TCPA Compliance for Text Messages: Rules, Checklist, and How to Stay Compliant

TL;DR: The TCPA treats every business text message the same as a phone call. That means you need consent before sending, you must honor opt-outs within 10 business days, and each violation costs $500 to $1,500 per message. The one-to-one consent rule was struck down in 2025, but the revocation rules tightened. This guide breaks down the rules in plain language, gives you a 15-point compliance checklist, and shows how Salesmsg builds TCPA compliance into the platform so your team does not have to manage it manually.

A single text blast to 5,000 contacts without proper consent could put your business on the hook for $2.5 million to $7.5 million in TCPA penalties. That is not a hypothetical. It is the math.

Most TCPA compliance guides are written by lawyers for lawyers. They cite the statute, explain the legal history, and leave you with "consult legal counsel" as the conclusion. That is accurate but not useful if you are a sales leader or marketing director who needs to text customers today without getting your company sued tomorrow.

This guide is different. It explains the TCPA rules for text messages in plain language, gives you a detailed compliance checklist you can hand to your team, and shows you how Salesmsg turns those requirements into a built-in workflow. No legal degree required.

Note: This guide covers general TCPA compliance for business text messaging. It is not legal advice. For questions about your specific situation, talk to a qualified attorney.

What Is the TCPA?

The Telephone Consumer Protection Act (TCPA) is a federal law passed in 1991 that restricts how businesses can contact consumers by phone. The law was originally written to stop the flood of robocalls to home phones. But in the decades since, the FCC has made it clear: text messages count as "calls" under the TCPA.

That one decision changed everything for business texting. Every rule the TCPA created for phone calls, from consent requirements to quiet hours to opt-out handling, now applies to your text messages too.

Here is a quick snapshot of what the TCPA covers:

• Autodialed calls and texts: Any text sent through a business platform falls under TCPA rules
• Prerecorded voice messages: Automated voice drops and ringless voicemail need prior consent
• Marketing and telemarketing texts: Promotional SMS requires express written consent, the highest bar
• Do Not Call compliance: You must maintain an internal DNC list and honor the National Do Not Call Registry
• Calling and texting hours: No texts before 8 AM or after 9 PM in the recipient's local time zone

The TCPA is enforced two ways. The Federal Communications Commission (FCC) writes and enforces the regulations. But here is the part that makes the TCPA uniquely dangerous: it also allows private lawsuits. Any consumer who receives an unsolicited text can sue your business directly, and the statutory damages of $500 to $1,500 per message mean class action attorneys actively look for violations.

Blunt take: The TCPA is not a suggestion. It is a federal law with real financial teeth, and the class action bar treats it like a revenue stream. Compliance is cheaper than a lawsuit.

How the TCPA Applies to Text Messages

Here is the foundational fact most sales and marketing teams do not know: under the FCC's interpretation, every text message sent from a business is treated as a "call" under the TCPA. Automated texts, manual texts from a business platform, broadcast messages, appointment reminders: they all fall under the same law.

The FCC made this ruling because the TCPA was written before texting existed. Instead of writing a new law, the FCC extended the existing rules to cover SMS. The practical result: SMS compliance is not a separate topic from TCPA compliance. They are the same thing.

Two recent court decisions in 2026 show this is still evolving. The Ninth Circuit ruled that unwanted texts were not "telephone calls" under one specific TCPA provision (the one dealing with sound-based communication), but the court acknowledged that federal do-not-call protections have been extended to text messages under other parts of the law. The takeaway: the overall TCPA framework still applies to texts, even if some provisions get litigated differently.

What this means for your team: if you are sending text messages through any business platform (including business texting tools, marketing automation, or CRM workflows), the TCPA applies to you.

TCPA Consent Requirements for Text Messages

Consent is the core of TCPA compliance. Without it, every text you send is a potential violation. But the rules are not as simple as "get permission." The TCPA defines two different types of consent, and which one you need depends on what you are sending.

Express consent

• Required for: Informational and transactional texts (appointment reminders, order confirmations, account notifications)
• How to obtain: Verbal agreement, written form, or the customer giving you their number in a business context
• Example: Customer gives their number when booking an appointment
• Key rule: Cannot be a condition of purchase

Express written consent

• Required for: Marketing and promotional texts (sale announcements, discount offers, product launches)
• How to obtain: Signed written agreement or opt-in checkbox on a form with required disclosure language that meets the FCC's consent requirements
• Example: Customer checks a box on a web form agreeing to receive promotional texts
• Key rule: Cannot be pre-checked. Must include clear disclosure language. Cannot be a condition of purchase.

Here is what compliant opt-in language looks like in practice:

"I agree to receive recurring automated text messages at the phone number provided. Msg & data rates may apply. Msg frequency varies. Reply HELP for help and STOP to cancel. View our Terms of Service and Privacy Policy."

Every element in that sentence serves a purpose:

• Message type: "recurring automated text messages"
• Cost disclosure: "Msg & data rates may apply"
• Frequency: "Msg frequency varies"
• Opt-out mechanism: "Reply STOP to cancel"
• Help option: "Reply HELP for help"
• Legal links: Terms of Service and Privacy Policy

Remove any of those pieces and you weaken your legal position. For a deeper look at how to collect and document consent, read our express written consent guide.

Types of Text Messages Under the TCPA

Not every text message requires the same level of consent. The TCPA distinguishes between message types based on their purpose.

Marketing and promotional messages (sale announcements, product launches, discount offers, re-engagement campaigns) require express written consent, which is the highest bar.

Transactional messages (appointment reminders, shipping updates, order confirmations, password resets) require express consent, which can be verbal or written.

Informational messages (account alerts, service notifications, billing reminders) also require express consent.

Conversational and two-way messages (a sales rep responding to an inbound inquiry, a customer support thread) have implied consent when the customer initiates, but express consent is still needed for automated follow-ups.

The gray area that trips teams up: a transactional message that includes a promotional element. If your shipping confirmation says "Your order is on the way! Use code SAVE10 for 10% off your next purchase," the promotional content turns the entire message into a marketing text. That means it needs express written consent.

Blunt take: When in doubt, treat it as marketing. Getting express written consent upfront covers you for all message types.

TCPA Exemptions for Text Messages

The TCPA does have exemptions, but they are narrower than most people think.

Emergency messages. Texts sent for emergency purposes (health alerts, safety warnings, fraud notifications) may be exempt from prior consent requirements. But they must be genuinely emergency-related, not marketing wrapped in urgency language.

Tax-exempt nonprofit organizations. Calls (and in some interpretations, texts) from tax-exempt nonprofits have limited exemptions from certain TCPA provisions. This does not mean nonprofits can text freely. Consent best practices still apply.

Purely informational, non-commercial messages. Messages with no commercial purpose may have a lower consent threshold. But the line between "informational" and "commercial" is thin, and courts have interpreted this narrowly.

Common misconception: Having an existing business relationship does NOT exempt you from TCPA consent requirements for text messages. This misconception comes from the telemarketing rules for phone calls, where an existing relationship does create an exemption. For texts, you still need consent.

TCPA Violations and Penalties

This is where the TCPA gets serious.

Negligent violations (unintentional): $500 per text message. At 1,000 texts that is $500,000. At 10,000 texts that is $5,000,000. At 100,000 texts that is $50,000,000.

Willful or knowing violations: $1,500 per text message (treble damages). At 1,000 texts that is $1,500,000. At 10,000 texts that is $15,000,000. At 100,000 texts that is $150,000,000.

Other facts that make this worse:

• Statute of limitations: Four years. Someone who got an unsolicited text today could sue in 2030.
• Class actions: A single violation affecting a contact list becomes a multi-million dollar case. Goodwin's TCPA litigation review reported 507 TCPA class actions filed in Q1 2025, more than double Q1 2024.
• FCC enforcement: On top of private lawsuits, the FCC can impose its own penalties of up to $16,000 per violation ($26,000 for intentional ones). The FCC imposed a $299,997,000 penalty in August 2023 for more than five billion illegal robocalls.
• The pattern is predictable: A company sends a mass text to a list without proper consent documentation, a class action attorney finds out, and the settlement costs more than the entire marketing budget.

The FCC's TCPA Rule Changes: What Is Current in 2026

The TCPA regulatory landscape shifted more than it settled over the past two years. Here is what actually happened and what the rules look like today.

The one-to-one consent rule is dead

The FCC adopted a rule requiring that consumer consent be given to one specific company at a time, killing the practice of lead generators selling one consent to multiple businesses. The rule was set to take effect January 27, 2025. Then the Eleventh Circuit Court of Appeals vacated it, ruling the FCC exceeded its authority. By September 2025, the FCC formally eliminated the rule. Multi-seller consent remains legal, though carriers may still enforce their own stricter standards.

The revocation rules tightened

New consent revocation rules took effect April 11, 2025. The key requirements:

• Consumers can revoke consent through any reasonable method, not just the word STOP
• Businesses must honor opt-out requests within 10 business days
• After receiving an opt-out, you may send one confirmation message and nothing more

The "stop one means stop all" rule is delayed

The FCC proposed that opting out of one message type from a sender would count as opting out of all message types from that sender. This provision was waived until April 11, 2026, then extended again to January 31, 2027, while the FCC reviews whether to modify it. As of October 2026, this is still not in effect, but smart compliance teams are preparing for it anyway.

The DNC registry now covers texts

The National Do Not Call Registry, originally for phone calls, has been expanded to cover text messages. If a number is on the DNC list, do not text it with marketing messages.

State-level "mini-TCPA" laws are growing

Multiple states have passed their own texting laws that are stricter than federal rules. Virginia requires businesses to retain opt-out records for 10 years. Florida requires express consent before sending any telemarketing messages. Oklahoma has its own telephone solicitation act. If your contacts span multiple states, you need to know the local rules.

TCPA Compliance Checklist for Text Messages

This is the section to bookmark. These 15 items cover what your business needs to have in place before, during, and after sending text messages. Each one maps to a specific TCPA or CTIA carrier requirement.

Before you start texting (items 1 through 6)

1. Register your number through A2P 10DLC. U.S. carriers require every business using a local 10-digit number to register through the A2P 10DLC system. Without registration, your messages will be filtered or blocked. Salesmsg's compliance onboarding walks you through this with real human support. Salesmsg's analysis of 636 business profile submissions shows 55% of rejections come from just five fixable documentation issues.

2. Collect express written consent for marketing texts. The recipient must opt in through an unchecked checkbox or text-in keyword with disclosure language. Pre-checked boxes do not count. Consent cannot be a condition of purchase.

3. Write proper opt-in disclosure language. Your opt-in form must include:

• What types of messages the person will receive
• Approximate message frequency
• A note that msg and data rates may apply
• Instructions for how to opt out (reply STOP)
• Instructions for help (reply HELP)
• Links to your terms of service and privacy policy

Place this directly below the phone number field, not buried elsewhere on the page.

4. Set up your opt-out keywords. Your platform must recognize STOP, END, CANCEL, QUIT, UNSUBSCRIBE, and common variations. Salesmsg handles this automatically and catches typos.

5. Scrub your list against the DNC registry. Check the National Do Not Call Registry before sending any marketing texts. This is a separate requirement from opt-in consent.

6. Set up quiet hours compliance. No texts before 8:00 AM or after 9:00 PM in the recipient's local time zone. If your contacts are in multiple time zones, your platform needs to respect each one individually. State laws may be stricter (some restrict to 8 AM to 8 PM).

When you send messages (items 7 through 11)

7. Identify yourself in every message. Include your business name in the message body. The CTIA requires this, and it is a best practice under the TCPA.

8. Include opt-out instructions in your first message. The first time you text a new contact, include clear opt-out instructions (e.g., "Reply STOP to unsubscribe"). Carriers and the CTIA require this. Repeat it periodically for ongoing campaigns.

9. Do not mix marketing content into transactional messages. A promo code in a shipping confirmation turns the entire message into marketing. That requires express written consent. Keep transactional messages clean.

10. Match your message content to the consent you collected. If someone opted in for appointment reminders, do not send them promotional offers. Consent is specific to what the person agreed to receive. Sending outside the scope of consent is a violation.

11. Respect the message frequency you disclosed. If your opt-in says "up to 4 messages per month," do not send 12. Exceeding disclosed frequency is a common basis for TCPA complaints.

Ongoing compliance maintenance (items 12 through 15)

12. Honor opt-outs within 10 business days. Under the 2025 revocation rules, 10 business days is the maximum. In practice, honor them immediately. Salesmsg processes opt-outs automatically the moment a keyword is received.

13. Keep records of every consent. Document when and how each contact opted in. Store:

• Opt-in method (web form, text keyword, verbal)
• Date and time of opt-in
• IP address (for web forms)
• The exact disclosure language that was displayed

If you ever face a TCPA complaint, this documentation is your defense. Salesmsg syncs consent records with your CRM (HubSpot, Salesforce) so you have a centralized audit trail.

14. Clean your list regularly. Remove contacts who have not engaged in 6 to 12 months. Re-verify numbers that bounce. Re-scrub against the DNC registry quarterly. A clean list reduces your risk surface and improves your deliverability.

15. Train your team. Everyone who sends text messages on behalf of your company needs to understand the basics: what consent is required, how to handle opt-outs, what they can and cannot include in a message, and what the consequences are for violations. This includes sales reps who text from the shared inbox.

How Salesmsg Handles TCPA Compliance

Following a checklist is one thing. Turning that checklist into a repeatable process across your entire team is another. This is where the platform you use matters.

Salesmsg builds TCPA compliance into the platform so your team does not have to manage it manually. Here is how it works:

Guided compliance onboarding. When you sign up, Salesmsg does not just hand you a documentation link and walk away. The compliance team walks you through the 10DLC registration process step by step. This matters because A2P 10DLC registration is the most common friction point businesses face when starting with SMS.

AI Compliance Checkr. Before you even submit your 10DLC application, Salesmsg's AI tool analyzes your submission details and tells you your likelihood of approval. It flags issues before they become rejections, saving the two to four weeks a resubmission typically takes.

Automatic opt-out handling. When a contact replies STOP, END, CANCEL, QUIT, UNSUBSCRIBE, or any common variation (including typos), Salesmsg immediately marks them as opted out and blocks any further messages. You do not have to monitor for these keywords manually.

Double opt-in. For teams that want extra protection, Salesmsg offers a double opt-in feature. New contacts receive a confirmation text and must reply to confirm before any messages are sent. This is an organization-wide setting that applies to every team member.

CRM consent tracking. Salesmsg integrates natively with HubSpot, Salesforce, and other CRMs. Opt-in and opt-out status syncs to the CRM record, so your consent documentation lives alongside the rest of your contact data. You can also manage opt-in/opt-out status directly from HubSpot workflows.

Shared inbox visibility. Every text message every rep sends is visible in the shared inbox and logged in your CRM. This solves the invisible rep activity problem that is one of the top compliance risks for sales teams: when reps text from personal phones, you have zero documentation if a complaint comes in.

Salesmsg 2026 Benchmark data: Analysis of 636 business profile submissions shows the top five 10DLC rejection reasons account for 55% of all rejections. All five are documentation errors: business ID not verifiable (13.2%), authorized rep unverifiable (12.7%), business name/website mismatch (12.3%), EIN verification failed (9.3%), and address not verifiable (7.9%). Nearly half (38.4%) of all rejections trace back to EIN or identity issues alone. The fix: use your IRS SS-4 or 147C letter (not a W-9), submit DBA documentation if your operating name differs from your legal name, and make sure your legal name appears on your website before submitting.

Start your free trial and get guided compliance setup

How to Set Up Compliant Business Texting with Salesmsg

Here is the step-by-step process from signup to your first compliant text message:

1. Sign up and start compliance onboarding. Create your Salesmsg account. The compliance team reaches out to walk you through 10DLC registration. Have your EIN, legal business name, business address, authorized representative details, and website URL ready.
2. Run the AI Compliance Checkr. Before submitting your 10DLC application, use the AI tool to check your submission for common issues. Fix anything it flags. This one step prevents the majority of registration delays.
3. Register your 10DLC campaign. Submit your business profile and campaign use case through Salesmsg. The platform handles the carrier-side submission. Approval typically takes a few business days for standard use cases.
4. Set up your opt-in forms. Configure your web forms, landing pages, or text-in keywords with proper disclosure language. Connect them to your CRM so consent is captured and logged automatically.
5. Connect your CRM. Integrate Salesmsg with HubSpot, Salesforce, or your CRM of choice. This ensures opt-in/opt-out status flows to your contact records and every message is logged.
6. Send your first message. Start with your opted-in contacts. Include your business name and opt-out instructions. Salesmsg handles quiet hours and opt-out keyword recognition automatically.

TCPA Compliance Best Practices

Compliance is not a one-time setup. It is an ongoing practice. Here are the habits that keep teams out of trouble:

• Audit consent records quarterly. Spot-check your database. If you cannot prove consent for a contact, stop texting them until you re-confirm it.
• Review opt-in language every six months. Regulations change. State laws get added. Make sure your disclosure language still meets current requirements.
• Clean your list on a schedule. Remove non-responsive contacts. Re-scrub against DNC. Audit for reassigned numbers. Smaller, cleaner lists outperform bloated ones.
• Keep SMS marketing practices aligned with consent scope. Adding broadcast campaigns on top of one-on-one sales texts? Make sure your consent covers the new use case.
• Review automated workflows before launch. Every new automation that sends texts needs to pass the checklist above.
• Monitor state law changes. Florida, Virginia, Oklahoma, and others have passed their own texting laws. If your contacts span multiple states, track the local rules.

Blunt take: The businesses that get sued are not usually the ones who never heard of the TCPA. They are the ones who set up compliance once, then let it drift. Stay on it.

FAQs About TCPA Compliance for Text Messages

What is TCPA compliance for text messages?

TCPA compliance for text messages means following the Telephone Consumer Protection Act when your business sends SMS to customers. The main requirements are: get consent before texting, identify yourself in messages, honor opt-out requests within 10 business days, do not text during quiet hours (before 8 AM or after 9 PM local time), and keep records of consent. Violations cost $500 to $1,500 per message.

Do I need consent to send text messages under the TCPA?

Yes. Marketing and promotional texts require express written consent, which means the person signed or checked a box agreeing to receive them. Transactional texts like appointment reminders require express consent, which can be verbal. In both cases, consent cannot be a condition of purchase. Without consent, every text you send is a potential $500 to $1,500 violation.

What are the penalties for TCPA violations on text messages?

Each unsolicited text carries statutory damages of $500. If the violation was willful, the penalty triples to $1,500 per message. A mass text to 10,000 people without consent could mean $5 million to $15 million in liability. Class action lawsuits are common, and the statute of limitations is four years.

Are transactional text messages exempt from TCPA?

Not entirely. Transactional messages like appointment reminders have a lower consent bar (express consent rather than express written consent), but you still need the recipient's permission. And if your transactional message includes any promotional content, it becomes a marketing text and requires the higher standard.

How does Salesmsg help with TCPA compliance?

Salesmsg builds compliance into the platform. During onboarding, the team walks you through 10DLC registration with real human support. The AI Compliance Checkr reviews your submission before you file it. The platform automatically handles opt-outs (STOP, END, CANCEL, and typos). Consent records sync with HubSpot and Salesforce so you have an audit trail. Double opt-in is available as an organization-wide setting.

What is the difference between express consent and express written consent?

Express consent means the person agreed to receive texts, verbally or in writing. Express written consent requires a signed document or checked opt-in box with specific disclosure language. Marketing texts always require express written consent. Non-marketing texts only require express consent. When in doubt, get express written consent for everything.

What changed in the FCC's TCPA rules in 2025 and 2026?

The one-to-one consent rule was vacated by the Eleventh Circuit in January 2025 and formally eliminated by the FCC in September 2025, so multi-seller consent remains legal. The revocation rules took effect April 2025: consumers can opt out through any reasonable method, and businesses must honor requests within 10 business days. The "stop one means stop all" provision has been delayed to January 31, 2027.

Stay Compliant Without Slowing Down

TCPA compliance for text messages comes down to a simple principle: text people who want to hear from you, document that they said so, and stop the moment they say stop.

The rules are not complicated. The risk of ignoring them is. And the businesses that do this well do not treat compliance as a legal burden. They treat it as the foundation that makes their texting program sustainable.

Salesmsg is built to make that foundation automatic. From guided 10DLC registration to real-time opt-out handling to CRM-integrated consent tracking, the compliance checklist above is not a separate workflow. It is how the platform works.

Start your free trial and get guided compliance setup