The Complete Guide to TCPA Compliance for Text Messages

Type: Blog
Topic: Consent Mgmt

Topic: Do Not Call Solution

The Telephone Consumer Protection Act (TCPA) sets strict rules for how businesses can send marketing text messages and who they can be sent to. The financial and legal cost of non-compliance can be steep, including serious penalties and fines, class action lawsuits, and long-term damage to brand reputation. Compliance requires getting several elements right at once—from obtaining valid consent to honoring opt-outs within required timeframes—and everything must be documented in a way that can withstand regulatory review or litigation.

These obligations are enforced aggressively, and the regulatory landscape extends beyond the TCPA itself. The FTC’s Telemarketing Sales Rule (TSR) imposes its own disclosure and recordkeeping standards when texts serve a telemarketing purpose, and state-level mini-TCPA statutes may add stricter requirements and higher damages on top of federal law. PossibleNOW’s DNCSolution® and MyPreferences® platforms help enterprises manage these layered requirements across channels and business units, from consent capture and suppression enforcement to real-time scrubbing and audit-ready recordkeeping.

Key areas covered in this guide:

• Federal and state laws that apply to marketing text messages
• Financial, legal, and reputational risks of non-compliance
• What qualifies as valid consent and how to document it
• How to handle opt-out requests and apply them across every system
• How to keep contact lists clean and avoid texting reassigned numbers
• Why businesses are liable for their vendors’ texting practices
• What records to maintain to support audits and defend against litigation

Key Laws That Govern Text Message Marketing

Multiple layers of regulation apply to businesses that send marketing texts. A compliant SMS operation must account for each of them.

• TCPA: This is the primary federal statute that governs SMS marketing. It requires prior express written consent before sending marketing text messages, gives consumers the right to revoke that consent at any time, and prohibits texts to numbers on the National Do Not Call Registry without a valid exemption. Violations carry statutory damages of $500 per text, or $1,500 for willful violations. The TCPA also provides a private right of action, meaning consumers can sue businesses directly.
• TSR: Applies when text messages are used for telemarketing purposes. It imposes its own disclosure, recordkeeping, and opt-out requirements that operate alongside the TCPA. TSR rules also govern scrubbing against the National Do Not Call Registry and set requirements for how long consent and suppression records must be retained.
• State-level mini-TCPA statutes: States such as Florida, Oklahoma, and Maryland impose stricter consent standards and tighter restrictions than federal law. Statutory damages under these state laws can stack on top of federal penalties, and some states also allow consumers to file private lawsuits, opening the door to class action litigation.

The Cost of Non-Compliant Text Marketing

Penalties for SMS violations can accumulate quickly because each individual text counts as a separate potential violation.

• Financial penalties are severe. TCPA statutory damages range from $500 to $1,500 per violation, with no requirement that the consumer prove actual harm. TSR civil penalties can reach up to more than $53,000 per non-compliant contact. State mini-TCPA damages can stack on top of federal penalties, and several states allow consumers to file private lawsuits.
• Class action lawsuits are surging. TCPA lawsuits rose significantly in 2025, with class actions accounting for the majority of cases. Settlements for large-scale SMS violations routinely reach into the millions of dollars.
• Carriers can block your messages. When complaint volumes rise, carriers and analytics platforms may flag numbers as spam, block messages, or suspend short codes. These actions can undermine campaign performance well before a formal complaint or lawsuit is filed.
• Brand reputation suffers. Consumers who receive unwanted texts are far more likely to file complaints, leave negative feedback, and disengage from the brand entirely. High-profile enforcement actions and settlements attract media coverage that can define a brand’s public image for years.

6 Key Steps for TCPA-Compliant Text Marketing

Federal and state regulations set specific requirements at every stage of an SMS marketing operation. The following steps outline what a compliant and defensible text messaging operation requires.

Collect Valid Consent Before Sending Marketing Texts

Federal law requires prior express written consent before sending marketing text messages. That consent must meet specific standards to hold up under regulatory or legal scrutiny.

What Qualifies as Express Written Consent

Any time a consumer is presented with a consent form or opt-in mechanism, the following must be included:

• Clear and conspicuous disclosure that the consumer is agreeing to receive marketing text messages.
• An affirmative opt-in action taken by the consumer, such as checking an unchecked box, signing an electronic form, or replying with a keyword. Pre-checked boxes do not qualify.
• Specific sender identification: Name the business or brand sending the messages.
• A statement that consent is not required as a condition of purchasing any goods or services.
• Notice of automated technology: Disclose that messages may be sent using an autodialer or similar automated platform.
• Required SMS disclosures: Include message frequency, possible data rates, and opt-out instructions such as replying STOP.

Build a Defensible Consent Record

Every consent must be documented in detail at the time it is collected. If a consumer files a complaint or a regulator requests records, the business needs to be able to show exactly what the consumer agreed to, when, and how.

Each consent record should capture:

• The consumer’s name and phone number
• A copy of the consent language as it was presented to the consumer
• The specific purpose for which consent was given
• The date and time of the opt-in
• The source or channel — web form URL, IVR path, in-store kiosk, keyword reply, etc.
• Verification details such as IP address, device identifier, or confirmation reply

Federal rules require retention of consent records for at least five years, though some states require 10 years, and many businesses choose to retain these records indefinitely as a best practice.

Honor Opt-Out Requests Promptly and Consistently

When a consumer revokes consent, federal rules require that marketing texts stop as soon as possible and no later than 10 business days after the request is received.

A one-time response is permitted after an opt-out request, but it must be sent within five minutes and contain no marketing or promotional content. If the consumer has opted into multiple message types, that response may ask which types they want to stop receiving. If the consumer does not reply, the revocation must be treated as applying to all messages from that sender.

Opt-out requests must be applied across every system involved in outbound texting, including dialers, SMS platforms, CRMs, and any third-party vendors sending on the brand’s behalf. When suppression data is siloed or delayed, consumers may continue receiving texts after revoking consent—one of the most common triggers for complaints and litigation.

How Consumers Can Revoke Consent to Text Messages

Federal rules prohibit businesses from requiring a single exclusive opt-out method. Consumers may revoke consent through any reasonable means, including:

• Standard reply keywords such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE
• Nonstandard phrases such as “please stop texting me” or “no more messages”
• Verbal requests during a phone call or customer service interaction
• Requests submitted through web forms, email, account settings, or self-service portals

Learn more about how consumers can revoke consent.

Scrub Contact Lists and Validate Numbers

Contact data should be reviewed and scrubbed regularly to remain compliant. For telemarketing campaigns, federal rules require sellers and telemarketers to update their lists against the National Do Not Call Registry at least every 31 days. Internal suppression files, however, should be checked far more frequently so opt-out requests are honored promptly across campaigns and systems. Some states, such as Florida and Louisiana, also maintain separate do-not-call registries with their own scrubbing requirements.

For a detailed breakdown of SMS-specific obligations, see PossibleNOW’s guide on Do Not Contact rules for SMS and text messaging.

Wireless Validation and Reassigned Numbers

Validate mobile numbers before texting. If a number collected through a web form is not actually a mobile number, using it for SMS can create unnecessary compliance risk and wasted outreach.

Reassigned numbers present another significant risk. When a phone number changes hands, the consent given by the previous owner does not transfer to the new owner. The FCC’s Reassigned Numbers Database helps businesses check whether a number has been disconnected or no longer belongs to the person who originally gave consent. Scrubbing against the RND helps prevent sending texts to unintended recipients.

The FCC’s RND safe harbor can protect a business that properly checks the database and receives an erroneous result. If the caller meets the rule’s conditions, that mistaken database response can provide a defense to TCPA liability for the contact.

Manage Vendor and Lead Generator Compliance

Courts have consistently found that businesses can be held responsible for text messages sent by outside partners on their behalf. If a lead generator, vendor, or remarketer sends texts without valid consent or continues texting after an opt-out, your brand may be vulnerable to lawsuits or fines.

Before a third party is allowed to send texts for your brand, your business should review how that partner collects consent, stores consent records, and processes opt-outs. If the partner cannot show where consent came from, when it was collected, and which specific brand the consumer agreed to hear from, that partner should not be texting on your behalf.

Consent language that refers only to “marketing partners” or bundles several brands together can create risk. Contracts should spell out compliance duties clearly, but businesses should also audit vendor practices instead of relying on assurances alone.

Maintain Detailed Records for Audit and Defense

If a regulator requests records or a consumer files a lawsuit, the business needs to be able to produce clear evidence that it followed the rules. Beyond consent records, organizations should maintain:

• Opt-out requests with timestamps, sources, and confirmation details
• Scrub receipts showing when lists were checked and against which registries
• Suppression list history with dates of addition and any subsequent changes
• Vendor communications related to consent collection, data handoffs, and suppression sharing

Without organized, accessible documentation, even a business that followed every rule may struggle to prove it when challenged.

How PossibleNOW Helps Businesses Keep SMS Marketing Compliant

PossibleNOW provides the technology and expertise enterprises need to manage every layer of SMS compliance, from consent capture through suppression enforcement and regulatory monitoring.

• MyPreferences® centralizes consent capture, preference management, and revocation handling across channels and business units. It records each consent and opt-out with full audit history and propagates updates in real time to connected CRMs, marketing platforms, and outbound systems.
• DNCSolution® delivers real-time scrubbing against federal, state, wireless, and internal Do Not Contact lists, along with the Reassigned Numbers Database and a list of known TCPA litigators.
• RegInfoHub® supplies continuously updated federal and state regulatory guidance, including SMS-specific rules and developments across mini-TCPA jurisdictions, so compliance teams can adapt quickly as requirements evolve.
• Strategic Consulting and Compliance Advisory Services help organizations design consent workflows, evaluate vendor and lead generator practices, and build defensible SMS operations aligned with current law.

The penalties for non-compliant text marketing are steep and growing steeper, with class action filings surging and per-violation damages that can reach into the millions. PossibleNOW’s platforms and advisory teams give enterprises a clear path to managing TCPA compliance at scale, protecting revenue, customer trust, and brand reputation.

Ready to evaluate your SMS compliance practices? Contact a PossibleNOW expert today to learn how DNCSolution and MyPreferences can support defensible text marketing at enterprise scale.