Why these four topics keep appearing in every procurement review
CPaaS compliance is the set of telecom regulations a platform has to operate inside so that your traffic keeps being delivered — and it resolves into four recurring topics: consent and calling-window law (TCPA), sender registration (10DLC and sender-ID schemes), caller-ID authentication (STIR/SHAKEN), and honoring opt-outs. Procurement teams ask about them because they determine two things a vendor's feature list cannot: whether your messages and calls reach recipients at all, and what liability a badly-run campaign creates.
These are the questions that arrive in every enterprise RFP and security questionnaire under the tooling rubric — the "what buyers ask in procurement" cluster — and they are evergreen: the statutes and carrier programs behind them change slowly, and each answer stays current for years. Glossary entries for the individual terms already answer the single-question version (TCPA, mini-TCPA, A2P 10DLC, STIR/SHAKEN, DNC); this guide is the long-form background that connects them, so an operator reading one page understands how the pieces interlock before they configure anything.
The section after each topic points at the operational controls. In Orbit those controls are tenant-owned: compliance is the customer operator's responsibility, and the platform's job is to give the operator working controls — registration flows, attestation, opt-out sync, configurable windows — rather than to legislate what the operator may do.
TCPA essentials: the US federal consent and dialing-window law
The Telephone Consumer Protection Act of 1991 (47 U.S.C. § 227) is the US federal law restricting calls and texts made with an automatic telephone dialing system or an artificial or prerecorded voice. Four provisions drive most day-to-day engineering decisions:
The 8 AM–9 PM calling window. Telemarketing calls and messages may only be placed between 8 AM and 9 PM in the recipient's time zone — not the sender's, and not the platform's. A call that is perfectly legal at 11 AM Eastern is a violation if it lands at 7:45 AM Pacific. Any voice or messaging system that schedules sends therefore needs per-recipient timezone resolution; when the timezone cannot be resolved, the conservative behavior is to hold the call. On Orbit this federal window is the one compliance guard the platform enforces globally rather than leaving to tenant configuration, precisely because the statutory penalty attaches per call; the details live in the state calling windows guide.
Prior express written consent. Marketing calls and texts using an autodialer or prerecorded voice require prior express written consent — a signed, dated agreement that names the business and the phone number and was not a condition of purchase. Informational messages (appointment reminders, delivery notices) to an existing customer generally run on the lighter prior express consent standard, but the consent record itself is what protects an operator in a dispute, so platforms build consent tracking in rather than treating it as a contract detail.
$500–$1,500 per violation. Statutory damages are $500 per violating call or text, trebled to $1,500 for willful or knowing violations — and TCPA claims are routinely brought as class actions. A single flawed consent or suppression process multiplied across a contact list produces liability out of all proportion to the messages sent, which is why operators treat the opt-out pipeline (below) as a hard correctness requirement rather than a UX nicety.
State mini-TCPAs. The federal baseline is not the only law in force. States including Florida, Oklahoma, and Washington have enacted their own equivalents — "mini-TCPAs" — with narrower windows (Florida restricts telemarketing to 8 AM–8 PM), different consent definitions, and private rights of action. An operation that targets US recipients needs a per-state overlay on top of the federal window, and the overlay has to be kept current as states legislate. See the mini-TCPA glossary entry for the term-level definition.
US 10DLC: brand, campaign, and The Campaign Registry
A2P 10DLC — Application-to-Person traffic over standard 10-digit long codes — is the US carriers' registration regime for business SMS. Before 10DLC, businesses sent application traffic over unregistered long codes designed for person-to-person conversation; carriers responded with aggressive filtering. 10DLC replaces that gray zone with a declared system:
- Brand registration identifies the legal entity sending — company name, EIN, address, contact points. Carrier vetting produces a trust score that gates throughput.
- Campaign registration declares what the brand sends — use case (marketing, 2FA, account notifications), sample messages, and the opt-in/opt-out flow description. A number cannot send carrier-grade traffic without a registered campaign attached.
- TCR — [The Campaign Registry](/de/glossary/tcr) — is the centralized registry the US carriers designated to hold brand and campaign records. Registration flows through it regardless of which platform submits the paperwork.
The operator-visible consequences: unregistered traffic is filtered or heavily throttled, throughput is tied to the campaign's declared use case and the brand's vetting score, and a campaign description that does not match actual message content is a takedown reason. In Orbit, 10DLC registration is a guided flow rather than raw paperwork — the step-by-step sequence is in the 10DLC registration guide, and the term-level definitions sit in the 10DLC brand registration and 10DLC campaign glossary entries.
STIR/SHAKEN: A/B/C attestation for outbound voice
STIR/SHAKEN is the FCC-mandated framework that cryptographically signs a call's caller ID so the terminating carrier can verify it was not spoofed. The originating provider assigns one of three attestation levels:
- A — full attestation. The provider knows the customer and knows the caller has the right to use the number. This is the level that lets a call through with its caller ID intact and is what carriers expect for legitimate business traffic.
- B — partial attestation. The provider knows the customer but cannot verify the right to the number (common when the caller-ID is not the provider's own number).
- C — gateway attestation. The provider cannot verify either leg — typical for traffic entering the network from an unknown origin. Downstream analytics engines treat C-level traffic as suspect and it is the most likely to be labeled or blocked.
Two consequences matter to operators. First, attestation is originating-provider behavior, not something a voice application can bolt on later — the platform that originates your calls decides what level you get, and the right to use a number must be provable to earn an A. Second, attestation interacts with call completion: carriers and analytics engines increasingly filter or label unverified traffic, so "my calls get marked spam" is usually an attestation-and-reputation problem, not a content problem. Orbit originates outbound voice over Devotel's own softswitch and attests calls per the A/B/C model; the mechanics, including inbound attestation parsing and delegate certificates, are in the STIR/SHAKEN reference, with the term-level entry at attestation.
Opt-out handling: STOP/HELP/START, DNC scrub, suppression vs opt-out lists
Consent management has two halves: capturing consent before the first send, and honoring revocation after it. The revocation half is where operators get sued, so the machinery is worth stating plainly.
Keyword handling. US carriers require A2P senders to honor a standard keyword set on every campaign: STOP (and STOPALL/END/CANCEL/QUIT/UNSUBSCRIBE) must revoke consent; HELP must return program contact information; START (or UNSTOP) re-enables a recipient who previously opted out. Keywords work across the channel boundaries — a STOP sent to one brand number must suppress that recipient for that brand, not merely for one sender. Orbit handles these keywords automatically at the platform layer so a campaign never depends on hand-rolled parsing; the term-level definition is the opt-out (STOP compliance) glossary entry.
DNC scrub. The federal Do-Not-Call Registry and state equivalents are external lists of numbers that must not receive telemarketing calls, maintained independently of any consent the business collected. A DNC scrub checks a contact list against the registry before a campaign; the DNC entry covers the registry itself. This is distinct from the business's own opt-out records, and both apply simultaneously: a number can be off the national registry and still be suppressed for your brand.
Suppression vs opt-out lists. An opt-out list is the consent ledger — "this recipient revoked consent for this channel, at this timestamp." A [suppression list](/de/glossary/suppression-list) is the operational artifact built on top of it: the set of addresses the sending pipeline must never message, fed by opt-outs, imports of legacy suppression data, and complaints. The distinction matters at audit time — the opt-out list is evidence of when and how consent was revoked; the suppression list is what the send path actually enforces. Operators should also expect consent state to propagate across every channel and sending surface in real time; an opt-out recorded on SMS that a voice or email tool does not honor leaves the exposure open. The mechanics of bulk suppression import and cross-channel honoring are in the opt-out and suppression reference.
SMS sender-ID registration outside the US
The US registration regime is 10DLC. Other markets run equivalents with different mechanics, and an operator sending internationally meets them market by market:
- Alphanumeric sender IDs. In much of Europe, Asia, and Africa, business SMS arrives from a brand-name sender ID instead of a number. Many countries require pre-registration of that sender ID with the local carriers before any traffic flows — the UK, France, Singapore, and Indonesia among them — and unregistered IDs are increasingly overwritten or filtered. See the alphanumeric sender ID entry for the term itself.
- India DLT. India mandates Distributed Ledger Technology (DLT) registration: the entity, its sender IDs (headers), and every message template must be registered on a carrier-accessible ledger before sending; unregistered templates are blocked at the carrier.
- Dedicated numbers where sender IDs are unsupported. A few markets (notably the US and Canada for two-way traffic) do not support alphanumeric sender IDs at all, so the registered entity is the number itself — which circles back to 10DLC or its regional equivalent.
The general rule: sender identity is a per-country registration surface, not a global one. A platform operating internationally has to carry country-by-country sender requirements, and the operator's job is to register each sending identity before traffic starts, not after filtering begins. Orbit's country-level requirements are tracked in the country requirements reference and the sender-ID registration guide.
Where this lands operationally
Nothing in this guide is abstract for an Orbit operator: each section maps to a shipped control surface — a registration wizard, an attestation level on outbound calls, automatic keyword handling, a suppression pipeline with bulk import, per-state calling-window enforcement. The guiding principle is stated once so it does not have to be repeated per section: compliance decisions are the operator's, and the platform supplies the controls, the guard rails where statute makes a control non-optional, and the evidence trail.
For the step-by-step mechanics, work through the docs:
- 10DLC registration guide — brand and campaign registration through TCR.
- US state calling windows — federal window, mini-TCPA overlays, Sunday bans.
- STIR/SHAKEN attestation — A/B/C levels, inbound attestation parsing, delegate certificates.
- Opt-out and suppression — keyword handling, cross-channel sync, bulk import.
- Consent management — the consent ledger behind suppression.
Frequently asked questions
Is my platform or my business responsible for TCPA compliance?
The business is. TCPA liability attaches to the party that initiates the call or message, and no platform contract transfers that. What an operator should expect from a platform is working controls — consent records, honoring STOP globally for the brand, windows enforced per recipient timezone, and evidence it can produce in a dispute. Orbit's tenant-owned control posture is exactly this: the operator configures and owns the decisions; the platform's one global guard is the federal 8 AM–9 PM window itself.
Does 10DLC registration apply outside the United States?
No — 10DLC is the US carriers' regime for standard 10-digit numbers. Other markets have equivalents with different mechanics: alphanumeric sender-ID pre-registration across much of Europe and Asia, India's DLT template ledger, dedicated-number regimes where sender IDs are unsupported. The common thread is that sender identity is registered per country, so international senders plan registration as part of entering each market.
What STIR/SHAKEN attestation level should outbound business calls get?
A — full attestation. It means the originating provider knows the customer and has verified their right to the calling number, which is the level carriers expect for legitimate business traffic and the least likely to be labeled or blocked. Getting an A is an originating-provider decision: it depends on the platform attesting and on the number ownership being provable, so it is a procurement question to ask any voice provider directly.
What is the difference between an opt-out list and a suppression list?
The opt-out list is the consent ledger: the auditable record of which recipient revoked consent, on which channel, and when. The suppression list is the operational set the send path enforces — built from opt-outs, imported legacy data, and complaints. Both matter: the first proves compliance happened; the second makes it happen on the next send.
Sources and further reading
- 47 U.S.C. § 227 — Restrictions on the use of telephone equipment: the TCPA statute text, including the per-violation damages provision.
- FCC — Telephone Consumer Protection Act: the FCC's consumer-protection rulemaking record around robocalls and robotexts.
- The Campaign Registry: the official registry for US 10DLC brands and campaigns.
- ATIS — STIR/SHAKEN: the industry standards body's SHAKEN framework pages.
- FTC — National Do Not Call Registry: the federal DNC registry operators scrub against.