TCR and provider practices

Twilio, SignalWire and Telnyx: requirements, boundaries and verification gaps.

Research checked October 16, 2026 · Publication and proposed design only

Provider policy and technical behavior, checked October 16, 2026. No accounts were accessed or messages sent. These sources document requirements and features, not evidence that a particular campaign or our proposed system is compliant.

Registration and recipient consent are different gates

The accessible TCR October 2025 CSP guide, pages 23–24, calls for a message flow explaining every opt-in method, plus compliant CTA, privacy policy and terms. An optional upload field does not make the underlying requirement optional. The indexed April 2026 guide could not be retrieved; this is not a verified latest-edition claim.

US local 10DLC registration, toll-free verification and short-code approval are distinct. None obtains an individual recipient's permission. SignalWire's messaging documentation describes separate 10DLC/TCR and toll-free paths. Recheck the chosen route, campaign and current onboarding requirements.

Acquire evidence for the business and purpose

Twilio

The Messaging Policy, April 13, 2026, calls for freely given, informed, sender/subject-specific express consent; promotional messages require written consent. A relevant reply to a customer inquiry is not recurring engagement permission. Consent cannot be bought, sold, rented or transferred. Retain proof, including date/method, for applicable legal needs and at least until withdrawal.

SignalWire

Its Messaging Requirements and Code of Conduct distinguishes conversational replies, express consent for information and written consent for promotion. A coupon can change the category. It recommends direct collection and requires honoring phone/email/text withdrawals. Promotional participation must remain optional.

Telnyx

The Messaging AUP requires explicit SMS opt-in, rejects third-party lists and numbers collected for unrelated purposes, and forbids turning transactional opt-in into recurring messaging. A CRM record or telephone field is not promotion permission.

The Telnyx campaign guide specifies brand, purpose, frequency, rates, STOP/HELP and accessible terms/privacy links. SMS consent is separate from email/calls; web checkboxes must be optional and actually recorded. Confirmation and HELP flows need program/support details. These are provider/carrier submission requirements, not a universal statutory checklist.

Twilio's business/website review expects verifiable context and a consent flow; its terms URL requirement became mandatory June 30, 2026. Do not copy older optional-field guidance into a current integration.

Recommended capture design: unchecked, separate marketing and service-update choices; separate channels; specific sender/purpose; nearby terms/privacy; no purchase-conditioned promotional enrollment. Save the exact disclosure and affirmative action with scope, date, destination and form version. Give reviewers redacted flow examples, never a public subscriber database.

Native suppression has boundaries

Twilio long codes and Messaging Services: Default filtering recognizes documented standard keywords. Scope follows the sender or Messaging Service, not every provider for a brand. Advanced Opt-Out supplies START/STOP/HELP via OptOutType and has already replied; avoid a duplicate application response. Its blocked-list reporting/editing limits do not describe every Twilio product.
Twilio toll-free and short codes: Toll-free STOP and START/UNSTOP are carrier-handled; YES cannot fully unblock toll-free. Standalone short codes lack the same default automation; an eligible Messaging Service can use Advanced Opt-Out. Verify short-code handling and approved keywords.
Telnyx local numbers: Keyword rules describe profile-wide suppression, with entire-message matching for STOP, STOPALL, STOP ALL, UNSUBSCRIBE, CANCEL, END and QUIT. START/UNSTOP must target the original number. Custom keyword management is available; list retrieval was still labeled “coming soon.” A separate profile is no permission to evade a block.
Telnyx toll-free: Network rules control STOP and START/UNSTOP with noncustomizable replies. Separate toll-free from profiles with custom rules as documented.
SignalWire: The platform FAQ assigns inbound-stop processing and list removal to the application, while the Code describes carrier STOP/UNSTOP protection. Implement both layers; a universal native brand-wide suppression service was not established.

Engineering rule: clear natural-language, email and operator-recorded withdrawals enter the same suppression workflow. Native keyword matching is narrower than human intent. START unblocking is not permission for unrelated brands, purposes or channels.

Do not invent a universal consent API

Twilio has a separate Consent Management API for bulk status upserts with contact, sender/service, source and date; support/sales enablement may be needed. For a Messaging Service, STOP creates both service and individual-sender blocks; a valid API-based re-opt-in needs both entries cleared. Do so only after independently establishing fresh permission for the narrow scope, never as a blanket reset. That is not proof of a universal suppression export endpoint. Keep your own ledger and confirm enabled capabilities. Telnyx's documented SMS retrieval limitation above and SignalWire's customer-owned model likewise require local evidence and reconciliation.

For webhook authentication use the actual contract: Twilio SDK signature validation; SignalWire signing-key validation; Telnyx Ed25519 signatures and timestamps. Verify exact signed URL/body handling, account/tenant mapping and replay controls. Twilio retry identifiers do not establish outbound exactly-once sending. Product-specific contracts govern retries.

Ownership, email and push need separate review

Twilio's US reassigned-number check uses a last-verified date and requires carrier approval. A lookup is not fresh consent; changed ownership invalidates inherited grants.

SendGrid documents email global/group unsubscribes and suppressions. Telnyx announced Email API GA on August 28, 2026, including suppression import/export and signed webhooks. These are separate from SMS APIs. SignalWire email-marketing suppression capability was not verified.

Twilio Notify documentation is deprecated. SignalWire incoming-call push does not establish a general promotional-push service. Its voice guidance calls for checks before origination. SMS permission is not automatic voice/email/push enrollment.

Before selecting a production route

Verify current policy date, sender type, registration, campaign, use case and jurisdiction.
Exercise every capture, HELP, STOP and re-enrollment route with synthetic test identities in an approved test environment.
Measure native suppression scope and whether callbacks arrive after provider auto-replies.
Verify enabled consent/reporting APIs, errors, callback signatures, ordering, retry and cancellation behavior.
Import suppression before migration; reconcile differences and block uncertain routing.
Document missing capabilities rather than assuming another provider's behavior transfers.

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.