TCPA Compliance Checklist for Text Message Marketing

SMS marketing is a powerful tool for engaging with customers, but it comes with compliance considerations. To protect your business, it helps to have a checklist for TCPA text message compliance.

This checklist will guide your text message and phone call outreach to help you comply with the FCC's Telephone Consumer Protection Act (TCPA). We'll help you understand not just federal TCPA guidelines, but also state-level "mini-TCPA" laws. This includes rules based on express written consent and consent revocation, timing and cadence of outreach, do not call (DNC) lists, and more.

Note: This page aims to be an accurate, up-to-date, and easy to understand checklist. For complete information, it’s always best to consult with your own legal counsel.

In Brief: TCPA Texting Checklist

For easy reference, here's your high-level executive summary.

Big Picture

• 1. Understand the types of consent.
• 2. Follow state-level laws.
• 3. Consult with your legal counsel.
• 4. Make compliance easy with a compliance-focused outreach partner.

For Sales and Marketing Messages

• 5. Adhere to business hours.
• 6. Provide caller name, business name, and phone number.
• 7. Transmit caller ID.
• 8. Scrub against the National Do Not Call Registry.
• 9. Maintain an internal do not call list with proper procedures.
• 10. Avoid abandoning calls.
• 11. Don't disconnect calls too early.

For Outreach Using Autodialers (ATDS)

• 12. Get the right consent for wireless numbers.
• 13. call multiple lines at the same business.

For Phone Calls Using Artificial or Prerecorded Voice

• 14. Get the right consent based on phone line type and message purpose.
• 15. Provide business name, phone number, and an automated opt-out system.

Understand TCPA Consent

Consent is the cornerstone of complying with the TCPA for SMS marketing. There are two main levels of consent you need to know before diving in further.

• Prior Express Written Consent: The highest form of consent and the only one explicitly defined by the FCC in the TCPA. Businesses must get consent documented in writing with a signature (or acceptable digital equivalent).
• Prior Express Consent: A clear indication of consent, but not in writing. The FCC says that providing a phone number in the course of business can count as implied prior express consent to contact them (DNC.com).

In general, marketing messages and automated outreach require higher levels of consent than administrative messages and manual dials. This checklist will help you break down the details to understand what’s needed for your outreach.

Here are a few more things to know about TCPA consent:

• The outreach you send must be consistent with the consent you obtained. If you want written consent to send marketing content, the consent disclosure should say that. If you need consent to use automated texting technology, mention that in the agreement.
• You must keep your outreach relevant to the context of the consent. Don't send outreach that the recipient wouldn’t expect based on the interaction where they gave consent.
• As of January 27, 2025, businesses must obtain consent on a 1:1 basis. That means that the consumer must individually grant consent to your business by name.

TCPA Checklist for Marketing Outreach

Does your message or call count as telemarketing?

TCPA regulations define “telemarketing” as:

“...the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services, which is transmitted to any person” (eCFR).

Your outreach isn't marketing if it's solely about an administrative update. For example, “Your prescription is available for pickup,” or “Your annual statement is ready.” However, if any part of the message is marketing in nature, all the rules in this section will apply.

Adhere to Business Hours

Send marketing messages only between 8 a.m. and 9 p.m. in the local time zone. This helps avoid bothering people when they are sleeping or relaxing. Beware: The specific hours permitted can differ depending on state laws.

Although outside the scope of the federal TCPA, there are more timing considerations beyond just business hours. Some states prohibit marketing texts and calls on holidays (and yes, what counts as a holiday also varies by state). There are also specific rules about how often you may contact consumers about collecting a debt.

Identify Yourself

Text senders and callers must provide their own name and the name of the business they represent. Messages also need to state an address or phone number to contact the business. The phone number should be toll-free.

Transmit Caller ID

Marketing callers must share caller ID information. Show either the caller’s phone number or Automatic Numbering Information (ANI) and, if possible, the telemarketer’s name. Displaying the name and number of the business responsible for the call is also OK. Regardless, the number provided must accept do-not-call requests during business hours.

Respect the National Do Not Call Registry

The National Do Not Call Registry plays an essential role in TCPA compliance. Businesses can't send marketing messages to numbers on the National DNC list unless they get prior express written consent.

• Regularly update your contact lists by checking them against the National Do Not Call Registry. Avoid sending unwanted messages by scrubbing your lists against the National DNC list.
• Ensure your data from the National DNC database is no more than 31 days old.
• Have written procedures for compliance with federal do-not-call rules.
• Train your staff and any third parties in National DNC compliance procedures.
• Maintain a list of telephone numbers that you may not contact (see also the section on internal DNC lists below).

By honoring opt-out requests and checking the Do Not Call Registry, you can protect your business from fines. This also helps you keep strong, trusted relationships with your audience.

Establish and Adhere to an Internal Do Not Call List

In addition to honoring the National DNC, you need to honor consent revocation requests made directly to you.

• Maintain an internal DNC list that is specific to your business or corporation. You may not text, call, or otherwise contact anyone on this list for marketing purposes.
• Honor DNC requests within 10 days. Maintain the name (if provided) and phone number of the opted-out recipient on your internal DNC list for five years.
• Have a written and recorded process for maintaining your DNC list. You’ll need to provide this written process on demand.
• Train employees and telemarketers on DNC maintenance and procedures.

These direct opt-outs are the subject of major recent TCPA updates. For example, one important upcoming update will mean that you must accept a wide variety of opt-out methods. Grab Drips’ 2024 TCPA Consent eBook to learn more about these changes.

Avoid Abandoned Calls

When a live agent is available, you need to connect the recipient to them within two seconds. If no one is available, you can provide a prerecorded message or automated/IVR system instead.

Failing to do any of these things counts as an abandoned call. You need to document these abandoned calls, and they can’t exceed more than 3% of your calls in any 30-day period.

Give Consumers Time to Answer

You can't disconnect an unanswered phone call before 15 seconds or four rings (whichever comes first).

TCPA Checklist for Automatic Telephone Dialing Systems

Does your outreach use automatic telephone dialing systems (ATDS, aka autodialers)? If so, there are several regulations that will apply.

The definition of an ATDS system has been the subject of confusion and the source of some important TCPA lawsuits. The definition can also differ at the state level (more on that below).

The federal TCPA defines an ATDS or autodialer as:

“...equipment which has the capacity to store or produce telephone numbers to be called using a random or sequential number generator and to dial such numbers” (eCFR).

Here are the rules relevant to the use of these systems. Note that unless stated otherwise, these apply regardless of whether the message is marketing or administrative.

Get the Right Consent for Cell Phones

The TCPA regulations distinguish between landlines and wireless numbers in some sections.

• To autodial a wireless number with a marketing message, you must obtain prior express written consent.
• To autodial a wireless number with a non-marketing message, you must obtain prior express consent. It doesn’t need to be in writing.

Don’t Call Multiple Lines

Do not use an automated system to call the same business on more than one of its phone lines at a time. (You can’t make every phone ring at your customer’s office just to get more attention!)

TCPA Checklist for Artificial or Prerecorded Voice

If your outreach uses artificially created voice or previously recorded voice, some additional regulations apply. Unless stated otherwise, these apply regardless of whether the message is marketing or administrative.

Get the Right Consent based on Phone Type and Message Purpose

The consent needed to use artificial or prerecorded voice in telemarketing calls depends on a few factors. Let’s break it down case by case.

• For marketing calls to a wireless number, you need prior express written consent to send prerecorded/artificial voice.
• For non-marketing calls to a wireless number, you need prior express consent to send prerecorded/artificial voice. It doesn’t need to be in writing.
• For marketing calls to a residential landline, you need prior express written consent to send prerecorded/artificial voice (the same as with wireless numbers).
• For non-marketing calls to a residential landline, no consent is needed to send prerecorded/artificial voice.

For administrative landline calls, note that a few limitations apply:

• You need to keep an internal do not call list. You must follow all the same rules for this list as mentioned above for marketing messages.
• Don’t call more than three times in 30 days.
• Certain healthcare outreach can call up to once per day with a maximum of three times per week.
• To call more than the amounts mentioned above, you need to obtain prior express consent to do so.

Provide Identifying Information and Opt-Out Mechanisms

Similar to the disclosures for marketing messages, any artificial or prerecorded voice calls must include the following information.

• Clearly identify your business name at the start of the message.
• During or after the message, provide a toll-free phone number for the business. If the message has promotional or marketing content, the number must be able to handle do-not-call requests.
• For marketing messages, include an automated way to opt out. Also share information on how to use the opt-out mechanism. Calls must provide this information within two seconds of giving the business name and number.

Follow State-Level "Mini-TCPA" Laws

Several states have their own “mini-TCPA” laws that restrict SMS and phone outreach to their citizens. Here's a non-comprehensive overview of some states with notable SMS and telemarketing regulations.

Connecticut

Connecticut’s mini-TCPA has some of the most restrictive prohibitions of any state. It bans any marketing outreach without express written consent. This rule applies to all outreach — manual, autodialed, prerecorded, SMS, WhatsApp, and much more.

• Callers must identify their name, the company name, and reason for calling within 10 seconds of starting a call.
• Acceptable hours for marketing outreach are between 9 a.m. to 8 p.m. local time.
• Connecticut allows for recovery of statutory damages up to $20,000 for each violation.

Oklahoma

• Oklahoma defines an ATDS or autodialer more broadly than the federal TCPA. This means commonly used automation tools may not be legal for recipients in Oklahoma.
• Acceptable hours for marketing outreach are between 8 a.m. to 8 p.m. local time.
• No more than three calls per 24-hour period.
• There is a rebuttable presumption that numbers with an Oklahoma area code belong to Oklahoma residents.

Florida

In response to the Supreme Court's decision in Facebook v. Duguid, Florida passed a major mini-TCPA law in 2021. However, Florida amended the law in 2023, rolling back most of the changes.

• The amended law expanded what counts as a signature for marketing consent. This includes things like swiping up on Instagram and checking a webform box.
• Consumers who do not wish to receive texts from a business can reply with “stop.” Businesses have 15 days to unsubscribe Florida recipients who opt out in this way.
• Acceptable hours for marketing outreach are between 8 a.m. to 8 p.m. local time.

Maryland

• Maryland's 'mini-TCPA' defines an ATDS or autodialer more broadly than the federal TCPA. This means commonly used automation tools may not be legal for recipients in Maryland.
• Acceptable hours for marketing outreach are between 8 a.m. to 8 p.m. local time.
• No more than three calls per 24-hour period.
• Specific rules against spoofing and concealing caller identity.
• A violation of the law constitutes a violation of Maryland's Consumer Protection Act (MPCA). This can mean damages of up to $2,500.

New York

• New York requires marketing calls to give a DNC request option at the start of the call. The DNC mechanism needs to come after identifying information but before stating the reason for the call.
• The New York attorney general can bring fines of up to $20,000 per DNC violation.

Why TCPA Compliance Matters

Federal TCPA violations can cost the responsible organizations $500-$1,500 per violation. These amounts are based on the following penalty amounts:

• $500 per call or text that violates any part of the TCPA.
• The damages can increase to $1,500 if violators act willingly or knowingly.

These penalties come from individuals’ lawsuits or class action lawsuits using a private right of action. Many serial plaintiffs actively seek to catch enterprises who may be in violation of the TCPA (TCPAWorld).

Of course, it’s not just about the money. The TCPA is in place to protect consumers — and your audience will appreciate your efforts to keep their best interests in mind.

Americans get an average of 2.5 billion spam and unwanted calls each month (Truecaller). In this environment, personalized outreach that matches consumers’ preferences can help you stand out as a trustworthy provider. This in turn can increase engagement, conversion, and retention rates for your services.

How to Keep It Safe When Texting

If you’ve read this far, you're likely ready to take the next step to improve TCPA compliance in your business or call center. But getting the operational details right isn't easy. You'll need consent disclosures, an audit of your lead sources, updated data systems, agent training, and more.

Getting compliance wrong can be costly, but taking the DIY approach can be costly, too.

That's why Drips has Keep It Safe as a core pillar of our services. We offer proprietary compliance technology and help clients manage fast-changing outreach regulations. If you need to stay compliant without taking your focus away from your business goals, let’s talk.

Contact Drips

Disclaimer: This article and all information contained in it are for educational and informational purposes only. Neither Drips nor any of the writers of this article are law firms or attorneys, and nothing herein should be construed as or relied on as legal advice. Drips and the authors herein disclaim any obligations relating to the timeliness or accuracy of the information contained here. No warranties should be implied. Although intended to be current and accurate, regulations and court rulings, as well as interpretations of the same, are always changing and we recommend consulting with your own counsel.