SMS Compliance Checklist: TCPA, Opt-In, and Best Practices (2026 Update)

Sending SMS for marketing or notifications can be powerful, but it comes with legal responsibilities. This checklist helps you stay compliant with US rules and best practices so your campaigns are effective and lawful. If you send outside the US, consent and opt-out rules come from the law of each recipient's country, so check your local regulator before you send.

Why SMS Compliance Matters

• TCPA (Telephone Consumer Protection Act) in the US restricts automated calls and texts without prior express consent.
• Carrier and platform policies (e.g., short code rules) often require clear consent and opt-out.
• Reputation and deliverability improve when you follow best practices and avoid spam reports.

Failing to comply can lead to fines, lawsuits, and blocked messages. When in doubt, get legal advice for your use case and region.

SMS Compliance Checklist

1. Consent (Opt-In)

• Express written consent - You have clear, written permission to send SMS to each number (e.g., checkbox, form field, or keyword signup).
• Disclosure - At the time of signup, you clearly state that the user will receive recurring (or one-time) SMS messages and that message and data rates may apply.
• No pre-checked boxes - Consent must be affirmative; avoid pre-checked consent boxes for marketing SMS.
• Documentation - You keep records of when and how consent was obtained (timestamp, source, IP if applicable).

2. Sender Identification

• Identify your business - Every message should make it clear who is sending it (e.g., "Acme Inc: Your order has shipped").
• Consistent identity - Use a consistent sender name or number so recipients recognize you.

3. Opt-Out (Unsubscribe)

• Clear opt-out in every message - Include a simple way to stop messages in every campaign (e.g., "Reply STOP to unsubscribe" or "Text STOP to opt out").
• Honor opt-outs promptly - Process STOP (and similar) requests immediately and remove the number from future marketing messages. The federal maximum is 10 business days (see below).
• Confirm opt-out - Send one final confirmation that they have been unsubscribed.
• No marketing after opt-out - Do not send further marketing SMS to that number unless they opt in again.

4. Frequency and Content

• Reasonable frequency - Avoid excessive messaging that could be considered harassment or spam.
• Accurate and relevant content - Don't mislead; match what you promised at signup (e.g., order updates vs. promotional blasts).
• Time of day - Send marketing texts only between 8 AM and 9 PM in the recipient's local time, and keep non-urgent messages inside business hours.

5. Record-Keeping

• Consent records - Retain proof of consent (source, date, method).
• Opt-out records - Keep a suppression list of numbers that have opted out and do not contact them for marketing.
• Audit trail - Be able to show what was sent, when, and to whom, for a reasonable period.

TCPA Quick Reference (US)

• Prior express consent is required for marketing and many informational SMS.
• Automated means equipment that can dial or text without human intervention; consent rules still apply.
• Do Not Call (DNC) - Respect the National Do Not Call Registry for telemarketing; SMS rules are related but distinct (consent and opt-out are key).
• Penalties - Statutory damages are $500 per violation, up to $1,500 when willful or knowing (47 U.S.C. 227, checked October 2026). Consult a lawyer for your situation.

Can you text existing customers without a new opt-in?

It depends on the content. The TCPA sets two consent levels.

Informational texts need prior express consent. Order updates, reminders, and account alerts are informational. A customer who gives you their number in a related context, without limits on its use, can give this consent. A text that mixes information with a promotion counts as telemarketing (Hunton Andrews Kurth summary, checked October 2026).

Marketing texts need prior express written consent. This is a written agreement with the person's signature (an electronic signature counts). You cannot require it as a condition of a purchase (47 CFR 64.1200, checked October 2026).

An established business relationship does not replace written consent. The FCC defines it as a purchase in the last 18 months or an inquiry in the last 3 months. It is an exemption from the Do Not Call rules only. Autodialed marketing to mobile numbers has no such exemption (47 CFR 64.1200, checked October 2026).

The one-to-one consent rule never took effect. It required consent for one seller at a time. The Eleventh Circuit vacated it on January 24, 2025, three days before its start date, in Insurance Marketing Coalition v. FCC (Kelley Drye summary, checked October 2026). The FCC then removed the rule from its regulations in 2025 (Goodwin summary, checked October 2026).

Revocation rules are in force. Since April 11, 2025, a customer can revoke consent by any reasonable means. A reply of "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe" counts. You must honor it within 10 business days at most (47 CFR 64.1200, checked October 2026). The "revoke-all" part (one opt-out covers every message type) is delayed to January 31, 2027. An FCC order set for a September 30, 2026 vote would limit an informational opt-out to that category, while a marketing opt-out still stops all marketing. It starts 30 days after Federal Register publication (FCC fact sheet and Troutman Pepper Locke summary, checked October 2026).

The practical rule for a small business: a text about something the customer bought or booked is fine when they gave you their number for it. A promotion, a coupon, or a "come back" offer needs express written consent first. A mixed text is marketing.

What must the message itself contain?

The carrier guidance here comes from the CTIA Messaging Principles and Best Practices, May 2023 (checked October 2026).

• Sender identity. Name your business at the start of the text. Links and phone numbers must not hide who sent it.
• Purpose that matches the consent. An opt-in covers only the campaign and sender it was given for.
• Opt-out instruction in promotional texts. Use standard "STOP" wording, and act on plain requests like "please opt me out" too.
• How often to repeat STOP and HELP text. No federal rule sets an interval. CTIA wants opt-out instructions in the opt-in confirmation, and its short code handbook v1.9 asks for HELP instructions at opt-in and at regular intervals (checked October 2026). Safe habit: put "Reply STOP to opt out" in every promotional text and the first informational one.
• No misleading links. Use a link shortener dedicated to your business, not a shared public one. The linked site must name its owner and give contact details.
• Quiet hours. FCC rules ban telephone solicitations before 8 AM or after 9 PM, local time at the recipient's location (47 CFR 64.1200, checked October 2026). Schedule by the recipient's time zone.

Content that carriers filter. CTIA lists these patterns as unwanted:

• SHAFT content (sex, hate, alcohol, firearms, tobacco), plus gambling and sweepstakes, which need extra carrier approval (short code handbook v1.9).
• Phishing for private or confidential information.
• Misleading, threatening, or harassing content, or malware links.
• Shared public URL shorteners, and phone numbers that hide their owner.

Sending Compliant SMS with textbee

Once your program is compliant, you need a reliable way to send messages. textbee.dev lets you send SMS from your Android device via API or dashboard, with no per-message fees and your existing phone plan. Put your business name first and the opt-out line last:

curl -X POST "https://api.textbee.dev/api/v1/gateway/send-sms" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"recipients": ["+15550142"], "message": "Acme Dental: 20% off whitening this week. Book at acmedental.example. Reply STOP to opt out."}'

textbee does not keep an opt-out list for you, so handle STOP replies in your app. Turn on Receive SMS and subscribe to the MESSAGE_RECEIVED webhook event (Receiving SMS docs). When a reply's message is an opt-out keyword, add its sender to your suppression list and check that list before each send. Verify the X-Signature header first (webhooks docs).

View textbee plans and pricing to get started with compliant SMS sending.

Frequently asked questions

Is the TCPA only for marketing texts?

No. Informational texts need prior express consent, which a customer can give by sharing their number for that purpose. Marketing texts need prior express written consent. Opt-out rules apply to both.

Do I need consent for appointment reminders?

You need prior express consent, not written consent, if the reminder has no promotion in it. A customer who gives you their number when they book usually gives it. Add an offer, and the reminder counts as marketing (Hunton Andrews Kurth summary, checked October 2026).

What are TCPA penalties per text?

A person can sue for actual losses or $500 per violation, whichever is greater. A court can triple that to $1,500 per violation when the violation is willful or knowing (47 U.S.C. 227, checked October 2026).

Does the TCPA apply to texts sent from a regular phone?

Partly. In Facebook v. Duguid (April 1, 2021), the Supreme Court held that an autodialer must use a random or sequential number generator, so a phone texting a saved list may fall outside that rule. The Do Not Call rules still apply (McGuireWoods summary, checked October 2026). Get consent and honor STOP on any device.

This checklist is for general guidance only and does not constitute legal advice. Laws and carrier policies vary by country and change over time. Consult qualified legal counsel for your specific use case.