SMS for business: the complete guide

Why SMS still wins.

Email open rates hover around a fifth of recipients; the average marketing email waits hours to be opened, if it’s opened at all. SMS is the inverse: the overwhelming majority of texts are read, most within minutes. It’s the closest thing business has to tapping a customer on the shoulder.

That power is exactly why it’s regulated. Every major market treats business texting as a privilege granted by the recipient, not a right of the sender — with consent requirements, opt-out rules and sender registration. This guide covers both halves: how to wield the channel, and how to stay on the right side of its rules.

A2P vs P2P: two kinds of texting.

Carriers divide the world in two. P2P (person-to-person) is humans texting humans — conversational, low-volume, high trust. A2P (application-to-person) is systems texting humans — appointment reminders, one-time passcodes, shipping alerts, marketing campaigns. Everything in this guide is about A2P, because that’s what “SMS for business” means.

The distinction matters because carriers filter A2P traffic aggressively. A long code blasting a thousand identical marketing texts looks exactly like the spam they’re paid to stop — which is why business senders get dedicated lanes (toll-free, short codes, registered 10DLC) with their own rules and throughput.

Choosing a sender type.

Your “from” number is a strategic choice, not a cosmetic one:

• Long codes (normal 10-digit numbers) are the conversational default. Customers can call them back, they feel human, and they’re cheap. Their weakness is throughput — about one message per second per number on US carriers — so they suit support chats and sales conversations, not blasts.
• Toll-free numbers can text too (in the US and Canada), with higher throughput once verified, and they carry brand weight. Great for alerts, reminders and notifications from a recognizable business identity.
• Short codes (5–6 digits) are the heavy machinery: ~100 messages per second, purpose-built for mass campaigns and high-volume 2FA. They’re also expensive and slow to provision (carrier approval takes weeks), so they’re for serious volume.

In the US, there’s a fourth lane that changed the game for everyone else: 10DLC — registered 10-digit long codes with approved throughput. It’s important enough to get its own guide: what is 10DLC.

Throughput: why speed limits exist.

Throughput limits aren’t carriers being difficult — they’re spam control. A number sending hundreds of texts a second is, statistically, either an emergency alert system or a spammer, and carriers throttle first and ask questions later. Legitimate bulk senders solve it the legitimate way: registered sender types with approved throughput, or pooling many numbers.

Plan backwards from your peak: how many messages in your busiest minute? Divide by your sender’s throughput to get the queue time. A 10,000-recipient campaign on a single long code at 1 msg/sec takes nearly three hours to drain — fine for a drip, disastrous for a flash sale. Size the lane to the moment.

The 160-character math.

SMS billing counts segments, not messages. One segment is 160 characters in the GSM-7 alphabet (basic Latin). Go longer and the phone silently splits your text into 153-character segments plus headers, reassembling them on receipt — and you’re billed per segment. A 200-character message is two segments; you just never see the seam.

The trap is encoding. One emoji, one smart quote, one character outside GSM-7, and the whole message switches to UCS-2 encoding: 70 characters per segment. That friendly “Hi 👋” just tripled your segment count. Professional senders strip or transliterate special characters — or budget for it knowingly.

Consent: the permission lifecycle.

The non-negotiable core of business texting, in every major market: no consent, no messages. The lifecycle looks like this:

• Opt-in must be clear and provable: a checkbox (unticked by default), a keyword texted to your number (“Text JOIN to 55512”), a form with explicit language. Keep records — “they gave us their number” is not consent to text.
• Confirm with a welcome message stating who you are, what they’ll receive, how often, and how to stop.
• Honor opt-out instantly. STOP, QUIT, CANCEL, UNSUBSCRIBE — and common variants — must suppress future messages immediately. This is the rule carriers enforce most aggressively.
• Respect quiet hours. Many jurisdictions restrict marketing texts to daytime hours; even where it’s not law, texting at 3am is how you lose subscribers.

In the US, the TCPA (Telephone Consumer Protection Act) backs all of this with serious penalties — statutory damages per violation are the reason every compliance officer you’ve ever met looks tired. Other regions have their equivalents (GDPR/ePrivacy in Europe, CASL in Canada, the Spam Act in Australia). The specifics vary; the principle doesn’t: permission first, always.

From send to seen.

Your API call is the start of a relay: your app → the provider’s messaging platform (queuing, segmentation, routing) → the carrier’s SMS center → the handset. Each hop returns a delivery receipt (DLR) — queued, sent, delivered, failed — and serious operations monitor them rather than assuming “sent” means “seen.”

Watch your DLRs the way you’d watch server logs: a rising failure rate means carrier filtering (check your registration and content), a dead number list means list hygiene problems, and undelivered 2FA codes mean customers locked out. Inbound matters too — two-way messaging on the same number turns notifications into conversations, which is where SMS quietly beats every other channel.

Questions, answered.

Where to go next.