Guide
TCPA SMS compliance checklist
By Encore Text Team ·
The Telephone Consumer Protection Act, or TCPA, is the main US federal law governing marketing calls and texts. It is enforced by the Federal Communications Commission and through private lawsuits, and the statutory damages can add up quickly across a large list. This checklist turns the core expectations into practical steps for a business sending marketing texts. It is general information, not legal advice.
1. Get prior express written consent for marketing
Marketing texts sent with automated technology generally require prior express written consent. That means the person agreed, in writing (an online form or a text reply can qualify), to receive marketing messages from your business at the number they provided.
- Name the business that will send the messages.
- Make clear the person is agreeing to receive marketing texts.
- State that consent is not a condition of purchase.
- Use an unchecked checkbox or an affirmative action, never a pre-checked box.
Informational messages, such as order confirmations, have different requirements, but mixing promotions into them can turn them into marketing messages.
2. Show clear disclosures at sign-up
Industry guidelines from the wireless trade association CTIA expect the sign-up point to explain the program. A good disclosure covers the brand name, the type of messages, how often messages are sent, that message and data rates may apply, how to opt out by replying STOP, how to get help by replying HELP, and links to your terms and privacy policy.
3. Send a confirmation message
After someone opts in, send one confirmation text that repeats the essentials: who you are, what they signed up for, the frequency, and how to opt out and get help.
Northside Live: You're subscribed to event alerts, up to 4 msgs/month. Msg & data rates may apply. Reply HELP for help, STOP to opt out.
4. Honor opt-outs quickly and broadly
People can revoke consent in any reasonable way, not only by replying STOP. Treat common words such as STOP, END, CANCEL, UNSUBSCRIBE and QUIT, and clear requests like please stop texting me, as opt-outs. FCC rules require businesses to honor revocations within a short, defined period, and the safest practice is to stop immediately. One confirmation that the person has been unsubscribed is acceptable; further marketing is not.
5. Identify yourself in every message
Start each message with your brand name. Recipients should never have to guess who is texting. Include opt-out instructions regularly, and always in the first message and in messages sent after a long gap.
6. Respect time-of-day limits
Federal rules restrict telephone solicitations to between 8 AM and 9 PM in the recipient's local time, and several states set narrower windows or limit sending on Sundays and holidays. Base timing on the recipient's time zone, not yours. Our guide to SMS quiet hours by state covers the common state rules.
7. Check the Do-Not-Call picture
The National Do Not Call Registry applies to telephone solicitations, and the FCC has treated texts as calls for these purposes. Prior express written consent from the person generally permits marketing texts to a number on the registry, but consent must be valid and documented. Keep your own internal do-not-contact list of everyone who has opted out, and never re-add them from another source.
8. Never use purchased or shared lists
Consent is given to a specific business. A list bought from a vendor, rented from a partner, shared by a sister brand or scraped from the web does not carry consent to you. Sending to such lists is one of the fastest ways to trigger complaints, carrier blocking and legal claims.
9. Keep records you can produce
If a consent claim is disputed, the business typically has to show proof. For each contact, keep the date and time of opt-in, the source (form, keyword, point of sale), the exact disclosure language shown, the IP address or other evidence where available, and every later opt-out or re-subscription. Keep these records for several years; the TCPA's general limitation period is four years.
10. Watch reassigned numbers
Phone numbers are reassigned when people change carriers or give up a line. Texting a number whose new owner never consented can create liability. Clean lists that have not been messaged for a long time, remove numbers that bounce or are landlines, and consider the FCC's Reassigned Numbers Database for older lists.
11. Know the state laws
Several states have their own telemarketing laws, sometimes called mini-TCPAs, that add requirements such as narrower calling hours, limits on the number of messages per day on the same subject, or broader definitions of automated systems. Florida, Oklahoma and Maryland are often cited examples. If you send nationally, plan for the strictest rule that applies to your recipients.
How Encore Text helps
Encore Text records consent source, timestamp and disclosure version for every contact, requires you to confirm consent when importing, handles STOP and HELP automatically, suppresses opt-outs across every campaign, holds overnight messages until 8 AM in each recipient's time zone and reviews each campaign for brand name and opt-out language before an owner or admin approves it. The tools help, but responsibility for consent and content stays with the sender.
12. Train your team
Compliance often fails at the human level: a staff member types in numbers from a guest list, a marketer reuses a list from another brand, or someone sends a late-night blast after a show. Write down your rules, share them with everyone who can send, and limit approval rights to people who understand them.
Frequently asked questions
- Does the TCPA apply to text messages?
- Yes. The FCC and courts have treated text messages as calls under the TCPA.
- Is a checkbox enough for written consent?
- An unchecked checkbox with clear disclosure language can serve as written consent online, provided it identifies the sender and says consent is not a condition of purchase.
- How long should I keep consent records?
- Keep them for several years. The TCPA's general limitation period is four years, so many businesses keep records at least that long.
- Can I text people on the Do Not Call Registry?
- Generally only with their valid prior express written consent, which you should be able to document.
This guide is general information, not legal advice. Laws and carrier rules change and depend on your situation, so talk to a qualified lawyer about your messaging program.
Send compliant texts from your own toll-free number
Every account gets its own toll-free number — included, no setup fees.
See pricing