TCPA SMS Compliance: The 2026 Rules Marketers Must Follow
11/09/2026
Marketing Strategy
Review the SMS consent, opt-out and carrier-registration controls your team needs before sending another promotional campaign.
To send marketing text messages legally in the United States right now, you need three things: Prior Express Written Consent naming your business, active Brand & Campaign registration with The Campaign Registry for 10DLC traffic, and a real-time opt-out system that processes revocations within 10 business days. Miss any one of these and you are exposed to statutory damages, carrier blocking, or both.
.png)
Key Takeaways
Marketing and promotional texts require PEWC, consent that cannot be bundled into a purchase requirement and must clearly identify the sender. Transactional and informational messages need a lower bar, prior express consent, but only if you keep marketing content out of them entirely. Blending the two is one of the fastest ways to trigger a carrier filter or a plaintiff’s attorney’s attention.
Here’s what to prioritize this quarter:
- Audit every capture form and archive the exact consent disclosure displayed.
- Test STOP and other supported revocation methods across vendors, with immediate internal suppression.
- Confirm A2P 10DLC brand and campaign registration status where applicable.
- Check state-specific rules and quiet hours with counsel before expanding sends.
TCPA SMS compliance in 2026 requires PEWC for marketing texts, 10DLC carrier registration, and real-time opt-out processing working together, not any single piece alone.
What Is TCPA SMS Compliance and Who Needs It?
TCPA SMS compliance means your text messaging program satisfies the Telephone Consumer Protection Act’s consent, disclosure, and opt-out requirements, plus the carrier registration rules that determine whether your messages get delivered at all. It applies to any U.S. business texting consumers for marketing, sales, or even routine account updates. If your company sends more than a handful of texts a month, this isn’t optional homework. It’s the difference between a functioning SMS channel and one that gets shut down by carriers or lands you in a class action.
What Counts as Valid Prior Express Written Consent?
Prior Express Written Consent is the legal standard for any marketing or promotional text sent using an autodialer or a platform capable of automated sending. Under the Federal Register’s 2025 rule text, valid PEWC has four non-negotiable elements:
- A clear authorization covering the relevant marketing communications and sender.
- A consent record that can be retained and produced, such as an affirmative web form action or compliant electronic signature.
- Appropriate disclosures, including that consent is not a condition of purchase when applicable.
- An unambiguous connection between the subscriber, number, disclosure and date of consent.
Informational and transactional messages, think appointment reminders, shipping updates, two-factor authentication codes, operate under a lighter standard: prior express consent, without the “written” requirement. The catch is that these messages must stay strictly transactional. The moment you slip a discount code or a “check out our sale” line into a shipping notification, you’ve converted it into marketing content that now requires PEWC you probably don’t have.
There’s also a wrinkle worth understanding if you’ve been following the regulatory back and forth. Courts vacating the federal one-to-one consent rule reduced the statutory requirement that consent be tied to a single named seller. But carriers didn’t get that memo, or rather, they don’t need to follow it the same way. The Campaign Registry and individual carriers still vet campaigns for seller-specific consent during registration. Treat consent as brand-specific in practice, regardless of what the current federal floor technically demands, because your deliverability depends on carrier approval, not just legal defensibility.
Compliant capture methods include a web form with an unchecked opt-in box, a texted keyword like “JOIN” in response to an ad, a signed paper form at point of sale, and, for informational messages only, a documented verbal agreement logged with a timestamp.
Pro Tip: Use double opt-in wherever your volume justifies it. Requiring a subscriber to reply “YES” to a confirmation text creates an automated, time-stamped record of intent that’s far harder to dispute in discovery than a single web form submission.
How Do You Handle Opt-Outs and Consent Revocation?
2026 update: The FCC extended one cross-category revocation requirement to January 31, 2027. Do not mistake that limited extension for removal of the general opt-out duties; confirm the current regulation and message type with counsel.
The FCC’s Report and Order requires you to honor revocation requests made through any reasonable method, not just the word “STOP.” A subscriber who says “please stop texting me” on a customer service call or types “unsubscribe” in a reply has revoked consent just as validly as someone who texts the standard keyword.
Here’s the operational sequence to follow:
- Recognize supported revocation requests, including clear opt-out language and relevant automated channels.
- Stop promotional sends immediately in operational systems, even where regulations allow a longer processing window.
- Synchronize suppression to CRM, automation and SMS vendors and confirm the result.
- Retain a timestamped record of request, action and any permitted confirmation.
Most TCPA lawsuits don’t stem from bad intent. They stem from a suppressed number that a CRM, an ESP, and a separate SMS vendor each track independently, with one system lagging behind the other two. A subscriber opts out through your website, but your outbound SMS vendor doesn’t sync until the next batch job runs, and now they’ve received two more messages after revoking consent.
Pro Tip: Test your STOP and HELP keyword automations monthly, not just at launch. Vendor platform updates and API changes break these flows more often than teams expect.
What Do 10DLC and Carrier Registration Require?
Legal consent gets you halfway there. The other half is carrier registration, and since February 1, 2025, carriers block unregistered A2P 10DLC traffic outright. No exceptions, no grace period. You can have flawless PEWC documentation and still watch every message fail to deliver because your brand and campaign were never registered with The Campaign Registry.
Registration requires:
- A verified business or brand profile with the appropriate tax and contact information.
- A campaign use case, message examples and accurate opt-in flow description.
- A working HELP and STOP experience as required by the messaging provider and carrier policy.
- Acceptance by the relevant messaging ecosystem before sending production 10DLC traffic.
You’ll also need to choose the right number type. 10DLC (10-digit long codes) suit standard business-to-consumer texting at moderate volume. Toll-free numbers register faster and work well for lower-volume transactional use but carry stricter throughput limits until verified. Short codes cost more and take longer to provision but handle the highest volumes with the fewest carrier restrictions, useful for large retail or enterprise programs.
Carriers also enforce content filtering known by the acronym SHAFT, blocking or downgrading messages that reference Sex, Hate, Alcohol, Firearms, or Tobacco. A single mixed-use campaign, one that sends both transactional order updates and promotional discount codes from the same registered campaign ID, is a common rejection trigger. Carriers expect a clean separation between your transactional and marketing traffic, registered as distinct campaigns with distinct sample messages.
How Much Financial Risk Does TCPA Non-Compliance Carry?
Federal TCPA damages run from $500 per message for negligent violations up to $1,500 per message for willful ones, and there’s no aggregate cap. Send 10,000 unauthorized texts to a class of plaintiffs and you’re looking at exposure between $5 million and $15 million before a single settlement conversation starts. That math is why plaintiff’s firms actively monitor SMS programs for sloppy consent practices.
State “mini-TCPA” laws stack additional exposure on top of the federal baseline. A handful of examples illustrate the range:
- Florida: Review applicable telemarketing consent, calling-time and private-action provisions with counsel.
- Oklahoma: Check the Telephone Solicitation Act requirements and current judicial interpretations.
- Texas: Check current state registration and telemarketing rules before launching campaigns.
- Multistate campaigns: Apply a jurisdiction-aware compliance process rather than assuming one federal rule covers every recipient.
Quiet hours matter here too: federal rules restrict marketing calls and texts to the 8 a.m. to 9 p.m. window in the recipient’s time zone, and several states narrow that further.
Carrier enforcement operates on a separate track entirely. A blocked campaign or a CTIA complaint doesn’t carry a statutory dollar figure, but it can shut down your entire messaging channel overnight, which is often more disruptive to revenue than a single lawsuit. Recordkeeping is your core defense against both tracks: exposure scales directly with list size, so the businesses that survive audits are the ones that can produce a clean, timestamped consent record for every single subscriber on demand.
Free Brand Health Audit
Make sure your brand is built to sell
Search has changed. Your customers aren't just Googling anymore. They're asking ChatGPT, Perplexity, Gemini and other AI platforms what to buy, who to trust and which brands they should consider.
If your brand isn't showing up clearly in those answers, you're already losing opportunities. Our free Brand Health Audit shows you where your brand stands across traditional search, AI search and brand positioning.
Sample brand audit
Live preview
Traditional search
72
AI search (GEO)
34
Brand positioning
58
What Should an Audit-Defensible SMS Compliance Checklist Include?
Building a program that survives a regulator inquiry or a discovery request comes down to sequencing. Here’s the order that actually protects you:
- Inventory all SMS capture points and reconcile the disclosure text with sender and campaign.
- Document consent and revocation data fields in one controlled source of truth.
- Verify carrier registration and separate transactional from promotional use cases.
- Test suppression in every connected sending system using real controlled test numbers.
- Assign a named compliance owner and conduct scheduled vendor and state-law reviews.
Pro Tip: Ask every SMS vendor for live, queryable access to their suppression logs, not a monthly export. If a lawsuit lands, you need to prove suppression happened within hours, not reconstruct it after the fact from a spreadsheet someone emailed you last quarter.
The checklist approach carriers and compliance consultants recommend consistently centers on these same fundamentals: registration first, standardized records second, suppression architecture third. Skipping the sequence, registering a campaign before your consent capture is standardized, for example, is how teams end up rebuilding their compliance program mid-year instead of auditing it.
What Records Do You Need to Survive Discovery?
If a TCPA claim lands on your desk, the strength of your defense comes down to what you can produce, fast. Every consent event, opt-in or opt-out, needs the same metadata fields captured at the moment it happens:
- Subscriber number and the identity of the sender or program.
- Timestamp, time zone, source page or keyword and the exact notice shown.
- Method of affirmative authorization, with supporting logs when available.
- Revocation timestamp, channel, processing action and vendor synchronization result.
Retain these records for at least four years, aligning with the outer edge of most state statutes of limitations for TCPA-adjacent claims, and structure them so they export cleanly under a discovery timeline measured in days, not weeks. Contract for audit rights with every vendor touching your SMS data, including live access to their suppression logs rather than periodic exports.
How The Branded Agency Builds Compliant SMS Programs
We build compliant signup flows, manage TCR brand and campaign registration, and architect suppression systems that sync in real time across every vendor in a client’s stack, work our compliance audits catch before it becomes a liability. Author Quincy Samycia’s guidance here reflects patterns The Branded Agency sees across growth-stage clients scaling SMS as a retention channel.
The signal to bring in outside help: your subscriber list crosses state lines, your volume exceeds what one internal marketer can audit quarterly, or your legal team wants documented proof of process before your next funding round or acquisition conversation.
How Do You Write SMS Content That Avoids TCPA Violations?
Compliant message content starts with a strict separation between what you’re allowed to automate and what requires a live human. The TCPA restricts prerecorded voice messages and autodialed texts to recipients who’ve given the matching consent tier, so a marketing blast sent through an automated platform to a list that only agreed to transactional alerts violates the statute even if the copy itself looks harmless.
Every marketing text should include your business name, a clear value proposition, and an easy opt-out instruction, typically “Reply STOP to unsubscribe.” Skip aggressive urgency language and repeated same-day sends. They’re not illegal on their face, but they’re the fastest way to generate opt-out complaints that carriers track as a deliverability signal.
Keep your message frequency consistent with what the subscriber agreed to at opt-in. If your consent language promised “occasional updates” and you’re sending daily promotions, you’ve created a mismatch that plaintiff’s attorneys specifically look for in discovery. Avoid SHAFT content categories entirely, even in a joking or incidental reference, since carrier filters flag keyword matches automatically regardless of context.
Finally, never let a transactional template drift into promotional territory.
What Counts as an Autodialer Under Current FCC Rules?
Legal accuracy note: Federal ATDS status cannot be inferred solely from bulk-SMS capability. Facebook v. Duguid requires the statutory random-or-sequential-number-generator capacity; separate telemarketing, consent, state-law and carrier requirements may still apply.
The TCPA defines an autodialer, formally an “automatic telephone dialing system,” as equipment with the capacity to store or produce phone numbers using a random or sequential number generator and to dial those numbers automatically. For years, the scope of that definition was a moving target in the courts.
What matters for SMS programs today is simpler than the legal history suggests: different consent, calling and carrier rules may apply depending on the technology, message content and jurisdiction. Under Facebook v. Duguid, bulk sending capability alone does not establish that a platform is an automatic telephone dialing system under the federal statutory definition. If your SMS platform can send from a stored list without a human manually dialing each number, you’re operating under TCPA restrictions.
This matters practically because many marketers assume “we don’t use an autodialer” means “we manually text everyone,” when bulk sending capability alone does not establish ATDS status under federal law. Consent and telemarketing obligations still require a fact-specific legal analysis of the sending technology, audience and content. If you’re using any SMS marketing software to send to more than a handful of numbers at once, assume PEWC applies and build your consent capture accordingly rather than betting on a narrow technical definition holding up in court.
Want to learn more about Digital Marketing and Strategy? Keep reading!
If you need help with your company’s marketing, contact us for a free custom quote.
How Should You Manage Vendor Risk in Outsourced SMS Campaigns?
Outsourcing SMS execution doesn’t transfer your TCPA liability. The FCC and courts have consistently held that both the business whose product is being marketed and the vendor sending the message can face liability, so vendor selection deserves the same scrutiny you’d apply to any function carrying regulatory exposure.
Before signing with any SMS vendor or platform, confirm three things in writing: their suppression list syncs in real time with yours, they can produce consent audit trails on demand rather than after a delay, and their contract includes indemnification language allocating responsibility if their platform sends to a suppressed number due to their own system failure.
Require documented proof of how a vendor captures and stores consent metadata, not just a general assurance of “compliance.” Ask specifically whether they support exportable, timestamped records including IP address, capture method, and disclosure text, because that’s what you’ll need to produce if a claim surfaces. A vendor comparison worth running before you commit budget should weigh these operational guarantees as heavily as pricing.
Build a standing quarterly review with every SMS vendor in your stack, checking suppression sync speed, registered campaign status with The Campaign Registry, and any carrier warnings or throughput downgrades. The businesses that get burned by vendor-side TCPA violations are almost always the ones that treated onboarding as a one-time checklist instead of an ongoing relationship requiring active oversight.
How Do You Respond to a TCPA Complaint or Legal Claim?
The first 48 hours after a complaint or demand letter arrives determine how much the claim ultimately costs you. Start by immediately suppressing the complainant’s number across every system, confirming the suppression synced with all vendors, not just your primary platform.
Next, pull the complete consent record for that phone number: timestamp, disclosure text, source URL, IP address, and capture method. If you can produce a clean, complete record showing valid PEWC or prior express consent, you have a strong defense. If the record is incomplete or missing, that gap itself shapes your legal strategy going forward.
Loop in counsel before responding substantively to any demand letter or regulatory inquiry, even one that looks informal. Do not send an apologetic reply admitting fault, and don’t offer a settlement number without legal review, since early informal responses can be used against you later.
Document the timeline of what happened: when consent was captured, when (if ever) revocation occurred, and when suppression was applied. This timeline is often the single most important exhibit in resolving a claim quickly rather than letting it escalate into full litigation.
Finally, treat every complaint as a system audit trigger. If one subscriber slipped through suppression, check whether it was an isolated vendor sync failure or a pattern affecting other numbers on your list.
Are There Exemptions to TCPA SMS Rules?
A narrow set of exemptions exist, and marketers routinely misunderstand their scope. Emergency alerts, messages concerning an imminent safety threat like a natural disaster or public health emergency sent by or on behalf of a government entity, fall outside standard TCPA consent requirements entirely.
Healthcare-related messages get more nuanced treatment. Certain time-sensitive healthcare messages, appointment reminders, prescription refill notifications, and post-discharge follow-ups, that meet FCC healthcare exemption criteria can be sent with prior express consent rather than the stricter PEWC standard, provided they meet strict content and frequency limitations and include an opt-out mechanism. That exemption does not extend to marketing content, so a healthcare provider promoting elective services or discounted procedures needs full PEWC regardless of the healthcare context.
HIPAA compliance operates as a separate, parallel requirement layered on top of TCPA rules, not a substitute for it. A healthcare message can satisfy TCPA consent standards while still violating HIPAA if it includes protected health information sent through an unsecured channel, or vice versa. Compliance teams handling healthcare SMS programs need to satisfy both frameworks independently, and neither one’s exemption covers gaps in the other.
Financial account alerts, fraud notifications, and similar time-sensitive account messages typically qualify under the same informational message standard as shipping updates: prior express consent, no marketing content, and a working opt-out.
Ready to Build a Compliant, High-Performing SMS Program?
TCPA compliance isn’t a box to check once and forget. It’s an operational discipline that touches your consent capture, your CRM, your SMS vendor, and your legal exposure simultaneously, and the businesses that treat it as a one-time setup task are the ones that end up rebuilding their program after a costly complaint. The Branded Agency builds SMS programs where compliance and performance aren’t competing priorities. Our retention marketing services integrate compliant signup flows, TCR registration support, and suppression architecture directly into the campaigns designed to turn subscribers into repeat customers. If your team is scaling SMS across state lines or juggling multiple vendors without a single source of truth for consent, talk with The Branded Agency about what a managed, audit-defensible program looks like for your growth stage.
Where to Verify These Rules Yourself
Bookmark the FCC’s order, the Federal Register rule text, and The Campaign Registry’s registration portal for consent and revocation language plus registration steps.
The Branded Agency’s Take on Where TCPA Compliance Is Headed
Most compliance guidance treats consent capture as the finish line. It isn’t. The research here points to a different priority: suppression architecture is where TCPA programs actually fail, not consent forms. A business can have flawless PEWC language and still generate six-figure exposure because a STOP request sent to one system never reached another.
The conventional advice, “get consent, add a STOP keyword, done,” undersells how much operational plumbing sits underneath a defensible program. Carrier registration adds a second layer most compliance checklists still treat as a legal footnote rather than the deliverability gatekeeper it actually is. Since February 2025, an unregistered campaign doesn’t get a warning. It gets blocked.
If you’re prioritizing one thing this year, make it suppression sync across every vendor touching your subscriber list, before you worry about optimizing send times or message copy. A perfectly worded text that reaches someone who opted out three weeks ago because your ESP and SMS platform don’t talk to each other in real time is not a copywriting problem. It’s a plumbing problem, and it’s the one most compliance teams still haven’t fixed.
Frequently Asked Questions
What is prior express written consent for SMS?
It is documented authorization for communications subject to the applicable marketing consent rules, with clear disclosures and sufficient evidence of the subscriber’s agreement.
How quickly must SMS opt-outs be processed?
Federal rules generally set a reasonable period not exceeding ten business days for covered revocation requests; immediate suppression is the safer operational target.
Does 10DLC registration replace consent?
No. Carrier registration and legally valid consent are separate requirements.
Is every bulk SMS platform automatically an ATDS?
No. The Supreme Court adopted a narrower statutory definition involving random or sequential number generation. Other TCPA and state requirements can still apply.
Do the same rules apply in every state?
No. State telemarketing laws and carrier requirements can impose additional restrictions; have counsel verify the jurisdictions you contact.
Sources
- FCC TCPA rules (47 CFR 64.1200): https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200
- FCC January 2026 order on revocation rule timing: https://docs.fcc.gov/public/attachments/DA-26-12A1.pdf
- Supreme Court Facebook v. Duguid (2021): https://www.supremecourt.gov/opinions/20pdf/19-511_p86b.pdf
- The Campaign Registry: https://www.campaignregistry.com/
- Federal Register October 2026 TCPA rule: https://www.govinfo.gov/content/pkg/FR-2026-10-26/pdf/2026-21821.pdf
Quincy Samycia
As entrepreneurs, they’ve built and scaled their own ventures from zero to millions. They’ve been in the trenches, navigating the chaos of high-growth phases, making the hard calls, and learning firsthand what actually moves the needle. That’s what makes us different—we don’t just “consult,” we know what it takes because we’ve done it ourselves.
Want to learn more about brand platform?
If you need help with your companies brand strategy and identity, contact us for a free custom quote.
We do great work. And get great results.
+2.3xIncrease in revenue YoY
+126%Increase in repurchase rate YoY
+93%Revenue growth in first 90 days
+144% Increase in attributed revenue
+91%Increase in conversion rate
+46%Increase in AOV
+200%Increase in conversion rate
+688%Increase in attributed revenue
