# TCPA compliance checklist for SMS senders (2026)

> A dated TCPA checklist for SMS: consent, opt-out words, 10-day revocation, quiet hours, do-not-call, reassigned numbers and list hygiene. Not legal advice.

Canonical: https://mobilevalidate.com/blog/tcpa-compliance-checklist-for-sms · Last updated: 2026-10-05

![A phone shows a STOP reply and a confirmation; a quiet-hours clock, a ten-day revocation counter, a do-not-call card and a checklist sit beside it.](https://mobilevalidate.com/images/blog/tcpa-compliance-checklist-for-sms.svg)

*Consent, opt-outs, ten-day revocation, quiet hours and reassigned numbers, checked before every campaign.*


By MobileValidate team (https://mobilevalidate.com/about) · Published: 2026-10-05 · Category: Guides · Tags: Tcpa, Compliance, SMS, Consent, Opt out, Reassigned numbers, US

TCPA compliance for SMS comes down to five habits: get the right consent for each kind of message, honour opt-outs in any reasonable form within ten business days, respect quiet hours and do-not-call lists, stop texting numbers that changed hands, and keep records that prove all of it. This checklist gives each item with its rule and date.

**This is not legal advice.** It summarises federal rules, FCC orders and one court decision as they stood in early October 2026. It doesn't cover state laws, several of which add their own telemarketing and texting rules. Consult your counsel before you rely on it.

## What does the TCPA cover for text messages?

The Telephone Consumer Protection Act of 1991, codified at 47 U.S.C. §227, restricts calls made with an automatic telephone dialing system or an artificial or prerecorded voice without the called party's prior express consent ([LII, 2026](https://www.law.cornell.edu/uscode/text/47/227)). The FCC applies these rules to autodialed texts, which its orders call "robotexts" ([FCC, 2024](https://docs.fcc.gov/public/attachments/FCC-24-24A1.pdf)).

The detailed rules sit in 47 CFR 64.1200 ([eCFR, 2026](https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200)). Two parts matter most to SMS senders:

- **Consent rules** in paragraph (a): what consent you need, and how people can take it back.
- **Telephone solicitation rules** in paragraphs (c) and (d): calling hours, the National Do-Not-Call Registry and your own do-not-call list. Paragraph (e) extends them to telemarketing text messages sent to wireless numbers.

The stakes are set by the statute. Private plaintiffs can recover $500 per violation, and a court may increase that to up to three times for wilful or knowing violations (§227(b)(3)). With thousands of messages per campaign, small process gaps add up.

## 1. Do you have the right consent for each message type?

Match the consent to the content. The rules distinguish two levels:

- **Prior express consent** is enough for autodialed informational texts, such as order updates or appointment reminders.
- **Prior express written consent** is needed for autodialed texts that contain advertising or telemarketing (64.1200(a)(2)). It is defined in 64.1200(f)(9): a written agreement, electronic signatures allowed, that names the number, authorises marketing messages and clearly states that signing isn't a condition of purchase.

Keep the consent record: the wording shown, the number, the date and time, the source (web form, keyword, paper) and the IP address or other evidence.

**What happened to "one-to-one consent"?** In 2023 the FCC adopted a rule requiring marketing consent to name one seller at a time. The Eleventh Circuit vacated that rule in *Insurance Marketing Coalition v. FCC* on 24 January 2025, holding that it went beyond the statute ([CA11, 2025](https://media.ca11.uscourts.gov/opinions/pub/files/202410277.pdf)). The court's mandate issued on 30 April 2025, and the FCC removed the text from its rules with effect from 29 August 2025 ([Federal Register, 2025](https://www.federalregister.gov/documents/2025/08/29/2025-16641/delete-delete-delete-targeting-and-eliminating-unlawful-text-messages-rules-and-regulations)). Lead-generation consent still has to be clear and specific enough to be defensible, so ask counsel how that applies to your forms.

## 2. Do you accept opt-outs in any reasonable form?

You must. The FCC's February 2024 consent order (FCC 24-24, adopted 15 February 2024) codified the right to revoke consent "using any reasonable method". Its main rules took effect on **11 April 2025** ([Federal Register, 2024](https://www.federalregister.gov/documents/2024/10/11/2024-23605/strengthening-the-ability-of-consumers-to-stop-robocalls)).

Under 64.1200(a)(10), a reply of **"stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe"** is a per se reasonable revocation. Other wording also counts if a reasonable person would understand it as a request to stop. You may not designate an exclusive way to opt out. Under 64.1200(a)(11), requests by other means, such as an e-mail or voicemail to your business, create a rebuttable presumption that consent was revoked.

Practical implications:

- Match opt-out keywords case-insensitively and allow extra words ("please stop texting me").
- Route free-text replies that look like refusals to a person or a classifier rather than ignoring them.
- If your texting channel can't receive replies, the rule requires a clear notice on each message and other ways to opt out, such as a phone number or link.
- Record opt-outs from every channel (support tickets, e-mail, calls) in one suppression list keyed on the E.164 number.

## 3. Do you honour revocations within ten business days?

The deadline is "a reasonable time not to exceed ten business days from receipt" (64.1200(a)(10)). The same ten-business-day limit applies to company-specific do-not-call requests under 64.1200(d)(3). Both have applied since 11 April 2025.

Ten business days is a ceiling, not a target. Automated keyword opt-outs should take effect before the next message is queued. Build a check that blocks sending to any number on your suppression list, and test it after every change to your messaging stack.

## 4. Is your confirmation text limited to one message?

You may send **one** text confirming the opt-out. Under 64.1200(a)(12), it must not contain marketing and must be the only extra message. If it goes out within five minutes of the request, it is presumed to be within the consumer's prior consent. Later ones need a showing that the delay was reasonable.

If the person had agreed to several kinds of messages, the confirmation may ask whether they want to stop all of them. Without a reply that says otherwise, you must stop every text that needs consent.

## 5. Are you ready for the "revoke all" rule?

Plan for it. FCC 24-24 also said that a revocation made in response to one kind of message applies to all future robocalls and robotexts from that caller on unrelated matters. That part of 64.1200(a)(10) has been waived twice. The Consumer and Governmental Affairs Bureau first delayed it to 11 April 2026 (DA 25-312, 7 April 2025). On 6 January 2026 it extended the waiver **until 31 January 2027** (DA 26-12), while the FCC reviews a further rulemaking record ([FCC, 2026](https://docs.fcc.gov/public/attachments/DA-26-12A1.pdf)).

The date may move again. Design your suppression data so that you can switch from "stop this programme" to "stop everything from us that needs consent" without a rebuild. Keep the message category on each opt-out record.

## 6. Do you respect quiet hours and do-not-call lists?

For telephone solicitations, which cover marketing texts, three rules apply:

- **Quiet hours:** no solicitations before 8 a.m. or after 9 p.m. in the recipient's local time (64.1200(c)(1)). Work out the local time from the recipient's location, not your own. Area codes are only a rough proxy when people move.
- **National Do-Not-Call Registry:** don't send solicitations to registered numbers unless an exception applies, such as the subscriber's signed, written agreement to be contacted by you that includes the number (64.1200(c)(2)(ii)).
- **Your own do-not-call list:** keep written procedures, train staff and record requests (64.1200(d)).

Some states set narrower hours or extra rules, which is another reason to involve counsel.

## 7. Do you check for reassigned numbers?

Consent belongs to a person, not to a number. When a number is disconnected and later given to someone else, your consent doesn't transfer. The FCC's Reassigned Numbers Database tells you whether a number was permanently disconnected since a given date. A wrong "no" answer can give you a narrow safe harbor under 64.1200(m). Our [Reassigned Numbers Database guide](/blog/reassigned-numbers-database-explained) explains the answers, costs and workflow.

## 8. Is your list clean before you send?

Hygiene doesn't replace consent, but it removes avoidable risk and cost:

- **Normalize to E.164 and dedupe**, so one person's number doesn't sit in your list three times with three consent states.
- **Check line type.** A landline can't receive SMS, and a number whose line type changed since collection deserves a second look. Our [carrier lookup](/services/carrier-lookup) and the bulk [US and Canada carrier lookup](/services/us-carrier-lookup) return line type and current carrier.
- **Suppress before you look up.** Apply opt-outs and do-not-call records first, so you don't process data for people who asked you to stop.
- **Re-check before each campaign.** Numbers change hands and types. A result from last quarter is stale.

MobileValidate doesn't provide consent management or Reassigned Numbers Database queries, and a lookup result is not proof of consent. Our checks help with the data-quality half: whether the number is possible, what kind of line it is and who serves it. Invalid and duplicate inputs are flagged for free, and inconclusive results aren't charged.

## 9. Does your programme follow carrier messaging rules too?

Carrier rules are separate from the TCPA but decide whether your messages arrive. The CTIA *Messaging Principles and Best Practices* (May 2023) ask senders to get opt-in consent, disclose programme details, support opt-out words such as STOP and send one final confirmation per campaign ([CTIA, 2023](https://api.ctia.org/wp-content/uploads/2023/05/230523-CTIA-Messaging-Principles-and-Best-Practices-FINAL.pdf)). On US long codes, that means registering your brand and campaign. Our upcoming guide to 10DLC registration covers the steps.

## What does the whole checklist look like?

| # | Item | Rule | In effect |
|---|---|---|---|
| 1 | Right consent per message type; records kept | 47 U.S.C. §227(b); 47 CFR 64.1200(a)(2), (f)(9) | Written-consent definition adopted in the FCC's 2012 order |
| 1a | One-to-one consent | Vacated, *IMC v. FCC* | Removed from rules 29 Aug 2025 |
| 2 | Any reasonable opt-out; STOP words per se | 64.1200(a)(10), (a)(11) | 11 Apr 2025 |
| 3 | Revocations honoured within 10 business days | 64.1200(a)(10), (d)(3) | 11 Apr 2025 |
| 4 | One confirmation text, no marketing | 64.1200(a)(12) | 4 Apr 2024 |
| 5 | Revocation applies to unrelated messages ("revoke all") | 64.1200(a)(10), waived | Delayed to 31 Jan 2027 (DA 26-12) |
| 6 | 8 a.m.–9 p.m. local; National DNC; company DNC list | 64.1200(c)(1), (c)(2), (d), (e) | Long-standing |
| 7 | Reassigned numbers checked | 64.1200(m) safe harbor | Database live since 1 Nov 2021 |
| 8 | List normalized, deduped, line type checked | Good practice | — |
| 9 | Carrier rules and 10DLC registration | CTIA principles (2023); carrier policies | Industry rules |

## What are the key takeaways?

- Match consent to content: written consent for autodialed marketing texts, and records for every consent.
- Accept opt-outs in any reasonable form, treat the seven listed words as automatic, and honour them within ten business days (in force since 11 April 2025).
- Send at most one non-marketing confirmation, ideally within five minutes.
- The "revoke all" requirement is waived until 31 January 2027. Store the message category on each opt-out so you can switch when it applies.
- Respect quiet hours and do-not-call lists, and check reassigned numbers before campaigns.
- Clean lists reduce risk but never replace consent. This checklist is guidance, not legal advice. Consult counsel.

## Sources

1. [47 U.S.C. 227 Restrictions on use of telephone equipment](https://www.law.cornell.edu/uscode/text/47/227) — Legal Information Institute, Cornell Law School, 2026
2. [47 CFR 64.1200 Delivery restrictions](https://www.ecfr.gov/current/title-47/chapter-I/subchapter-B/part-64/subpart-L/section-64.1200) — eCFR, US Government Publishing Office, 2026
3. [Rules and Regulations Implementing the TCPA, Report and Order (FCC 24-24)](https://docs.fcc.gov/public/attachments/FCC-24-24A1.pdf) — Federal Communications Commission, 2024
4. [Strengthening the Ability of Consumers To Stop Robocalls (final rule, 89 FR 15756, 2024-04587)](https://www.federalregister.gov/documents/2024/03/05/2024-04587/strengthening-the-ability-of-consumers-to-stop-robocalls) — Federal Register, 2024
5. [Strengthening the Ability of Consumers To Stop Robocalls (effective-date notice, 89 FR, 2024-23605)](https://www.federalregister.gov/documents/2024/10/11/2024-23605/strengthening-the-ability-of-consumers-to-stop-robocalls) — Federal Register, 2024
6. [Order extending the waiver of section 64.1200(a)(10) (DA 26-12)](https://docs.fcc.gov/public/attachments/DA-26-12A1.pdf) — Federal Communications Commission, Consumer and Governmental Affairs Bureau, 2026
7. [Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277](https://media.ca11.uscourts.gov/opinions/pub/files/202410277.pdf) — US Court of Appeals for the Eleventh Circuit, 2025
8. [Delete, Delete, Delete; Targeting and Eliminating Unlawful Text Messages (conforming rule, 2025-16641)](https://www.federalregister.gov/documents/2025/08/29/2025-16641/delete-delete-delete-targeting-and-eliminating-unlawful-text-messages-rules-and-regulations) — Federal Register, 2025
9. [Messaging Principles and Best Practices](https://api.ctia.org/wp-content/uploads/2023/05/230523-CTIA-Messaging-Principles-and-Best-Practices-FINAL.pdf) — CTIA, 2023

## Frequently asked questions

### Does the TCPA apply to text messages?

Yes, in the FCC's reading. The FCC's rules and orders apply the TCPA's robocall restrictions to autodialed texts, which it calls robotexts. The do-not-call rules in 47 CFR 64.1200(c) and (d) also cover telemarketing text messages to wireless numbers under paragraph (e).

### How fast must I honour a STOP reply?

Within a reasonable time, not more than ten business days from receipt, under 47 CFR 64.1200(a)(10), in effect since 11 April 2025. You may send one confirmation text, which is presumed fine if sent within five minutes.

### Which words count as an opt-out?

The rule lists stop, quit, end, revoke, opt out, cancel and unsubscribe as per se reasonable. Other wording also counts if a reasonable person would understand it as a request to stop.

### Is the one-to-one consent rule in force?

No. The Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC on 24 January 2025. The FCC removed the text from its rules with effect from 29 August 2025.

### Is this checklist legal advice?

No. It summarises federal rules and their dates as of early October 2026. State laws and your facts matter, so consult your own counsel.