If you are planning to text donors — even to reply to a donor who texted you first — US carriers require you to be registered under A2P 10DLC. Unregistered traffic is increasingly filtered, throttled, or blocked outright. Nonprofits are not exempt. This guide walks through what the rules actually are, what you have to submit, and where the landmines are.
Three overlapping rules
Three separate systems govern donor texting in the US. You have to satisfy all three:
- TCPA — federal law. Requires affirmative consent before sending any automated text to a mobile number.
- CTIA Messaging Principles & Best Practices— the wireless industry’s voluntary standard, enforced in practice by carriers.
- A2P 10DLC — the technical registration layer carriers require before they deliver your texts.
What A2P 10DLC actually is
“Application-to-person” (A2P) messaging is any text sent from software, not a human’s phone. “10DLC” stands for “ten-digit long code” — a normal phone number that your software uses to send and receive. Because carriers were being overwhelmed by unvetted automated traffic, the major US carriers (through an industry registry called The Campaign Registry, or TCR) now require every sender to register two things:
- A Brand — your legal entity, with EIN, registered address, and industry category.
- A Campaign — a specific messaging use case, sample messages, opt-in language, and opt-out keywords.
Nonprofits are not exempt
This is the single most common misconception. Being a 501(c)(3) does not exempt you from 10DLC. Nonprofits register the same way for-profit businesses do. The registration is about message integrity, not tax status. There isa distinct “Charity” campaign category, and nonprofits sometimes qualify for a lower-vetting path, but registration itself is mandatory.
Consent, the TCPA way
Under TCPA, you need prior express consent before sending any automated text — and prior express written consent before sending marketing. In text-to-give, donor intent is clean: the donor texted you first. That initial keyword is an opt-in for the transactional reply (the checkout link and receipt). It is not an opt-in to add them to a newsletter or a fundraising list. Mixing those is where nonprofits get sued.
STOP and HELP are non-negotiable
Every message program is required to respond to two keywords:
- STOP — immediately unsubscribes the user and sends one confirmation message. Any further message to that number is a TCPA violation.
- HELP — replies with program identification, support contact, and opt-out instructions.
Carriers programmatically test for these. If your platform does not handle them, expect suspension.
The registration process
Submitting to TCR normally looks like this:
- Your platform (or you directly) submits a Brand record with your EIN, legal name, address, and vertical.
- The brand is vetted — sometimes automatically, sometimes by a third-party vetting partner like Aegis or WMC. Vetting results in a score that determines your throughput limit.
- Next, you submit a Campaigndescribing the use case (e.g., “Charity”), with sample inbound and outbound messages, your opt-in flow, and the URL to your privacy policy.
- Once approved, the campaign is attached to your phone number and carriers begin accepting traffic.
Turnaround ranges from a few minutes (auto-approved low-volume) to a few weeks (manual review of large brands). Most nonprofits land in days.
Where platforms cut corners
- Running donor texts under a shared “generic” campaign. If your platform cannot name the campaign ID your messages go out under, that is a red flag.
- Not displaying a compliance disclosure at opt-in (“Message and data rates may apply,” message frequency, STOP/HELP instructions, and a link to privacy terms).
- Importing lists. You cannot purchase, rent, or upload phone numbers and text them under 10DLC. Consent has to be captured, logged, and auditable.
What AstraGive does about all this
We registered our 10DLC brand and a Charity campaign upfront, and every customer’s number gets provisioned under it automatically. That lets nonprofits skip the TCR paperwork entirely. Our platform also logs every opt-in, handles STOP and HELP responses at the platform level, and exposes the consent ledger for audit. See our Acceptable Use Policy and the Privacy Policy for the specifics.
If you want the short version: assume 10DLC applies to you, assume consent has to be logged, and assume your platform has to prove it. Vet on those three things and you will not get into trouble.