10DLC registration for cannabis dispensaries

10DLC registration is the carrier approval a dispensary needs before its text messages will reliably reach customers, and cannabis is one of the hardest categories to get approved. This guide covers what 10DLC is, what the carriers check, which words and offers get campaigns rejected, how loyalty texts are treated, and what happens if you send without registering.

What 10DLC is, and why cannabis campaigns get rejected

10DLC is the US system for registering business text messages sent from ordinary 10-digit phone numbers, and cannabis campaigns get rejected because carriers class cannabis as restricted content. The name stands for 10-digit long code. It covers A2P messaging, which means application-to-person: any text sent by software rather than typed by a person on a handset.

Two bodies sit behind the rules. CTIA is the trade association for the US wireless industry, and its Messaging Principles and Best Practices, published in May 2023 to replace the 2019 edition, is the document carriers point to when they filter a message. The Campaign Registry, usually shortened to TCR, is the database where your business and your message programs are registered before carriers will carry them.

Cannabis sits inside the content group the industry calls SHAFT, short for sex, hate, alcohol, firearms and tobacco. Cannabis and CBD are grouped with tobacco, which is why a licensed dispensary in a legal state still faces the same scrutiny as categories that are illegal everywhere. Cannabis remains a Schedule I substance under federal law according to the US Drug Enforcement Administration, and carriers write their content rules to federal law, not to your state licence.

What carriers check before they approve a dispensary campaign

Carriers check that your business is real, that your consent flow is visible, and that your sample messages match what you say you will send. Registration happens in two parts, and both have to pass.

Brand registration identifies the business. You supply the legal business name exactly as it appears on your tax filing, your EIN, the registered address, a working website and a contact. Mismatches between your EIN record and what you type are one of the most common reasons a submission stalls.

Campaign registration describes the messages. You supply a use case, a description of the program, sample messages and the opt-in flow. Reviewers want to see the actual point where a customer consents, so a screenshot of the sign-up form or a link to the page carries more weight than a description of it. Since January 2024, brands have been required to show a compliant call to action for every consent method they offer, documented in provider registration guidance.

Vetting is optional and sets your throughput, which is the number of messages per minute the carriers will accept from you. Brands that skip vetting get conservative default limits. The Campaign Registry added Authentication Plus, an identity layer for brand registration, on 17 October 2024.

Registering as a dispensary, delivery service or CBD shop

The registration path is the same for a storefront dispensary, a delivery service and a CBD shop, and so is the obstacle: your messaging provider has to be willing to submit a cannabis use case in the first place. Many will not.

Before you spend time on paperwork, ask a prospective provider three questions. Will you submit a cannabis or CBD use case to TCR under our legal name. What happens to our program if a carrier suspends the campaign later. What do you offer as a fallback channel if messages stop delivering.

Have this ready before you start:

• Legal business name and EIN, matching your tax record exactly
• Registered business address and a working website
• A named contact with a business email address
• The page or form where customers opt in, with the consent language visible
• Three to five sample messages that match the program you are describing
• Your privacy policy, reachable from the opt-in page

Delivery services and CBD shops are registered the same way. A CBD-only shop is sometimes approved where a THC retailer is not, but that is a carrier decision on the day, not a rule you can rely on.

Words and offers that fail carrier review

Campaigns fail review most often on the offer rather than a single banned word, and the pattern is consistent: anything that reads as a price promotion on a controlled product draws scrutiny. Carriers do not publish a word list, so treat the categories below as the practical filter.

The content that draws rejections and filtering:

• Product names and strain names in a promotional context
• Prices attached to product, such as ounce deals or bundle pricing
• Words that describe intoxication or potency
• Discount language stacked with product language in the same message
• Links that redirect, use link shorteners, or point to a domain that does not match your registered brand
• Emoji that stand in for product, which reviewers read as evasion

The mechanics that draw rejections:

• An opt-in the reviewer cannot see or verify
• Missing disclosures at the point of consent, meaning brand name, message frequency, "message and data rates may apply", and STOP and HELP instructions
• Sample messages that do not match the declared use case
• Pre-checked or forced consent boxes
• A campaign description too thin to tell a reviewer what the program actually sends

A message that clears registration can still be filtered later. Registration buys you a lane, and it does not buy you delivery.

How loyalty program texts fit under 10DLC

Loyalty texts are treated as marketing under 10DLC whenever they carry an offer, even when the message is about points the customer already earned. A balance update on its own reads as transactional. The same message with "come in this week and use them" reads as promotional, and the promotional read is the one carriers apply.

Consent is separate from enrolment. Joining a loyalty program is not consent to receive marketing texts, so your sign-up flow needs its own, visible opt-in for SMS with the disclosures listed above. Keeping the two decisions separate is also what lets a member stay in the program after they opt out of texts.

Opt-out handling has tightened. The Federal Communications Commission's amendments to its consent rules under the Telephone Consumer Protection Act took effect on 11 April 2025 and cut the window for honoring a revocation from 30 business days to 10. The broader provision, which would require a business to treat one opt-out as covering all its message programs, is now set to take effect in January 2027.

This is where channel mix matters for a loyalty program. Wallet push, meaning a notification sent to an Apple Wallet or Google Wallet pass a customer has already added to their phone, is not carried by the mobile carriers and is not registered under 10DLC. It is not exempt from your state's rules on claims, warnings and disclosures, and it does not replace consent. It does mean a loyalty program can keep reaching enrolled members on a channel that carrier filtering does not touch.

What happens if you skip registration

Unregistered messages do not get delivered. US carriers moved from charging penalty rates on unregistered A2P traffic to filtering it outright from 1 February 2025, a change documented in carrier connectivity guidance last verified in July 2026.

The failure is quiet, which is what makes it expensive. Your sending platform reports the message as sent. The carrier drops it. You see no bounce, no error and no complaint, and the first signal is a campaign that produced nothing. Dispensaries often discover this months later while reviewing why text-driven revenue fell off.

There is a second cost. A campaign that is suspended or terminated for a confirmed violation follows the brand, and re-registering under the same EIN starts from a worse position.

How Sticky Cards handles registration for dispensaries

Sticky Cards manages the carrier registration for your texting number as part of the platform, so the brand and campaign submission is handled for you rather than left to you and a general-purpose messaging vendor. Setup and POS integration are included, billing is month to month, and there is no setup fee.

Registration is one channel of four. Sticky Cards runs wallet loyalty passes in Apple Wallet and Google Wallet, email, text and MMS, and wallet push on one journey canvas, reading from the POS you already run. That list includes Dutchie, Treez, Flowhub, Cova, Greenline, TechPOS, Breadstack, Shopify and WooCommerce, plus HubSpot and Klaviyo on the marketing side.

Klaviyo is worth naming here. Klaviyo does not allow cannabis SMS, so dispensaries running Klaviyo flows can keep them and add text, MMS and push steps through Sticky Cards rather than rebuild.