TCPA Compliance for SMS Marketing: The 2026 Checklist Every Sender Needs

TCPA Compliant Texting: Why It Matters in 2026

TCPA compliant texting is required, and it can decide whether you run a successful SMS (text message) marketing program or face a lawsuit that could bankrupt your business. The Telephone Consumer Protection Act (TCPA) is the federal law on calls and texts. It has been in place since 1991, but enforcement has never been stricter than it is now.

In 2025 alone, TCPA lawsuits resulted in settlements and judgments totaling over $1.5 billion. Individual penalties of $500 per non-compliant text ($1,500 for willful violations) add up quickly when you send to thousands of contacts. A single campaign of 5,000 texts sent without proper consent could generate $2.5 million to $7.5 million in liability.

This checklist covers everything you need to know to keep your SMS marketing program fully compliant in 2026.

The Complete 2026 TCPA SMS Checklist

Consent Requirements

• Prior express written consent (clear permission, given in writing in advance) is required for all marketing text messages sent using an autodialer or prerecorded system
• Consent must be clear and conspicuous, not hidden in terms of service or fine print
• Consent must be voluntary, so you cannot make it a condition of purchasing a product or service
• The consent form must specify the exact company or organization that will be sending messages
• The consent must authorize your organization to send. Consent to receive texts from Company A does not authorize Company B to text that person, even if the two companies are affiliated
• Consent obtained through a lead generator (a company that collects contact details and sells them) must specifically name your company, not just "marketing partners"

Message Content Requirements

• Every first text must identify the sender (company or organization name)
• Include opt-out instructions in the first message and at regular intervals ("Reply STOP to unsubscribe")
• Messages must be relevant to the consent given. For example, if someone signed up for appointment reminders, do not send them promotional offers without separate consent
• Never send deceptive or misleading content
• Include the "Msg & data rates may apply" disclosure in your first opt-in confirmation

Timing Restrictions

• No texts before 8:00 AM or after 9:00 PM in the recipient's local time zone
• Account for time zone differences across your contact list
• Some states have stricter hours. For example, Florida limits texts to 8 AM to 8 PM

Opt-Out Management

• Process STOP, QUIT, CANCEL, UNSUBSCRIBE and END responses as immediate opt-outs
• Send a single confirmation message acknowledging the opt-out
• Remove the number from your active list within 24 hours (ideally, immediately)
• Never re-subscribe someone who has opted out without new, explicit consent
• Maintain a master suppression list (numbers that must not be texted) and check it before every send

Record Keeping

• Store proof of consent for every contact: date and time, source, IP address (the device's internet address) and exact consent language
• Maintain opt-out records indefinitely
• Keep message logs showing what was sent, when, and to whom
• Document your compliance procedures in writing

Technical Requirements

• 10DLC registration: All A2P messaging (texts sent from software rather than a personal phone) must go through a registered 10DLC campaign, which registers your standard local number with the carriers
• Do Not Call list: Check your list against the National Do Not Call (DNC) Registry and remove listed numbers (required for telemarketing, recommended for all texting)
• Carrier compliance: Follow each carrier's messaging guidelines to avoid filtering (carriers are the phone companies, such as AT&T, Verizon and T-Mobile)
• Use a platform that provides automated compliance features, because tracking compliance by hand for a large list leads to mistakes

The FCC's Consent Rules: What Changed and What Did Not

Two recent FCC rule changes are worth understanding, and only one of them took effect.

One-to-one consent was struck down: The FCC planned to require that consent name one specific seller, so a single checkbox could no longer cover "Company X and its marketing partners." The U.S. Court of Appeals for the Eleventh Circuit struck the rule down on January 24, 2025, days before it was due to apply, and the FCC formally removed it in August 2025. The longstanding standard still applies: marketing texts need prior express written consent that authorizes your organization to send them. If you buy leads, make sure each consent form names your organization.

Lead generator accountability: Companies using lead generators are responsible for making sure the consent collected meets TCPA standards. Not knowing that a lead generator failed to collect proper consent is not a defense.

For a complete overview, read our guide to TCPA compliant texting.

Revocation methods: Consumers can revoke consent through any reasonable method, not just the standard STOP keyword. If someone emails you saying "stop texting me," that counts.

State-Level TCPA Additions for 2026

Several states have enacted texting regulations that go beyond federal TCPA requirements:

• Florida (FTSA): Requires written consent (an electronic signature qualifies), limits texts to 8 AM to 8 PM and requires specific opt-out language
• California (CCPA/CPRA): Adds data privacy requirements under the state's consumer privacy laws. Consumers can request deletion of their phone number and texting data
• Oklahoma: Specific disclosure requirements for commercial text messages
• Maryland: Restricts certain types of automated texting and requires clear identification
• Washington: Enhanced consent requirements for automated messages

Always check the laws in every state where your recipients are located, not just where your business operates.

Common TCPA Violations and How to Avoid Them

Violation 1: Texting without consent. This includes purchasing phone lists and texting them. Purchased lists almost never have valid consent for your business. Build your own list with proper opt-ins.

Violation 2: Ignoring opt-outs. If your system does not process STOP requests immediately, every message sent after the opt-out is a separate violation. Use an SMS marketing platform that automates opt-out processing.

Violation 3: Texting outside allowed hours. If a campaign is sent at 9:15 PM to contacts in the Eastern time zone, every message to a recipient in that zone is a violation.

Violation 4: Inadequate consent language. "By providing your phone number, you agree to our terms" is not sufficient. You need to specifically mention text messages and identify the sender.

Violation 5: Sharing consent across companies. You cannot text someone based on consent they gave to a different company, even an affiliate or partner, because written consent must authorize the organization that sends.

Building Compliance Into Your SMS Program

Organizations that avoid TCPA problems do so deliberately, by building compliance into every step of their texting program:

• Use clear, specific opt-in language everywhere you collect phone numbers
• Store consent records in a system where they cannot be deleted by accident
• Process opt-outs automatically and promptly
• Train every team member who works with your contact list on compliance basics
• Review your practices every quarter
• Use a platform that enforces compliance rules automatically

CampaignCNX+ was built with TCPA compliance in mind. Automatic opt-out processing, consent tracking, limits on sending hours, Do Not Call list checks and 10DLC management are all built into the platform. You focus on your message, and we handle the compliance tools behind it.

Start with 100 free SMS and run your SMS marketing program with compliance safeguards in place from your first message. You get 100 free SMS to start, your number is $5 a month, and we file the carrier approval for you. That review usually takes about 3 business days for a toll-free number.

Read more about CampaignCNX+ texting for small businesses.