TCPA Compliance Checklist 2026: 12 Rules for SMS Marketers

The Telephone Consumer Protection Act (TCPA) is the US federal law that governs how businesses can text consumers. Statutory damages start at $500 per message and climb to $1,500 for willful violations — class actions routinely settle in the millions. The good news: compliance is mostly procedural, and a good platform automates most of it.

The non-negotiables

• Express written consent before sending any marketing SMS.
• Clear opt-out language in every marketing message ("Reply STOP to unsubscribe").
• Honor STOP requests immediately and permanently across all campaigns.
• Identify your brand in the message body.
• Disclose msg & data rates may apply at the opt-in step.
• Respect quiet hours — typically 8am–9pm in the recipient's local time zone.

What counts as "express written consent"

A timestamped record showing the subscriber affirmatively agreed to receive marketing texts from your brand at the specific number provided. A pre-checked box doesn't count. A vague "subscribe to updates" toggle doesn't count. The consent language has to mention SMS, marketing, and your brand.

Records you should keep

• The exact opt-in language displayed to the subscriber.
• Timestamp and IP address of the opt-in event.
• Source (which form, popup, or checkout step).
• STOP request timestamps.

YIPSMS logs all of the above automatically — see the compliance features.

State laws to know

Florida (FTSA), Oklahoma (TCPA-OK), and Washington (CEMA) have stricter rules than federal TCPA — including narrower quiet hours and lower damage thresholds. If you ship nationally, follow the strictest standard by default.

The five-minute audit

• Pull up your opt-in form. Does it explicitly mention SMS marketing and your brand? If not, fix it today.
• Send yourself a test campaign. Does it include "Reply STOP"? Does it identify the brand?
• Reply STOP. Are you immediately unsubscribed?
• Can you produce a consent record for any subscriber on demand?