TCPA-compliant texting software with opt-outs, DNC lookup, quiet hours, and 10DLC built in.

What the TCPA actually says

Four TCPA requirements every SMS marketing program has to meet.

The Telephone Consumer Protection Act of 1991 was written for autodialed phone calls, but it also covers SMS, and the FCC (the Federal Communications Commission) has been steadily tightening its interpretation since 2012. For a text marketing program, four requirements matter in practice:

The longer version, written as something you can work through line by line, is the TCPA compliance checklist.

1. Express written consent before any promotional message. A pre-checked checkbox doesn't count. The opt-in must be a clear affirmative action by the recipient (texted-in keyword, signed form, unchecked checkbox they ticked).
2. Disclosure at opt-in: the recipient must be told who's texting them, that message and data rates may apply, and how to opt out (typically "Reply STOP to cancel").
3. Honored opt-outs: STOP, UNSUBSCRIBE, CANCEL, END, QUIT, and several variants must all stop further messaging. Carriers enforce this at the network level, but you need to handle it cleanly in your own list too.
4. Quiet hours: the federal rule at 47 CFR 64.1200(c)(1) sets the window at 8:00 a.m. to 9:00 p.m. in the local time at the recipient's location, not the sender's, and some states are stricter on top of that. People most often get the early end wrong, not the late end. For example, a 9:00 a.m. Eastern send reaches a Pacific number at 6:00 a.m. You can work out the window for the time zones you actually text with the SMS quiet hours calculator, which also explains why a nationwide send has ten hours rather than thirteen.

CampaignCNX+ enforces (3) and (4) automatically on every message. (1) and (2) are your program's responsibilities, but the platform stores the consent timestamp and source for each contact so you have the audit trail when you need it.

A few more points to know if you are building a serious program:

• The FCC's one-to-one consent rule never took effect. It would have stopped a single checkbox on a lead-generation form from covering many unrelated sellers, but the U.S. Court of Appeals for the Eleventh Circuit struck it down on January 24, 2025, days before it was due to apply, and the FCC formally removed it in August 2025. The longstanding standard still applies: marketing texts need prior express written consent that authorizes your organization to send them. If your program takes in leads from forms run by other companies, make sure each form names your organization.
• Political SMS is largely exempt from TCPA's most restrictive provisions when sent manually (not autodialed) by non-commercial speakers, but the safe path is to treat political the same as commercial: written consent, quiet hours, STOP handling.
• Statutory damages are real: $500 per message for negligent violations, $1,500 for willful. Class-action attorneys actively scan for non-compliant senders. The exposure adds up quickly on a 10,000-recipient send.
• 10DLC is not a substitute for TCPA compliance. Carrier registration helps your messages reach people's phones and shows the carriers you are a legitimate sender, but it does not replace consent, quiet hours, or opt-out handling.

Where the risk actually is

Most TCPA claims start somewhere other than a bad message.

Many programs picture a TCPA problem as a message that should never have been sent. In practice, the message itself is usually fine, and the problem is the record behind it. Four situations cause most of the legal risk, and none of them involve the wording of the message.

• Reassigned numbers. Mobile numbers are disconnected and given to someone new all the time. Consent belongs to the person who gave it, not to the phone number, so a number that was properly opted in two years ago may now reach a stranger who never agreed to anything. Groups of contacts you have not texted in a long time carry more of this risk than recent ones.
• Consent you cannot produce. Having consent and being able to prove it are different things. If your only answer to "show me the opt-in" is a description of a form that has since been redesigned, your position is weak even when the original consent was real.
• Delayed opt-outs. Suppose a STOP is honored on the platform but not on a list someone exported to a spreadsheet last week. The next send from that spreadsheet may be a violation. Exported lists are where opt-outs most often stop being applied without anyone noticing.
• Someone else sending on your behalf. Agencies, consultants, and affiliate partners may send in your name. A complaint is generally made against the brand named on the message, no matter who actually sent it.

In all four cases, the decision to send could be defended, but the records around it could not. That makes it a record-keeping problem, which is good news, because keeping records is cheap compared to the alternative.

At a minimum, keep the following for each contact:

• When and how consent was given. Keep a timestamp and the source, so an opt-in can be traced to a specific form or keyword rather than to "the website".
• What the person actually agreed to. Keep the disclosure language as it read on the day of sign-up, not as it reads now. Forms are rewritten over time, and the saved original wording is what matters if the consent is ever questioned.
• Every opt-out, with its timestamp. This includes opt-outs that arrived by reply, by phone, or by email, which are the ones most likely to be recorded outside the platform.
• What was sent, and when. The send log is the only record that can show quiet hours were respected across time zones.

CampaignCNX+ stores all four automatically, and the audit trail can be exported, so an inquiry can be answered quickly instead of requiring you to rebuild the record. The part no platform can do for you is the disclosure language at the point of sign-up, because that appears on your own form.

Two further points are worth knowing in advance. Several states have their own versions of the TCPA (often called mini-TCPA statutes) that are stricter than the federal rules on timing and consent, and these laws change. If you send into a state you do not operate in, check that state's rules specifically rather than assuming. Also, the exemptions that apply to non-commercial political messaging are narrower than they are often described, which is covered in more depth in the political texting guide.

Getting consent in the first place

Four ways consent gets captured, ranked by how well they hold up.

Every method below can produce valid consent. They differ in how easy the consent is to prove a year later, and that is what matters once someone asks.

1. Keyword opt-in. The person texts a word to your number. This is by far the strongest of the four, because the consent arrives as a timestamped message sent from the phone number in question. There is no form to reconstruct and no question about who ticked which box. If you can have new subscribers sign up with a keyword, do so.
2. Web form with an unchecked box. This holds up well when the box is truly unchecked, sits next to the disclosure rather than behind a link, and the submitted information is stored. It is weak when the disclosure is buried in terms nobody opened, or when the form has since been redesigned and nobody saved the old wording.
3. Point of sale or paper. This is common in retail stores and clinics, and it works if the paper slip is kept and the phone number on it is readable. The usual failure is simple: the paper goes in a drawer, the number is typed in later, and the only link between the two is someone's memory.
4. Imported from another system. This is the weakest position, because you take on whatever consent was collected before without having seen it. Before importing a purchased or inherited list, ask what people actually agreed to and whether the seller can prove it. If the answer is vague, treat the list as having no consent and ask those people for permission again.

Whichever method you use, the disclosure has to name you. A person who opted in to a form on a partner site did not consent to hear from your brand, and consent through a single checkbox that covers several senders at once has been narrowing rather than widening as an acceptable practice.

One useful habit costs nothing. When you change an opt-in form, keep a dated copy of the wording it replaced. Every consent collected under the old version is supported by the old wording, and having to reconstruct that wording later is what turns a routine question into a problem.