopify

US law: what the TCPA requires for marketing texts

The Telephone Consumer Protection Act and the FCC rules under it, at 47 CFR 64.1200, govern automated texts to US mobile numbers. Under paragraph (a)(2), a call or text that includes an advertisement or constitutes telemarketing, sent with an autodialer, needs the recipient's prior express written consent.1eCFR, 47 CFR 64.1200 Delivery restrictions (up to date as of October 9, 2026) The rule defines it:

The written agreement must disclose clearly and conspicuously that the person is authorizing such messages, and that they are not required to sign it, or agree to it, as a condition of purchasing any property, goods or services. An electronic signature counts where federal or state law recognizes it.1eCFR, 47 CFR 64.1200 Delivery restrictions (up to date as of October 9, 2026) A checkbox with the right disclosure is how ecommerce brands collect it online.

The other rules in 64.1200 that apply to an ecommerce SMS program:1eCFR, 47 CFR 64.1200 Delivery restrictions (up to date as of October 9, 2026)

Two details catch brands out. First, any reasonable words count: if a customer replies "please stop texting me", the rule says you must treat it as a revocation when a reasonable person would understand it that way.1eCFR, 47 CFR 64.1200 Delivery restrictions (up to date as of October 9, 2026) Your tool's keyword list isn't enough on its own. Second, the "revoke all" part of the rule is postponed: a January 6, 2026 FCC order delays, until January 31, 2027, the requirement that an opt-out sent in reply to one type of message also stops all your other, unrelated texts and calls.2FCC, Order DA 26-12, revocation of consent waiver, January 6, 2026 The rest of the revocation rule applies today.

Inside Tagada

Build the funnel once, route every customer to the right offer

Checkout, upsells and subscriptions on one flow, with conditions per country, order or customer.

Start free

A2P 10DLC: registering to send from a US number

A2P 10DLC is the system US carriers use to verify business texts sent from ordinary 10-digit numbers. Twilio's documentation describes it as the standard carriers put in place to ensure that SMS traffic to US users from long code numbers is verified and consensual, and says that anyone sending from a 10DLC number through an application must register.6Twilio Docs, Programmable Messaging and A2P 10DLC

The register is run by The Campaign Registry (TCR). A brand can't register with TCR directly: it works through a messaging provider, which TCR calls a Campaign Service Provider (CSP), and the provider handles the registration.5The Campaign Registry, The 10DLC ecosystem

What Twilio's documentation says about the process:6Twilio Docs, Programmable Messaging and A2P 10DLC

• Two registrations. The brand says who is sending. The campaign describes the purpose of the messages and how people opt in, opt out and get help.
• Brand types. A Sole Proprietor brand gets one campaign. Low-Volume Standard and Standard brands can register up to five campaigns, unless there's a clear business reason for more.
• Unregistered traffic costs more. Registered senders get lower filtering and higher throughput; unregistered 10DLC traffic gets extra carrier fees.
• Other number types. Toll-free numbers and short codes are outside 10DLC and have their own approval processes.

Write the campaign description as you would the opt-in: the same message types, the same frequency, the same STOP and HELP wording. A campaign that says "order updates" but sends flash sales is what carriers look for.

CTIA rules: STOP, HELP and what carriers expect

The CTIA Messaging Principles and Best Practices aren't law, but carriers apply them, and the 10DLC campaign review is built on them.4CTIA, Messaging Principles and Best Practices, May 2023

CTIA also lists content senders should keep out of the network: anything unlawful, deceptive (phishing), obscene, hateful or inciting violence, threatening, or not age-gated when it should be. Marketing claims should comply with the FTC's truth-in-advertising rules.4CTIA, Messaging Principles and Best Practices, May 2023 For a supplement or wellness brand, that last point covers health claims in a 160-character text just as it covers a product page.

Restricted products: SHAFT and what carriers block

Some products can't be marketed by SMS at all, whatever the consent. The industry shorthand is SHAFT: sex, hate, alcohol, firearms, tobacco. Providers publish how they apply the carrier rules. Here is Twilio's list for the US:7Twilio Help Center, Forbidden message categories in the US and Canada

Three points from Twilio's page matter for DTC brands.7Twilio Help Center, Forbidden message categories in the US and Canada An age gate means the visitor types a date of birth: a yes/no question doesn't count. For businesses in the cannabis category, the ban covers every use case, including order updates and login codes. For prescription drugs, Twilio also requires an 18+ age gate with a birth-date field when consent is collected. Other providers and carriers may apply stricter rules, so read your own provider's list before you register a campaign. Brands in regulated health categories should also see telehealth payment processing for the payment side.

EU rules: consent and the soft opt-in

In the EU, SMS falls under the ePrivacy Directive. Its definition of "electronic mail" covers any text, voice, sound or image message sent over a public network and stored until the recipient collects it, which includes SMS.9Directive 2002/58/EC (ePrivacy), consolidated text, Articles 2 and 13 Article 13(1) allows electronic mail for direct marketing only to people who gave their prior consent. Article 13(2) creates an exception, usually called the soft opt-in:9Directive 2002/58/EC (ePrivacy), consolidated text, Articles 2 and 13

The consent itself follows the GDPR. Recital 32 says silence, pre-ticked boxes or inactivity are not consent. Article 7(3) says withdrawing consent must be as easy as giving it. Article 21 gives everyone the right to object at any time to direct marketing.10Regulation (EU) 2016/679 (GDPR), Recital 32, Articles 7 and 21 The directive is applied through each member state's own law, so details vary by country.

How to measure SMS revenue honestly

Platform dashboards credit SMS with every order placed within a few days of a click. Many of those customers would have bought anyway. Two numbers give a truer picture.

Revenue per recipient against a holdout. Before a campaign or a flow goes live, set aside a random share of eligible subscribers who don't get the text. After the attribution window, compare revenue per person in the two groups. The difference, multiplied by the number of people texted, is what the message actually added. Subtract message costs, segments included, and any discount given to customers who would have paid full price.

Opt-out rate per send. Unsubscribes divided by messages delivered, per campaign and per flow. It is the cost side of every send. A campaign that brings orders but loses many subscribers can lower future revenue.

What else to watch:

Choosing an SMS tool for an ecommerce brand

Whatever the tool, check these points on the provider's own pages before you sign:

• Registration. It registers your 10DLC brand and campaigns, or supports toll-free verification or a short code.
• Consent capture and records. Checkout and form opt-ins, double opt-in, and an exportable record of each consent (time, source, wording).
• Opt-out handling. STOP and plain-language replies, and an opt-out that applies across all lists and flows.
• Quiet hours by recipient time zone. Sending windows based on the customer's location, not the store's.
• Event triggers. Checkout started, order paid, shipped, subscription renewed, payment failed: the events this guide's flows start from.
• Holdout groups. Built-in random holdouts for campaigns and flows.

Our guide to the best SMS marketing platform compares tools on these criteria.

How Tagada fits

Whatever you use to send, the method stays the same: separate consent from the phone number, send fewer texts tied to real events, honor every opt-out within the legal deadline, and measure each flow against people who didn't get it.