SMS Marketing for Ecommerce: The Build That Stays Compliant

We build SMS programs for Shopify brands. This is the build we’d hand a client who has already decided to run SMS marketing for ecommerce properly. It covers the rules that bind a brand texting its own list, how that list gets built, which flows to text first, how to pick a platform on published pricing and consent models, and when RCS registration has to start if you want it live by Black Friday, November 27, 2026.

Whether you should add SMS at all is a separate question, and we’ve argued it in you don’t have an email problem you can fix with SMS. That post’s test: a flow earns a text when it already converts on email, when the message is time-sensitive, and when it couldn’t have waited for an inbox. Everything below assumes you’ve passed that test.

Nothing in 2026 reset how you build an SMS list. The federal consent rule that would have changed it was vacated by the Eleventh Circuit in January 2025, and the FCC removed it from its rules that summer. The past two years brought changes to how subscribers revoke consent, to carrier enforcement, and to a handful of state laws.

Every rule, date and number below links to its source: the regulation, a court or agency order, the carrier rulebook, or the vendor’s own documentation. Vendor statements stay labeled as the vendor’s, including where two vendors contradict each other. Vendor pricing is as of September 2026 and changes. We won’t re-caveat that in every paragraph.

Is any of this legal advice? No. We quote the regulation, the orders and the carrier rulebook so you can check your own setup against the text, but BLKDG is a marketing agency and not your counsel. Consent language and state registration decisions belong with a lawyer who has seen your forms.

SMS marketing is a brand texting subscribers who’ve given it written permission. It goes out as scheduled campaigns, or as flows that fire on something the shopper did, like leaving a cart or placing an order. An ecommerce SMS marketing program typically sends three formats from the same list: plain SMS, MMS with an image, and RCS, which carries rich cards and buttons.

SMS consent comes in two kinds, transactional and promotional, and Klaviyo’s docs treat them separately. Its opt-out documentation says an unsubscribe “automatically removes consent for both SMS transactional and promotional consent.” Does email consent cover SMS? Klaviyo’s consent collection documentation answers: “No. Having consent for email does not mean you have consent for SMS.”

Klaviyo’s SMS metrics documentation states that “Klaviyo does not track open rates for SMS, because most recipients will open an SMS message that they receive,” so an SMS program is judged on delivery, clicks, conversions and unsubscribes. RCS is the exception: Klaviyo’s open tracking documentation says “SMS and MMS do not support open tracking,” while RCS opens come from read receipts, which are “Off by default (users must turn them on).”

Four layers govern a brand texting its own list: the federal consent standard, the federal revocation rules, the carrier rulebook your platform enforces, and state law. The consent standard hasn’t changed since August 2025. The revocation rules changed in 2024 and 2025, and one of their pieces hasn’t taken effect yet.

The TCPA’s consent rules reach texts through FCC interpretation. The Eleventh Circuit’s opinion notes that the statute “does not mention text messages,” and that the FCC has read “call” to include them.

In its 2023 order the FCC wrote a rule under which consent would authorize no more than one identified seller, and texts had to be “logically and topically associated with the interaction that prompted the consent.” The Eleventh Circuit vacated that part of the order on January 24, 2025, holding that the FCC had exceeded its statutory authority. The rule never took effect, because the FCC had postponed its effective date before the court’s mandate issued. The FCC conformed its rules to the decision in a July 14, 2025 order, and the eCFR shows the language replaced by the earlier definition effective August 29, 2025.

The rule was aimed at lead generation. The court’s background describes the petitioner’s members as lead generators, merchants that rely on them, and consumers who use lead generators to compare products. It recounts the petitioner’s example of a consumer who couldn’t consent to calls from two banks with a single checkbox. A Shopify brand collecting opt-ins for its own texts on its own site was always one seller.

The definition in force today is the pre-2023 one. Under 47 CFR 64.1200(f)(9), prior express written consent is “an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages,” and electronic signatures valid under federal or state contract law count. The same section requires a disclosure that signing isn’t a condition of purchase. Our Black Friday email and SMS plan for Shopify quotes that disclosure and applies it to peak-season opt-in offers.

The section has been amended since, according to the eCFR’s version history, on September 16 and December 15, 2025 and on March 25, 2026. Those amendments cover a cross-reference, blocking of do-not-originate calls, and call-blocking code mapping. None of them touches consent, revocation, texting or quiet hours.

The platform, not the FCC, holds a Klaviyo brand to a one-brand rule that’s stricter than federal law after the vacatur. Klaviyo’s consent documentation states that “A single consent cannot be provided to multiple brands or organizations,” and that “Lead generation, affiliate related, or purchased lists are not valid SMS consent.”

The first revocation rule took effect April 4, 2024. After someone opts out, you may send one confirmation text, as long as it only confirms the request and carries no marketing. Under 64.1200(a)(12), a confirmation sent within five minutes of the request is presumed to fall within the consumer’s prior consent.

The rest took effect April 11, 2025, except for one piece covered below. The FCC’s consent order lets consumers revoke “in any reasonable manner that clearly expresses a desire not to receive further calls or text messages,” and bars senders from designating an exclusive way to do it. Under the regulation, a reply that uses words other than the listed keywords still counts if a reasonable person would read it as a request to stop. A voicemail or email to a number or address meant to reach you creates a rebuttable presumption that consent was revoked.

The deadline is in 64.1200(a)(10): a request “must be honored within a reasonable time not to exceed ten business days from receipt of such request.” A footnote in the FCC’s order adds, “We encourage callers to honor such requests as soon as practicable as a best practice.” That’s encouragement. The ten-business-day ceiling is the rule. The per se keyword list and how it plays out at peak volume are in our Black Friday email and SMS plan.

The one piece not yet in effect is revoke-all, which would require a STOP sent in response to one type of message to cover every future text from that sender on unrelated matters. The FCC waived that piece to April 11, 2026 in DA 25-312, then to January 31, 2027 in DA 26-12, and both orders limit the waiver to that one piece.

For a Klaviyo brand the postponement changes nothing in practice, because a Klaviyo unsubscribe already removes both transactional and promotional SMS consent, per its opt-out documentation. The same page says that if you send from a toll-free number, a subscriber who texts STOP “must resubscribe using the keyword UNSTOP or START,” and Klaviyo recommends sending opt-out instructions “at least once a month.”

The carriers’ rulebook is CTIA’s Messaging Principles and Best Practices, and the current version is dated May 2023. CTIA’s October 2025 Messaging Security Best Practices is a separate document that still refers readers to the Messaging Principles and Best Practices for its defined terms. The principles are written as recommendations, though Holland & Knight, a law firm that sells compliance work, wrote in May 2026 that carriers have made compliance mandatory for A2P messaging.

For your sign-up form, CTIA says senders “should display a clear and conspicuous Call-to-Action with appropriate disclosures to Consumers about the type and purpose of the messaging that Consumers will receive.” Its list of what the consumer should know covers the program description, the originating number or numbers, who’s sending, opt-in and fee language, and the other terms.

After opt-in, CTIA says “the Message Sender should send the Consumer an opt-in confirmation message before any additional messaging is sent.” That’s a confirmation message rather than double opt-in, and CTIA’s document doesn’t use the phrase double opt-in. A Shopify brand’s double opt-in requirement comes from its platform and the carriers, which the list-building section below covers.

CTIA asks senders to document opt-in consent, and its May 2023 principles list seven data points to retain where applicable:

The same document says “A Consumer opt-in should apply only to the campaign(s) and specific Message Sender for which it was intended or obtained,” and that “Message Senders should not use opt-in lists that have been rented, sold, or shared to send messages.” Both have been carrier guidelines since at least May 2023, so neither is a 2026 legal change.

CTIA also says senders “should support multiple mechanisms of opt-out, including phone call, email, or text.” If you shorten links, CTIA wants a shortener whose web address and IP addresses are dedicated to your exclusive use, which rules out a public shortener.

Virginia’s telemarketing statute now covers texts. Section 59.1-510 defines telephone solicitation to include “any text message sent to any wireless telephone with a Virginia area code,” or to a phone registered to a Virginia resident. Under 59.1-514(A), a reply of UNSUBSCRIBE or STOP is a do-not-contact request, and “Any such request not to receive telephone solicitations shall be honored for at least 10 years from the time the request is made.”

The same section exempts messages sent with permission evidenced by a signed written agreement, and messages to someone with an established business relationship. The business-relationship exemption doesn’t survive a prior do-not-contact request. Under 59.1-514.1, the seller and the telephone solicitor are jointly and severally liable.

Florida’s telemarketing statute, 501.059, was last amended in 2023. Its subsection (10)(c) requires a subscriber to reply STOP before suing over texts, then gives the sender 15 days after that notice to stop texting, with one confirmation text allowed.

Frequency caps and state quiet hours reach most brands through their platform’s settings. Klaviyo’s frequency cap documentation says states including Florida, Oklahoma, Oregon and Maryland limit promotional texts within a rolling 24 hours, and Klaviyo auto-enforces a cap of three promotional texts per rolling 24 hours for those states’ area codes, across campaigns and flows, as an account-level toggle that’s on by default.

Postscript’s compliance overview lists Florida, Maryland, Oklahoma, Connecticut and Washington as 8 a.m. to 8 p.m. states and New Jersey as 8 a.m. to 9 p.m. Those two lists describe different rules and are the vendors’ summaries, so don’t merge them into one list of strict states. The federal quiet-hours window and the argument over its carve-out are in our Black Friday email and SMS plan.

Texas SB 140 took effect September 1, 2025. It extended the state’s definition of telephone solicitation to cover “a transmission of a text or graphic message or of an image,” and it added deceptive trade practices remedies to Chapters 304 and 305 of the state’s business code. The open question for brands was whether consent-based texting also triggers Chapter 302 registration.

According to a Troutman law-firm post, Postscript (as Stodge), the Ecommerce Marketers Alliance and Flux Footwear sued the State of Texas in the Western District of Texas. The case ended in a joint motion to dismiss after the Texas Attorney General said consent-based text programs aren’t subject to Chapter 302 registration. NatLaw Review dates the settlement to November 6, 2025, and reported on December 11, 2025 that the AG’s formal letter opinion was still pending.

Klaviyo tells its customers to register anyway. Its Texas SB 140 documentation says “The Texas Attorney General’s view that SB 140 does not apply to consent-based marketing is advisory, not binding,” that “Klaviyo continues to recommend registration as the most reliable path to compliance,” and that “The EIA settlement does not prevent private lawsuits; it only limits government enforcement.” Klaviyo lists a $200 application fee, a $10,000 security and renewal after one year. It also offers a beta toggle to pause promotional texts to Texas area codes, and it enforces Texas state-level quiet hours, including Sunday rules, in flows.

Chapter 302 has its own exemption. Section 302.058 covers a person who “(A) is soliciting business from a former or current customer; and (B) has operated under the same business name for at least two years.” A Varnum client alert from January 29, 2026 notes that “customer” isn’t defined in that section, and that Chapters 304 and 305 and the deceptive trade practices linkage remain in force.

So Klaviyo and Postscript read the same law differently. One was a plaintiff whose case produced the AG’s position, and the other calls that position advisory. Take the question to Texas counsel. The decision is whether to register, at $200 plus a $10,000 security, or to rely on an advisory position and the customer exemption.

Klaviyo sets the consent rules most Shopify brands hit in practice. Its consent documentation calls for a checkbox or button specifically for SMS and says a general agree-to-marketing option isn’t considered sufficient in most countries. It also states that “Single-step forms may be used, but only with double opt-in and when SMS consent is clearly optional.”

Klaviyo’s explicit vs. implicit consent documentation says “Implied consent also expires and is not allowed when using Klaviyo SMS,” and recommends recording “when, where, and how someone gave express consent.” That record is the same audit trail CTIA’s seven data points describe.

Shopify checkout is a capture point with its own rules. Klaviyo’s Shopify checkout documentation says “The customer does not need to complete their order to have their consent synced to Klaviyo,” but “Consent will only sync to Klaviyo if the person is subscribing to SMS in Shopify for the first time.” It adds that “Shopify Plus customers can also use SMS app blocks on their checkout pages.”

Can you import an existing phone list? You can, but Klaviyo’s double opt-in documentation states that “List imports do not trigger double opt-in.” Between that and CTIA’s line on rented, sold or shared lists, an imported list is only as good as the consent records you hold for it.

Postscript’s confirmed opt-in documentation has subscribers confirm by replying Y, with the example prompt “Shop Name: Reply Y to subscribe to recurring automated promotional msgs (e.g. cart reminders). Msg & data rates may apply.” Postscript also offers an Onsite Opt-in.

Do you need double opt-in for SMS? For a US brand that wants SMS in its cart flow, yes. Klaviyo’s double opt-in documentation says “You should always use double opt-in for SMS lists. Carriers often require it, particularly for abandoned cart messages.” Its opt-in methods reference goes further: in the US, double opt-in “is required if you plan to add SMS to your abandoned cart flows.”

Klaviyo offers two ways to confirm. The standard double opt-in sends a confirmation text the subscriber has to answer, which is why Klaviyo skips it on branded sender IDs that can’t receive texts. Smart Opt-in has the shopper type a one-time passcode on your site instead, and Klaviyo says “You must have a paid SMS plan to configure Smart Opt-in in sign-up forms.” Its double opt-in page also notes that “Currently, double opt-in does not work with SMS transactional consent.”

The cart flow carries its own limits. Klaviyo’s US cart abandonment guidelines say to “Use only 1 SMS per recipient in a cart abandonment flow,” to “Have the SMS send within 48 hours of the triggering event,” and that “The list they are sent to must have double opt-in enabled.” Klaviyo attributes these to “the TCPA, CTIA, or carriers” without saying which one imposes which rule.

The same page says “you cannot complete the transaction on behalf of the customer, collect payment information via text, or accept purchase via a keyword confirmation from the customer.” Your disclosure has to mention cart reminders, and your privacy policy has to describe how abandonment is detected. Build double opt-in and the cart language into the form on day one. A list collected without them can’t feed your cart flow later.

Do you need 10DLC registration? On Klaviyo or Postscript in the US, 10DLC isn’t the documented path. Klaviyo’s sending numbers documentation states that “Toll-free numbers are the default sending numbers in Klaviyo for the US and Canada. They are automatically created as soon as you set up SMS.” That page’s sending-number availability table marks long codes, the number type 10DLC covers, as unavailable in the US. Twilio’s 10DLC throughput tiers and T-Mobile’s daily caps are in our Black Friday email and SMS plan.

Klaviyo says toll-free fits if “You send fewer than 300,000 messages at a time,” and that verification “typically takes 2 to 5 business days.” Short-code approval “takes several weeks,” and short codes are the only Klaviyo sending numbers with an additional monthly cost. Postscript’s pricing page gives every merchant a dedicated toll-free number it verifies for free, and states that “DSCs cost $750/month through the carriers (AT&T, Verizon, etc.).”

Klaviyo’s toll-free verification documentation says “Verification is not allowlisting” and “Your website must be live in order for your toll-free number to be verified.” If several weeks pass between verification and your first send, carriers “may change the status back to unverified, not inform Klaviyo, and then heavily filter your message.” Verify close to launch, not months ahead of it.

Twilio’s changelog, dated February 17, 2026, says new toll-free submissions now require a business registration number for every business type except sole proprietorships. We haven’t confirmed whether Klaviyo’s toll-free form asks for one. Klaviyo’s RCS registration does, so have your EIN documentation ready either way.

Build email flows before SMS, and in the order laid out in the lifecycle that pays rent. Those rankings are email numbers that don’t transfer to texts. Klaviyo’s SMS benchmark article covers campaigns only, so the per-flow SMS figures available come from a vendor that sells the channel.

Postscript’s 2026 SMS Benchmarks report earnings per message (EPM) by message type across more than 17,000 Shopify stores. The data runs from January 1 to December 15, 2025. It’s limited to shops that installed at least 90 days before Black Friday 2025 and spent at least $100 on Postscript Marketing in Q3 2025, which leaves out stores that spent little or nothing on it that quarter. EPM is per message, so it doesn’t compare with per-recipient email figures.

Our arithmetic off that table: an abandoned cart text at the 25th percentile ($3.52) earns more than six times what a campaign text earns at the 75th ($0.55). That gap is the case for building flows before scheduling campaigns, with the caveat that it’s Postscript’s data about Postscript’s customers.

The welcome text is the first SMS flow we’d build, because the carrier rulebook puts it there: CTIA says the opt-in confirmation should go out before any other message, so the first welcome text follows it. Klaviyo’s welcome series documentation adds that “As a best practice, your SMS welcome flow should be separate from your email welcome series.”

Abandoned cart comes second. It’s a single text rather than a sequence, because Klaviyo’s US guidelines allow one text within 48 hours, to a double opt-in list. Back in stock goes alongside it: it posts the highest click rates in Postscript’s table, and the subscriber asked to hear about that exact product.

Browse abandonment and post-purchase come after those. Post-purchase texts get better when you segment on what someone actually bought, which is the work covered in how a properly built Klaviyo setup turns purchase history into repeat revenue.

Campaigns come last. Measure them on clicks and unsubscribes, since there’s no open to measure. Klaviyo’s benchmark article calls an SMS campaign click rate of 8.9% to 14.5% good and an unsubscribe rate of 0.6% to 1.4% good. It bases those on US customers and discloses no sample size or period.

When email and SMS run from one program, carriers do for texts what mailbox providers do for email: they decide what reaches the subscriber. Our post on email deliverability in 2026 recommends separate marketing and transactional email streams. Keeping transactional and promotional SMS consent separate is the same discipline on the text side.

We compare Klaviyo, Postscript and Attentive here only on what each one publishes: pricing, cost model, default sending number, consent tooling, email in the same platform, and RCS. Every cell in the table below comes from the vendor’s own Klaviyo pricing, Postscript pricing or Attentive pricing page, or from its help center, changelog or press release, as of September 2026.

Postscript publishes the most complete rate card of the three. Its pricing page lists Starter at $0 a month with a “$49 monthly minimum spend,” Growth at $100 a month, Professional at $500 a month and custom Enterprise pricing, with Starter texts at “$0.009/SMS” plus carrier fees. It states that “Postscript passes the exact fee from your brand to the carriers without any additional markup,” and gives average US carrier fees of $0.00418 per SMS and $0.00841 per MMS.

Our arithmetic off those published figures: $0.009 plus the $0.00418 average carrier fee is about $0.0132 per SMS segment at Starter. A one-segment campaign to 10,000 subscribers costs about $132 before any MMS. A longer message that splits into two segments doubles it.

Klaviyo’s pricing page prices texts through a mobile messages calculator. For US toll-free SMS it shows $0.01 plus carrier fees per send, rounded to the cent, and a monthly cost of $40.00 at its default of 2,900 messages. Its FAQ says carrier fees “are built into the rate you see.” Our arithmetic: $40.00 across 2,900 texts is about $0.0138 per SMS at that volume, close to the Postscript Starter figure above.

Klaviyo’s mobile messaging documentation gives the formula, “Rate x Recipients x Message segments = Total cost,” and says “carrier fees are still built into your rate.” It puts the exact rate for your account and plan tier in your billing settings, and unused plan spend doesn’t roll over.

Attentive doesn’t publish a rate. Its pricing page states that “Attentive’s pricing is tailored to your business needs based on your message volume, subscriber list size, number of channels, and AI products selected,” so the only Attentive number you can compare is a quote.

If your email already runs on Klaviyo, Klaviyo SMS is where we’d start. One profile carries both email and SMS consent, and Smart Sending, the state frequency caps and quiet hours are all set in the account your email flows already run in. Per Klaviyo’s Smart Sending documentation, each channel has its own Smart Sending window, so an email doesn’t hold back a text sent the same day. The trade-offs are a public price that’s a rounded calculator estimate, with your exact rate visible only inside your account, and more of your program sitting with a single vendor, the concentration our email-vs-SMS argument warns about.

Postscript fits a brand that wants to model cost before signing, or that runs email somewhere else. Published rates and pass-through carrier fees make the budget a spreadsheet exercise. Attentive can’t be evaluated on published pricing, so it belongs on a shortlist only once you’re ready to take a demo and compare its quote against the other two.

RCS messaging has been generally available in Klaviyo since February 24, 2026, per its changelog. Klaviyo’s GA announcement lists 11 countries, starting with the United States and the United Kingdom, and its RCS pricing documentation says “Fallback to SMS/MMS occurs automatically when RCS is not supported on the recipient’s device or network.” Its March 24, 2026 press release restates the general availability.

Klaviyo’s RCS vs SMS vs MMS documentation limits RCS to “RCS-capable devices only (Android 5.0+ or iOS 18+ on supported networks).” Its iOS documentation says “Apple has only recently added support for RCS on iOS, and that implementation is still evolving,” and documents squashed images, cached button labels, and multiple buttons collapsing into an options dropdown.

Klaviyo’s Unknown Senders documentation says RCS messages come from a new sender ID that iOS can route to the Unknown Senders inbox, and that RCS agents can’t be saved as contacts. Any welcome-flow step that asks subscribers to save your number as a contact won’t work on RCS. Klaviyo’s RCS vs SMS vs MMS documentation also calls RCS delivery reporting “deterministic,” and a number that fails as incapable defaults to SMS for future sends.

Can you text your existing SMS list over RCS? In Klaviyo, yes. Its getting started with RCS documentation states that “SMS consent applies to RCS, and vice versa,” that “You can send RCS messages to your existing SMS list without re-obtaining consent,” and that “Opt-outs apply across both channels.” The same page says “SMS regulations also apply to RCS” and that prohibited-content rules are stricter on RCS than on SMS.

Klaviyo’s RCS registration guide says “Your registration will be reviewed by Google and carriers and can take over 30 days.” It requires an EIN document, a legal name and address that match your registration exactly, and a message description with at least one marketing and one informational example. It also requires a readable screenshot of your sign-up form’s disclosure.

The guide also states that “Your privacy policy must state that text message consent will not be shared with any third parties for purposes unrelated to delivering the messaging service,” so your privacy policy may need an edit before you submit.

Our arithmetic on the calendar: from Friday, September 11, 2026 to Black Friday on November 27 is 77 days. Klaviyo’s RCS setup guide says carrier review “typically takes 4 or more weeks,” so a registration submitted September 11 that takes 30 days clears October 11. The same guide says a rejected application needs a new registration, and a second 30-day review would put approval at November 10, six days before the November 16 freeze in our Black Friday email and SMS plan.

Postscript and Attentive offer RCS too. Postscript’s RCS flow guide says every RCS message carries an auto-generated SMS or MMS fallback and that “RCS messages are ONLY available in Flow Builder.” Attentive’s May 20, 2026 press release says it “was among the first platforms to launch RCS for Business with Google in the U.S.”

Klaviyo’s RCS pricing documentation says it “does not currently charge any RCS agent fees in any country,” and adds that fees “may be introduced in the future for agents registered in the US only.” It states that “Basic RCS in the US is billed in 160-character segments, similar to SMS,” and that RCS draws from your existing Mobile Messages spend. The same page still shows legacy credit tables: one credit per Basic RCS segment and three for a rich Single RCS message.

RCS gets more room per segment: because it needs no organization prefix or opt-out text, Klaviyo says you gain roughly 40 characters per message, and emojis don’t cut the limit to 70. In Klaviyo’s own example, a promotion runs 185 characters and two segments as an SMS, and 153 characters and one Basic RCS segment once the prefix and opt-out text come off.

Klaviyo and Postscript describe the RCS rate in different terms. Klaviyo’s getting started documentation says “in most countries, you can send text only messages over RCS at the same rate as SMS,” and doesn’t publish the US rate. Postscript’s carrier fee documentation estimates US carrier fees at “$.0043 for text-only RCS messages (~30% higher than standard SMS) and $.0089 for media RCS messages (~10% higher than standard MMS).” One is an all-in rate and the other a pass-through carrier fee, so read them as two vendor statements rather than a contradiction.

RCS opens are measurable but partial: Klaviyo tracks them through read receipts, which are off by default, so an RCS open rate counts only subscribers who turned them on.

The build runs in this order:

None of those steps depends on a rule that changed in 2026. SMS marketing for ecommerce runs on the written-consent standard in force since August 2025, revocation rules effective since April 2024 and April 2025, a May 2023 carrier rulebook, and a state layer your platform can enforce if you switch it on. The step with a deadline is RCS registration, if you want it through review before Black Friday.

Your competitor’s text program isn’t better than yours. It just started registering earlier. If you want the build scoped before peak, book a free Growth Audit. Not a sales call. Not a quote request. We’ll review your consent capture, your sending-number and RCS registration path, and the first flows worth a text, and give you the order to fix them in before November 27.

If you already know the work is bigger than an audit, start with our email and SMS marketing services. You built something worth finding. We make sure it gets found, and texted.