Overview

To incentivize prompt remediation of severe short code compliance violations and protect consumers from spam and fraud, Twilio is introducing a new monthly Short Code Non-Compliance Fee. This fee specifically targets US short codes violations that fail to resolve critical issues following compliance outreach.

These changes will automatically be applied to your Twilio account on the effective date if your short codes remain in a non-compliant state.

What You Need To Know

Effective January 1, 2027, Twilio will begin charging a monthly non-compliance fee for any short code that has open, unremediated compliance violations and fails to act upon Twilio's compliance remediation requests.

This is a Twilio-initiated fee, distinct from carrier-imposed pass-through fines.

Note: This is a flat monthly fee assessed per non-compliant short code. This charge is separate from, and may be applied in addition to, any standard per-message carrier fees or carrier pass-through penalties.

What Triggers a Short Code Non-Compliance Fee?

A short code program may be charged a non-compliance fee if an audit determines it deviates from its approved use case, or if it violates the Twilio Messaging Policy, the Twilio US Short Code Guidelines, the CTIA Short Code Monitoring Handbook, or carrier guidelines such as the T-Mobile Code of Conduct.

Specifically, this fee targets compliance where customers fail to resolve open compliance tickets. Severe violations that commonly trigger non-compliance actions include:

1. Severe Consent and Opt-Out Failures (Severity 0)

• CTIA Violation: Failure to adhere to mandatory consumer consent (opt-in) and revocation (opt-out) rules.
• Specific Triggers: Sending unsolicited promotional messages without express written consent, buying/sharing opt-in lists, or failing to honor mandatory opt-out requests. Please note: an audit, and subsequently non-compliance fees, could also be triggered from keywords (such as HELP or STOP) not responding compliantly to end-users.

2. Non-Compliant Call to Action (CTA) and Legal Policies

• CTIA Violation: Failure to properly inform consumers of the messaging program details before they consent, or failing to maintain required legal documentation.
• Specific Triggers:
  • Call-to-Action (CTA): The opt-in CTA is missing mandatory compliance elements (e.g., program name, "Message and data rates may apply", or message frequency).
  • Terms of Service (ToS): The ToS is missing, incomplete, or does not accurately reflect the messaging campaign.
  • Privacy Policy: The Privacy Policy is missing, not linked clearly from the CTA, or indicates that consumer opt-in data will be shared/sold to third parties (which is strictly prohibited). 

3. Phishing, Smishing, and Social Engineering (Severity 0)

• CTIA Violation: Deceptive messaging designed to steal personal information, credentials, or financial data.
• Specific Triggers: Sending fraudulent links or impersonating trusted brands (including simulated phishing sent for internal security testing).

4. Illegal Content (Severity 0)

• CTIA Violation: Content that is not legal at both the federal level and in all 50 states.
• Specific Triggers: Promoting or selling cannabis, marijuana, CBD products, illegal prescriptions, or illicit solicitation.

5. SHAFT Violations (Sex, Hate, Alcohol, Firearms, and Tobacco) (Severity 0)

• CTIA Violation: Transmitting prohibited content or failing to implement proper legal safeguards for restricted content.
• Specific Triggers: Promoting adult content, hate speech, firearms, or sending alcohol/tobacco promotions without a strictly enforced age-gate.

6. Messaging Program Evasion

• CTIA Violation: Attempting to bypass carrier filtering or monitoring systems.
• Specific Triggers: Using techniques like "snowshoeing" (spreading similar messages across multiple numbers to evade spam filters) or unauthorized number recycling.

What to do next

We are here to support you in bringing your traffic into compliance to avoid these fees.

1. Check for Open Support Tickets: If your short code is flagged for compliance violations, Twilio's Compliance Operations team has already reached out via Zendesk. Search your support history for open audit tickets requiring action.
2. Remediate Immediately: Work with Twilio Compliance Operations to correct your opt-in flows, terms of service, message content, or keyword responses. Once you make the required updates, Twilio will re-audit the code and close the ticket once fully remediated.
3. ISV Responsibility: Independent Software Vendors (ISVs) are considered the "content provider" and are held responsible for the traffic of their end-users. Twilio will charge the ISV for non-compliant short codes, though ISVs may independently pass the fee down to their customers.

If you have questions about how to resolve an open compliance ticket or need clarification on CTIA guidelines, please reply directly to your open compliance ticket, or reach out to your Account Executive.