TCPA-compliant texting software with opt-outs, DNC lookup, quiet hours, and 10DLC built in.

What the TCPA actually says

Four TCPA requirements every SMS marketing program has to meet.

The Telephone Consumer Protection Act of 1991 was written for autodialed phone calls, but it covers SMS, and the FCC has been progressively tightening interpretation since 2012. For a text-marketing program, four things matter in practice:

The longer version, written as something you can work through line by line, is the TCPA compliance checklist.

1. Express written consent before any promotional message. A pre-checked checkbox doesn't count. The opt-in must be a clear affirmative action by the recipient (texted-in keyword, signed form, unchecked checkbox they ticked).
2. Disclosure at opt-in: the recipient must be told who's texting them, that message and data rates may apply, and how to opt out (typically "Reply STOP to cancel").
3. Honored opt-outs: STOP, UNSUBSCRIBE, CANCEL, END, QUIT, and several variants must all stop further messaging. Carriers enforce this at the network level, but you need to handle it cleanly in your own list too.
4. Quiet hours: most state-level interpretations require sends between 8:00 a.m. and 9:00 p.m. local time of the recipient, not the sender. A noon Eastern blast doesn't land at 9 a.m. Pacific.

CampaignCNX+ enforces (3) and (4) at the send path automatically. (1) and (2) are program responsibilities, but the platform stores the consent timestamp and source per contact so you have the audit trail when you need it.

A few things worth knowing if you're building a serious program:

• The FCC's 2024 one-to-one consent rule tightens what counts as consent on lead-gen forms: a single checkbox can no longer cover multiple unrelated sellers. If your program ingests leads from third-party forms, audit them.
• Political SMS is largely exempt from TCPA's most restrictive provisions when sent manually (not autodialed) by non-commercial speakers, but the safe path is to treat political the same as commercial: written consent, quiet hours, STOP handling. The FCC's 2024 closing of the political robocall loophole reinforced this.
• Statutory damages are real: $500 per message for negligent violations, $1,500 for willful. Class-action attorneys actively scan for non-compliant senders. The math gets ugly fast on a 10,000-recipient send.
• 10DLC isn't a TCPA shortcut. Carrier registration improves deliverability and signals to networks you're a legitimate sender, but it doesn't substitute for consent, quiet hours, or opt-out handling.

Where the risk actually is

Most TCPA claims start somewhere other than a bad message.

Programs tend to picture a TCPA problem as a message that should never have been sent. In practice the message is usually fine and the record behind it is not. Four situations produce most of the exposure, and none of them are about the copy.

• Reassigned numbers. Mobile numbers get disconnected and handed to somebody new, and that happens constantly. Consent belongs to the person who gave it, not to the digits, so a number that was legitimately opted in two years ago may now reach a stranger who never agreed to anything. Long-dormant segments carry more of this risk than fresh ones.
• Consent you cannot produce. Having obtained consent and being able to evidence it are different things. If the answer to "show me the opt-in" is a description of a form that has since been redesigned, the practical position is weak even when the original consent was real.
• Opt-out lag. A STOP that is honored on the platform but not on a list somebody exported to a spreadsheet last week is a violation waiting for the next send from that spreadsheet. Exports are where suppression quietly stops applying.
• Someone else sending on your behalf. Agencies, consultants, and affiliate partners send in your name. The brand on the message is generally where a complaint lands, whoever pressed the button.

The pattern across all four is that the sending decision was defensible and the surrounding record was not. That is a record-keeping problem, which is good news, because record-keeping is cheap compared to the alternative.

A workable minimum for what to retain, per contact:

• When consent was captured, and through what. A timestamp plus the source, so an opt-in can be traced to a specific form or keyword rather than to "the website".
• What the person actually agreed to. The disclosure language as it read on the day, not as it reads now. Forms get rewritten; the archived wording is what matters if the consent is ever questioned.
• Every opt-out, with its timestamp. Including opt-outs that arrived by reply, by phone, or by email, which are the ones most likely to live outside the platform.
• What was sent, and when. The send log is the only thing that can demonstrate quiet hours were respected across time zones.

CampaignCNX+ stores all four as a matter of course and the audit trail exports, which is what makes an inquiry a short conversation rather than a reconstruction exercise. The part no platform can do for you is the disclosure language at the point of capture, because that lives on your form.

Two further notes worth having in mind rather than discovering later. Several states run their own mini-TCPA statutes that are stricter than the federal baseline on timing and consent, and they change; if you send into a state you do not operate in, that is worth a specific check rather than an assumption. And the exemptions that apply to non-commercial political messaging are narrower than they are often described, which is covered in more depth in the political texting guide.

Getting consent in the first place

Four ways consent gets captured, ranked by how well they hold up.

Every method below can produce valid consent. They differ in how easy it is to prove a year later, which is the only property that matters once somebody asks.

1. Keyword opt-in. The person texts a word to your number. The strongest of the four by a distance, because the consent arrives as an inbound message from the handset itself, timestamped, from the number in question. There is no form to reconstruct and no question about who ticked what. If you can route new subscribers through a keyword, do.
2. Web form with an unchecked box. Solid when the box is genuinely unchecked, sits next to the disclosure rather than behind a link, and the submitted values are stored. Weak when the disclosure lives in terms nobody opened, or when the form has been redesigned since and nobody archived the old wording.
3. Point of sale or paper. Common in retail and clinics, and workable if the slip is retained and the phone number on it is legible. The failure is mundane: the paper goes in a drawer, the number gets keyed in later, and the link between the two is a person's memory.
4. Imported from another system. The weakest position, because you inherit whatever the previous consent looked like without having seen it. Before importing a purchased or inherited list, ask what people actually agreed to and whether the seller can evidence it. If the answer is vague, treat the list as unconsented and re-permission it.

Whichever method you use, the disclosure has to name you. A person who opted in to a form on a partner site did not consent to hear from your brand, and single-checkbox consent covering several senders at once has been narrowing rather than widening as an acceptable practice.

One practical habit that costs nothing: when you change an opt-in form, keep a dated copy of the wording it replaced. Every consent captured under the old version is defended by the old wording, and reconstructing it after the fact is the part that turns a routine question into a problem.