The SMS compliance rulebook for an agency texting across many sub-accounts

The message went out at 7:41 in the morning. It was a nurture text on a real estate sub-account, fired by a workflow that had run cleanly for weeks, and it landed on a contact in Sacramento at 4:41 their time because the contact had moved and nobody updated the record. Two days later the client forwarded a reply that was not a question about a listing. It was a screenshot of the message next to a paragraph the recipient had clearly copied from somewhere, quoting a statute and a dollar figure per text.

Nothing was broken. The snapshot was installed correctly, the number was registered, the workflow did exactly what it was built to do. That is the part worth sitting with. Registration is the gate that decides whether a text can send at all. Everything that decides whether it should have sent, whether you had consent, whether it was a legal hour, whether that person had already told you to stop, lives on a second track that most agencies never build and never audit. This briefing is that second track, written for an operator running texting across a stack of GoHighLevel sub-accounts who would rather know the rulebook than learn it from a demand letter.

Where SMS compliance actually lives

There is a habit of treating A2P 10DLC registration as the finish line. You register the brand, you register the campaign, the campaign clears, texts start arriving, and the compliance box feels ticked. It is not. Registration is the carriers deciding they will carry your application-to-person traffic. Compliance is a separate stack of obligations that sits on top of a registered number, and each layer of it has its own rule, its own enforcer, and its own place it lives inside GoHighLevel.

Consent is a record, not a checkbox

The foundational rule is that you may only text a person who agreed to be texted by that business, for the kind of message you are sending. Marketing texts need express written consent. The word that matters in an argument is record: not that consent existed in spirit, but that you can produce, for a specific contact, when and how they opted in and to what.

In GoHighLevel that record is assembled from a few places that do not automatically agree with each other. A form or survey submission carries a timestamp and the checkbox state at submit time. A contact imported from a spreadsheet carries whatever the importer decided, which is usually nothing. A contact created by a staff member typing a phone number in carries no consent evidence at all. The system will happily let a workflow text all three. The difference between them only surfaces when someone asks you to prove the first one was real, and by then the import and the manual add are indistinguishable from the consented submission unless you built the fields to tell them apart.

The registered brand is the surface you are really protecting

When an agency runs many clients on one registered brand, the thing under carrier scrutiny is not any single client. It is the brand. The Campaign Registry assigns a trust score during standard brand registration, and that score, not your intentions, governs how fast and how reliably messages move. According to Twilio’s own documentation, an unvetted or low-volume brand sends around one message per second per carrier, while a well-scored brand can send far more, and GoHighLevel’s help portal describes the same throughput mechanics for accounts on its platform. The score moves with engagement and complaints. That is the quiet structural fact behind everything below: the accounts share a reputation, so one account’s behaviour is every account’s problem.

Quiet hours run on the recipient’s clock

Marketing messages have a legal time window. Under the FCC rules that implement the Telephone Consumer Protection Act, solicitations may only be sent between 8am and 9pm in the called party’s local time, a point the Federalist Society’s write-up of the quiet-hours rule makes plainly, and one ActiveProspect summarises for texting as well. The window is set by where the recipient is, not where your server is or where the agency is. Several states are tighter. Florida, and a handful of others, close the window at 8pm rather than 9pm, per state-by-state breakdowns of the calling-hour rules. GoHighLevel has account and workflow settings for send windows, but they only protect you if they are keyed to the contact’s time zone and if the contact’s time zone is actually correct. A blank or wrong time zone field is a silent liability, because the workflow will still fire.

STOP and HELP are handled by the account, not the workflow

The last layer is opt-out. Every A2P campaign has to support standard opt-out and help keywords, a requirement the CTIA Messaging Principles codify and carriers enforce through the registration itself. GoHighLevel intercepts a STOP reply and adds the contact to Do Not Disturb, which stops further automated sends on that channel. That mechanism is real and it is the right default. What it does not do is think about your obligation across the whole account. It does not stop a staff member from manually texting a DND contact, it does not reason about a contact who exists twice, and it does not travel with a person who gets moved to another sub-account. Opt-out is a state you own, and the platform handles the reflex, not the ownership.

The rules, in the order they get enforced

An operator does not need the statute memorised. They need the short version of who enforces what, and where each rule lives in the tool, so it can be checked. This is that table.

Two rows deserve their exact numbers. The opt-out timeline changed on 11 April 2025: businesses now have to honor a revocation within 10 business days, down from the older 30, and a request in any reasonable form counts, so stop, quit, cancel, unsubscribe, end and revoke are all the same instruction, as law-firm guidance on the new opt-out rules spells out. And SHAFT, the content that carriers restrict regardless of consent, stands for Sex, Hate, Alcohol, Firearms and Tobacco, the five categories the CTIA framework treats as off-limits for standard A2P traffic. A cannabis dispensary snapshot is not a snapshot problem; it is a category problem the carrier decides.

Where it breaks across many sub-accounts

Any of these can go wrong on a single account. What makes an agency’s exposure different is that the same mistake, made once, rides a shared brand into every account. Here are the five that recur, what the operator sees, what is actually wrong, and the fix.

Consent captured in one account, texted from another

You onboard a new client, and to give them a fast start you copy a segment of contacts from an existing account that operates in the same niche. The texts send. Nobody objects for a week. What is wrong is that consent belongs to the business the contact agreed to hear from, and it does not transfer to a different brand because the two happen to share an agency. You have created a list with no valid consent behind it and pointed a registered number at it. The fix is a rule you enforce before the convenience tempts you: no contact moves into a sub-account for texting unless the consent came from that business. A dormant list a client hands you is re-permissioned through a reactivation sequence that leads with a clear opt-in, not blasted on day one.

The nurture that fires before 8am somewhere

Your workflow send window is set, but it is set in the account’s time zone, and the contact lives two zones west with a blank time zone field. GoHighLevel falls back, the message fires at what is 7:40 in the morning for the recipient, and you have sent a marketing text outside the legal window. The operator sees a normal, successful send in the workflow history. What is wrong is invisible in that view because the workflow did its job. The fix has two parts. Populate and trust the contact time zone at capture, from the form or from the area code as a fallback, and set the workflow window against the contact’s zone, not the account’s. Then spot-check: pull a handful of recent marketing sends, look at the recipient’s local time, and confirm none landed before 8am or after 9pm.

STOP caught by the workflow but not the account

A contact replies STOP. GoHighLevel adds them to Do Not Disturb, and automated messages stop. A month later the same person gets a text, because a staff member opened the conversation and sent a manual message, which DND does not block, or because the contact was re-imported under a slightly different record and the new record never carried the DND state. The operator sees an angry reply and cannot understand how it happened after the opt-out. What is wrong is that opt-out was treated as a workflow event rather than an account-wide fact about a person. The fix is to treat DND as sacred: train staff that a DND contact is off-limits on every channel, dedupe aggressively so one human is one record, and audit for messages sent to DND contacts as a standing check rather than a surprise.

One client’s cold list drags the whole brand’s trust score down

A client insists on importing a purchased list and texting it. You allow it. The list has stale numbers and no consent, complaints and failures spike, and the trust score on the shared brand falls. Now every other client on that brand sends slower and gets filtered more, because carriers read the brand, not the individual client. The operator running the other accounts sees their delivery quietly degrade and has no idea why. What is wrong is a shared reputation with an unguarded door. The fix is a policy, not a setting: you refuse the bad list, or you isolate the offending client on their own brand so their behaviour cannot tax the accounts that are clean. Saying no to a client’s bad list is protecting your other clients, and it is worth framing it to them that way.

The reassigned number

A number that consented to be texted six months ago now belongs to someone else, because carriers recycle disconnected numbers. Your record still says consent. The new owner did not agree to anything, and a text to them is a text to a stranger. The operator sees nothing until a complaint arrives from a name that does not match the contact. What is wrong is that consent has a shelf life you are not tracking. The fix is hygiene: watch for hard failures and unexpected replies as signals that a number changed hands, and let a long-dormant contact re-confirm before you resume texting rather than assuming the consent from last year still points at the same person.

What non-compliance actually costs

The numbers here are not softened, because the reader is deciding whether to spend real hours building consent and opt-out discipline into a snapshot, and the honest comparison is against the downside.

Start with the statutory exposure. The TCPA carries damages of $500 per violating message, rising to $1,500 for a willful violation, a figure the quiet-hours and calling-hour guidance states directly. Per message. Run the arithmetic on a single mistimed nurture blast. Assume a client list of 2,000 marketing contacts, and assume a workflow fired the send an hour before the legal window opened for the roughly one in five who sit in a western time zone. That is 400 messages. At the floor of $500 each, the exposure on that one send is $200,000, and at the willful rate it is $600,000. Change the assumptions to your own list and the shape does not change: the number is large because the penalty is per message and lists are big.

Now the throughput cost, which is quieter and hits accounts that did nothing wrong. Trust score governs messages per second. Take a legitimate 5,000-contact announcement a client wants out. On a healthy brand sending at, say, 75 messages per second per carrier, that blast clears in a little over a minute. On a brand whose score has collapsed to the roughly one message per second an unvetted or damaged brand gets, per Twilio’s throughput tables, the same 5,000 messages take more than 80 minutes to drain, and a share of them get filtered on the way for content review. The math is just division: 5,000 divided by 75 is about 67 seconds; 5,000 divided by 1 is 5,000 seconds. The point is that the difference between a good brand and a taxed one is not cosmetic. It is the difference between a campaign that lands at lunchtime and one that trickles out through the afternoon into a filter.

Set those against the cost of building the discipline: a few custom fields, a consent-aware capture flow, correct time zones, an opt-out audit habit, and a policy of refusing bad lists. Hours, once, per account. The exposure it removes is measured in hundreds of dollars per message and in the delivery of every other client on the brand.

The objections worth answering

“We are registered, so this is handled.” Registration and compliance are different layers, and this is the objection that costs agencies the most, because it feels reasonable. Registration is the carrier’s decision to carry your traffic. It contains no consent record, no clock, no opt-out logic tied to a specific human. Every failure mode above happens on a fully registered number. Treat registration as the price of entry and compliance as the thing you actually operate.

“GoHighLevel handles STOP, so opt-out is covered.” It handles the reflex, and the reflex is genuinely useful. What it does not cover is the manual message to a DND contact, the duplicate record that never inherited the opt-out, the contact moved between sub-accounts, or the full breadth of opt-out language the April 2025 rules require you to honor. Opt-out is a state you own across the whole account. The platform is one input to it, not the whole of it.

“This is fear-selling. Why should we build it with you rather than ignore it?” Fair, and here is the honest version. You do not need us to be compliant. The custom fields, the time-zone hygiene and the DND discipline are things a careful operator can build without buying anything, and if you have the hours and the attention, build them. What we sell is the hours back. Our snapshots ship with the consent-aware capture and opt-out structure already wired, and agency account setup handles A2P and email-domain configuration inside the free installation support that comes with a snapshot, which is 12 hours of dedicated help to be used within 10 days of purchase. Once those hours are spent, further work is quoted. What we do not do is pretend a snapshot makes you compliant on its own. Compliance is an operating practice, and no file you import can run it for you.

If you want the discipline standing before your next rollout rather than after your next complaint, the insurance agency snapshot, the mortgage broker snapshot and the other high-volume texting niches in the library are built with the consent and opt-out plumbing in place, and the pricing page lays out where a single snapshot ends and managed help begins. Your share link lands within 24 business hours of purchase confirmation, and the install is free. The rulebook above is yours either way.