TCPA Compliance Checklist for SMS: Consent, 10DLC, and Penalties

A TCPA compliance checklist for SMS covers seven things you have to get right before you send a business text: written consent for marketing messages, clear opt-in disclosures, a working opt-out process, sending only during permitted hours, checking the Reassigned Numbers Database, carrier registration through 10DLC, and record keeping that can survive a lawsuit. Each unauthorized text carries $500 in statutory damages under 47 U.S.C. § 227, and up to $1,500 per message if a court finds the violation was willful.¹ Capital One settled a TCPA class action for $75.5 million. Wells Fargo settled for $95 million. The math is why compliance is not optional.

Get the Right Kind of Consent

The TCPA treats marketing texts and transactional texts differently, and the consent standard is where most programs succeed or fail.

Promotional messages that advertise, sell, or generate interest in a product or service require prior express written consent: a signed agreement, electronic or physical, specifically authorizing marketing texts. Transactional messages such as order confirmations, shipping notifications, appointment reminders, and two-factor codes require only prior express consent, which can be established when a consumer voluntarily gives their number for that specific informational purpose.²

The line gets messy in practice. A pharmacy that sends a prescription-ready alert is sending a transactional text. If it starts pitching vitamins to that same number, it has crossed into marketing territory and needs written consent it probably never got. Consent given for one purpose does not automatically extend to another. Getting written consent covering all text communications is the cleanest approach.

The E-SIGN Act validates electronic signatures for TCPA consent purposes, defining them as any electronic sound, symbol, or process that a person uses with the intent to sign a record.³ In practice, three methods work:

Website opt-in forms with an unchecked checkbox next to clear disclosure language, where the user actively clicks to agree.
Text-to-join keywords, where the consumer initiates by texting a word like “JOIN” after seeing a disclosure about what they are signing up for.
Mobile app consent screens, where the user taps to authorize marketing texts with disclosure language visible on the same screen.

Consent cannot be buried in general terms and conditions or bundled with a purchase. FCC rules require that agreeing to marketing texts not be a condition of buying anything. A checkout flow with a pre-checked SMS box, or one that automatically enrolls buyers, fails the standard.

Purchased lists do not carry consent. The burden of proving consent falls entirely on the business sending the message, and that consent has to tie the specific consumer to your specific brand.² A lead vendor’s assurance that “these people opted in” gives you nothing if those consumers never agreed to hear from you by name. This is where most lead-generation TCPA cases start, and where they end fastest.

What the Opt-In Flow Must Disclose

The consent form itself has to give a reasonable consumer the information they need before agreeing. Treat this as a checklist inside your opt-in screen:

Your identity. The business name or program name must be clearly stated. A consumer who cannot tell which company will be texting has not given informed consent.
Message frequency. If messages are recurring, say so. “Up to 4 messages per month” sets a concrete expectation; “periodic updates” invites complaints.
Data rates. Include language that standard message and data rates may apply.
Opt-out instructions. Tell the consumer how to stop messages before they receive one. “Reply STOP to cancel” is the standard.
Voluntary consent. Make clear that agreeing is not required to purchase any product or service.

All of this needs to be visible at the point of consent, not hidden behind a link. A small “terms” hyperlink at the foot of a long form does not meet the clear-and-conspicuous standard.

Honor Opt-Out Requests

FCC revocation rules at 47 CFR § 64.1200(a)(10) allow consumers to revoke consent through any reasonable means. Certain keywords are treated as automatic and unambiguous: STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE. A reply using any of them definitively revokes consent, and no further messages may be sent.⁴

The rule does not stop at magic words. A reply like “please don’t text me anymore” or “take me off this list” is a valid revocation if a reasonable person would read it that way. You cannot funnel consumers into a single designated opt-out method and ignore requests that arrive through other channels. The regulation expressly prohibits designating an exclusive means of revocation.⁴

After an opt-out, one confirmation text is allowed. It must do nothing but acknowledge the request. No marketing, no promotional offer, no “sorry to see you go, here’s 20% off.” If sent within five minutes, that confirmation is presumed to fall within the original consent; longer delays require you to justify the timing.⁴

Revocation requests must be honored within 10 business days, though real-time processing is the practical target. The 10-business-day compliance window under § 64.1200(a)(10) takes full effect on April 11, 2026; the FCC delayed that provision to give businesses time to update their systems.⁵ The rest of the framework, including the “any reasonable means” standard and the confirmation text rules, is already in effect as of April 2025.

Send Only During Permitted Hours

FCC rules prohibit telephone solicitations before 8:00 a.m. or after 9:00 p.m. in the recipient’s local time zone under 47 CFR § 64.1200(c)(1). Whether that restriction applies to texts sent with prior express consent is technically unsettled: the definition of “telephone solicitation” at 47 CFR § 64.1200(f)(15) excludes messages made with the recipient’s prior express invitation or permission.

In practice, treat 8:00 a.m. to 9:00 p.m. as a hard boundary for all marketing texts. Plaintiffs’ attorneys actively target businesses for messages sent outside those hours, and litigating an exemption argument costs far more than scheduling around it. The recipient’s time zone is the one that matters, not yours. A text sent at 7:30 p.m. Pacific lands on an East Coast consumer at 10:30 p.m.

Area codes give you a starting point for time zones, but mobile number portability means a 212 number may belong to someone living in California. Better platforms use additional geolocation data. At minimum, flag numbers where the area-code time zone puts the send window near the cutoff.

Check the Reassigned Numbers Database

Phone numbers change hands constantly. When a consumer who gave you consent gives up the line and the carrier reassigns that number, texting it means contacting someone who never agreed to hear from you. The FCC’s Reassigned Numbers Database is built to address this, and checking it creates a safe harbor defense.⁶

To qualify for the safe harbor, you must show three things: you originally obtained consent from the intended recipient, you (or your authorized agent) checked the database before sending, and the database incorrectly indicated the number had not been reassigned. Meet all three and you are protected from liability for that message.⁶ The database updates every 30 days, so querying at least that often keeps your safe harbor current.

Register With Carriers Through 10DLC

Legal consent alone will not get your messages delivered. The major U.S. carriers require businesses sending SMS from standard 10-digit phone numbers to register through The Campaign Registry, a system known as 10DLC. This is a carrier-level mandate, not a TCPA rule, but unregistered messages get filtered or blocked, and carriers may fine senders using unregistered numbers.

Registration happens in two stages. You register the brand with your legal business name, address, EIN, and website. Then you register each SMS campaign with a description of its purpose, sample messages, proof of how you collect opt-ins, and links to your SMS privacy policy and terms. Carriers review these submissions to screen for spam. In practice, this has to be finished before you launch, even though it is not written into federal law.

Keep Records That Prove Consent

When a TCPA lawsuit is filed, the caller carries the burden of proving consent existed. The FCC has said so directly: if any question arises as to whether prior express consent was provided, the burden is on the caller to prove it. If you cannot produce the receipt, you lose.

Consent records should include, at minimum:

The exact date and time consent was given.
The method (web form, text keyword, mobile app, or other channel).
For web-based opt-ins, the IP address used at registration.
A snapshot of exactly what the consumer saw when they consented. If you update opt-in language, keep archived versions tied to the version each consumer actually agreed to.
Opt-out records: the date, time, and method of every revocation, plus confirmation that it was processed and the time of your confirmation message.
Message logs showing every text sent to each number, with content and delivery time.

Retention length is not uniform. The TCPA sets different limitation periods depending on the type of enforcement action, including one year for certain FCC forfeiture actions involving autodialer violations and four years for caller ID spoofing violations.¹ For private lawsuits under § 227(b)(3), the statute does not specify its own limitation period, so courts typically apply the relevant state statute of limitations, which varies. Five years of records gives you a comfortable buffer against claims filed in any state.

Account for State Law on Top of Federal

Federal TCPA compliance is the floor, not the ceiling. Several states have telemarketing statutes that impose additional restrictions on text messages:

Stricter quiet hours. While the federal standard is generally 8:00 a.m. to 9:00 p.m., Florida, Washington, Oklahoma, and Maryland cut off marketing texts at 8:00 p.m., and Maryland does not allow them before 9:00 a.m.
Frequency caps. Florida, Oklahoma, and Maryland limit contact attempts to three per 24-hour period. Federal law imposes no equivalent cap.
Broader autodialer definitions. Florida and Oklahoma cover any platform with the ability to automatically dial or select records for dialing, which sweeps in systems that would not qualify under the narrowed federal definition.
Higher penalties. State-level damages range from $100 per violation in Washington up to $11,000 per violation in New York, with some states allowing additional penalties for repeat offenders.

If you text consumers nationwide, your program has to be built around the strictest applicable state law, not the federal baseline alone. A campaign that runs cleanly under the TCPA can still create liability under Florida or Maryland rules.

Know the Limits of the Exemptions

Certain categories of automated messages to wireless numbers are exempt from the TCPA’s consent requirements, but each exemption comes with conditions and volume limits. The FCC has codified exemptions for messages from financial institutions, healthcare providers, package delivery notifications, and calls made by or on behalf of tax-exempt nonprofit organizations.⁷ Emergency calls are exempt under the statute itself.⁸

These exemptions are narrower than they sound. A healthcare provider can send appointment reminders, but the exemption does not cover marketing a new cosmetic procedure. A financial institution can send fraud alerts, but not promotional credit card offers. Every exempt category still requires an opt-out mechanism, and the FCC caps how many exempt messages you can send. Relying on an exemption without reading its specific conditions is a fast way into the litigation you thought you had avoided.

Watch AI-Generated Content

In February 2024, the FCC ruled that AI-generated voices qualify as “artificial” voices under the TCPA, bringing them fully within the statute’s consent and disclosure requirements. The ruling primarily targets voice calls, but it signals how regulators view AI-generated content generally. Any call or message using an AI-generated voice must identify the business responsible and provide the sender’s phone number at the beginning of the communication, with no exception for tools that claim to replicate a live human interaction.⁹ If your SMS program uses AI to craft message content or simulate conversational exchanges, build your consent disclosures and sender identification around that assumption.

What Non-Compliance Actually Costs

Per-message math is what makes TCPA litigation dangerous. Each unauthorized text carries $500 in statutory damages under the federal statute, and courts have discretion to award up to $1,500 per message for willful violations.¹ A campaign that reaches 50,000 people without proper consent creates exposure of $25 million at the base rate, or $75 million if a court finds the violation knowing. Beyond private suits, the FCC can impose its own forfeiture penalties, and state attorneys general can bring actions under their consumer protection statutes. A single non-compliant campaign can generate parallel litigation on all three fronts.

1
Office of the Law Revision Counsel. 47 U.S. Code 227 – Restrictions on Use of Telephone Equipment
2
Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions
3
Office of the Law Revision Counsel. 15 U.S. Code 7006 – Definitions
4
eCFR. 47 CFR 64.1200 – Delivery Restrictions
5
Federal Communications Commission. DA 25-312 – TCPA Consent Order Compliance Extension
6
Federal Communications Commission. Reassigned Numbers Database
7
Federal Register. Limits on Exempted Calls Under the Telephone Consumer Protection Act of 1991
8
Office of the Law Revision Counsel. 47 U.S.C. 227 – Restrictions on Use of Telephone Equipment
9
Federal Communications Commission. FCC 24-17 – TCPA AI-Generated Voice Declaratory Ruling