TCPA Compliance Checklist for Text Messages: The SMS Marketing Compliance Guide

A TCPA compliance checklist for text messages covers six things a sender controls: consent before marketing texts, a working opt-out honored within 10 business days, Do Not Call scrubbing, quiet hours, a registered 10DLC campaign, and records that prove each step. The TCPA treats a text as a call, so every rule below applies to SMS.

Does the TCPA apply to text messages?

Yes. The Telephone Consumer Protection Act, 47 U.S.C. 227, does not use the word “text,” but the Supreme Court said in Campbell-Ewald Co. v. Gomez (2016) that a text message to a cell phone “qualifies as a ‘call'” under the statute. The FCC’s rules at 47 CFR 64.1200 apply the same way.

Two parts of the TCPA matter most for texting:

• 47 U.S.C. 227(b): texts sent with an automatic telephone dialing system (an autodialer) need prior express consent, and prior express written consent for telemarketing (47 CFR 64.1200(a)(2)). Since Facebook v. Duguid (2021), equipment counts as an autodialer only if it uses a random or sequential number generator.
• 47 U.S.C. 227(c): the do-not-call rules, including the national registry and your own internal do-not-call list.

Private plaintiffs can recover up to $500 per message, and up to three times that for willful or knowing violations. For how claims over texts play out in court, see our breakdown of TCPA violations for text messages.

What belongs on a TCPA compliance checklist for SMS?

Use this before you launch a campaign, and again whenever you add a lead source, a new tool or a new message type.

1. Consent. For marketing texts, get prior express written consent: a signed agreement (an electronic signature counts where federal or state law recognizes it) that names who will text, covers marketing texts to that number, and says consent is not a condition of purchase (47 CFR 64.1200(f)(9)).
2. Consent records. Keep when, where and how each person agreed, and the exact language they saw.
3. Opt-outs. Honor any reasonable request to stop within 10 business days (47 CFR 64.1200(a)(10)).
4. Do Not Call scrubbing. Scrub marketing texts against the national registry and keep your own internal do-not-call list (47 CFR 64.1200(c) and (d)).
5. Quiet hours. No telephone solicitations before 8 a.m. or after 9 p.m. at the recipient’s location (47 CFR 64.1200(c)(1)). Some states set tighter limits.
6. Sender identification. Say who you are in the message. CTIA’s Messaging Principles and Best Practices expect the program name, help information and opt-out instructions to be clear.
7. 10DLC registration. Register your brand and campaign before sending application-to-person texts on 10-digit numbers.
8. List sourcing. Know where every number came from. CTIA’s guidance says senders should not use opt-in lists that were rented, sold or shared.
9. State laws. Check the states you text into. Florida’s Telephone Solicitation Act (Fla. Stat. 501.059), for example, has its own consent definition that covers text messages.
10. Counsel review. Have your own counsel review consent language, opt-out handling and record keeping before you scale.

What counts as consent for marketing texts?

Prior express written consent is the bar for marketing texts sent with an autodialer. The FCC defines it at 47 CFR 64.1200(f)(9): a written agreement, signed by the person, that clearly authorizes the seller to send them marketing texts at a specific number, with a disclosure that consent is not required to buy anything.

In 2023 the FCC also adopted a “one-to-one” consent rule for lead forms. The Eleventh Circuit vacated that part of the order in Insurance Marketing Coalition v. FCC (Jan. 24, 2025), so it never took effect. Consent still has to name the seller clearly, so a vague “our partners may contact you” form is a weak record.

For how the courts are reading consent in real disputes, including a “yes” reply that became consent, see what the latest TCPA ruling means for SMS consent.

How fast do you have to honor an opt-out?

Within a reasonable time, no more than 10 business days, and a consumer may revoke “using any reasonable method” (47 CFR 64.1200(a)(10)). You may send one confirmation text with no marketing in it. The FCC adopted changes to these rules on Sept. 30, 2026 (FCC 26-67), and they start 30 days after Federal Register publication.

The details, including the new option to name an exclusive opt-out method, are in our guide to revocation of consent under the TCPA.

What we would check on the ground:

• Every channel where a “stop” can arrive (texting tool, dialer, CRM, email, voicemail) feeds one suppression list.
• Unclear replies like “please don’t text me” go to a person, not only a keyword filter.
• The opt-out date and the date you processed it are both logged.

Do you need to scrub text lists against the Do Not Call Registry?

The FCC rule at 47 CFR 64.1200(e) applies the national Do Not Call rules to marketing texts sent to wireless numbers, and that rule has not changed. Some federal courts in 2026 split on whether a person can sue over texts alone. Our explainer on whether the Do Not Call Registry applies to text messages covers the split. Our read: keep scrubbing.

Scrub before each campaign, keep your internal do-not-call list current, and keep a record of each scrub. If you text through Kloudi, our DNC scrub and known litigator screening can be applied to your list before a campaign goes out. It is a screening step, not a substitute for your own consent and opt-out records.

What are the quiet hours for marketing texts?

Under 47 CFR 64.1200(c)(1), no telephone solicitation before 8 a.m. or after 9 p.m., local time at the recipient’s location. Use the area code and any address you have to estimate the time zone, and schedule sends in the recipient’s time, not yours. Several states set narrower windows or limit how many messages you can send in a day, so check the states on your list.

How does 10DLC registration fit into SMS compliance?

10DLC registration is a carrier requirement, not a TCPA rule. Brands and campaigns that send application-to-person texts on standard 10-digit numbers register through The Campaign Registry. Carriers review the use case, sample messages, the opt-in flow and the website.

A registered campaign does not make the messages lawful, and lawful messages can still be filtered if the campaign is not registered. Treat them as two separate checks. If a campaign was rejected, our list of common 10DLC campaign rejection reasons walks through the fixes.

What makes a business texting platform secure?

Security here means two things: protecting the data and controlling what gets sent. On the data side, look for encrypted connections, role-based access and a clear record of who sent what. On the sending side, look for controls you can apply before a message goes out: list screening, phone number verification and automatic opt-out handling.

Kloudi’s Compliance Shield puts those screening steps (DNC scrubbing, optional known litigator suppression, phone verification and 10DLC campaign support) in front of the send. Tools help you run the checklist. They do not replace your consent records, your opt-out process or your counsel.

What records should a texting business keep?

• Consent: date, time, source (form, page or call) and the exact language.
• Opt-outs: every request, the channel it came in on and the date you processed it.
• List sources: where each number came from, with dates.
• DNC scrubs: which lists, which date, for which campaign.
• Messages: what was sent, to whom and when.

CTIA’s guidance lists similar consent fields: timestamp, medium, the language used, the campaign, and the number. If a demand letter arrived tomorrow, could you show when and how each number opted in?

How do automation and integrations change compliance?

They multiply it. Every workflow, drip sequence and CRM trigger is another place a text can go to someone who opted out. Before you automate, make sure the suppression list is checked at send time, not only when the list was built. Our guides to SMS marketing automation and connecting an SMS API to your CRM cover how to set that up, and the SMS platform guide for regulated industries covers lending, insurance and debt relief.

What to check with your counsel

• Is each message type marketing, informational or transactional, and what consent does each need?
• Does your consent language name your business clearly and meet 47 CFR 64.1200(f)(9)?
• How do opt-outs from every tool, lead source and affiliate reach one suppression list?
• Which state laws apply to the numbers on your list?
• How long should you keep consent and opt-out records?

Frequently asked questions

What is a TCPA compliance checklist?

A list of the steps a sender takes before texting consumers: get and record consent, honor opt-outs within 10 business days, scrub against Do Not Call lists, keep quiet hours of 8 a.m. to 9 p.m. recipient time, register 10DLC campaigns, and keep records of each step.

Does the TCPA apply to text messages?

Yes. The Supreme Court said in Campbell-Ewald Co. v. Gomez (2016) that a text to a cell phone qualifies as a call under the TCPA, and the FCC’s rules at 47 CFR 64.1200 apply to texts.

Is SMS marketing legal in the U.S.?

Yes, when the sender has the right consent, honors opt-outs, respects Do Not Call and quiet-hour rules, and follows carrier requirements such as 10DLC registration. The details depend on the message type and the states involved.

What is SMS compliance?

Following the laws and carrier standards that apply to business texts: consent, opt-outs, Do Not Call, quiet hours, sender identification, 10DLC registration and record keeping.

Does a registered 10DLC campaign mean my texts are TCPA compliant?

No. 10DLC is a carrier registration process. The TCPA and FCC rules on consent, opt-outs and Do Not Call apply separately.

This guide is general information, not legal advice. Talk to your own counsel about how these rules apply to your business.

Sources

• 47 U.S.C. 227 (Telephone Consumer Protection Act): https://www.law.cornell.edu/uscode/text/47/227
• 47 CFR 64.1200 (current text, eCFR): https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200
• Campbell-Ewald Co. v. Gomez, 577 U.S. 153 (2016): https://www.law.cornell.edu/supremecourt/text/14-857
• Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): https://www.supremecourt.gov/opinions/20pdf/19-511_p86b.pdf
• Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025): https://media.ca11.uscourts.gov/opinions/pub/files/202410277.pdf
• FCC, Report and Order and Further Notice of Proposed Rulemaking, FCC 26-67 (adopted Sept. 30, 2026): https://docs.fcc.gov/public/attachments/FCC-26-67A1.pdf
• CTIA, Messaging Principles and Best Practices (May 2023): https://api.ctia.org/wp-content/uploads/2023/05/230523-CTIA-Messaging-Principles-and-Best-Practices-FINAL.pdf
• Florida Telephone Solicitation Act, Fla. Stat. 501.059: https://www.flsenate.gov/Laws/Statutes/2025/501.059