SMS compliance: what the rules require and how to follow them

What TCPA requires

The Telephone Consumer Protection Act, enacted in 1991 and updated multiple times since, establishes the core rules for commercial text messaging in the United States. For marketing texts, TCPA requires prior express written consent before sending. The consent must be specific to SMS, clearly disclosed, and affirmative (the recipient must actively opt in, not fail to opt out of pre-checked boxes).

TCPA also prohibits texting before 8 AM or after 9 PM in the recipient's local time, requires that every commercial text identify the sender, and requires an opt-out mechanism. Violations are subject to statutory damages of $500 to $1,500 per message, which has made TCPA the basis of significant class-action litigation.

How to get proper consent

Valid TCPA consent for marketing SMS must be written (though digital forms qualify), clear about what the subscriber is consenting to (receiving marketing texts from you), voluntary (no purchase required to opt in or opt out), and accompanied by a disclosure of what they are signing up for.

Common consent collection methods include web signup forms with a checkbox and clear disclosure language, keyword opt-in (texting a word to your number, with prior instruction on a website or marketing material), point-of-sale paper signup, or verbal consent accompanied by a written record. Simply having a customer's phone number from a purchase or inquiry is not enough to send marketing texts.

Opt-in and opt-out mechanics

A double opt-in adds a confirmation step: after the initial signup, the subscriber receives a text asking them to confirm. Replying YES confirms the subscription. Double opt-in is not required by TCPA but is considered a best practice because it confirms the number is valid, the person controls it, and they genuinely want to receive messages.

Opt-out must be simple and must work. STOP is the universal keyword; replying STOP must remove the number from all marketing sends immediately and permanently (unless the subscriber later re-opts-in). Including opt-out instructions in every message is required. Continuing to text someone who has opted out is a TCPA violation regardless of any other factor.

Carrier filtering and sender reputation

Beyond legal compliance, carriers enforce their own guidelines through filtering. The CTIA messaging principles cover consent, content standards, and message frequency. Carriers and aggregators use automated systems to detect and filter messages that violate these principles.

Registering your sending number with The Campaign Registry (TCR) for A2P 10DLC messaging is now standard practice and required by major US carriers for business texting on long codes. Registration involves identifying your brand, the type of messaging you send, and the consent flow you use. Registered campaigns deliver more reliably than unregistered ones.

This guide is information, not legal advice

This page summarizes publicly available information about TCPA and CTIA guidelines for general educational purposes. It is not legal advice, and it is not a substitute for consultation with a qualified attorney regarding your specific business practices and messaging programs.

TCPA interpretation has evolved through court decisions, FCC rulings, and state law variations. Requirements that apply to your specific situation depend on the nature of your business, the messages you send, the consent methods you use, and the states in which your subscribers are located. Consult qualified legal counsel before launching any commercial SMS program.