Navigating the ever-tightening landscape of cannabis SMS marketing in 2025 is more challenging than ever. As federal and state regulators, mobile carriers, and industry watchdogs increase scrutiny around promotional messaging, licensed cannabis and hemp businesses must ensure airtight compliance—especially with the TCPA (Telephone Consumer Protection Act), A2P 10DLC (Application-to-Person 10-Digit Long Code) registration, and SHAFT rules enforced by carriers and the CTIA.
Below, we break down how the complex patchwork of regulations impacts your SMS programs, what’s changed for 2025, and the practical steps needed to maintain deliverability while sidestepping enforcement actions or costly fines.
The Federal Big Three: TCPA, 10DLC, and SHAFT (CTIA)
1. TCPA: Express Written Consent Is Non-Negotiable
The TCPA remains the principal federal law governing commercial text messages. For cannabis and hemp marketers, it’s the foundation of compliance:
- Express written consent is mandatory for any promotional or automated marketing texts. "Implied consent" (having someone’s number from a purchase or previous engagement) is not sufficient.
- The consent language must clearly and conspicuously disclose:
- That the consumer is agreeing to receive marketing texts
- Your business/brand identity
- Message frequency (e.g., "Recieve up to 4 messages per month")
- That message and data rates may apply
- How to opt-out (“Reply STOP to end”)
- Double opt-in is advised: Have consumers confirm consent after the initial opt-in to bolster your evidentiary record and reduce risk.
- Maintain robust consent records—including time stamps and IP address—to defend against complaints or chargebacks.
- Quiet hours (typically before 8am and after 9pm local time) should be respected in every campaign, matching state-specific rules where stricter.
Learn more about TCPA compliance from the FCC
2. 10DLC: Carrier Registration and A2P Scrutiny in 2025
A2P 10DLC registration requirements have been phasing in nationwide, and by 2025, every business sending application-originated SMS at scale must:
- Register your brand and campaigns with The Campaign Registry (TCR) or equivalent gateway. Carriers are outright blocking unregistered traffic.
- Submit use-case disclosures, sample messages, and specify opt-in/opt-out flows for pre-approval.
- Cannabis and hemp are categorized as high-risk traffic—expect additional scrutiny, potential for message blocking, and lower throughput rates.
- Carriers routinely monitor for SHAFT violations, and both SMS/MMS containing references to THC, CBD, or cannabis often get flagged. Even hemp-derived CBD is sometimes blocked, particularly if it appears to be marketed as a regulated product.
- Keep approval artifacts organized—in case a carrier or regulator requests documentation.
Read about A2P 10DLC compliance on Sakari’s 2025 Guide
3. SHAFT Rules & CTIA Best Practices
Carriers follow CTIA’s “SHAFT” guidelines, which block (and penalize) traffic touching:
- Sexually explicit content
- Hate speech
- Alcohol (most carriers block alcohol traffic by default unless age gating and controls are in place)
- Firearms
- Tobacco
Cannabis and hemp are treated by most carriers as a de facto SHAFT category—many will block your messaging outright even if conducted under state law. Age-gating (verifying the recipient is 21+) must be clearly documented and enforced for all programs, whenever allowed.
♦️ See SHAFT restrictions and forbidden content at 10DLC.org
Building a Bulletproof SMS Program for 2025: Compliance Best Practices
Opt-in Structure and Consent Management
- Use double opt-in as your default: Have users sign up via a webform or in-store, then confirm with a PIN or reply.
- Ensure clear and conspicuous disclosures: Brand name, frequency, HELP/STOP instructions, and a privacy link, ideally before opt-in is finalized.
- Capture and securely store consent artifacts: Timestamp, method of opt-in, consent language, and any follow-up confirmations.
List Hygiene and Suppression
- Maintain a suppression list of opt-outs and ensure carriers/gateways do not process messages to these numbers.
- Rigorously process opt-outs—ideally within minutes, but no later than 10 days per TCPA.
- Regularly audit for age verification and data minimization under privacy laws (e.g., CCPA, applicable state “mini-TCPA” statutes).
Message Content: Transactional vs. Promotional
- Where possible, shift to transactional messaging (order confirmations, ready-for-pickup alerts) to reduce compliance risk. These require a lower opt-in bar and are less likely to be blocked.
- Segment your lists: Only send promotional texts to recipients who have explicitly opted in for marketing.
- Avoid or tightly restrict keywords commonly flagged: “THC,” “cannabis,” “weed,” “edibles,” etc., and use discretion with CBD.
Documentation and Dispute Defense
- Archive campaign records, consent flows, and sample messages along with policy acknowledgements from stakeholders.
- For chargebacks or regulatory complaints, furnish records of consent (with time/date/IP data), opt-in method, and message logs.
Campaign Scheduling, Frequency, and Quiet Hours
- Respect state-imposed and federal quiet hours.
- Disclose message frequency up-front and honor it in campaign scheduling to avoid claims of unexpected or harassing outreach.
- Provide clear opt-out instructions on every touch.
Review Mini-TCPA and State Rules
Several states (e.g., Florida, Oklahoma, Washington) have enacted "mini-TCPA" laws with even stricter standards for consent, opt-out, or DNC compliance. Always tailor your program for each subscriber’s state of residence and coordinate with your SMS gateway/provider for real-time geofencing or list segmentation.
Detailed coverage of state-specific SMS marketing rules (TextMyMainNumber)
Heightened 2025 Enforcement: What to Watch For
Carrier Blocking and Content Scrutiny
- As of 2025, most major U.S. carriers identify and suppress unregistered, non-compliant, or SHAFT-violative cannabis/hemp messaging—sometimes with no notice to the sender.
- Use reputable SMS vendors with cannabis sector experience; coordinate on pre-approved templates and compliance reporting.
- Constantly monitor deliverability and maintain backup communications channels when campaigns are critical.
Litigation and Class Action Risk
- TCPA lawsuits and enforcement actions are trending upward, especially for businesses in regulated industries like cannabis and hemp.
- Fines for violations can exceed $500 per message, rising to $1,500 for willful non-compliance. Class actions quickly compound exposure.
- FTC, FCC, and state AGs are increasing audits—especially for multi-state operators.
What Cannabis and Hemp Businesses Should Do Next
- Audit current SMS programs for TCPA, A2P 10DLC, CTIA SHAFT, and applicable state law compliance.
- Update consent language, double opt-in processes, and suppression list management.
- Engage with legal counsel and compliance technology providers to automate recordkeeping and response to opt-out/dispute events.
- Train staff on evolving best practices and deliver ongoing compliance education.
Compliance is Your Best Investment
Marketing your dispensary or hemp business via SMS remains one of the best channels for customer engagement and retention—but only when compliance is prioritized at every stage.
Contact CannabisRegulations.ai for the most up-to-date regulatory insights, compliance management solutions, and resources for building resilient, effective, and legal SMS marketing campaigns in the cannabis and hemp sector.
Stay ahead of the rules—protect your license, your reputation, and your bottom line.
