Ask HN: Do 10DLC Requirements make it impossible for hobby projects to send SMS?
i made bunch of bots and hobby projects with twilio numbers over the years.. i had a new idea, it's my understanding to get a number you have to register a business
19 comments
Why not just pull an old Android phone out of the junk drawer, pop in a PAYG SIM card, connect via USB cable and you're good to go. There are several apps that will implement the connection if you don't want to hack it yourself.
I was wondering about this too. It could be a an android using something like airdroid and still provide people with the opt out messages sms always should have.
Putting a keyword at the front of outgoing and incoming messages might be able to help as well if a users phone number was tied to more than one service.
Putting a keyword at the front of outgoing and incoming messages might be able to help as well if a users phone number was tied to more than one service.
10DLC is a nightmare. I’ve had to deal with it across several different projects and it essentially comes down to very specific language & processes for opting-in / removing subscribers. Feels like 10DLC was designed to be obtuse — if I was going to spam people I certainly wouldn’t want to jump through all the hoops.
That said, if you look up the best practices and use the very specific language / processes that the DCAs are looking for, you should be able to get approved with little effort.
Some things I’ve learned, in no particular order:
— If your provider (e.g. Twilio) has specific language they advise you include on a form / website / etc., use that exact language verbatim.
— For forms where you collect a phone number, have the compliance text very visible, perhaps even sacrificing UI/UX. After your campaign is approved, you can clean it up.
— Make sure you include your business / project name & opt-out instructions (reply STOP) in every sample message you submit for the campaign.
— Stick to the use case you selected & do not deviate. Make sure your campaign details align with the campaign description.
— Marketing-related campaigns — avoid if at all possible.
That said, if you look up the best practices and use the very specific language / processes that the DCAs are looking for, you should be able to get approved with little effort.
Some things I’ve learned, in no particular order:
— If your provider (e.g. Twilio) has specific language they advise you include on a form / website / etc., use that exact language verbatim.
— For forms where you collect a phone number, have the compliance text very visible, perhaps even sacrificing UI/UX. After your campaign is approved, you can clean it up.
— Make sure you include your business / project name & opt-out instructions (reply STOP) in every sample message you submit for the campaign.
— Stick to the use case you selected & do not deviate. Make sure your campaign details align with the campaign description.
— Marketing-related campaigns — avoid if at all possible.
I use ntfy.sh for the hobby projects now. The Twilio (and others) process was just too heavy. And for business the delays are frustrating; every small business I work with complains - but has no way to change the system.
There may be a wrapper opportunity here.
There may be a wrapper opportunity here.
Either their status page is broken or they have bailed.
Status page is wrong; no outage; it's been working great.
I have many Twilio SMS based personal apps and the application process was annoying but nothing too complicated. The worst was the long approval wait time while my stuff was broken but that’s partly my fault for not reading the warning emails carefully enough.
You do need to have a “reason” that fits into a tree of business-like-things but you don’t need an EIN or anything. Mine was “technology industry” I think.
You do need to have a “reason” that fits into a tree of business-like-things but you don’t need an EIN or anything. Mine was “technology industry” I think.
I also use Twilio for a hobby project. When the 10DLC changes came down I found it pretty confusing. I was able to keep my current pricing by purchasing a toll free number (trivial cost) and filling out a Word doc explaining how my website meetings some basic requirements (users opt in for SMS, theres a way to unsubscribe, etc)
I wrote about my experience on reddit: https://old.reddit.com/r/twilio/comments/z9q3i1/10dlc_confus...
I wrote about my experience on reddit: https://old.reddit.com/r/twilio/comments/z9q3i1/10dlc_confus...
I was able to. You just have to fill out the same paperwork. Give people an option to opt out, etc.
Yep, same. The process is obtuse, maybe intentionally to weed out bots and scammers too stupid to read instructions. But if you are legit and know what you are doing it was fairly straightforward, just pretty slow to hear back.
Last time I used SMS gateways, I was able to have an easier time of registering my business with AWS and obtaining an 800 number. It was easier than the hell Twilio was putting me through for a PoC.
For very small audience or personal projects, PushOver or similar push notifications API app/services are decent very low friction options.
For very small audience or personal projects, PushOver or similar push notifications API app/services are decent very low friction options.
10dlc is "10 digit long code", a new way for application-to-person messaging. Fyi, had to look it up.
I did basic RCS research a couple months ago & was pretty elsurprised how much RCS Business Messaging motivation there was, about retaining sms in the face of apps & notifications eroding the channel. Offering branding & other business features. It was eye opening context, new framing to me for why RCS is happening, far deeper than Android/everyone vs iPhone vs whatsapp. https://en.wikipedia.org/wiki/Rich_Communication_Services#RC...
I did basic RCS research a couple months ago & was pretty elsurprised how much RCS Business Messaging motivation there was, about retaining sms in the face of apps & notifications eroding the channel. Offering branding & other business features. It was eye opening context, new framing to me for why RCS is happening, far deeper than Android/everyone vs iPhone vs whatsapp. https://en.wikipedia.org/wiki/Rich_Communication_Services#RC...
Yikes is this something I'd have to deal with for personal SMS usage? That is, I might want to send myself an SMS from an online app once in a while, but never to anyone except myself. I hadn't heard of it before.
is there any reason not to use SMS/MMS gateways (https://en.wikipedia.org/wiki/SMS_gateway) for your hobby projects?
Messages have serious delays (sometimes minutes, sometimes hours) through SMS gateways. There's also rate limiting. That limits their usefulness.
Would registering a business be the simplest thing that might work?
Dealing with A2P 10DLC regulations was my job for a while, and I can tell you, the short answer is no. The long answer is noooooo... /s
TL;DR: Use a gateway independent service provider, or register with another carrier that lets you work around the restrictions for small use-cases at the cost of slightly higher technical complexity.
In seriousness, though, what those regulations boil down to is carriers self-regulating so that congress doesn't step in and regulate for them in ways that they won't like. It is _backed_ by congress, though, so the penalties are very real and potentially disastrous; up to $10k fine per offending message, not offending company or organization. Amounts that even for hobby projects can add up to very large amounts, very quickly.
Wild over-simplification incoming: Essentially all the hoops that twilio and others make you jump through are part cover-your-butt, and part cover-their-butt. All of it is dictated to them by The Campaign Registry (TCR) and the various Direct Carrier Aggregators (DCA's. Twilio is kind of a DCA unto themselves, and kind of not... it gets a little confusing in their case). Basically TCR makes the rules, and the DCA's interpret and implement them. Some of them don't leave a lot of room for interpretation (clear opt-out language, requiring positive confirmation of opt-ins for marketing traffic, etc.) and some of them are really fuzzy around the edges (your website needs contact information that matches EXACTLY your business registration information for some DCA's and not others. Some DCA's require very specific language on contact forms and privacy policies, some don't. Some need some language that covers the rules, but not specific language dictated to you by them. It turns into a minefield). Because the DCA's interpret the rules themselves, you get the wait-times. Almost all DCA's do manual verification of the campaign applications, and most of the time they sit in very deep queues.
Some providers, like Telgorithm and Bandwidth, allow you to act as your own campaign holder, whereas Twilio is actually the registered campaign contact. Twilio does that to lock you into their service - it makes it a pain to move your number because you have to re-apply to TCR for all new brands and campaigns. The other providers make that "easier", but you have to do more work on your end to capture and handle TCR webhooks, so there are plusses and minuses. However, one big plus of going with one of those other guys is that you don't _have_ to use the API's, you can do it all on the TCR and provider dashboards, and that lets you register special-case campaigns and brands such as conversational-only (doesn't require all the crazy opt-out language restrictions, etc.), and personal brands (can use DBA's and other low-touch business styles registered to your house address for a dollar). If you are only ever making a bot that only ever texts you personally, that can be a good way to go. However, the second it goes to someone else's phone there is a chance (low, mostly, slightly higher for Tmobile phone numbers for a big list of other reasons) that it will be auto-flagged as potentially invalid traffic. At low trust-scores that will result in not getting messages. If your trust scores continue to fall, they can turn you over to the FTC, and then... well probably best to fake your own death at that point. And before you ask, no, they don't tell you what your trust score is. You have to infer it from average delivery rates, which is just... super.
Your last option is a gateway provider. These are companies that give you a number (AWS has one with 800 numbers, for example), or have very limited behavior such as push-notifications only. Generally these work by registering as a brand of their own with TCR and creating for you an on-the-fly campaign that is configured in such a way that they are essentially sending traffic on your behalf. You'll pay a higher price per message to cover their risk, and if something looks wonky, they will cut you off way faster than anyone else, so expect weird errors and spotty delivery (especially to Tmobile numbers). They sit in a bit of a gray-area, and generally limit the kinds of traffic you can send, in some cases requiring that you pre-define the content of all messages you intend to send. So if you are doing a lot of dynamic message content generation, it might not work for you.
If you're still reading, well, congrats! I know that is a wall of text, and honestly I'm just scratching the surface and leaving a lot out. The goal of services like Twilio is to make it as simple for you as is technically possible, and honestly they do a pretty good job of it. My advice would be 1) if you are only ever sending a small number of messages, just to yourself, and of a fixed content, just use a gateway. 2) if you are generating dynamic content in the message bodies, or if you intend to send to a small number of phones, register a DBA and sign up with Twilio with your DBA (or LLC if you don't mind the extra tax work) as the business and do the wait-and-check dance. Expect that to take a month or more. 3) In any other case, or if you have a very limited use case, talk with the folks at Telgorithm and they can hook you up (I'm not affiliated with them - I just have used them in the past and really like them).
TL;DR: Use a gateway independent service provider, or register with another carrier that lets you work around the restrictions for small use-cases at the cost of slightly higher technical complexity.
In seriousness, though, what those regulations boil down to is carriers self-regulating so that congress doesn't step in and regulate for them in ways that they won't like. It is _backed_ by congress, though, so the penalties are very real and potentially disastrous; up to $10k fine per offending message, not offending company or organization. Amounts that even for hobby projects can add up to very large amounts, very quickly.
Wild over-simplification incoming: Essentially all the hoops that twilio and others make you jump through are part cover-your-butt, and part cover-their-butt. All of it is dictated to them by The Campaign Registry (TCR) and the various Direct Carrier Aggregators (DCA's. Twilio is kind of a DCA unto themselves, and kind of not... it gets a little confusing in their case). Basically TCR makes the rules, and the DCA's interpret and implement them. Some of them don't leave a lot of room for interpretation (clear opt-out language, requiring positive confirmation of opt-ins for marketing traffic, etc.) and some of them are really fuzzy around the edges (your website needs contact information that matches EXACTLY your business registration information for some DCA's and not others. Some DCA's require very specific language on contact forms and privacy policies, some don't. Some need some language that covers the rules, but not specific language dictated to you by them. It turns into a minefield). Because the DCA's interpret the rules themselves, you get the wait-times. Almost all DCA's do manual verification of the campaign applications, and most of the time they sit in very deep queues.
Some providers, like Telgorithm and Bandwidth, allow you to act as your own campaign holder, whereas Twilio is actually the registered campaign contact. Twilio does that to lock you into their service - it makes it a pain to move your number because you have to re-apply to TCR for all new brands and campaigns. The other providers make that "easier", but you have to do more work on your end to capture and handle TCR webhooks, so there are plusses and minuses. However, one big plus of going with one of those other guys is that you don't _have_ to use the API's, you can do it all on the TCR and provider dashboards, and that lets you register special-case campaigns and brands such as conversational-only (doesn't require all the crazy opt-out language restrictions, etc.), and personal brands (can use DBA's and other low-touch business styles registered to your house address for a dollar). If you are only ever making a bot that only ever texts you personally, that can be a good way to go. However, the second it goes to someone else's phone there is a chance (low, mostly, slightly higher for Tmobile phone numbers for a big list of other reasons) that it will be auto-flagged as potentially invalid traffic. At low trust-scores that will result in not getting messages. If your trust scores continue to fall, they can turn you over to the FTC, and then... well probably best to fake your own death at that point. And before you ask, no, they don't tell you what your trust score is. You have to infer it from average delivery rates, which is just... super.
Your last option is a gateway provider. These are companies that give you a number (AWS has one with 800 numbers, for example), or have very limited behavior such as push-notifications only. Generally these work by registering as a brand of their own with TCR and creating for you an on-the-fly campaign that is configured in such a way that they are essentially sending traffic on your behalf. You'll pay a higher price per message to cover their risk, and if something looks wonky, they will cut you off way faster than anyone else, so expect weird errors and spotty delivery (especially to Tmobile numbers). They sit in a bit of a gray-area, and generally limit the kinds of traffic you can send, in some cases requiring that you pre-define the content of all messages you intend to send. So if you are doing a lot of dynamic message content generation, it might not work for you.
If you're still reading, well, congrats! I know that is a wall of text, and honestly I'm just scratching the surface and leaving a lot out. The goal of services like Twilio is to make it as simple for you as is technically possible, and honestly they do a pretty good job of it. My advice would be 1) if you are only ever sending a small number of messages, just to yourself, and of a fixed content, just use a gateway. 2) if you are generating dynamic content in the message bodies, or if you intend to send to a small number of phones, register a DBA and sign up with Twilio with your DBA (or LLC if you don't mind the extra tax work) as the business and do the wait-and-check dance. Expect that to take a month or more. 3) In any other case, or if you have a very limited use case, talk with the folks at Telgorithm and they can hook you up (I'm not affiliated with them - I just have used them in the past and really like them).