AT&T TCR Compliance Guide 2025

AT&T TCR Compliance Landscape

AT&T enforces three carrier-specific compliance requirements beyond standard TCR registration. Organizations deploying SMS campaigns via AT&T must implement privacy policy sharing disclosures, age-gated content verification, and AT&T Code of Conduct adherence to achieve campaign approval.

Privacy Sharing Clause

AT&T requires affiliate sharing disclosure in SMS-specific privacy policy section. Missing clause triggers TCR error 7103 with immediate campaign blocking on AT&T network.

Age-Gated Content

Alcohol and vaping businesses must submit age verification vendor documentation during TCR registration. AT&T validates 21+ age-gate implementation before granting Mixed use case approval.

AT&T Code of Conduct

Messaging content must align with AT&T Acceptable Use Policy prohibiting misleading claims, aggressive urgency tactics, and pre-checked consent mechanisms violating TCPA standards.

Violation Risk: AT&T violations combine TCR error codes (7103 privacy policy, 601 prohibited content) with carrier-level campaign suspension within 48 hours. Non-compliance exposes organizations to $500-$1,500 TCPA penalties per message plus AT&T traffic blocking requiring manual compliance review.

Privacy Policy Sharing Clause Requirements

AT&T mandates affiliate sharing disclosure in SMS consent privacy policies as unique carrier-specific requirement. Organizations deploying generic privacy policies without SMS-specific sections trigger TCR error 7103 with immediate AT&T campaign blocking.

Required Privacy Policy Elements

AT&T-compliant privacy policies include four mandatory disclosure components:

1

SMS-Specific Consent Section

Privacy policy must contain dedicated section titled "SMS/Text Message Communications" or "Mobile Marketing" separate from general privacy provisions. Generic policies covering all communication channels fail AT&T validation.

Example Header: "By consenting to receive SMS messages from [Company Name], you acknowledge our affiliate data sharing practices detailed below."
2

Affiliate Sharing Disclosure Language

Policy must explicitly state whether phone numbers will be shared with third-party partners, affiliates, or service providers. Vague language like "we may share data" without SMS-specific attribution triggers rejection.

Compliant Disclosure: "Your mobile phone number may be shared with our marketing partners and affiliated brands to deliver promotional offers via SMS. You may opt out at any time by replying STOP."
3

Data Retention Specifications

AT&T requires explicit statement of how long phone numbers will be retained after opt-out. Indefinite retention without disclosure violates carrier privacy expectations.

Retention Statement: "Phone numbers are retained for 12 months after opt-out to honor suppression requests and maintain compliance records."
4

Privacy Policy URL in TCR Campaign

Updated privacy policy URL must be submitted in TCR campaign registration. AT&T validates policy accessibility and reviews sharing clause during campaign approval process (48-72 hours automated review).

Implementation: Host policy at stable URL (e.g., yourcompany.com/privacy-sms) and submit exact URL in TCR "Privacy Policy" field during campaign creation.

AT&T-Specific Enforcement: Privacy policy validation occurs during automated campaign review (48-72 hours). Missing sharing clause triggers TCR error 7103 with AT&T-only blocking while other carriers may approve. Manual review escalation adds 5-7 business days to remediation timeline.

Age-Gated Content Compliance

AT&T enforces age verification requirements for alcohol, vaping, cannabis-adjacent (e.g., CBD with THC disclaimers), and tobacco-related messaging. Organizations marketing age-restricted products must implement 21+ age-gate before SMS opt-in consent capture and submit verification documentation during TCR registration.

Age Verification Implementation Requirements

AT&T validates age-gate deployment through three technical checkpoints:

Third-Party Age Verification Vendor

Organizations must contract with AT&T-recognized age verification provider (e.g., Veratad, Cognito, AgeChecker.Net). Self-certification mechanisms fail AT&T validation. Vendor contract and implementation screenshots submitted during TCR Mixed use case registration.

Cost Range: $0.50-$2.00 per verification transaction with 85-95% pass rates

Verification-Before-Consent Logic

Age verification must complete successfully before displaying SMS opt-in form. Organizations displaying consent checkbox before age-gate validation fail AT&T review. Implementation requires conditional form rendering blocking SMS consent until 21+ verification confirmed.

Technical Flow: User enters DOB → Vendor API validates age → If 21+, reveal SMS opt-in form → Capture consent with age acknowledgment

Audit Documentation Requirements

AT&T requires retention of age verification logs for 4+ years matching TCPA statute of limitations. Documentation includes verification transaction IDs, timestamps, verification pass/fail results, and correlation to SMS consent records for regulatory audit readiness.

Submission: Include verification vendor contract, implementation screenshots, and data retention policy in TCR campaign "Additional Documentation" field

TCR Mixed Use Case for Age-Gated Content

Alcohol and vaping campaigns register under TCR "Mixed" use case with Age-Gated Content attribute selection. AT&T validates age-gate implementation during manual review process adding 5-7 business days beyond automated review timeline. Trust scores for age-gated campaigns typically range 50-75 triggering manual review requirements.

Penalty Exposure: Messaging minors without age verification creates $500 TCPA liability per message plus state-level penalties ranging $1,000-$10,000 per incident. AT&T suspends campaigns within 48 hours of minor complaint. FTC enforcement actions for marketing alcohol/vaping to minors carry penalties up to $43,792 per violation.

AT&T Campaign Review Process

AT&T processes TCR campaigns through two-tier review architecture balancing automated validation with manual policy verification. Understanding review triggers and timelines enables accurate launch planning.

Automated Review

48-72 Hours

Standard campaigns with trust scores 75+ and non-sensitive use cases process through automated validation checking privacy policy accessibility, consent mechanism compliance, and sample message content alignment.

Auto-Approval Criteria: Account notifications, delivery alerts, 2FA, customer care (non-marketing)

Manual Review

5-7 Business Days

Age-gated content, Mixed use case, trust scores 50-74, or privacy policy compliance questions escalate to AT&T specialist review validating age verification implementation and sharing clause presence.

Manual Triggers: Alcohol, vaping, high-risk financial, new brands (no DUNS), privacy policy missing sharing clause

Common AT&T Rejection Reasons

AT&T-specific rejections differ from T-Mobile and Verizon enforcement patterns:

Error 7103: Privacy Policy Sharing Clause Missing

AT&T-only rejection when SMS privacy policy lacks affiliate sharing disclosure. Other carriers approve same campaign. Remediation: Add sharing language to SMS consent section, update TCR privacy policy URL, resubmit within 24-48 hours.

Pre-Checked Consent Boxes Detected

AT&T validates opt-in implementation screenshots during manual review. Pre-checked boxes violate TCPA affirmative action requirements. Remediation: Default checkbox to unchecked state, submit updated consent form screenshot, resubmit for 5-7 day manual review.

Age Verification Documentation Insufficient

Alcohol/vaping campaigns without vendor contracts or implementation screenshots fail AT&T Mixed use case approval. Remediation: Contract with age verification provider, implement verification-before-consent logic, submit vendor agreement and screenshots, expect 7-10 day review.

Vague Opt-In Disclosure Language

Consent forms stating "I agree to receive messages" without specifying message type (marketing vs. transactional), frequency, or carrier fee disclosure fail AT&T validation. Remediation: Add explicit "promotional SMS messages," "message frequency varies," "message and data rates may apply" language.

Implementation Roadmap

Organizations achieve AT&T campaign approval in 14-21 days through phased compliance deployment addressing privacy policy updates, age-gated verification (if applicable), and TCR registration:

1

Privacy Policy Update

Add SMS-specific consent section with affiliate sharing disclosure language. Timeline: 3-5 days for legal review, policy hosting, URL submission preparation.

Draft SMS consent section with sharing clause

Legal counsel review and approval

Host policy at stable URL

2

Age-Gate Setup (If Applicable)

Contract with age verification vendor, implement verification-before-consent logic, prepare audit documentation. Timeline: 7-10 days for vendor onboarding and integration.

Select and contract verification vendor

Integrate age-gate API before consent form

Document verification flow with screenshots

3

TCR Campaign Registration

Submit TCR campaign with updated privacy policy URL and age-gate documentation. Timeline: 48-72 hours automated review, 5-7 days if manual review triggered.

Register brand with DUNS (if available)

Create campaign with privacy policy URL

Upload age-gate documentation (if Mixed use case)

Accelerate AT&T Approval

MyTCRPlus AT&T Compliance Toolkit includes privacy policy template with sharing clause, age verification implementation guide, and TCR submission checklist for accelerated approval.

Get AT&T Toolkit

Frequently Asked Questions

Why does AT&T require a privacy policy sharing clause when other carriers don't?

AT&T implements carrier-specific privacy requirements beyond TCR standard validation. The sharing clause requirement addresses consumer protection concerns about SMS data monetization. T-Mobile and Verizon accept generic privacy policies, but AT&T validates SMS-specific consent sections during manual review. Organizations must maintain AT&T-compliant privacy policies even if other carriers approve campaigns without sharing disclosures.

How long does AT&T campaign review take compared to T-Mobile and Verizon?

AT&T automated review completes in 48-72 hours for standard campaigns, similar to T-Mobile (24-48 hours) but faster than Verizon (48-96 hours). Manual review triggered by age-gated content, privacy policy questions, or trust scores 50-74 extends timeline to 5-7 business days. Organizations submitting complete documentation with sharing clause compliance typically achieve approval within automated review window.

Do I need age verification for CBD products or only THC-containing cannabis?

AT&T requires age verification for any cannabis-adjacent products including CBD with disclaimers referencing THC content or psychoactive effects. Pure CBD products marketed without cannabis association may avoid age-gate requirements, but AT&T reviews product descriptions and sample messages for restricted content indicators. Alcohol and vaping products always require 21+ age verification regardless of messaging approach.

Can I use the same privacy policy for AT&T, T-Mobile, and Verizon campaigns?

Yes. Privacy policies meeting AT&T sharing clause requirements exceed T-Mobile and Verizon standards. Organizations should implement AT&T-compliant policies with SMS-specific sections and affiliate sharing disclosures as universal standard. Single policy URL submitted in TCR campaign applies across all carrier networks, eliminating need for carrier-specific privacy documentation.

What happens if AT&T rejects my campaign but T-Mobile and Verizon approve it?

Carrier-specific rejections result in network-level blocking. AT&T subscribers will not receive messages even if T-Mobile and Verizon approve campaign. Organizations must remediate AT&T-specific violations (typically error 7103 privacy policy or age-gate documentation) and resubmit campaign. AT&T processes resubmissions in 24-48 hours for documentation-only corrections, 5-7 days if manual review required. Campaign remains active on approving carrier networks during AT&T remediation.

Does MyTCRPlus guarantee AT&T campaign approval?

MyTCRPlus provides compliance tools designed to meet AT&T requirements but cannot guarantee specific carrier approval outcomes. AT&T maintains discretion in campaign review decisions based on brand reputation, use case appropriateness, and policy compliance. Organizations using MyTCRPlus toolkit report 85-95% approval rates on properly configured campaigns with complete documentation. MyTCRPlus does not provide legal advisory services or carrier approval guarantees.

AT&T TCR Compliance 2025 Requirements