The 10DLC Quick Start Guide for political texting

10DLC stands for ten-digit long code: the standard local phone numbers that application-to-person (A2P) text programs send from in the United States. Carriers require every organization sending A2P traffic on these numbers to register who they are and what they send, through an industry body called The Campaign Registry (TCR).

For political work this is not optional paperwork. Unregistered or misregistered traffic gets filtered, and political messaging has its own registration category with its own verification gate. Registered correctly, a political sender gets some of the highest sending capacity in the entire 10DLC system. Registered lazily, the same client is capped at a tiny fraction of that.

1. 1

   Client profile: who the client is

   Legal name, EIN, organization type and subtype, registered address, and website. Everything downstream inherits from these answers, so an error here is an error everywhere.

2. 2

   Brand: the identity vetting verifies

   The brand is the client’s business identity as the registration systems see it: business structure, industry, and tax status, checked against federal records. This is the stage where automated vetting passes or fails.

3. 3

   Campaign: what the client sends

   The use case, a description of the messaging program, the opt-in flow, and sample messages. This is reviewed for internal consistency: the description, samples, and consent story must all describe the same program.

4. 4

   Campaign Verify: political vetting, 527s only

   Candidate committees, PACs, and party committees clear an extra identity check through Campaign Verify before the political use case opens up. Covered in its own section below, because it is the most misunderstood step in the process.

The single highest-leverage moment in the whole filing is classifying the client correctly. Political and nonprofit senders register as nonprofit entities, and the subtype determines which verification path applies.

Fields that cascade from the entity type

For political clients, the jurisdiction drives further required fields. Federal committees supply their FEC ID and classification (House, Senate, presidential, PAC, party). State and local committees classify as candidate, PAC, party, or ballot measure, with the city or county named for local outreach. Candidate and ballot-measure filings also require the election date; PAC and party filings do not.

Campaign Verify (CV) is the nonpartisan identity-verification service for political senders. The rules about who needs it are simple but constantly gotten wrong, in both directions.

527s: the token is a hard gate

For candidate committees, PACs, and party committees, the political use case does not even appear as an option until a valid CV token is imported. 527 status is not auto-detected at registration; the token is the proof. A 527 filed without one can only run standard use cases, which means bottom-tier sending limits and exposure for misregistered political traffic.

• ✓Roughly $95 per entity per two-year election cycle, paid to Campaign Verify
• ✓One to seven business days to issue, so it is never a day-of task
• ✓Expires each election cycle and must be renewed
• ✓Imports once per messaging provider: a token used with a previous vendor cannot be reused, the client needs a fresh one for the new brand
• ✓For state, local, and tribal verifications, the committee EIN on the token must match the brand's EIN exactly

501(c)(4), (c)(5), (c)(6): no token, ever

Social-welfare organizations, unions, and trade associations unlock the political use case automatically through IRS tax-status verification at brand registration. Campaign Verify will not issue them a token, so waiting on one stalls the filing for nothing. If a vendor tells a (c)(4) to go get verified by CV, that vendor has the rules backwards.

Automated brand vetting is a records-matching exercise. Knowing what it matches against removes most of the mystery, and most of the failures.

• ✓Legal name comes from federal records: the IRS tax-exempt listing for 501(c)s, or the IRS 527 filing for political orgs. Never a DBA, an abbreviation, or the consultant’s name.
• ✓The EIN and legal name must match those records exactly. A mismatch is the classic silent brand failure.
• ✓The address is the organization’s registered address, not a treasurer’s home or your firm’s office. Address mismatches drag verification scores down.
• ✓New EINs lag 30 to 90 days before appearing in the databases vetting checks. A brand-new committee will fail automated vetting through no fault of the filing.

Failed brand vetting is recoverable: there are free resubmissions after correcting the underlying data, and a manual appeal path using the IRS EIN confirmation letter for cases like the new-EIN lag. The discipline is never resubmitting without changing the field that failed, because resubmission attempts are finite.

The campaign stage describes the actual messaging program, and it is reviewed for one thing above all: consistency. The description, the opt-in story, and the sample messages must describe the same entity running the same program. Any internal contradiction is itself grounds for rejection.

The description

Three to five sentences answering three questions: who sends, who receives, and why. The exact legal entity name, its plain-language entity type, the precise jurisdiction, an explicit statement that recipients opted in and how, and a complete list of the message types sent. Vague catch-alls like “marketing messages and more” invite rejection; a specific, upcoming election milestone anchors the filing.

The samples

• ✓Lead with the sender's identity in the first few words
• ✓Use bracketed placeholders for names and links, which is what reviewers expect for dynamic content
• ✓Keep links on the client's own domain: public URL shorteners are a named rejection cause
• ✓End every sample with opt-out language
• ✓Only show message types the description claims: samples and description are cross-checked

The consent field is where most campaign rejections happen, and it is also the field with the most legal weight behind it. The rule: describe the mechanism that actually exists, completely, and never assert one that does not.

The five disclosures

Wherever the phone number is collected, whether that is a web form, a paper card, or a canvass script, five things must be disclosed at the point of collection: the program or brand name, the phrase “Message and data rates may apply”, the expected message frequency, “Reply HELP for help”, and “Reply STOP to opt out”, plus a visible link to the privacy policy.

Non-public opt-ins need hosted proof

If consent is collected somewhere a reviewer cannot see, such as a paper form, an event sign-up sheet, or a page behind a login, the filing must include a publicly accessible screenshot or photo of that material showing the disclosures. “Trust us, the form says it” is not a filing.

The privacy policy gets read

Reviewers check the client’s privacy policy for specific language: what data is collected, how it is used, and an explicit statement that texting opt-in data and consent will not be shared with or sold to third parties. That last clause is the single most rejection-prone omission in political filings. The terms page needs the program name, frequency, rates language, support contact, and opt-out instructions.

Registration category determines sending capacity. These are the carrier-published tiers as of this writing; carriers set and revise them, so treat the exact numbers as indicative and the ordering as the point.

Two practical notes. Capacity is set at the campaign level and shared across all of a client’s numbers, so adding numbers does not add capacity. And the daily cap, where it applies, is usually the binding constraint at GOTV scale, which is why the Campaign Verify token’s cap exemption is the real client-facing win for 527s.

Not all rejections are equal, and the difference determines the next move.

Recoverable: fix the field, resubmit

Most campaign rejections name a fixable defect: a vague description, samples that do not match, a missing privacy-policy clause, a URL shortener, a dead website link, or an opt-in flow without its disclosures. These are corrected and resubmitted. Resubmission after third-party review can carry a repeat vetting fee, which is the financial argument for passing on the first attempt.

Terminal: do not resubmit the same filing

A small set of rejection categories, prohibited content, suspected spam or phishing, high-risk classification, and non-compliant use cases, are final for that filing. Resubmitting the same campaign burns time and standing. The only paths forward are a formal appeal or a materially changed new campaign, and choosing between those is a judgment call we make with you, not a form you resubmit.

What we verify before any client filing goes in. If you collect these from the client up front, registration becomes a formality.

• ✓Exact legal name as it appears in IRS federal records
• ✓EIN, and whether it is more than 90 days old
• ✓Entity type: 527, 501(c) designation, or government
• ✓For 527s: a current-cycle, unused Campaign Verify token, or the timeline to get one
• ✓Jurisdiction, committee classification, and election date where required
• ✓The organization's registered address
• ✓A live website on the client's own domain
• ✓The real opt-in mechanism, with hosted proof if it is not public
• ✓Privacy policy with the no-third-party-sharing clause
• ✓Terms page with program name, frequency, rates, HELP and STOP language

Moving a book of clients whose registrations already exist elsewhere? That is a different process with its own guide: the Migration Playbook.