> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# CTIA Messaging Principles as an ordered schema

> One concept page that ties the five CTIA Messaging Principles pillars — A2P/P2P lanes, SHAFT content categories, opt-in consent, opt-out keyword handling, and message content requirements — into a single readable schema, with the exact Orbit surfaces each pillar maps to.

# CTIA Messaging Principles as an ordered schema

CTIA posture on US SMS is scattered across four deep pages — the
[restricted-content reference](/compliance/restricted-industries), the
[keyword rules editor](/guides/opt-out-rules), the
[short-code preflight catalog](/compliance/shortcode-preflight), and the
[10DLC baseline posture](/guides/10dlc-marketing-baseline) — because each
pillar of the CTIA **Messaging Principles and Best Practices** is a
different kind of control. This concept page is the schema that orders
them: read it once to assemble the whole posture, then dive into the one
deep page your traffic actually touches.

<Warning>
  Every control named here is **tenant-owned, and this page is not legal
  advice.** Orbit carries the configuration and enforces what you set;
  whether your program satisfies CTIA is your program's call — confirm it
  with qualified counsel. The sole global exception to tenant-ownership is
  the federal TCPA voice dialing window; SMS has no equivalent platform
  guard.
</Warning>

## 1. Why CTIA matters independently of the carrier-supplied rules

Two rule books govern US SMS, and they come from different bodies:

* **TCPA** is federal statute. It defines what is *illegal* — texts to a
  number without prior express consent, calls outside the dialing window —
  priced per violation. TCPA is the one rule Orbit cannot waive for you on
  voice (see the
  [TCPA federal voice guard](/concepts/tcpa-federal-voice-guard)); on SMS
  it is your obligation to honour, and the statute itself is silent on
  *how* you wire the controls.
* **CTIA Messaging Principles** is the industry self-regulation
  carve-out. The carriers wrote it to translate TCPA-class obligations
  into operational requirements: lane assignment, consent mechanics,
  keyword handling, content limits. Carrier audits, TCR re-vet, and
  short-code program reviews evaluate against CTIA rather than against a
  bare TCPA reading — a program can be TCPA-compliant on paper and still
  fail a carrier audit because the opt-out keyword set, the
  call-to-action disclosures, or the SHAFT posture do not match the
  Principles.

That is the reason to treat CTIA as its own schema instead of folding it
into "general compliance": the examiner's checklist is CTIA-shaped, so
your posture check has to run CTIA-shaped too.

## 2. The topic map: five pillars, one surface each

Five pillars carry the whole schema. Each row names the pillar, the
Orbit control that implements it, and the deep page to read.

| Pillar                       | What CTIA asks                                                                                                                                                                     | The Orbit surface                                                                                                           | Deep page                                                                                                            |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| **Lane definition**          | Declare A2P (application-to-person) vs P2P (person-to-person); declarative A2P traffic files a TCR campaign with a use case that matches the real traffic                          | 10DLC brand + campaign registration; the wizard validates the use-case lane                                                 | [Baseline compliance posture for US SMS traffic](/guides/10dlc-marketing-baseline)                                   |
| **SHAFT content categories** | Sex, Hate, Alcohol, Firearms, Tobacco (plus cannabis/CBD) are restricted or banned regardless of destination country; high-risk verticals need extra vetting                       | Policy scanner (`POST /api/v1/messages/lint` at compose time, per-message scan at dispatch)                                 | [Restricted & Prohibited Industries](/compliance/restricted-industries)                                              |
| **Opt-in gate**              | Consent must be prior, express, and provable; the CTIA call-to-action disclosures (frequency, "message and data rates may apply", STOP, HELP) must be visible at the opt-in moment | Consent records per `(contact, channel)`; preflight lint of the opt-in description for short-code programs                  | [Short-code preflight: checks and remediation](/compliance/shortcode-preflight)                                      |
| **Opt-out keyword handling** | STOP (and the canonical aliases) must unsubscribe; HELP must answer; START re-subscribes; the platform keyword set is mandatory and cannot be narrowed                             | Opt-out & opt-in rules page (Messages → SMS → Opt-out Rules); per-service suppression lists; the send-time suppression gate | [SMS opt-out & opt-in rules](/guides/opt-out-rules)                                                                  |
| **Content requirements**     | Every outgoing message identifies the sender, avoids prohibited categories, and — for marketing — carries opt-out wording; carrier content filters re-score every dispatch         | Pre-send policy scanner with `warn` (default) / `strict` / `off` modes; suppression + quiet-hours gates at send time        | [10DLC baseline posture](/guides/10dlc-marketing-baseline) and [Pre-Send Policy Scanner](/compliance/policy-scanner) |

### Lane definitions: A2P vs P2P

A2P is any application-originated send — campaigns, notifications, OTPs.
P2P is handset-to-handset conversational traffic. US carriers require
A2P to declare itself: on long codes that means a TCR-registered 10DLC
campaign; on short codes it means a carrier-approved program brief.
Filing promotional traffic as `CUSTOMER_CARE` is the classic lane
violation, and a rejection on it is the most common first-round outcome.

### SHAFT categories

SHAFT is the shared content standard the carriers' automated filters
score every message against, and the vetting standard brand and campaign
registration scores your samples against. Restricted categories
(alcohol, some firearms and tobacco contexts) require age-gating and a
dedicated program; the rest are outright prohibitions on A2P lanes.

### The opt-in gate: consent-required vs notice-sufficient

Marketing and two-factor traffic requires prior express **consent** —
the receipt you can produce for the `(contact, channel)` pair, captured
at a recorded opt-in moment with the CTIA disclosures visible alongside.
Transactional traffic to an existing customer operates on a
**notice-sufficient** posture: the relationship implies the opt-in, but
the disclosures and the STOP path still apply. Decide which gate a send
passes through *before* you tag its use case; the 10DLC filing, the
quiet-hours carve-out, and the litigation-grade receipt all hang off
that tag.

### Opt-out keyword handling: STOP, HELP, START

Orbit enforces the carrier-mandated keyword floor — STOP-family opt-outs and
the START re-subscribe pair — at the platform layer, and your rules page
can only widen it (aliases like `CANCELAR` or branded opt-ins like
`REJOIN`). HELP wording belongs in the call-to-action and the opt-in
description; the preflight engine scores short-code briefs for exactly
those disclosures. A deleted tenant rule never narrows the floor, so the
audited posture is "platform floor plus your additions," never "your
list minus defaults."

### Content heuristics

The day-to-day heuristics that keep a send inside the Principles: name
the sender in the body of at least one sample and prefer it on every
send; keep opt-out wording on marketing lane messages; never put a
public URL shortener in the body (use a branded domain); avoid SHAFT-C
vocabulary even accidentally; expect the carrier's own filter to
re-score what passes Orbit's scanner.

## 3. Worked example: auditing a live campaign against the checklist

A retail tenant runs a US 10DLC campaign for weekend promotions. Audit
each pillar against the surface read it depends on:

1. **Lane.** `GET /api/v1/compliance/10dlc/campaigns/:id/status`
   (dashboard: 10DLC wizard summary) — confirm the use case reads
   `MARKETING`, not `CUSTOMER_CARE`. The [baseline posture](/guides/10dlc-marketing-baseline)
   names the mismatch rejection.
2. **SHAFT.** Re-run the stored samples through
   `POST /api/v1/messages/lint`; confirm `warn` mode at minimum and no
   error-severity findings. The
   [restricted-content category table](/compliance/restricted-industries)
   is the vocabulary the scanner uses.
3. **Opt-in.** Query the Consent API per recipient sample — a receipt
   must exist for `(contact, sms)`, captured at a described opt-in
   moment. For short codes,
   [preflight the stored brief](/compliance/shortcode-preflight) and
   confirm no `R-SC-CTA-*` findings remain.
4. **Opt-out.** Text `STOP` to a reply-capable number from a handset;
   the [rules proof flow](/guides/opt-out-rules) shows the inbound turn,
   the auto-reply, and the flipped consent state. Verify the seeded
   defaults still cover every language you send in.
5. **Content.** Check the policy-scanner mode on the organization — the
   send path re-reads it per message; `strict` rejects SHAFT-C findings
   with `POLICY_VIOLATION` while `warn` records and sends. Check the
   quiet-hours gate on the `sms` channel is enabled for the marketing
   lane.

A campaign that clears all five surface reads passes the deterministic
half of a carrier audit; the human-review half still sits with the
carrier, so keep the evidence (consent receipts, suppression additions,
DLRs) exportable per your
[data retention settings](/compliance/data-retention-policy).

## 4. When to use what: routing to the right surface per lane

| If you are…                                                                    | Start with                                                              | Then                                                                                                   |
| ------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| Standing up a **new US 10DLC marketing sender**                                | [10DLC baseline posture](/guides/10dlc-marketing-baseline)              | [10DLC registration wizard](/guides/10dlc-wizard) → suppression + quiet hours → this page's audit loop |
| Filing a **short-code program brief**                                          | [Short-code preflight](/compliance/shortcode-preflight)                 | [Apply for an SMS short code](/guides/short-code-application) for the submission walkthrough           |
| Adding a **new content vertical or market**                                    | [Restricted & Prohibited Industries](/compliance/restricted-industries) | [Country Compliance Requirements](/compliance/country-requirements) for the per-market overlay         |
| Serving **P2P-like conversational traffic** over SMS (two-way support threads) | [SMS opt-out & opt-in rules](/guides/opt-out-rules)                     | Keep keyword handling provable on reply-capable numbers; the lane is still A2P to the carrier          |
| Answering a **carrier audit or re-vet**                                        | This page's checklist order                                             | [10DLC rejections and re-vet](/guides/10dlc-rejections-and-revet) to decode the codes                  |

Transactional-heavy senders run the same five pillars but lean on the
notice-sufficient consent posture and the transactional carve-out at the
quiet-hours gate — both still wired on the same surfaces, both still
tenant-owned.

## See also

* [Omnichannel fallback compliance matrix](/concepts/omnichannel-compliance-matrix) — the same three-plane comparison across every channel, for choosing where CTIA-shaped SMS traffic fits in a fallback chain
* [TCPA federal voice guard](/concepts/tcpa-federal-voice-guard) — the one platform-owned guard, and why SMS has no equivalent toggle
* [Consent and suppression model](/concepts/consent-and-suppression-model) — the data model behind the opt-in gate and keyword handling
* [Pre-Send Policy Scanner & DLP](/compliance/policy-scanner) — verdict modes and the content-heuristic rules each channel runs
* [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) — bulk import, scopes, and the send-time suppression gate