TCPA Compliance SMS Checklist for 2026

Send marketing texts with confidence in 2026 by getting consent, opt-outs, and state rules right before you hit send. The rules moved in 2025 and 2026, and several widely repeated compliance tips are now out of date. This guide explains what the TCPA requires today and gives franchise and multi-location brands a current checklist for managing SMS compliance.

SMS Compliance: What's New for 2026

Consumers can now opt out any reasonable way, including more than the word STOP. The FCC's consent revocation rule took effect April 11, 2025. A customer who replies "stop texting me," "remove me," or "cancel" has revoked consent, even without using a standard keyword. Honor the request as soon as possible, within 10 business days. The FCC had previously proposed a 24-hour deadline but did not adopt it.

The one-to-one consent rule never took effect. In December 2023 the FCC adopted a rule that would have required separate consent for each individual seller and closed the lead-generator loophole. The Eleventh Circuit vacated it on January 24, 2025 in Insurance Marketing Coalition v. FCC, and the FCC later deleted it. Prior express written consent, the standard that predates 2023, still governs where the FCC's telemarketing consent rule applies. Some vendor guides continue to describe one-to-one consent as a 2026 requirement.

The "revoke-all" provision is delayed to January 31, 2027. This part of the FCC's revocation rule would broaden the effect of certain opt-outs across additional robocalls and robotexts from the same sender. The FCC pushed its effective date into 2027 while it reviews comments.

State mini-TCPA laws are expanding fast. Texas and Virginia both added text-specific rules in the last year, while other states impose their own requirements for consent, opt-outs, registration, private lawsuits, and damages. National texting programs increasingly need state-level compliance settings. See section 9 for the details.

Carrier registration is effectively mandatory. Major carriers block or filter unregistered business traffic on standard 10-digit numbers. A2P 10DLC brand and campaign registration, along with toll-free verification, directly affect whether your messages reach customers. See section 10.

Litigation exposure remains significant. TCPA statutory damages carry no aggregate cap. A campaign sent to an improperly consented list can create substantial exposure as damages multiply across recipients and messages. State telemarketing laws can add separate claims and penalties.

A federal court just narrowed do-not-call claims over texts. In July 2026, the Seventh Circuit ruled in Steidinger v. Blackstone Medical Services that the TCPA's private do-not-call provision covers "telephone calls" rather than text messages. Under current Seventh Circuit precedent, that private claim is unavailable for texts in Illinois, Indiana, and Wisconsin, including texts to numbers on the Do Not Call Registry. The Ninth Circuit has treated texts as covered under a different TCPA provision. Other TCPA provisions, state laws, opt-out obligations, and carrier rules continue to govern SMS. See section 4.

Courts are giving the FCC less deference. Following the Supreme Court's 2024 Loper Bright decision and its June 2025 ruling in McLaughlin Chiropractic v. McKesson, courts can independently interpret the TCPA instead of automatically treating FCC interpretations as binding. In February 2026 the Fifth Circuit held that oral consent could satisfy the statute for the automated telemarketing calls at issue in Bradford v. Sovereign Pest Control. The FCC's written-consent regulation remains on the books outside contrary binding precedent. For SMS marketers, documented written consent provides the strongest record if consent is later challenged.

What is the TCPA?

Congress enacted the Telephone Consumer Protection Act (TCPA) in 1991 to regulate certain telephone calls and faxes. Text messaging emerged afterward, and FCC rules and court decisions later applied many TCPA protections to SMS.

Core TCPA Rules for SMS Marketing

• Prior express written consent is the safest standard to meet before sending marketing text messages.
• In a private TCPA lawsuit, statutory damages are generally $500 per violation and can rise to as much as $1,500 for a willful or knowing violation.
  • Standard violation: $500
  • Willful or knowing violation: up to $1,500
• In many SMS cases, each unlawful text counts as a separate violation. Damages can grow quickly across a large list.
• Honor opt-out requests as soon as possible, within 10 business days. Consumers may revoke consent through any reasonable method.

Government enforcement operates separately. The FTC's Telemarketing Sales Rule allows civil penalties of up to $53,088 per violation for covered telemarketing-call violations, including certain National Do Not Call violations. That figure applies to conduct covered by the TSR. TCPA private damages follow the separate 500/1,500 framework described above.

Most SMS compliance programs still use TCPA consent, identification, and opt-out rules as their baseline. Recent court decisions have made the treatment of texts under particular TCPA provisions less uniform, so the specific claim and jurisdiction can affect the analysis.

Does the TCPA's** Do Not Call **Rule Cover Text Messages?

In July 2026, the Seventh Circuit held in Steidinger v. Blackstone Medical Services that the TCPA's private do-not-call action under Section 227(c)(5) applies to "telephone calls" and does not extend to texts. That precedent currently controls in Illinois, Indiana, and Wisconsin.

The Ninth Circuit has treated texts as covered under Section 227(b), a different part of the TCPA. The two courts therefore addressed different statutory provisions rather than the identical legal question.

For a national texting program, Steidinger changes one category of private claim in three states. Continue maintaining opt-out and suppression practices across the country because other TCPA provisions and state texting laws remain in play.

What Constitutes Valid Consent Under TCPA in 2026?

For promotional SMS, build your program around documented prior express written consent. When the FCC's telemarketing consent rules apply, the agreement needs to clearly authorize the communications and include the required disclosures.

Express Written Consent

Use a consent flow that leaves a clear record of what the customer agreed to receive:

• Require an affirmative opt-in. A past purchase, website visit, or period of inactivity does not establish marketing consent.
• Use an unchecked box or another explicit action that records agreement.
• Where the FCC's prior express written consent rule applies, the disclosure must state that consent is not a condition of purchasing goods or services.
• Keep records showing when and how consent was obtained, the phone number involved, the disclosure presented, and the consent language in effect at the time.

TCPA claims generally carry a four-year limitations period. Keeping consent records beyond that period gives you a stronger record if a dispute surfaces later.

Illustrative Opt-in Language

A simplified starting point might look like this:

"By providing your phone number and clicking 'I Agree,' you agree to receive promotional text messages from [Company Name] at the number provided, including messages sent using automated technology where applicable. Consent is not a condition of purchasing any goods or services. Message and data rates may apply. Message frequency varies. Reply STOP to opt out or HELP for help."

Match the disclosure to your messaging technology, campaign, state requirements, and carrier program. The surrounding page and the action the customer takes should make the scope of consent equally clear.

TCPA SMS Compliance Checklist

1. Managing Opt-ins: Active vs. Inactive Customers

Long-dormant subscribers create more risk than active ones. Phone numbers get reassigned, people forget old opt-ins, and disengaged subscribers are more likely to complain.

Periodic re-engagement can help clean up an aging list. A message such as "We miss you! Reply YES to keep receiving exclusive deals from [Company Name]" gives subscribers a simple way to reconfirm their interest and helps remove contacts who no longer want the messages.

2. Transactional vs. Promotional Messages

Classify the message before you send it because promotional content can trigger a higher consent requirement.

Transactional Messages

Transactional messages give customers information connected to an existing interaction, such as an order or appointment. Keep them informational unless the recipient also has marketing consent.

Examples:

• Order confirmations: "Your order #12345 has shipped!"
• Delivery updates: "Your package is arriving today."
• Appointment reminders: "Reminder: your appointment is Friday at 2 PM."

Promotional Messages

Promotional messages encourage a purchase, advertise an offer, or otherwise market the business. For marketing texts sent using technology covered by the FCC's telemarketing rules, prior express written consent is the federal standard.

Examples:

• Discounts: "Flash Sale: 20% off today only! Use code SAVE20."
• Exclusive offers: "VIP members get a free gift this weekend. Click to claim!"

If you add promotional material to an otherwise transactional message, make sure the recipient has the consent required for that promotional content.

3. Opt-out Process Requirements in 2026

Since April 11, 2025, consumers have been able to revoke consent through any reasonable method. Process valid requests as soon as possible and within 10 business days.

Recognize more than standard keywords. STOP, QUIT, END, CANCEL, UNSUBSCRIBE, and OPT OUT remain common commands. Requests such as "please stop texting me" or "take me off this list" can also revoke consent.

Send one confirmation after the opt-out. You may send a single non-promotional confirmation such as "You have been unsubscribed from [Company Name]. No further messages will be sent."

The FCC's broader "revoke-all" provision is scheduled for January 31, 2027. Until then, the scope of an opt-out can depend on the customer's wording and the consent involved. Some brands suppress the number more broadly because one universal suppression process is easier to administer.

4. Penalties for TCPA Violations in 2026

Private TCPA claims generally carry statutory damages of $500 per violation, with damages of up to $1,500 for a willful or knowing violation. Many SMS cases treat each unlawful message as a separate violation.

Steidinger created an important exception for one type of claim. Under current Seventh Circuit precedent, Section 227(c)(5)'s private do-not-call action does not apply to texts in Illinois, Indiana, and Wisconsin. Other TCPA claims and state-law claims may still apply.

The FTC can separately seek civil penalties of up to $53,088 per violation under its Telemarketing Sales Rule for covered conduct, including certain National Do Not Call violations involving telemarketing calls.

Maintain consent records, process opt-outs promptly, and track the laws governing each campaign.

5. Frequency of Messages: How Much is Too Much?

The TCPA sets no universal numerical limit on marketing-text frequency. Your consent disclosure, applicable state laws, and carrier policies can still shape how often you should send.

Match the cadence subscribers were told to expect. Monitor complaints and engagement, and consider allowing customers to choose options such as weekly or monthly messages.

6. How to Handle Reassigned Phone Numbers

A valid opt-in from the previous owner of a phone number does not give you consent from its new owner. Reassigned numbers therefore create risk even when your original consent record was sound.

Regular list cleaning helps. You can also check the FCC's Reassigned Numbers Database. A proper database check can create a safe harbor when an incorrect database result causes you to contact a reassigned number.

7. Exemptions for Specific Industries or Messages

Certain nonprofit communications receive more flexibility under federal rules. Genuine emergency-purpose calls and texts can also qualify for exemptions from some consent requirements.

The content and purpose of the message determine whether an exemption applies. A health-, weather-, or safety-related message does not automatically qualify as an emergency communication.

Document the basis for any exemption your campaign relies on.

8. How Do Automated SMS Platforms Affect Compliance?

Automation can take several repetitive compliance tasks out of your team's hands. An SMS platform can record opt-ins, process opt-outs, suppress numbers, enforce sending windows, and apply frequency limits by campaign or jurisdiction.

Natural-language opt-out detection is especially useful under the FCC's current revocation rule because customers are no longer limited to a small set of keywords.

Your settings still need to reflect the correct consent rules, state requirements, and campaign structure. Automation is most valuable when those rules are configured correctly from the start.

9. State-Level Regulations: The Multi-State Challenge

A national SMS program can cross dozens of state regimes in one campaign. Some states focus on consent. Others add registration, opt-out, damages, or private-enforcement requirements.

Several state rules deserve special attention in 2026:

• Texas (SB 140, effective September 1, 2025): Texas expanded its telemarketing framework to cover text messages and strengthened private enforcement under the affected laws. Chapter 302 includes registration and security-deposit requirements. Current Texas Secretary of State guidance says businesses texting consumers with prior consent do not need to complete the Chapter 302 Telephone Solicitation Registration Statement. Separate Texas telemarketing and no-call provisions use their own definitions and exemptions, including rules written specifically for calls.
• Virginia (SB 1339, effective January 1, 2026): Consumers can opt out of solicitation texts by replying "Unsubscribe" or "Stop." You must honor that request for at least 10 years.
• Florida (FTSA, Fla. Stat. 501.059): Florida regulates sales communications made by telephone call, text message, or voicemail transmission and requires prior express written consent for certain automated marketing communications. For a damages action based on text solicitations, the recipient generally must first reply "STOP." You then have 15 days to stop. Continued nonconsensual texts after that period can support a text-message damages claim. Florida's separate 8 a.m. to 8 p.m. and three-per-day restrictions are written specifically around commercial solicitation "phone calls," which leaves their SMS application less straightforward.
• Oklahoma (OTSA): Oklahoma expressly addresses text messages in its written-consent rules and allows private claims for actual damages or $500, with possible increases for willful or knowing violations. Its 8 a.m. to 8 p.m. window and three-contact limit use "phone call" language, creating similar uncertainty around SMS.
• Washington (CEMA, RCW 19.190): Washington generally requires affirmative consent before you send commercial texts to Washington subscribers. As of June 11, 2026, statutory damages for a prohibited commercial text are $100 or actual damages, whichever is greater. The new amount applies to actions filed on or after that date, including claims involving earlier messages.

Maryland, Indiana, New Jersey, Oregon, Pennsylvania, Tennessee, and other states also have texting or telemarketing requirements. Track the rules by jurisdiction instead of relying solely on your federal TCPA settings.

Privacy laws add another layer. California's CCPA and CPRA, for example, govern how you collect and use phone numbers and other personal information.

When determining which state rules apply, use the customer information available to you, including residence, number assignment, and known location. Different statutes use different jurisdictional tests.

A conservative national baseline can cover shared requirements such as consent and opt-outs. Registration, recordkeeping, damages, and private-enforcement provisions still require state-specific tracking.

10. Carrier Registration: A2P 10DLC and Toll-Free Verification

In the US, application-to-person messages sent through standard 10-digit long codes generally need A2P 10DLC brand and campaign registration. Major carriers filter or block unregistered traffic.

Toll-free messaging uses a separate verification process. Providers commonly ask for company information, your use case, the opt-in flow, and sample messages.

Carrier and industry requirements sit alongside your legal obligations. Keep registration details current as campaigns, consent flows, and messaging use cases change.

11. SHAFT Content Restrictions

Carriers and messaging providers place additional restrictions on several high-risk content categories grouped under the acronym SHAFT: Sex, Hate, Alcohol, Firearms, and Tobacco.

Messages in these categories may be blocked or face extra requirements. Repeat violations can jeopardize your access to messaging services.

Policies differ among carriers and providers. Some permit lawful age-restricted products, such as alcohol, when you use an appropriate age gate and satisfy additional requirements. Confirm the applicable rules before launching a campaign involving one of these categories.

Ensuring TCPA Compliance with Voxie

TCPA compliance gets harder when dozens or hundreds of local operators can text on behalf of the same brand.

Voxie automatically processes opt-ins and opt-outs so revocations take effect right away and suppressed numbers stay suppressed. Safe sending hours keep campaigns inside the windows you set, while frequency limits help enforce the cadence established for a campaign or jurisdiction. Brand-level safeguards reduce manual mistakes across local teams.

Voxie's strategists also work with franchisors and franchisees on messaging programs that balance cadence, personalization, and compliance.

Ready to give local operators the freedom to text, safely? Let's talk.

---

This guide is for informational purposes only and does not constitute legal advice. Regulations and case law change frequently. Consult qualified legal counsel for advice specific to your business, use case, messaging technology, and the states where you operate.