Can a dispensary text its customers? 10DLC, SHAFT-C and the channels that actually work in 2026

Short answer. No: not for anything about cannabis. Registering a 10-digit number is how every business gets permission to send texts, but carriers review what the texts are about, and cannabis, CBD and hemp-derived products are on the list they refuse. That holds in every state, adult-use or medical, and it covers order and delivery notifications, not only promotions.

This page exists because "10DLC for cannabis businesses", "10DLC for dispensaries", "10DLC for CBD shops" and "10DLC for cannabis delivery" are some of the most common questions operators bring to us, usually after a texting vendor sold them a plan. Here is what the rules are, where they come from, and what to do instead.

What 10DLC is, in one paragraph

A 10DLC is an ordinary 10-digit phone number used by a business to send application-to-person texts. Since carriers stopped carrying unregistered business traffic, every sender registers its brand (the legal entity) and each campaign (the use case, with sample messages and the opt-in flow) through The Campaign Registry. Carriers then decide whether to carry the traffic. Toll-free numbers and short codes have their own verification processes, but the same content rules apply. See the 10DLC glossary entry for the term itself.

Why cannabis is refused even where it is legal

Carriers enforce content rules that sit on top of the law. The industry shorthand is SHAFT: sex, hate, alcohol, firearms, tobacco, with cannabis treated as part of the restricted set (often written SHAFT-C). Three things make cannabis different from, say, alcohol, which can be allowed with age-gating on some routes:

1. Carriers follow federal law, not state law. Messaging providers say plainly that cannabis and CBD content is blocked even where it is locally legal.
2. The ban is by route, and it covers every route. Providers list cannabis, CBD, hemp-derived products and related accessories as prohibited across 10DLC, toll-free and short code in the US and Canada.
3. It is about the business, not only the words. Some providers state that businesses whose primary business is cannabis or CBD may not use SMS or MMS at all, regardless of what an individual message says.

What this means in practice: a campaign that describes a dispensary, a menu, deals or delivery is rejected at registration. Traffic that gets through anyway, through a vague campaign description or creative spelling, is filtered when carriers spot it, sometimes without notice to the sender. A rejected campaign is not fixed by re-filing with different wording.

Who it covers

There is one more exception worth knowing: some providers say approved short-code programs can exist with prior carrier approval. Treat that as rare and slow, and never as a way to send promotions.

What happens if you text anyway

• Registration rejection. The cheapest outcome: you find out before sending.
• Filtering. Messages are silently dropped. Your vendor's dashboard may still show "sent", so open rates and redemptions look like the campaign failed on its merits.
• Number and account suspension. Providers suspend senders whose traffic does not match the registered campaign.
• Consent exposure on top. The TCPA's consent rules apply to marketing texts whatever the carrier decides. A list built from POS check-boxes rarely carries the proof the TCPA expects; see why a checkbox is not consent.

The channels that work, and what each needs

Two rules make these channels work. First, each channel has its own consent: an SMS opt-in collected years ago is not email consent, and an app install is not marketing consent. Second, the proof matters as much as the yes: channel, timestamp, source and the text version the customer saw. A consent proof can be produced when someone asks; a boolean cannot.

A one-hour audit of what you have now

1. Export your contacts from the POS or loyalty tool with every consent field it holds.
2. Split by channel. Count contacts with email consent, push permission and the old "SMS opt-in".
3. Check the proof. For each channel, how many records have a timestamp, a source and a wording version? Those are your sendable contacts.
4. Stop SMS sends that mention products, deals or orders. If your vendor says it has a carrier-approved route, ask for the approval in writing and which route it covers.
5. Move the SMS list to email by asking, not assuming. At the counter and on the receipt, ask people to join the email list. Record the answer properly.
6. Re-plan the calendar around email and push, with a holdout group so you can see what each campaign actually adds.

How BudAlly handles it

BudAlly's loyalty and wallet module keeps a consent proof on every contact (channel, timestamp, source, text version) and checks it before a draft exists. It sends no SMS without a registered campaign and proven consent on that channel, and every campaign ships with a holdout so the result reports lift, or says "not significant". Consent records imported from a POS come in as "unknown" unless they carry proof, so the sendable count you see is the real one.

This page explains carrier and industry rules for operators. It is not legal advice; your messaging provider's written policy is the final word on what it will carry.