SMS compliance for review requests: US, UK and Australia
The US, UK and Australia apply different rules to review request texts, including who may be contacted, how the sender is identified and when messages may be sent.
Lachlan Fea 9 min read
In this article9 sections
SMS compliance for a review request comes down to four things. You need consent to text the customer, the message has to say who it is from, it has to offer a way to stop, and it must not offer anything in return for the review. The detail differs in the United States, the United Kingdom and Australia, and the differences matter more than the similarities.
Every SMS compliance guide ranking for the term is published by a text-message vendor and written for an American retail blast. A review request is a different message. What follows is for a business texting its own customers. It is not legal advice. Every rule below is quoted from the regulator that published it, read on 6 September 2026.
Is a review request text marketing?
Not obviously, in American law: the FCC defines an advertisement as "any material advertising the commercial availability or quality of any property, goods, or services" (47 CFR 64.1200(f)), and a review request sells the recipient nothing. It matters less than it looks, because consent is needed either way, and putting a discount code in the request ends the argument. Elsewhere it does not arise: UK rules cover "electronic mail", defined to include "messages sent using a short message service" (PECR regulation 2), and Australia's Spam Act covers email and SMS together.
What counts as consent for a review request text
United States
FCC rules "ban text messages sent to a mobile phone using an autodialer unless the phone owner previously gave consent", and "commercial texts require written consent; for informational texts, your consent may be oral" (FCC). The stricter tier, prior express written consent, is "an agreement, in writing, bearing the signature of the person called", with the number written into it. An electronic signature counts "to the extent that such form of signature is recognized as a valid signature under applicable federal law or state contract law", so whether your web form clears that bar is a question for your lawyer, not your SMS vendor. The wording is one line where you take the number: we may text you about your appointment and ask for a review, reply STOP any time.
United Kingdom
Regulation 22 of PECR bars unsolicited direct marketing by electronic mail "unless the recipient ... has previously notified the sender that he consents". The exception service businesses live under is the soft opt-in. The ICO puts it plainly: someone who "bought something from you recently, gave you their details, and did not opt out" can be marketed to about similar things, but "you must have given them a clear chance to opt out, both when you first collected their details, and in every message you send", and it "does not apply to prospective customers or new contacts".
So the opt-out has to have been offered at collection, which is a form change rather than a message change. The protection attaches to individuals, and reg 2 counts "an unincorporated body of such individuals", so a sole trader you invoiced is covered while a limited company is not.
Australia
This is where Australian review programmes are quietly non-compliant. ACMA splits consent into express, given by "filling in a form, ticking a box on a website, over the phone, face to face", and inferred, which needs "a provable, ongoing relationship with your business". Then the line that decides it: "It does not cover sending messages after someone has just bought something from your business" (ACMA, avoid sending spam).
One transaction is not consent in Australia, and you cannot fix it afterwards, because ACMA is equally direct that "you cannot send an electronic message to ask for consent, because this is a marketing message". The fix is at the counter, and the burden of proof is yours: "it's up to you to prove that you have a person's consent." Underneath the guidance sit sections 16 to 18 of the Spam Act 2003.
Who the text has to say it is from
This is the rule review requests fail most often, because the message is short and the business name gets cut for space.
Australia is the strictest. Every commercial message must "accurately identify your name or business name" and "include correct contact details", using "the correct legal name of your business, or your name and Australian Business Number (ABN)", correct "for at least 30 days after you send the message". ACMA's SMS Sender ID Register then applies from 1 July 2026: if your texts are branded with your business name rather than sent from a number, you "must contact your telco or message provider to register those sender IDs", or they "may be labelled as 'Unverified' and will be grouped together with other 'Unverified' messages, including scam messages" (ACMA). A review request in the scam pile does not get a review.
In the United Kingdom, regulation 23 of PECR bans marketing by electronic mail where the sender's identity "has been disguised or concealed", or where no valid address has been given for opt-out requests. In the United States there is no statutory sender-ID rule for texts. The carriers impose their own instead.
Wherever you are, put the business name in the first few words. On a locked phone that is all the customer sees, and an unrecognised number asking someone to tap a link reads as a scam.
Opt-out and the STOP keyword
The American rule is the strictest in the world and the most misread, and it changed recently: the FCC's revocation rules took effect on 11 April 2025 (DA 25-312).
Under 47 CFR 64.1200(a)(10) a customer may revoke consent "by using any reasonable method to clearly express a desire not to receive further calls or text messages". Replying "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" is reasonable per se. Then the part that breaks most software: a reply using any other words must be treated "as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent". Somebody who replies "please stop texting me" has opted out as surely as somebody who typed the keyword. Revocations "must be honored within a reasonable time not to exceed ten business days", and senders "may not designate an exclusive means to request revocation of consent".
Australia runs a different clock. Every commercial message needs an unsubscribe option that "honours a request to unsubscribe within 5 working days", stays "functional for at least 30 days", and does not make the person "log in to, or create, an account". ACMA's own SMS examples are "Reply STOP" and "Unsub: (1800-number)", and it flags the trap: alphanumeric headers "are generally not capable of receiving return messages", so if you text from your business name, Reply STOP does not work. The United Kingdom requires a valid opt-out address in every message.
An opt-out belongs to the person, not the campaign, and in the United States that is now written down. The FCC's own summary of 64.1200(a)(10) is that it "requires a caller to treat a consumer's revocation of consent as revoking consent for all calls from the caller, irrespective of subject". That part was waived until 11 April 2026 to give senders time, and in October 2025 the Commission asked for comment on modifying it (FCC 25-76). Until it does, somebody who stopped your appointment reminders has not consented to a review request six weeks later.
Keeping that ledger across a customer file, two channels and several locations is where review programmes fall over. Cloutly's review campaigns never enrol a contact who has opted out, treat a repeat customer as one contact asked once rather than one ask per transaction, skip anyone who reviewed you in the last 90 days, stop the follow-up when the review lands, and send from a local number in the United States, the United Kingdom and Australia.
Quiet hours, by jurisdiction
There is less law here than the guides imply. 47 CFR 64.1200(c)(1) prohibits a telephone solicitation to a residential subscriber "before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)". It is written for solicitations to residential subscribers, not for a text to a mobile, so treat it as a fence rather than a floor. Neither PECR nor the Spam Act sets hours for texts.
Set your own operating rule: 9am to 6pm in the customer's local time, mid-week rather than Saturday morning. The failure that actually happens is mechanical. The send is scheduled in head-office time and a customer three timezones west gets a 6am text asking them to rate their haircut.
10DLC registration in the United States
This is not a law and no regulator enforces it, which is why it surprises people when their messages simply stop arriving. American carriers require a business texting from a standard ten-digit local number to register the brand, meaning the legal entity, and the campaign, meaning what you send and how you collect consent. You do it through your messaging provider, approval takes days rather than minutes, and unregistered traffic gets filtered. What you send then has to match the sample message you registered, so a review campaign registered as "appointment reminders" is a problem. The substance is no stricter than the FCC's: CTIA's best practices "ask non-consumer message senders to obtain consent before texting consumers and to provide a way for consumers to opt out". It is just enforced by whoever carries your traffic.
What a review request text may never say
Consent gets you the right to send. Google's policy and the FTC's rule decide what the message may contain, and these get reviews deleted rather than fines issued.
No incentive. Google's prohibited and restricted content policy bars merchants from offering incentives "such as payment, discounts, free goods and/or services - in exchange for posting any review or revision or removal of a negative review". A prize draw counts. So does a free coffee. The FTC's Consumer Reviews and Testimonials Rule, in effect since 21 October 2024, bans incentives only where there is "an express or implied requirement that the reviews have to express a particular sentiment"; its worked example is "Tell us how much you loved your visit to John's Steakhouse and get a $5 coupon". The FTC forbids buying a sentiment, Google forbids buying at all, and Google is where you want the review.
No number of stars, and no scripted wording. The same Google policy says merchants should not "request that specific content be included", nor "require or pressure users to leave ratings or write reviews while on the premises".
No rating question before the review link. That is gating, and the policy bars merchants from "discourag[ing] or prohibit[ing] negative reviews, or selectively solicit[ing] positive reviews". What Google allows is the plain version: "solicit or encourage the posting of content that does represent a genuine experience, without offering incentives to do so or attempting to influence the rating or the contents of the review". More in review gating and Google's review policy explained.
Three compliant review request texts
Coastline Physio is a fictional clinic. Each message names the business early, asks once, carries one link and offers a way out. Counts assume a 24-character short link.
The first ask, the day after the appointment. 153 characters, one segment.
Hi Emma, it's Sam from Coastline Physio. If Tuesday's session helped, would you leave us a Google review? [link] Reply STOP to opt out.
The single follow-up, three to five days later. 149 characters, one segment.
Emma, Sam at Coastline Physio again. Here's that review link if you have a minute: [link] Fine to ignore. Reply STOP to stop these.
When your sender ID cannot receive replies, the Australian alphanumeric case. 136 characters, one segment.
Coastline Physio here, Emma. If your visit went well, a Google review helps others find us: [link] Unsub: 1800 000 000
All three are plain GSM-7 characters, which is what keeps them inside one 160-character segment. Paste them through a word processor and the straight apostrophe becomes a curly one, dropping the ceiling to 70 characters and turning one message into three on your bill. A longer business name tips the first two over 160, so read the segment counter before you save the template. Email versions are in the review request templates.
SMS compliance in the US, UK and Australia, side by side
| United States | United Kingdom | Australia | |
|---|---|---|---|
| Rule | TCPA, FCC rules at 47 CFR 64.1200 | PECR 2003, regulations 22 and 23 | Spam Act 2003 ss 16 to 18, ACMA guidance |
| Consent | Prior express consent for an autodialled text, written consent if the message is commercial | Consent, or the soft opt-in for your own recent customers | Express, or inferred from an ongoing relationship. One purchase is not enough |
| Identify yourself | No statutory text rule, carriers enforce 10DLC | Identity must not be disguised or concealed | Legal name or name plus ABN, contact details correct for 30 days, sender IDs registered from 1 July 2026 |
| Opt-out | Any reasonable method, within ten business days, no exclusive means | Valid opt-out address in every message | Clear instructions, within 5 working days, no account or fee |
| Quiet hours | 8am to 9pm local for solicitations to residential subscribers | None set for text | None set for text |
Two things carry most of the risk, and neither is the wording of the message: the consent line on the form where you take the mobile number, because in Australia nothing you send afterwards can create it, and suppressing an opt-out across every channel and location, permanently. Who to ask and when is in how to get more Google reviews; the case for texting rather than emailing is in SMS vs email review requests.