What is A2P 10DLC? How it compares to toll-free and short code

What is A2P 10DLC? The US business-texting registration chain explained

That registration is important, but it is not the same thing as recipient consent. A business can have a correctly registered Brand and Campaign and still lack permission to message a particular person. The reverse can also happen: a customer can have clearly opted in, while the sender's 10DLC route is not yet properly registered or associated. Understanding A2P 10DLC therefore requires keeping 2 questions separate:

1. Is this sender and use case registered for the US 10DLC route?
2. Is this recipient permitted to receive this message from this sender for this campaign?

The mental model: 2 ledgers have to agree

A2P 10DLC is easiest to understand as a registration control plane sitting beside the actual message-delivery path.

The registration side identifies who is sending and what they intend to send. The Campaign Registry describes the Brand as the company or entity the end user believes is sending the message, and a Campaign Service Provider, or CSP, as a party that works with Brands to create and launch messaging Campaigns. TCR provides the registry where CSPs register Brands and Campaigns.

The delivery side is the path the message takes from an application, through messaging-provider and carrier infrastructure, to the recipient. TCR is not a hop that every text message travels through. It is a registry that supplies identity and use-case information to the ecosystem. Recipient permission sits beside both. It is not automatically created by a registry approval.

What A2P and 10DLC mean separately

A2P means application-to-person. The recipient is getting an SMS or MMS from software rather than from another individual engaged in normal person-to-person texting.

10DLC means 10-digit long code, the familiar US local-number format. A business can also send US application messaging over other sender types, such as toll-free numbers or short codes, but those are not part of the A2P 10DLC registration system.

The framework matters because ordinary long-code routes were not originally designed as an unbounded business-messaging channel. US carriers introduced A2P 10DLC to make business messaging over that route more attributable and controlled.

If an ecommerce platform sends an order update, abandoned-cart reminder, marketing promotion, or support notification through an application using a US long-code number to a US recipient, the traffic is in the kind of application-originated category the 10DLC framework is intended to govern.

Treat registration as a state machine, not a checkbox

A reliable messaging system should not store A2P 10DLC as one boolean such as registered = true. At minimum, keep separate state for:

This makes failures diagnosable. "Brand verified, Campaign approved, number association pending" tells an operator what to fix. "Registered" does not. It also prevents a dangerous inference in application code: registry approval should never flip a customer's consent state to true.

Who actually approves a Campaign?

The answer is more nuanced than "The Campaign Registry approves it." TCR says it is the centralized registry, but it also explicitly states that TCR does not review, approve, or reject Campaigns. Campaign approval is performed by CSPs and their upstream connection partners. TCR also says approval time varies by use case and by CSP, and can take longer when more partners are in the connection chain. That has 2 practical consequences.

First, do not promise a universal approval time such as "all 10DLC registrations take 3 days" or "10 business days." The correct estimate depends on the provider, the use case, whether manual vetting is involved, the connection chain, and whether the submitted data is complete.

Second, when a Campaign is rejected, the actionable rejection reason is normally obtained through the CSP or provider used to register it. TCR directs rejected senders back to their CSP for remediation guidance.

A current provider-specific example: privacy and terms URLs

Provider implementations change, which is why fields should be described with scope and date rather than as eternal properties of "10DLC."

Twilio announced that, starting June 30, 2026, new A2P 10DLC Campaign registrations submitted through its Messaging REST API must include both PrivacyPolicyUrl and TermsAndConditionsUrl. Twilio says a new Campaign request without both fields is rejected during Campaign review. Its announcement also says this specific API-field change does not retroactively affect existing registered Campaigns.

That is a Twilio implementation requirement for new submissions, not evidence that every CSP exposes the same API fields or that TCR suddenly became the author of those web pages. The durable lesson is to re-check the current provider registration schema before building a fixed form into your product.

10DLC vs toll-free vs short code

These sender types can all be used for application messaging in the US, but they are not interchangeable registration labels. Do not copy throughput numbers, fees, or approval-time promises from one route into another. Those values can be carrier- and provider-specific and change over time.

Why a registration gets rejected or stalls

The fastest way to troubleshoot is to identify which object or state is failing.

Brand verification fails

Check whether the legal entity information matches the tax identifier and authoritative records. Do not assume the storefront name is the legal name.

Campaign review fails

Check whether the description and samples accurately explain the messaging program, whether the opt-in path can be inspected, and whether help and opt-out behavior are clear. Resolve the provider's actual rejection reason instead of resubmitting the same vague text.

The provider asks for privacy or terms pages

Confirm whether this is a current provider requirement and whether the pages are publicly accessible and match the business and messaging program. For Twilio API submissions after its June 30, 2026 change, both URLs are explicit fields for new Campaigns.

Campaign is approved but messages are still not ready to send

Verify that the intended 10DLC number is actually associated with the Campaign or provider messaging service. Approval and number association are separate states.

Messages are registered but still filtered or fail

Registration can improve the route's legitimacy and, in provider implementations, can affect filtering and throughput. It does not make delivery unconditional. Diagnose the carrier/provider error, content, traffic behavior, recipient state, and sender configuration rather than assuming "approved" means "guaranteed."

The business changes its use case

Do not assume a Campaign registered for one purpose automatically describes materially different traffic forever. Review the provider's current rules before expanding or changing the messaging program.

Worked example

Imagine Example Store wants to use one US local number for transactional order updates and promotional messages.

• A weak implementation treats the number itself as the permission boundary:

Number is registered -> customer can receive SMS

• That model loses the distinction between infrastructure and permission

• A stronger implementation keeps the layers separate:

Business identity -> Brand verificationMessaging program -> Campaign registrationSender -> number associated with approved CampaignRecipient -> separate consent state for the relevant programMessage -> send only when route state and recipient state both allow it

• Suppose the Brand verifies successfully and the Campaign is approved. The number is associated. The route is now operationally ready

• Customer A explicitly opted in to shipping updates. Sending an order-status message can be evaluated against that permission record

• Customer B bought once but never agreed to marketing texts. Campaign approval does not turn that purchase into marketing consent

Customer C previously opted in but sent STOP. A valid route does not override the opt-out. The registration data and consent data answer different questions, and the system should keep both.

What A2P 10DLC requires

What passes and what does not

• This is the distinction most worth remembering
• A2P 10DLC registration describes the route, sender, and declared messaging program. Recipient permission describes whether a particular person has agreed to receive a particular class of messages from that sender
• CTIA's Messaging Principles and Best Practices says non-consumer message senders should provide clear calls to action, send only after opt-in where applicable, retain consent evidence, make opt-out available, and treat an opt-in as specific to the intended Campaign and message sender. It also says opt-in lists should not be rented, sold, or shared for messaging
• A useful consent record can include information such as:
• phone number
• timestamp
• acquisition method
• the wording or experience used to obtain consent
• the Campaign or messaging program covered
• enough identity/session evidence to investigate disputes
• opt-out state and timestamp
• Those records solve a different problem from Brand or Campaign registration
• This page is not a substitute for legal advice or a dedicated TCPA/consent guide. Laws, carrier rules, CTIA guidance, provider policy, and the facts of a particular program can impose different or additional requirements. The operational point is simpler: never treat route registration as proof of recipient permission

Common mistakes

1. Treating A2P 10DLC as a legal-consent certificate
2. Saying TCR itself universally approves or rejects every Campaign
3. Promising one fixed registration timeline across providers and use cases
4. Using a trade name when the Brand-verification flow needs the legal entity tied to the tax ID
5. Treating Brand verification, Campaign approval, and number association as one status
6. Registering a Campaign description that does not match the messages actually sent
7. Assuming more phone numbers automatically create more throughput
8. Reusing a recipient's consent for a different Campaign or sender without checking whether that permission actually covers it
9. Copying one provider's API fields, fees, or limits into a universal definition of 10DLC

Questions we get asked