TCPA Compliance for Text Messages: Business SMS Guide

TCPA Compliance for Text Messages: the short answer

TCPA compliance for text messages is an operating discipline, not a checkbox. Before sending promotional SMS, identify the sender and program, obtain and preserve consent appropriate to the message and sending method, make opting out easy, and suppress people who revoke permission or appear on applicable do-not-contact lists. The Telephone Consumer Protection Act (TCPA), FCC rules, FTC telemarketing rules, state law, and carrier or platform rules can all matter. Their scope is not identical. This guide explains practical controls, not legal advice; have qualified counsel apply the rules to your program, technology, jurisdictions, and facts.

For a typical ecommerce or lifecycle team, the safe implementation pattern is straightforward: market only to people who affirmatively enrolled in that brand’s program, describe the recurring program at collection, retain proof, honor STOP and other reasonable revocations across systems, and review each new campaign before launch. That conservative pattern also aligns with CTIA’s industry messaging principles and common A2P registration expectations. [1] [4] [5]

Start by classifying the message and the risk

Do not label every outbound text “transactional” because it mentions an order or customer account. Classify the actual purpose, the audience, the sender, the technology, and the consent record. A shipping update that simply reports delivery status is different from a shipping update that adds a discount or product pitch. A customer-service reply initiated by the customer is different from a scheduled marketing flow. The classification should drive the approved template, data source, consent threshold, and suppression rules.

The FCC defines an advertisement as material advertising the commercial availability or quality of goods, property, or services. Its TCPA rules apply do-not-call and telemarketing provisions to calls or text messages to wireless numbers as described in the Commission’s orders. The rule also treats an established business relationship as terminated for telemarketing purposes when the consumer makes a seller-specific do-not-call request. [1] That is why purchase history is not a substitute for a current suppression decision.

Prior express consent: collect it for the exact program

Consent is not one universal field. The appropriate standard depends on the message, the technology used, and applicable law. Under the FCC rule, a covered call or text with an advertisement or telemarketing content sent using an automatic telephone dialing system or artificial or prerecorded voice to a wireless number generally requires the called party’s prior express written consent, subject to stated exceptions. [1] A program should not rely on a loose interpretation of a general privacy notice, a prechecked box, a purchased list, or a customer’s phone number collected for another purpose.

Build a dedicated opt-in flow that makes the proposition understandable before submission. The consumer should be able to see the brand, program or product description, the number or sender identity where applicable, message category, recurring nature and expected frequency when relevant, opt-out instructions, help contact, and links to the terms and privacy policy. CTIA describes these as elements of a clear and conspicuous call to action and recommends an enrollment confirmation for recurring programs. Those are industry principles, not a substitute for legal advice, but they are a sensible implementation baseline. [4] See our practical guide to SMS opt-in requirements and the implementation tradeoffs of SMS double opt-in.

• Capture the phone number, consent timestamp, source page or store location, exact disclosure language, program or campaign, and the affirmative action taken.
• Store the form or page version, consent checkbox state, IP or session identifier where available, and confirmation events without overstating what any single data point proves.
• Keep consent separated by brand and message category when your use cases differ, such as marketing, account alerts, and two-factor authentication.
• Do not import vendor, affiliate, or acquired lists into a marketing program without counsel-approved evidence and a carrier-policy review. CTIA says senders should not use rented, sold, or shared opt-in lists. [4]

This evidence is useful only when it is retrievable. Create a durable consent ledger rather than leaving proof in a form tool, ecommerce plugin, or agency spreadsheet. For a practical data model, see consent records and audit trails.

Revocation and do-not-contact controls cannot be optional

Consumers can revoke prior express consent, including prior express written consent, by any reasonable method that clearly communicates they do not want further calls or texts from that caller or sender. The FCC rule expressly recognizes reply words including STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE. It also requires senders to treat other reply language as a valid revocation if a reasonable person would understand it that way. The sender may not make one exclusive revocation channel the only acceptable option. [1]

For covered TCPA messages, revocation requests made in any reasonable manner must be honored within a reasonable time, not exceeding 10 business days after receipt. A sender may send one purely confirmatory text after a revocation; if sent within five minutes it is presumed to fall within prior consent, and it cannot include marketing. If consent applies to several message categories, a confirmation may ask for clarification, but the sender must cease texts for which consent is required unless the person clarifies that they want to continue. [1] Operationally, aim for immediate suppression rather than building your process around the outside limit.

A functional opt-out system is broader than keyword automation. Centralize suppressions across the SMS provider, CRM, customer-support inbox, marketing platform, manual upload tools, agencies, and replacement sending numbers. Teach support staff how to recognize “don’t text me,” “take me off,” and email or voicemail requests. Test that the suppression is applied before the next triggered flow, not merely before the next campaign. Our SMS opt-out requirements guide outlines the workflow detail teams usually miss.

For telemarketing, maintain both a seller-specific do-not-call list and, where applicable, controls for the National Do Not Call Registry. FCC rules require procedures, training, recordkeeping, and use of a Registry version obtained no more than 31 days before a call to support the stated safe-harbor conditions. They also require a record of a consumer’s do-not-call request to be honored for five years. [1] The FTC separately explains that seller- and telemarketer-specific lists are their own obligation and that federal Registry coverage has exemptions, including certain established business relationships and written permission. [3] Do not let an exemption analysis override a direct opt-out.

TCPA law, carrier policy, and conservative best practice are different layers

A2P 10DLC is not a legal safe harbor. It is a U.S. carrier framework for application-to-person traffic over 10-digit long codes. Twilio’s current documentation describes it as a carrier standard intended to make traffic verified and consensual, and says registration includes a brand plus a campaign description that covers purpose and opt-in, opt-out, and help behavior. [5] Plan the registration alongside your consent architecture, not after your first campaign is built. Start with this A2P 10DLC registration guide.

Carrier rules may be stricter or more operationally specific than the legal baseline. Treat rejected registration, filtering, or an account warning as a production issue that needs root-cause analysis. Do not simply rotate numbers or reword the same unapproved program.

A workable compliance operating system for CRM and ecommerce teams

The best control is a repeatable launch process that marketing can use without improvising. Assign a business owner for each program and make legal, privacy, operations, and vendor responsibilities explicit. The goal is not to turn marketers into lawyers. It is to prevent unreviewed changes to message purpose, consent language, data sources, or sending technology.

1. Inventory every sending number, short code, toll-free number, provider account, automation, agency, and system that can trigger an SMS.
2. Map each program to its purpose, audience, consent method, disclosure version, sender, message examples, frequency, owner, and approved data source.
3. Set a hard pre-send gate: the audience query must apply master opt-out, seller-specific do-not-call, relevant DNC, invalid-number, and program-consent exclusions before export or API handoff.
4. Test opt-in confirmation, HELP, STOP, natural-language opt-outs, agent-entered opt-outs, and suppression propagation across every downstream system.
5. Keep change records for forms, terms, campaign registration, copy, vendor routing, and automation logic. Review complaint, opt-out, delivery, and filter signals after each material launch.
6. Escalate exceptions: a new acquisition partner, a blended promotional/transactional template, an affiliate, a new state, or a proposed reactivation flow should go to counsel and the program owner before deployment.

Two controls are particularly valuable. First, segment by consent and program purpose before you segment by revenue potential. Second, validate data quality without treating a valid mobile number as permission to market. Pair the consent ledger with routine SMS list hygiene and a documented campaign QA process. Time-zone and local-hour controls are also prudent; see our SMS quiet-hours guide.

The practical decision standard

Before a text program goes live, a responsible operator should be able to answer five questions quickly: Who is the sender? Why is this person receiving this message? What evidence supports that permission? How can they stop it through every reasonable channel? Which system prevents a future send? If one of those answers is vague, the program is not ready.

That standard improves both compliance posture and program quality. It forces a clean distinction between a useful service message and a marketing campaign, makes revocation durable, and gives teams evidence when they need to investigate a complaint or carrier issue. For a broader implementation review, use our SMS marketing compliance guide.