What Does "Msg & Data Rates May Apply" Mean? SMS Compliance Explained

What "Msg & Data Rates May Apply" Actually Means

The phrase is a carrier-mandated warning that the consumer may be charged by their wireless provider for receiving your text messages. Even though most US mobile plans now include unlimited texts and data, the disclosure is still legally required.

The reason it persists: the CTIA (Cellular Telecommunications Industry Association) and the major US carriers — AT&T, T-Mobile, and Verizon — require it as a condition of using their A2P (Application-to-Person) messaging infrastructure. It is not optional, and its presence is verified during 10DLC campaign registration.

Think of it as the SMS equivalent of "call your doctor before starting this program" — it exists to protect consumers from unexpected charges and to signal that the sender has followed the carrier opt-in protocol.

FTEU exception: Some SMS programs are designated "Free to End User" (FTEU), meaning the brand absorbs all carrier costs and the consumer is never charged. For FTEU programs, CTIA guidelines technically do not require the "msg & data rates may apply" disclosure. However, FTEU programs require prior carrier approval and a specific program structure — the vast majority of business SMS programs are non-FTEU and must include the disclosure. If you are unsure whether your program qualifies as FTEU, assume it does not and include the disclosure.

Where It Must Appear — and Where It Cannot Be Hidden

The CTIA guidelines are specific: the disclosure must appear in clear and conspicuous text directly adjacent to the consent mechanism. This means:

• On the same screen as the checkbox or opt-in button, before the user submits
• In readable font size — not 8px grey text below the fold
• Not behind a link — linking to a separate terms page with the disclosure does not satisfy the requirement
• Not in a collapsed accordion that the user must click to expand
• Not in a cookie notice or footer that appears after the opt-in

TCR reviewers check the opt-in URL as part of 10DLC campaign registration. If the disclosure is missing or visually buried, the campaign is rejected. If it is present but requires scrolling or interaction to see, the campaign may still be flagged.

The Full Required Disclosure Package

"Msg & data rates may apply" is one element of a complete CTIA-compliant disclosure. A fully compliant opt-in must include all of the following in visible text near the consent mechanism:

• Business name — the specific brand sending the messages
• Program description — what messages the consumer will receive ("Get order updates and promotional offers from [Brand]")
• Message frequency — "Msg frequency varies" or a specific estimate like "Up to 4 messages/month"
• Msg & data rates notice — "Msg & data rates may apply"
• Opt-out instructions — "Reply STOP to cancel"
• Help instructions — "Reply HELP for help"
• Links to terms and privacy policy — as linked text within or immediately below the disclosure

The full standard disclosure block looks like this:

By checking this box, I agree to receive promotional text messages from [Business Name] about [topic]. Message frequency varies. Msg & data rates may apply. Reply STOP to cancel, HELP for help. [Terms] | [Privacy]

Every element above has a purpose: carriers use the STOP/HELP language to automate opt-out processing; TCR reviewers use the frequency estimate to validate your campaign use case; the business name ties the consent to a specific sender.

What Happens When You Omit It: 10DLC Rejections and TCPA Exposure

Missing or incorrectly placed disclosure language has two consequences:

1. 10DLC campaign rejection. When you submit a campaign to The Campaign Registry (TCR), reviewers visit your opt-in URL and verify the disclosure. If "msg & data rates may apply" is absent, the campaign is rejected. Resubmission takes days and delays your SMS launch. Repeated rejections can lower your brand's trust score, which throttles your message throughput even after approval.

2. TCPA liability. Under the TCPA, valid SMS marketing consent requires disclosure of the nature and terms of the messages being received. A consent form that lacks carrier-required disclosure language is legally weaker — plaintiff attorneys use missing disclosures as evidence that the consent was defective. In demand letters and class action complaints, "omission of required CTIA disclosure language" is a standard allegation.

The fix is simple: always use a purpose-built consent form that enforces the full CTIA disclosure package and stores the exact disclosure text shown at signup as part of the consent record.

5 Common Mistakes Businesses Make With This Disclosure

• Linking to it instead of showing it. A "See terms" link that leads to a page with the disclosure does not satisfy the conspicuous display requirement.
• Placing it after the submit button. The disclosure must be visible before the consumer opts in, not in a post-submission confirmation screen.
• Using it on voice consent only. For phone-based opt-ins, the disclosure must still be read aloud — written forms are not the only context.
• Omitting it from mobile-responsive views. Some forms hide disclosure text on mobile screens. Test every consent form on mobile before launching.
• Not updating it when program terms change. If you change your message frequency from weekly to daily, the disclosure must be updated. Old consents granted under the old terms may not cover the new frequency.