The Toll-Free Verification Guide for 2026

Last updated August 24, 2026

Toll-free verification is the messaging industry's identity check for 8XX numbers — the toll-free equivalent of 10DLC registration, run through the toll-free aggregator rather than The Campaign Registry. You submit your business identity, use case, and opt-in evidence for each toll-free number; once verified, your traffic is trusted at full throughput.

Unverified toll-free messaging has been blocked industry-wide since the 2023 cutover, and in 2026 the review process got noticeably stricter: business details are checked against public records, and vague use cases that would have passed two years ago now come back rejected. A further tightening lands September 15, 2026, when the verification program expands its rejection reasons from 83 to 118 — adding explicit codes for missing terms & conditions, missing privacy policies, and newly prohibited use cases — so the feedback on a denial is more specific, and more submissions that once slipped through now don't.

For the plain-English version — what reviewers actually check, and why submissions get rejected — see Toll-Free Verification, Explained.

• Legal business name matching state/IRS records.
• EIN / business registration number and an accurate business address.
• The end-user brand's own details — the business that owns the toll-free number and sends the content. Intermediary or platform (ISV) details in place of the end brand's are rejected.
• Specific use case — "appointment reminders for existing customers," not "notifications."
• Sample messages that match the use case, including opt-out language — and the same point-of-consent disclosures 10DLC reviewers expect (brand name, frequency, "Message and data rates may apply", STOP/HELP; see the disclosure checklist).
• Customer-facing opt-in evidence — a screenshot of your actual web form or sign-up page, or a live URL, showing exactly how recipients consent to receive texts. As of September 15, 2026, internal database or CRM screenshots are no longer accepted — the evidence has to be the consumer-facing opt-in itself.
• Expected monthly volume for the number.
• Privacy policy, terms & conditions, and opt-in evidence — required as of September 15, 2026. The toll-free verification program makes all three mandatory fields in every submission from that date: a live privacy policy URL, a hosted SMS terms & conditions URL, and evidence of the opt-in. They have always been what reviewers checked; now a submission without them is rejected outright.

Verification checks the language in your live messages and the consent flow behind them, not just the campaign details. Have all of the following in place before you submit — and note that as of September 15, 2026, the privacy policy, the hosted terms & conditions, and the opt-in evidence below are required parts of every verification submission, not recommendations. Reviewers also check that your public website, its business model, and both policies line up with the use case you describe — a mismatch between what your site sells and what you say you'll text about is itself a rejection reason.

Messages must carry the required disclosures — reviewers compare them against what you actually send:

• Welcome / confirmation message: "Welcome to {Business Name}. Msg freq. varies. Msg & Data rates may apply. Reply STOP to end or HELP for help."
• HELP reply: "{Business Name}: {Description}. Help at {Email} or {Phone}. Msg&Data rates may apply."
• Your program or brand name in every content message.
• No public URL shorteners (bit.ly and the like) — a common rejection reason.

Your privacy policy must explain what data you collect and how it's used, and state that mobile opt-in information is not shared with third parties or affiliates for marketing or promotional purposes.

Your terms & conditions, kept separate from the opt-in language, must include:

• Program or brand name and a description.
• A "Message and data rates may apply" disclosure.
• Message frequency or recurring-message disclosure.
• Customer support contact information.
• Opt-out instructions (HELP and STOP), in bold or capitals.
• A link to your privacy policy.
• A "Carriers are not liable for any delayed or undelivered messages" disclosure.

Your opt-in flow must:

• Match the use case described in your submission.
• Collect consent per campaign — voluntary, and not bundled with other agreements.
• Keep SMS consent separate from other channels and from each other use case: text-message opt-in gathered on its own, not rolled into an email sign-up, and a distinct consent for each use case (don't mix, say, promotional and one-time-passcode opt-ins under a single agreement).
• Use opt-in controls (checkboxes, toggles) that are unchecked or off by default; pre-checked boxes and other pre-authorizations are rejected.
• Show evidence of consent — a link or screenshot with your business name or logo visible.
• Link to the privacy policy and the terms from the opt-in page with direct, publicly accessible URLs — not password-protected or login-gated. A privacy policy or terms page on its own is not opt-in consent language: reviewers treat the opt-in itself as the consent, and the policies as support for it.

Toll-free has always excluded the industry's standard restricted categories — sex, hate, alcohol, firearms, and tobacco (SHAFT), plus illegal substances and high-risk financial schemes. The September 15, 2026 update expands the disallowed list, and a few additions reject otherwise ordinary-looking programs:

• Person-to-person (P2P) use. Toll-free verification is for business (A2P) messaging. Traffic that only goes to the line owner, family members, or is otherwise personal isn't a valid verified use case — that's P2P messaging, a separate thing.
• Prescription drugs. Medications not available over the counter, including GLP-1 drugs, are prohibited content.
• Academic dishonesty services. Essay mills, exam or homework help sold as a shortcut, ghostwriting, and sales of test material.
• Simulated phishing or scam tests. Programs that send mock social-engineering attacks to gauge an organization's security are no longer permitted over toll-free.

Standard processing typically completes within about a week for clean submissions. Rejected submissions restart the clock — a resubmission cycle commonly adds one to several weeks, and numbers stuck "in verification" for months almost always trace back to mismatched business data or unverifiable opt-in evidence. The fastest path is a complete, consistent submission the first time.

Common rejection reasons in 2026:

• Business name that doesn't match public records.
• Vague or overly broad use-case descriptions.
• Sample messages that don't match the stated purpose.
• Missing or unverifiable opt-in language.
• The same content reused across unrelated campaigns.
• Opt-in evidence that is only an internal record rather than the customer-facing form or page.
• Intermediary or platform (ISV) business details standing in for the end brand that owns the number.
• Privacy policy or terms links that are missing, or hidden behind a login.

Many businesses run more than one: short codes for mass and keyword traffic, toll-free for national support, 10DLC for local engagement. Carrier pass-through fees apply to all three and moved repeatedly in 2026 — T-Mobile and UScellular (Jan 19), Verizon (May 1), and eighteen regional carriers (Jul 1).

Short codes skip TCR entirely — carriers vet each program directly under CTIA Short Code Monitoring standards. See Short Codes for how that channel works.