TCPA-Compliant SMS Marketing for US Businesses
The Telephone Consumer Protection Act (TCPA) governs how US businesses can use SMS and phone calls for marketing. It has teeth — statutory damages of $500 per message ($1,500 for willful violations) and a private right of action that has produced settlements in the tens of millions. Class-action plaintiff firms watch for non-compliant SMS campaigns the way patent trolls watch for accidental infringement. The good news is that TCPA compliance for SMS marketing is well-defined: get written express consent, respect quiet hours, honor STOP requests instantly. This guide walks through what each of those means in practice and how to structure your SMS program so it stays defensible.
Rule 1: Get prior express written consent for marketing messages
For any SMS that promotes products or services ("marketing" in TCPA terms), you need prior express written consent before the first message. The consent must:
- Be in writing (electronic signature counts — a checkbox at signup is fine)
- Be a clear and conspicuous opt-in that's not pre-checked
- Disclose that the user will receive marketing messages
- Disclose that consent is not a condition of purchase
- Identify the sender by name
- Disclose that message and data rates may apply
- Disclose typical message frequency ("up to 4 messages per month")
Rule 2: Respect quiet hours
Federal TCPA rules prohibit telemarketing calls and texts before 8 AM or after 9 PM in the recipient's local time zone. Many states layer on stricter limits — for example, Florida and Oklahoma restrict to 8 AM-8 PM. Your SMS platform should route messages to send within the recipient's quiet-hours window based on phone area code or self-reported time zone. A message sent at 10 PM ET because your servers are in California is still a TCPA violation — the recipient's time zone is what matters.
Rule 3: Honor STOP and HELP keywords immediately
Any recipient who replies STOP, UNSUBSCRIBE, CANCEL, END, or QUIT must be opted out within 5 minutes (carriers enforce 30 seconds in practice). You must also respond with a one-time confirmation message acknowledging the opt-out. After opt-out, no more marketing messages to that number, period — re-collecting consent later requires going through the full opt-in flow again. HELP keyword must return your contact info, message frequency, and how to opt out.
Rule 4: Maintain proof of consent for at least 4 years
TCPA's statute of limitations is 4 years from the violation. If you get sued, you need to produce the consent record for each plaintiff: the form they signed (or screenshot of the checkbox they ticked), the timestamp, IP address, and the version of the consent text in effect at that moment. Without that record, you'll likely settle. Modern SMS platforms maintain this audit trail automatically; spreadsheet-based programs almost never do.
Rule 5: Use 10DLC for application-to-person messaging
Since 2023, US carriers (AT&T, Verizon, T-Mobile) require business SMS to be sent via 10DLC (10-Digit Long Code) numbers that are registered with the Campaign Registry. Unregistered traffic gets filtered, throttled, or blocked. Registration involves disclosing your business EIN, providing campaign details, and paying small fees. Toll-free numbers are an alternative but require their own verification. Short codes (the 5-6 digit numbers) are still the gold standard for high-volume marketing but require a multi-month approval process and cost $500-$1,500 per month.
What penalties actually look like
TCPA penalties are statutory and stack per message:
- $500 per non-willful violation (per message, per recipient)
- $1,500 per willful or knowing violation
- Class-action plaintiffs can aggregate recipients — a campaign to 50,000 numbers without proper consent could expose $25-75M in damages
- Settlements typically resolve in the $1-10M range for mid-size violations
Frequently asked questions
Does TCPA apply if customers ask me to text them?
Inquiry messages (informational, transactional) have a lower bar than marketing — you can text in response to an inbound request, send order confirmations, or notify about appointments without express written consent. The moment the message includes a promotional offer ("BOGO this weekend"), it becomes marketing and the full consent rules apply.
Can I import an existing contact list and start texting?
Almost certainly no. Unless every contact on the list went through a compliant opt-in flow specifically for SMS marketing from your business (not generally — phone number on a contact form doesn't count), importing and texting them is a textbook TCPA violation. Run a fresh opt-in campaign.
What about texting customers who bought from us?
Customer status doesn't equal consent for marketing SMS. A purchase gives you grounds for transactional texts (order updates, shipping notifications) but not for promotional ones. Add a clear opt-in for marketing texts at checkout or in account settings — don't assume.
How is TCPA different for B2B?
TCPA applies to mobile phones regardless of whether they're personal or business. The same consent rules apply for SMS to a contact's cell phone, B2B or B2C. Some B2B campaigns use email instead specifically to sidestep TCPA exposure.
What about international (non-US) numbers?
TCPA is US law and covers US phone numbers. Other countries have their own SMS regulations — Canada's CASL, the EU's ePrivacy directive, etc. — many of which are stricter. International SMS programs should treat each country's rules separately, not assume TCPA compliance covers them.
Do quiet hours apply to transactional messages?
Federal TCPA quiet hours technically apply only to telemarketing. Transactional messages (order confirmations, shipping updates, two-factor codes) can run 24/7. That said, sending a non-urgent shipping update at 3 AM is bad customer experience even if it's legal — most platforms apply quiet hours to all message types by default.
This guide is general information about TCPA compliance and is not legal advice. Penalty structures and carrier requirements change — consult a telecom or marketing-law attorney before launching any SMS marketing program.
