Toll-Free Verification: What Changed on 15 September 2026

Toll-free is no longer the lighter registration#

Carriers began rejecting any new toll-free verification that arrives without a Privacy Policy URL and a Terms and Conditions URL on 15 September 2026. Both fields are now mandatory on the submission itself.

GoHighLevel shipped the two fields into its own toll-free form ahead of the date and put the reason plainly: a submission without both links is rejected outright from 15 September.

Bandwidth's verification guide carries the same date, describing both links as currently optional and mandatory effective 15 September 2026.

• The change is a carrier-level standard rather than one provider's policy, which is why the same date shows up in the documentation of providers that compete with each other (bandwidth.com toll-free verification guide and ideas.gohighlevel.com changelog, both read 20 September 2026).
• It applies however the submission is filed: the verified sender form, a bulk verification file, or the verification API (telgorithm.com, published 30 July 2026, read 20 September 2026).
• Numbers verified before the date are out of scope and need no resubmission, per the same two sources.
• Nothing here is a registration you can opt out of. A toll-free number that fails verification does not send.

What the terms page now has to contain#

Bandwidth publishes the content checklist, and a link to a generic terms page does not clear it. The page has to be separate from the opt-in language and carry seven specific items.

Read that list next to an A2P 10DLC campaign brief and the overlap is almost total. Same disclosures, same consent evidence, different form.

• Program or brand name and a description of the messaging program, including the use cases you asked to be verified for.
• A "Message and data rates may apply" disclosure, plus a message frequency or recurring message disclosure.
• Customer support contact information and a direct link to your privacy policy.
• HELP and STOP instructions, which Bandwidth specifies must be displayed in bold or capitalized.
• A statement that carriers are not liable for any delayed or undelivered messages (bandwidth.com toll-free verification guide, read 20 September 2026).

The privacy policy has one load-bearing sentence#

Privacy policy requirements for toll-free verification are shorter and easier to fail. The page has to say what customer data you collect and how it is used, which most policies already do.

Then comes the sentence that trips submissions. The policy has to state that mobile opt-in information is not shared with third parties or affiliates for marketing or promotional purposes.

Teams that route lead data to partners, resellers or an affiliate network usually have a policy that says the opposite, and nobody notices until the rejection arrives.

• The non-sharing statement covers affiliates, not only outside companies, so an intra-group data flow counts (bandwidth.com, read 20 September 2026).
• Both URLs must load for anyone, with no login wall, because a reviewer opens them cold.
• Publishing the pages is not enough on its own. The submitted URL has to point at the page that carries the disclosures, not at a homepage that links to it.
• Check your consent form too: disclosures adjacent to the phone field, an unchecked consent box, and consent collected for the messaging program rather than bundled into unrelated terms.

The rejection codes show what failure costs#

Twilio publishes the two error codes this change produces, and both are worth reading before you submit rather than after. Error 30493 covers the terms page.

Its description, read today, is direct: the Terms of Service URL is missing, cannot be reached, or lacks the required SMS disclosures on rates, frequency and opt-out.

Error 30519 covers the other half, a business that collects personal data submitting without an acceptable privacy policy.

• Both error pages state the consequence in the same words: messaging traffic on that toll-free number is blocked until the number is verified (twilio.com/docs/api/errors/30493 and /30519, read 20 September 2026).
• A rejection is not a warning with a grace period. The number sits silent while you republish a policy page and resubmit.
• 30519 lists an inaccessible policy URL as a distinct cause from a missing one, so a page behind a staging password fails the same way an absent page does.
• Plan the calendar around it. A campaign that depends on new numbers going live on a fixed date now depends on a review of two web pages you may not control.

This is the third tightening inside a year#

September's change reads differently once you put it in sequence. Toll-free verification has been converging on the 10DLC standard in steps, each one adding a field that 10DLC already asked for.

Twilio started collecting Business Registration Numbers on new toll-free verifications on 30 September 2025, optional at first, and said the fields would become required for all new verifications from 17 February 2026.

Carriers moved first. From 1 January 2026, new toll-free verification requests had to carry a business registration number, the issuing country, and the entity type.

• The 1 January 2026 requirements applied only to new submissions, exactly as September's do (telgorithm.com, published 14 January 2026, read 20 September 2026).
• Each round adds something 10DLC campaign registration already required: business identity, then campaign scrutiny, then public legal documentation.
• A sole proprietor submitting toll-free may face extra vetting under the entity type field, which is the same friction that pushed some teams off 10DLC in the first place.
• Reading the trend as finished would be optimistic. Three tightenings in twelve months is a direction, not an endpoint.

The cost argument did not survive either#

Twilio's published US pricing table, read today, prices outbound SMS at $0.0083 per segment on a long code and $0.0083 on toll-free. The per-message rate is identical.

The number itself is where they part. A leased long code is $1.15 a month and a leased toll-free number is $2.15, so the number type that was sold as the shortcut costs nearly double to hold.

So a team that migrated to toll-free to move faster through registration now files a comparable amount of paperwork and pays more per number for the privilege.

• Both figures come from the same published table (twilio.com/en-us/sms/pricing/us, read 20 September 2026). Carrier fees stack on top of the per-message rate on either number type.
• MMS inbound differs too, at $0.0165 on a long code against $0.02 on toll-free, which matters if your inbound volume is real.
• None of this makes toll-free a bad number type. It makes it a choice about the identity your customer sees, which is what it should have been.
• A national brand with no regional footprint has a genuine case for toll-free. A local sales team texting local buyers never did.

Where iMessage sits in this picture#

Blue Reacher runs on iMessage, which does not travel over the carrier SMS rails that A2P 10DLC and toll-free verification govern. There is no campaign brief, no verified sender form, and no A2P registration required.

Consent law does not move with the channel. The TCPA is written about conduct rather than about which network carries the message, and a stop request binds you on iMessage exactly as it does on SMS.

What changes is which kind of work you do. The compliance work stays. The carrier paperwork, the review queue, and the blocked-until-verified state do not exist here.

• A Blue Reacher line paces at 50 opted-in or 30 cold new conversations a day, replies are never metered, and there is no total daily message cap.
• Suppression attaches to the contact record and applies across every line and campaign on the account. See how opt-out handling works.
• The consent questions are the same ones the toll-free reviewer asks, which is why the TCPA guide is worth reading whichever channel you land on.
• Reply rate is the number to watch after the switch, because a message that arrives as a blue bubble from a real number gets answered at a different rate than a green one.

Check these before your next submission#

Verification failures in this category are almost never about the message content. They are about two web pages and one consent form, all of which you can inspect in an afternoon.

Run this list before filing rather than after a rejection, because the number earns nothing while it waits.

• Open your terms URL in a private browser window. Does it load with no login, and does it name the program, the frequency, the rates line, support contact, and HELP and STOP in bold or capitals?
• Open your privacy policy the same way. Does it say in words that mobile opt-in information is not shared with third parties or affiliates for marketing purposes?
• Does the opt-in page show the disclosures next to the phone field, with the consent box unchecked by default?
• Does your submitted use case match the opt-in flow a reviewer will actually see, or does it describe the program you intended to run?
• If you hold numbers verified before 15 September 2026, list them. They are exempt today, and every number you add after that date is not.

Frequently asked questions