Med Spa 10DLC SMS Compliance: Keep AI Follow-Up Running

Part of our complete guide to AI automation for South Carolina service businesses.

A med spa in Columbia sends a five-message AI follow-up sequence to every consultation inquiry — appointment reminders, post-visit aftercare tips, and a reactivation nudge at 90 days. The sequences are running, the automations are triggering, and the staff assumes leads are being nurtured. But carrier-level filtering is silently dropping 40 to 60 percent of those messages before they ever reach the recipient's phone. This is the most common and most expensive failure mode in med spa 10DLC SMS compliance for AI follow-up: the system appears functional while the actual contact rate is gutted. Getting compliant is not complicated, but it requires understanding exactly what carriers are checking and why unregistered campaigns fail.

What Is 10DLC Registration and Do I Need It for My Med Spa?

10DLC stands for 10-digit long code — a standard local-looking phone number (as opposed to a short code like 55555 or a toll-free number beginning with 800). The 10DLC framework was introduced by major U.S. carriers in 2021 as a response to widespread SMS spam. Under the system, any business sending application-to-person (A2P) messages — meaning texts sent from software to individual recipients — must register both the business identity and the specific messaging campaign with The Campaign Registry (TCR), a neutral third-party database that carriers query to validate senders.

For a South Carolina med spa, the answer to "do I need it" is straightforward: if your practice sends any automated text messages to clients or leads — appointment confirmations, consultation follow-ups, promotional offers, post-treatment instructions, or reactivation sequences — you are already sending A2P messages and are required to register. This requirement applies regardless of whether you send 50 messages per month or 5,000. The volume threshold that triggers the requirement is essentially zero for automated outbound SMS. Most industry experts agree that any business using a CRM, AI automation platform, or even a basic texting tool to send outbound messages is operating as an A2P sender and must comply.

The practical consequence of skipping registration is not a fine notice in the mail — it is silent message filtering. AT&T, Verizon, and T-Mobile each apply their own filtering algorithms to A2P traffic from unregistered numbers. Those filters can suppress message delivery without bouncing the message back to the sender. Your AI automation platform reports the message as sent. Your client never sees it. You have no idea the gap exists unless you audit delivery rates directly.

How Carrier Filtering Kills Your AI Follow-Up Contact Rate

The financial impact of poor deliverability is easier to quantify than most med spa operators realize. According to industry research from Zipwhip's 2023 State of Texting report, SMS open rates for compliant, registered business messages average around 98% — but that figure assumes the message was delivered in the first place. When carrier filtering intervenes on unregistered campaigns, effective delivery rates can drop to 50% or lower depending on message volume, content patterns, and the specific carriers your client list spans.

Consider a Charleston med spa running a three-touch AI sequence to 200 monthly consultation inquiries. At full deliverability, that sequence reaches 200 people. At 50% suppression, only 100 people receive any message at all. If the practice converts 15% of contacted leads into booked appointments at an average service value of $350, full deliverability produces 30 booked appointments worth $10,500. Suppressed deliverability produces 15 bookings and $5,250. That $5,250 monthly difference — $63,000 annualized — is the direct cost of running unregistered AI SMS automation. The system still costs the same to operate. The leads still came in. The gap is pure suppression loss.

Carrier filtering does not only suppress messages wholesale. It also degrades sender reputation over time, meaning a number that starts at 60% delivery can decline further as the carrier's algorithm accumulates signals. Once a number is flagged at the carrier level, recovery requires re-registration on a new number — and migrating clients to a new contact number adds its own friction and data hygiene costs. This is why med spa 10DLC SMS compliance for AI follow-up systems should be treated as a lead conversion protection issue, not a regulatory checkbox.

How to Complete 10DLC Registration: The Exact Workflow for Med Spas

The registration process runs through your SMS platform provider (also called a messaging aggregator or CSP — Campaign Service Provider). Common platforms that med spas use include Twilio, Podium, GoHighLevel, and similar tools. Each of these providers interfaces with The Campaign Registry on your behalf. Here is the step-by-step workflow:

• Step 1 — Brand Registration: Submit your business legal name, EIN, physical address, and business type to TCR. This creates your Brand record and costs a one-time fee of approximately $4. Approval typically takes 24–48 hours. Use your exact IRS-registered business name — mismatches cause rejection.
• Step 2 — Campaign Registration: Register each distinct messaging use case as a separate campaign. A med spa typically needs two: one for transactional messages (appointment reminders, confirmations, aftercare instructions) and one for marketing messages (promotional offers, seasonal specials, reactivation sequences). Do not combine use cases into a single campaign registration — carriers penalize mixed-use campaigns.
• Step 3 — Submit Message Templates: Each campaign registration requires 2–4 sample message templates that represent what you will actually send. These templates are reviewed by carriers and set the boundaries for acceptable content. Templates must include your business name, opt-out language ("Reply STOP to unsubscribe"), and for marketing campaigns, a clear indication that the message is promotional.
• Step 4 — Link Your Phone Number: Once campaigns are approved, associate your sending phone number(s) with the registered campaign. A single number can only be linked to one campaign at a time — this is why separating transactional and marketing use cases into separate numbers is the cleanest architecture.
• Step 5 — Verify Opt-In Capture: Before sending any messages, confirm that your intake forms, website booking tools, and any other lead capture points include compliant opt-in language that explicitly authorizes SMS contact. This documentation must be available if challenged by a carrier or regulatory body.

The entire registration workflow, if submitted cleanly, takes 2–6 weeks for full carrier approval. Some carriers (AT&T in particular) maintain their own secondary vetting queue that can add additional time. This timeline is non-negotiable — plan accordingly before launching any AI automation that sends SMS.

For med spas already running AI appointment booking systems, the underlying follow-up workflow may already be configured correctly — the registration layer is what needs to be added on top. If you've read our overview of how AI appointment booking reduces no-shows for med spas, the compliance layer described here is what makes those automated reminder sequences reach clients reliably rather than disappearing into carrier filters.

Message Template Requirements That Carriers Actually Approve

The template submission step is where many small businesses get rejected or delayed. Carriers are reviewing templates for several specific signals: sender identification, consent acknowledgment language, opt-out instructions, and content category alignment. A template submitted for a "transactional" campaign that contains promotional language — even language as subtle as mentioning a current offer — will trigger a review flag.

Here is what approved med spa message templates typically look like in practice:

Transactional example (appointment reminder): "Hi [FirstName], this is a reminder from [Spa Name] in Greenville, SC — your appointment is confirmed for [Date] at [Time]. Questions? Reply here or call us at [Phone]. Reply STOP to opt out."

Marketing example (reactivation sequence): "[Spa Name]: It's been a while since your last visit! We're offering complimentary consultations for returning clients this month. Reply YES to schedule or STOP to unsubscribe. [Spa Name], [City, SC]."

Both templates share the same structural requirements: business name present, location identifiable, opt-out path explicit, and no deceptive framing. The research consistently shows that templates which include "STOP" language in the first message of any sequence see dramatically lower carrier filtering rates compared to sequences that push opt-out language to a later message.

Your AI follow-up system's message library needs to be mapped back to these registered templates. This does not mean every message must be identical to the sample — it means the content category, tone, and structural elements must remain consistent with what was submitted. If your AI generates message variations dynamically (personalization based on service type, name, or timing), those variation rules should be reviewed against your submitted templates before deployment.

Opt-In Capture Logic: Where Most Med Spas Get This Wrong

The FTC and TCPA enforcement record is clear on one point that many small practices misread: existing clients are not automatically opted in to receiving automated marketing texts. The general consensus among telecom compliance attorneys is that a prior business relationship — even a long-standing one — does not constitute documented consent for A2P SMS marketing. Retroactive opt-in is not valid.

This means the opt-in capture must happen at a specific point in your intake or lead capture workflow, and it must be documented. For med spas, the highest-leverage opt-in capture points are:

• Website consultation request forms: Include an unchecked checkbox with text such as: "I agree to receive automated appointment reminders and follow-up messages from [Spa Name] at the mobile number provided. Message frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe."
• In-person intake paperwork (digital or paper): Add an explicit SMS consent field separate from general terms of service. The consent must be standalone — bundling it into a general liability waiver creates ambiguity that carriers and regulators do not accept.
• Booking confirmation pages: If a client books through your online scheduler, the confirmation page and confirmation email can both serve as secondary consent acknowledgment points — but primary consent still needs to happen before the booking, not after.
• Chat widget or AI intake tool: If your practice uses an AI intake bot on your website, configure it to capture SMS consent before collecting a phone number and triggering any follow-up sequence.

The opt-in record — the timestamp, the source, the exact language the client agreed to — should be stored in your CRM tied to that contact record. If a carrier or regulatory body requests proof of consent, "we think they checked the box" is not an acceptable answer. The FTC's guidance on the Telemarketing Sales Rule provides the federal baseline for what constitutes valid written consent for automated communications.

What Is 10DLC Better Than? Comparing Long Code, Short Code, and Toll-Free for Med Spas

Med spa operators evaluating SMS infrastructure frequently ask whether a toll-free number or a dedicated short code offers better protection against filtering. Here is the practical comparison:

Short codes (5–6 digit numbers) offer the highest throughput and are pre-approved for A2P by carriers, but they cost $500–$1,000 per month to lease, require a separate vetting process that takes 8–12 weeks, and are cost-prohibitive for a single-location med spa sending under 10,000 messages per month.

Toll-free numbers with toll-free verification (TFV) provide reasonable deliverability for transactional messages and are often used by businesses that want a single national-looking number. However, toll-free numbers are increasingly subject to the same carrier scrutiny as long codes, and their TFV process has its own vetting timeline. Many platforms are converging on 10DLC as the standard for local-looking business numbers.

10DLC registered long codes are the right choice for most South Carolina med spas because they use a local area code (803, 864, 843), which consistently outperforms toll-free in local service businesses. According to CTIA messaging compliance guidelines, 10DLC registered senders receive carrier-grade deliverability equivalent to short codes for typical small-business message volumes.

Most operators discover that 10DLC's combination of local number format, sub-$10 monthly registration fees, and full carrier compliance makes it the clear default for any med spa running AI-automated follow-up sequences under 5,000 messages per month.

How Much Does 10DLC Registration Cost for a Small Medical Spa?

The registration fees involved in 10DLC are frequently overestimated by med spa owners who assume compliance requires enterprise-level spend. The actual cost structure is straightforward:

• Brand Registration: One-time fee of approximately $4, paid through your messaging platform.
• Campaign Registration: Approximately $10 per campaign per month, per carrier. Most platforms bundle this into a flat monthly fee. A med spa with two registered campaigns (transactional and marketing) will typically pay $15–$25 per month in registration fees total.
• Platform/aggregator fees: If you are using a platform like GoHighLevel or Podium, 10DLC registration is handled through the platform's built-in workflow. Some platforms charge a small setup fee ($20–$50) to process your Brand and Campaign submissions on your behalf.

The total ongoing cost of 10DLC compliance for a typical single-location med spa is under $30 per month. Against the lead conversion loss described earlier — potentially $5,000 or more monthly in suppressed AI follow-up contact — this is not a meaningful financial decision. It is simply infrastructure cost for running a functional SMS system.

For med spas exploring a broader AI automation setup that spans appointment booking, follow-up nurture, and post-visit reactivation, reviewing how AI automation serves med spas and similar service businesses provides useful context on how these components fit together into a complete lead-to-rebooking system.

How Long Does 10DLC Approval Take Before I Can Send SMS Campaigns?

The approval timeline is the operational constraint that catches the most med spas off guard. Brand Registration approval is fast — typically 24 to 72 hours for businesses with clean EIN records that match TCR's database lookup. Campaign Registration is where timelines vary significantly by carrier:

• T-Mobile: Typically 1–3 business days for standard use case campaigns.
• AT&T: Maintains its own secondary vetting queue that adds 2–4 weeks beyond standard TCR approval.
• Verizon: Generally aligns with TCR approval timelines, often 5–10 business days.

The practical planning implication is that you should budget 4–6 weeks from initial submission to full carrier approval across all major networks. Sending messages before AT&T's secondary vetting completes means those messages will still be filtered by AT&T even if T-Mobile and Verizon have cleared your campaign. The general consensus is that practices should complete full approval before any AI automation goes live — partial compliance creates a false sense of security and inconsistent deliverability that is difficult to diagnose.

If your med spa is building out a broader AI follow-up workflow that also includes email touches, the registration timeline for 10DLC creates a natural window to configure and test your email automation in parallel. South Carolina service businesses in adjacent industries like home services have found that multi-channel follow-up setups benefit from building both channels simultaneously. For context on how these workflows are structured across different service types, the AI follow-up workflow guide for Lexington SC service businesses covers sequencing logic that translates directly to med spa multi-touch campaigns.

For med spas interested in seeing how a complete, compliant AI automation system is built from diagnosis through deployment, the Palmetto AI Automation build process outlines exactly how registration, template setup, and automation configuration are handled as integrated steps rather than separate projects.

Frequently Asked Questions

What happens if I keep sending AI text messages without 10DLC registration?

Carrier filtering will suppress a significant portion of your outbound messages without notifying you or generating delivery errors on your end. Over time, your sending number's reputation degrades further, worsening deliverability. In addition to lost contact rate, unregistered A2P SMS exposes your practice to TCPA liability, with statutory penalties ranging from $500 to $1,500 per message sent without valid consent documentation.

Can I register my personal cell phone number or an existing landline through 10DLC?

No. 10DLC registration applies specifically to 10-digit long code numbers provisioned through a messaging platform or VoIP provider for A2P use. Personal cell phones and landlines cannot be registered as A2P senders and are not eligible for the carrier protections that registration provides. You will need a dedicated business messaging number through a compliant platform.

Do I need separate 10DLC campaigns for appointment reminders versus promotional messages?

Yes — and this is one of the most common mistakes in initial registration. Carriers treat transactional messaging (confirmations, reminders, aftercare instructions) and marketing messaging (offers, reactivation, promotional content) as distinct use cases that require separate campaign registrations. Mixing both content types into a single campaign registration causes carrier-level flags and can result in campaign suspension.

Does 10DLC registration protect me from TCPA lawsuits?

Registration alone does not provide TCPA protection — consent documentation does. 10DLC registration ensures carrier deliverability compliance, but TCPA liability stems from sending messages to recipients who have not provided valid written consent. You need both: a registered campaign and documented opt-in records for every contact in your AI follow-up sequences. The two requirements are complementary, not interchangeable.

What if a client opts out mid-sequence — does my AI system handle that automatically?

Most compliant AI automation platforms process STOP replies automatically and remove the contact from all active sequences within minutes. However, you should confirm this behavior with your specific platform before going live. The opt-out must propagate across all active campaigns associated with that contact — not just the sequence that received the STOP reply. If your platform does not do this automatically, you need a manual audit process to prevent re-messaging opted-out contacts.

Is 10DLC compliance the same as HIPAA compliance for med spa text messaging?

No — these are separate requirements covering different risks. 10DLC registration governs carrier deliverability and anti-spam compliance. HIPAA compliance governs the handling of protected health information (PHI) in electronic communications. For a med spa, text messages containing treatment details, diagnosis references, or specific procedure information may involve PHI and require HIPAA-compliant messaging infrastructure with Business Associate Agreements in place with your platform provider. Review both compliance frameworks independently when setting up AI-automated patient communications.

Med spas that complete 10DLC registration properly, build message templates that pass carrier review, and document opt-in consent at every intake touchpoint are not just checking compliance boxes — they are protecting the lead conversion infrastructure that their AI automation depends on to generate revenue. The sequences, the timing logic, and the personalization in your AI follow-up system are worthless if the messages do not reach the recipient. Getting the compliance foundation right is what makes everything else in your AI stack perform as designed. If you are ready to audit your current SMS setup or build a compliant automation system from the ground up, the starting point is understanding exactly where your current workflow stands against the framework described here.

Written by Deniz Turk, Founder — Palmetto AI Automation