Here is something that trips up even experienced Salesforce admins more often than you might expect - and nobody really talks about it openly. A customer places an order. The system fires an automated text. Someone in legal sees it and starts asking about consent - and suddenly what felt like a routine confirmation message is sitting in a gray zone nobody on the team is fully comfortable resolving. The distinction between transactional SMS vs marketing SMS sounds simple enough on paper, but inside a live Salesforce org with multiple business units, overlapping journeys, and a few legacy automations nobody wants to touch, the classification question gets messy fast. Understanding SMS compliance requirements is what separates teams that navigate this cleanly from those that end up in reactive legal conversations.
Worth noting upfront: this is not just a labeling exercise. How you classify your messages has direct downstream effects on what consent mechanisms you need, what Salesforce tools you should be using, and - most pointedly - whether you are exposed to TCPA litigation.
Getting Oriented Before the Rules Even Matter
Most teams start with the TCPA and work backward. Honestly, that is the wrong order. The more useful starting point is operational: map out what types of messages you are actually sending, or planning to send, before you start placing them into regulatory buckets. Otherwise you end up in a situation where someone has categorized a win-back campaign as transactional because it references a past purchase, and that decision gets baked into a production flow before legal ever sees it.
The categories sit on a spectrum - not clean binary endpoints - and that distinction matters more than most documentation lets on. A message that starts as a service notification can tip into promotional territory the moment someone drops in offer language, a discount code, or phrasing that is pretty clearly pulling someone back in rather than keeping them informed. That drift is almost never a conscious decision. What usually happens is a stakeholder quietly added "and use code SAVE15" to a template that had been running fine for months - nobody flagged it, nothing else about the template looked different, and nobody meant to create a problem. It just slipped through.
Anyway, let us get into what the actual distinctions look like in practice.
Transactional vs Promotional SMS - Where the Line Actually Sits
| Message Type | Classification | Consent Standard | Typical Salesforce Tool |
|---|---|---|---|
| Order confirmation | Transactional | Prior business relationship | Marketing Cloud or Flow |
| Shipping update | Transactional | Prior business relationship | Marketing Cloud or Flow |
| Appointment reminder | Transactional | Prior relationship or express consent | Marketing Cloud or Health Cloud |
| Flash sale announcement | Promotional | Express written consent (TCPA) | Marketing Cloud Journey |
| Product recommendation | Promotional | Express written consent (TCPA) | Marketing Cloud Journey |
| Account security alert | Transactional | Implied / relationship-based | Any SMS-integrated tool |
| Re-engagement campaign | Promotional | Express written consent (TCPA) | Marketing Cloud Journey |
| Loyalty reward earned | Context-dependent | Depends on message framing | Case-by-case review |
The loyalty message row is there intentionally. That is one of the categories where teams consistently get it wrong. "You earned 200 points" is transactional. "You earned 200 points - use them before they expire on a curated selection just for you" has tipped into promotional territory, even though it still references a genuine account event.
The TCPA Standard and Why It Treats These Categories Differently
Here is the thing that does not always land clearly in internal training sessions. TCPA transactional SMS messages are not fully exempt from the law, they are just held to a less demanding consent standard. The common shorthand - "transactional messages don't need consent" - is imprecise enough to be dangerous. What is closer to accurate is that transactional messages can generally be sent on the basis of an existing business relationship, whereas promotional messages require express written consent, documented in a form that meets FCC specifications.
The regulation has real ambiguity baked into it - more than most compliance guides admit upfront, honestly. Courts and the FCC have not always landed in the same place on where the line sits, and the 2024 FCC one-to-one consent rule added another layer that caught a lot of multi-brand orgs off guard - specifically around how consent travels across business partners. If your consent was collected under a parent brand name and you are now messaging on behalf of a subsidiary, that is not something to resolve with an internal policy memo. Get counsel involved directly.
A practical framework that compliance teams tend to use when auditing SMS messages:
- Does the message contain any offer, discount, incentive, or promotional language - even buried in a postscript? If yes, call it promotional. Doesn't matter what triggered it, doesn't matter how small the offer language is.
- Would a recipient who never asked to receive marketing from you feel surprised or vaguely misled getting this message? That gut-check catches framing problems that formal checklists often miss entirely.
- Would a recipient who never asked to receive marketing from you feel surprised or vaguely misled getting this message? That gut-check catches framing problems that formal checklists often miss entirely.
- Has consent been documented in a format that includes the sender's identity, the types of messages being authorized, and a disclosure about message and data rates? For promotional messages, the absence of any one of those elements is a vulnerability.
How Salesforce Orgs Create Classification Problems Without Realizing It
This is the section that does not get enough attention in vendor documentation. Salesforce as a platform does not enforce message classification for you. Journey Builder, Marketing Cloud Engagement, and Salesforce Flow will send whatever you configure them to send - the classification logic being sound or not is simply not something the tool checks. Compliance infrastructure lives elsewhere: in how you capture consent, how your data model is structured, and whatever governance your team has wrapped around template approval.
What actually goes wrong in most orgs is layered. Marketing teams own journey logic but not consent data. IT owns the data model but not the business rules for message classification. Legal reviews policies but rarely audits individual templates before they go live. Nobody designed that gap on purpose - it is just what happens when a flexible platform gets built out across teams that each own only part of the problem.
A few failure modes worth naming specifically:
- Journey cloning is one of the more common culprits. Someone duplicates a transactional journey to build a promotional one and keeps the original audience entry conditions, which do not account for the stricter consent requirements promotional messaging demands.
- Data extensions inherited from older implementations sometimes include contact records where consent status is null rather than false - and a null gets treated as an eligible record by a journey that was not designed with that edge case in mind.
- SMS keyword opt-out handling is frequently not tested end-to-end. A contact texts STOP to a short code, gets pulled from one journey, and stays fully eligible for another because suppression lists are siloed by business unit and nobody ever connected them. That is the kind of gap that shows up in litigation rather than QA - and by the time it surfaces there, it is a much harder conversation than it needed to be.
Before any new SMS journey goes live in Salesforce, someone on the team should be able to answer these three questions without hesitation - what is the classification of this message, what consent mechanism covers this audience, and where is that consent documented in the data model? If any of those answers require a conversation to produce, the journey is not ready to deploy.
Building a Governance Layer That Does Not Collapse Under Pressure
The teams that handle this well tend to share one characteristic. They have made message classification a step in the build process, not a review that happens after the fact. Practically, that looks like a short classification checklist embedded in whatever intake or request process your marketing ops team uses - not a separate compliance review that only triggers when someone flags a concern.
Short feature table for what that governance layer typically includes:
| Component | Purpose |
|---|---|
| Message classification checklist | Forces explicit categorization before build begins |
| Consent field audit in data model | Ensures promotional audiences are filtered on express consent |
| Template approval workflow | Routes promotional SMS templates through legal before activation |
| Suppression list governance | Confirms opt-outs propagate across all relevant business units |
| Quarterly journey audit | Catches classification drift in long-running automations |
The quarterly audit is the one most organizations skip. It is also the one that would catch the "SAVE15 crept into a transactional template" problem before it becomes a legal conversation.
The Part of This That Stays Unresolved Longer Than It Should
There is a version of this problem that governance frameworks and classification checklists do not fully address, and it is worth naming. The TCPA was drafted well before anyone imagined a CRM platform that could fire millions of individualized, behavior-triggered messages across dozens of brands from a single org. Regulators wrote rules for broadcast telemarketing. What exists now is something structurally different, and courts are still working out what the old standards actually mean when applied to this architecture.
The direction the industry is heading is toward more granular consent - more specific opt-in language, consent scoped to message type, narrower definitions of what qualifies as an established business relationship. That direction makes sense. Whether the regulatory framework catches up in a coherent way, or produces another round of ambiguous enforcement followed by reactive compliance scrambles, is genuinely unsettled. The classification discipline you build now matters and offers real protection. It is also not a fixed target, and anyone who frames it as fully solved is probably oversimplifying.
