BFCM 2026 SMS Marketing Rules: Consent, Quiet Hours and Carrier Registration for Shopify Fashion Brands

Quick answer: Before you send a single Black Friday text, make sure four things are true. First, every US subscriber gave prior express written consent for marketing texts, and that consent was not a condition of purchase. Second, your sending number is registered (A2P 10DLC brand and campaign, or a verified toll-free number). Third, your messages respect quiet hours: federal rules allow 8am to 9pm in the recipient's local time, but Florida, Oklahoma and Maryland cut that to 8pm and cap same-subject messages at three per 24 hours. Fourth, opt-outs are honoured quickly, within 10 business days at most under current FCC rules. UK and EU sends need consent or a valid soft opt-in, and UK fines for breaches rose sharply in 2026.

Black Friday falls on 27 November 2026 and Cyber Monday on 30 November. For many fashion brands SMS is the fastest channel of the week: short, urgent, read within minutes. It is also the channel with the sharpest legal edges, because US texting law lets consumers sue directly and carriers can block unregistered traffic outright.

This guide is a practical checklist for Shopify fashion brands sending to the US, UK and EU, built from the regulations themselves, carrier guidance and the help documentation of the tools most brands use. It is general information, not legal advice; if you send at volume, have counsel review your consent language. If email is your bigger channel, read our companion guide to BFCM 2026 email deliverability first.

The US rules that matter for marketing texts

Consent: prior express written consent

Under the FCC's TCPA rules (47 CFR 64.1200), marketing texts sent with automated systems require "prior express written consent." The rule defines that as an agreement in writing, which can be electronic, that names the phone number and makes clear the person is "not required to sign the agreement" as a condition of buying anything.

In practice that means a clear opt-in at the point of collection, with your brand name, what kind of messages they will get, and that consent is not a condition of purchase.

What happened to "one-to-one consent"

In January 2025, the US Court of Appeals for the Eleventh Circuit vacated the FCC's "one-to-one consent" rule, which would have required consent to be given to a single named seller, as law firm Kelley Drye reported. The existing written-consent rules still apply. If you collect numbers through lead forms, giveaways or partners, you still need valid written consent for your brand.

Revoking consent: what changed, and what is coming

Since 11 April 2025, consumers can revoke consent "by any reasonable method," and senders must honour it within 10 business days, according to law firm Manatt. On 30 September 2026, the FCC adopted a further order. Kelley Drye reports that it lets senders designate an exclusive opt-out method, such as replying STOP, as long as it is clearly disclosed, and drops the separate "revoke-all" requirement. The changes take effect 30 days after publication in the Federal Register, which may fall close to BFCM.

For peak season, treat this as fixed: honour STOP and natural-language opt-outs (stop, end, unsubscribe, cancel, quit) immediately, and never send a marketing text to someone who has opted out.

Quiet hours: federal and state

The FCC's rule bars telephone solicitations "before the hour of 8 a.m. or after 9 p.m." in the recipient's local time. Several states are stricter. According to summaries from law firms Jones Day, Benesch and Klein Moynihan:

• Florida (Telephone Solicitation Act): 8am to 8pm, and no more than three messages to the same person on the same subject in 24 hours.

• Oklahoma (since November 2022): no sends between 8pm and 8am, the same three-per-24-hours limit, and a private right of action of $500 per violation, trebled if wilful.

• Maryland (Stop the Spam Calls Act, since January 2024): no sends before 8am or after 8pm, and a three-per-24-hours limit on the same subject.

Klaviyo's quiet hours guide also notes the Florida window and explains that for US flows it determines time zone by the phone number's area code unless a better profile time zone exists. For a Black Friday campaign, the safest single rule is to send between 8am and 8pm in the recipient's local time and cap promotional texts at three per day.

Carrier rules: register before you send

The law is only half of it. Carriers enforce their own rules, and unregistered traffic is simply blocked.

• A2P 10DLC (standard long-code numbers): brands register a Brand and one or more Campaigns with The Campaign Registry. Twilio's documentation states carriers "block any A2P messaging traffic to US recipients" from unregistered 10DLC numbers, whatever the volume.

• Toll-free numbers: since November 2023, Twilio has required all US-bound messages from toll-free numbers to be fully verified, and blocks unverified traffic.

If your SMS platform handles registration for you, confirm it is complete now, not in November. Registration reviews can take time, and the week of Black Friday is the worst time to find out a campaign was rejected.

CTIA's opt-in and opt-out standards

The CTIA Messaging Principles and Best Practices (2023) are what carriers expect. Your call to action should tell consumers the program or product description, make opt-in and "any associated fees or charges" clear, and include terms such as how to opt out, customer care contact and your privacy policy. The opt-in confirmation message should include the program name, help instructions, how to opt out, and that messages recur and how often. CTIA says "standardized 'STOP' wording should be used." The familiar "Msg and data rates may apply" line is industry-standard wording that satisfies the fees disclosure.

Shopify and Klaviyo: what the tools do and do not do for you

• Shopify checkout opt-in. In Shopify, Settings, Checkout, Marketing opt-in, you can enable SMS consent collection at checkout. Shopify requires a terms of service and privacy policy first, saves the preference only when the customer submits checkout, and reminds merchants to "send promotional content only to customers who have agreed."

• Shopify Messaging. Shopify's changelog (December 2025) says merchants can now "create, send, and track SMS directly from Shopify" in select regions, with built-in compliance safeguards.

• Klaviyo. Klaviyo syncs Shopify checkout SMS consent for first-time SMS subscribers and strongly recommends double opt-in. Its quiet hours settings stop flow messages sending outside preferred hours.

None of these tools makes your consent language compliant on its own. A checkbox at checkout is a mechanism; whether the wording meets TCPA and state rules is your responsibility.

UK and EU: consent or soft opt-in

In the UK, SMS counts as "electronic mail" under the Privacy and Electronic Communications Regulations (PECR). The ICO says organisations "must have consent before sending unsolicited electronic mail marketing to individual subscribers," unless the soft opt-in applies. The soft opt-in only works when you collected the number while selling or negotiating a sale, you market only your own similar products, and you offered an opt-out at collection and in every message.

The stakes went up this year. The Data (Use and Access) Act 2025 raised the maximum PECR fine from £500,000 to £17.5 million or 4% of global annual turnover, and the ICO confirmed those provisions commenced on 5 February 2026.

In the EU, Article 13 of the ePrivacy Directive requires prior consent for electronic marketing, with a similar soft opt-in for existing customers. Consent must meet the GDPR standard: "freely given, specific, informed and unambiguous." Member states add their own rules; Klaviyo notes, for example, that France bars marketing sends before 8am, after 10pm, and on Sundays and public holidays.

A six-week SMS checklist for BFCM 2026

• Week of 19 October: audit consent sources. Remove any numbers without documented written consent (US) or consent or soft opt-in (UK and EU).

• Week of 26 October: confirm A2P 10DLC or toll-free verification is complete. Check your opt-in language against CTIA's checklist.

• Week of 2 November: set quiet hours to 8am to 8pm recipient time and a three-per-day cap on promotional texts. Test STOP and natural-language opt-outs end to end.

• Week of 9 November: segment by country and US state so Florida, Oklahoma and Maryland subscribers follow the stricter rules automatically.

• Week of 16 November: draft and approve every Black Friday and Cyber Monday message, including brand name and opt-out in each.

• Cyber Week (23 to 30 November): monitor opt-out rates and carrier errors daily, and pause any send that is spiking complaints.

FAQ

Do I need written consent to send marketing texts to US customers?

Yes, for marketing texts sent with automated systems. The FCC's TCPA rules require prior express written consent that names the number and says consent is not a condition of purchase. Electronic signatures and checkboxes can count if the wording is right.

What time can I send Black Friday texts?

Federally, between 8am and 9pm in the recipient's local time. Florida, Oklahoma and Maryland limit marketing texts to 8am to 8pm and cap same-subject messages at three per 24 hours, so 8am to 8pm is the safer window.

What is A2P 10DLC registration?

It is carrier registration for business texting from standard 10-digit numbers. Brands register a brand and campaign with The Campaign Registry. Unregistered traffic to US recipients is blocked.

How fast do I have to honour an SMS opt-out?

Under current FCC rules, within 10 business days of a request made by any reasonable method. In practice, honour STOP and similar replies immediately.

Can I text UK customers who bought from me without asking first?

Only under the soft opt-in: you collected the number during a sale, you market only similar products of your own, and you offered an opt-out at collection and in every message. Otherwise you need consent.

Does Shopify's checkout SMS checkbox make me compliant?

It collects consent, but compliance depends on your wording, disclosures and how you send. Shopify itself reminds merchants to send promotions only to customers who agreed.

Make every compliant message count. Elara for Commerce is an AI shopping assistant for fashion brands on Shopify. When a subscriber clicks through from your Black Friday text, Elara greets them, understands the occasion they are shopping for, and builds complete outfits from your catalog, with virtual try-on and revenue attributed per conversation. It integrates with Klaviyo. Book a demo or start the 30-day free trial.