TCPA Compliance: The Complete Guide for SMS Marketers

TCPA Compliance: The Complete Guide for SMS Marketers

The Telephone Consumer Protection Act (TCPA) was passed in 1991 to protect consumers from unwanted calls and texts. In the age of SMS marketing, it's the law most likely to land a business in court — and the penalties are severe enough to matter even for large companies.

This isn't a guide written to scare you. It's written to give you the information you need to run a clean, compliant SMS program that scales safely.

What the TCPA Actually Requires

At its core, TCPA compliance for SMS marketing requires:

1. Prior express written consent before sending any marketing messages

2. Clear disclosure of what subscribers are agreeing to receive

3. Easy opt-out mechanisms that work immediately

4. Honoring opt-outs within 10 business days (most platforms do this instantly)

5. Sending only during permitted hours (8 AM–9 PM in the recipient's local time zone)

The "prior express written consent" requirement is the one that trips up most marketers. The FCC is explicit: consent cannot be buried in terms of service. It must be clear, conspicuous, and specific to SMS marketing.

What Valid Consent Looks Like

A compliant opt-in includes:

• The business name clearly identified
• That the subscriber will receive recurring automated marketing messages
• That message and data rates may apply
• How to opt out (e.g., "Reply STOP to unsubscribe")
• How to get help (e.g., "Reply HELP for help")

A common compliant opt-in example: *"By entering your phone number and clicking Subscribe, you agree to receive recurring automated promotional text messages from [Brand] at the number provided. Consent is not a condition of purchase. Msg & data rates may apply. Reply STOP to unsubscribe, HELP for help."*

Common Violations That Lead to Lawsuits

• Purchased lists. Buying a list of phone numbers and texting them is an immediate TCPA violation. No prior consent exists.
• Checkbox consent buried in checkout. Pre-checked boxes or consent language hidden in small print doesn't satisfy "clear and conspicuous."
• Re-subscribing opted-out users. Once someone opts out, they cannot receive marketing messages until they actively re-subscribe.
• Third-party consent. Consent gathered by a lead generation partner doesn't automatically transfer to your brand without specific disclosure.
• Ignoring time zone restrictions. Sending at 9 AM Eastern when the recipient is in California means sending at 6 AM — a violation.

The Penalty Structure

TCPA violations carry statutory damages of:

• $500 per violation for negligent violations
• $1,500 per violation for willful or knowing violations

"Per violation" means per text message sent. A single campaign to 50,000 contacts without proper consent could expose a business to $75 million in liability. Class action attorneys actively monitor for TCPA violations and the case law makes it relatively easy to certify a class.

Best Practices for a Clean Program

• Document every opt-in with a timestamp and source
• Store consent records indefinitely — lawsuits can come years later
• Use a double opt-in flow for higher-value compliance protection
• Audit your list every 6 months and remove contacts with no recent opt-in confirmation
• Train your entire marketing team on what constitutes a valid opt-in

Staying Current

The FCC regularly updates TCPA guidance. The 2024 rulemaking on "one-to-one consent" significantly tightened how lead gen consent can be transferred between companies. If you work with lead generation partners, audit their consent language and ensure your brand is specifically named.

Compliance isn't a one-time setup — it's an ongoing operational practice. Build it into your workflows from day one.