What Is the TCPA? A Complete Guide for SMS Marketing Compliance

If your business sends marketing text messages, you've probably heard of the Telephone Consumer Protection Act (TCPA). But what exactly is it, and why does it matter?

The TCPA is the primary U.S. law governing SMS marketing. It sets rules around who you can text, when you can text them, and how you must collect consent before sending automated marketing messages. Following the TCPA helps protect consumers from unwanted texts—and helps businesses avoid costly lawsuits and carrier penalties.

In this guide, we'll explain what the TCPA is, how it applies to SMS marketing, and the best practices every ecommerce brand should follow.

The Telephone Consumer Protection Act (TCPA) is a federal law passed by Congress in 1991 to regulate telephone and automated messaging communications, including SMS marketing.

Today, the TCPA governs how businesses send promotional text messages using automated platforms. Its core principle is simple:

Consumers have the right not to receive unsolicited marketing text messages. Businesses must obtain prior express written consent before sending automated marketing SMS.

The law is enforced by the Federal Communications Commission (FCC), while wireless carriers also enforce additional industry requirements through CTIA messaging guidelines. Together, these rules help maintain consumer trust in SMS as a communication channel.

SMS consistently delivers some of the highest engagement rates of any marketing channel, but it's also one of the most regulated.

Failing to comply with the TCPA can result in:

• Lawsuits from consumers

• Statutory damages of $500–$1,500 per violating message

• Carrier filtering or blocking of your messages

• Suspension of your SMS program

• Damage to your brand reputation

For brands investing in SMS marketing, compliance isn't optional—it's essential.

While the law contains many details, most ecommerce brands should focus on several core requirements.

Before sending automated promotional text messages, you must receive prior express written consent from each subscriber.

Consent should clearly state that the consumer agrees to receive recurring automated marketing messages. It also needs to explain that:

• They are consenting to receive marketing text messages

• At the phone number they have provided

• Using an automatic dialer

• Consent is not a condition of purchase.

These disclosures should appear anywhere someone signs up for SMS, including:

• Website popups

• Checkout opt-ins

• Landing pages

• Social media promotions

• QR codes

• Email signup links

• Printed marketing materials

In addition to the TCPA, brands must also comply with additional requirements imposed by the CTIA on behalf of wireless carriers.  Your signup forms should include TCPA and CTIAcompliant language informing subscribers exactly what they're agreeing to receive.

A compliant disclosure typically includes:

• Consent to receive recurring automated marketing SMS

• Notice that consent isn't required to purchase

• Message and data rate disclosure

• Message frequency disclosure

• STOP and HELP instructions

• Agreement to your Terms of Service and Privacy Policy

If your Terms or Privacy Policy can't be hyperlinked, include the full URLs so customers can easily access them.

Every marketing message should make it easy for subscribers to stop receiving texts.

Common opt-out keywords include:

• STOP

• UNSUBSCRIBE

• CANCEL

• QUIT

• END

• REVOKE

• OPT OUT

Once someone opts out, businesses must stop sending marketing messages to that subscriber. Most modern SMS platforms automate this process.

As a matter of courtesy to your customers, marketing texts should only be sent during reasonable hours.

This generally means limiting marketing messages to 8:00 a.m.–9:00 p.m.. These rules are generally voluntarily when a consumer has provided their prior consent to receive text messages, nevertheless SMS marketers should do their best to respect these times and any applicable state-level requirements.

Prior express written consent means a consumer has actively agreed to receive marketing text messages before you send them.

A compliant consent process typically includes:

• The customer voluntarily enters their phone number.

• Required disclosures are displayed before signup.

• The customer takes an affirmative action, such as clicking a button or checking an unchecked box.

• Your Terms of Service and Privacy Policy are accessible from the signup form.

Simply having someone's phone number or email address does not give permission to send promotional SMS messages.

While not universally required by the TCPA, double opt-in is widely considered a best practice.

With double opt-in, including Postscript’s patented Onstite Opt-in, subscribers confirm their intent by replying to a confirmation text or entering a verification code after signing up.

Benefits include:

• Verifying that the phone number belongs to the subscriber

• Reducing accidental signups

• Creating stronger records of consent

• Improving subscriber quality

• Reducing compliance risk

• Increasing the likelihood the court will enforce your terms of service, including any class action waiver and mandatory arbitration provisions it may include

Many marketers confuse TCPA and CTIA, but they serve different purposes.

Successful SMS programs follow both TCPA requirements and CTIA guidelines.

Many compliance violations happen unintentionally. Common mistakes include:

• Sending texts before obtaining proper consent

• Missing or incorrect opt-in disclosures

• Using pre-checked signup boxes

• Forgetting to include Terms of Service and Privacy Policy links or not presenting them in a way that will not result in the Terms of Service creating a binding agreement, preventing enforcement of arbitration provisions and class action waiver

• Continuing to message someone after they've opted out

• Texting outside permitted hours

• Assuming email consent also covers SMS marketing

Building compliance into every subscriber touchpoint helps reduce these risks.

Brands should treat compliance as an ongoing process—not a one-time setup.

Some best practices include:

• Collect consent at every SMS entry point using compliant disclosures.

• Maintain records of subscriber consent.

• Use double opt-in whenever possible.

• Honor STOP requests immediately.

• Include required disclosures on all signup forms.

• Link your Terms of Service and Privacy Policy and present them in a way that results in a binding agreement.

• Stay informed about evolving federal, state, and carrier requirements.

TCPA stands for the Telephone Consumer Protection Act, a U.S. federal law regulating telemarketing calls and automated text message marketing.

Yes. Some parts of the  TCPA apply to automated marketing text messages and a combination of state and federal law and CTIA requirements means businesses must obtain prior express written consent before sending promotional SMS campaigns.

Not necessarily. A purchase alone does not automatically authorize promotional SMS marketing. Businesses generally need prior express written consent before sending automated marketing texts.

Double opt-in is not universally required under the TCPA, but it is considered a strong compliance best practice because it verifies subscriber intent and creates better documentation of consent.

Violations can lead to consumer lawsuits, statutory damages ranging from $500 to $1,500 per violating message, and potential carrier enforcement actions that affect message deliverability.

The TCPA exists to protect consumers and preserve trust in SMS as a marketing channel. For ecommerce brands, following the law isn't just about avoiding penalties—it's about building a sustainable, high-performing SMS program.

By collecting proper consent, using compliant opt-in language, honoring opt-out requests, and following both TCPA and CTIA requirements, brands can confidently grow their SMS marketing while maintaining customer trust and protecting long-term deliverability.

The TCPA and FCC guidance generally recommend that marketing text messages only be sent during a subscriber's waking hours. As a baseline, this means 8:00 a.m. to 9:00 p.m. in the recipient's local time zone, but several states have adopted stricter requirements.

SMS quiet hours are the times when businesses should avoid sending promotional text messages to subscribers. Federal TCPA guidance generally recommends sending marketing texts only between 8:00 a.m. and 9:00 p.m. in the recipient's local time zone, while several states have stricter requirements. Many brands follow a 9:00 a.m.–8:00 p.m. sending window nationwide to simplify compliance. Modern SMS platforms like Postscript automatically delay campaigns and automations that would otherwise send during quiet hours.

Differences by state:

• Florida, Connecticut, Maryland, Oklahoma, and Washington limit marketing messages to 8:00 a.m.–8:00 p.m.

• New Jersey permits messages between 8:00 a.m. and 9:00 p.m.

• Texas has unique quiet hours of 9:00 a.m.–9:00 p.m. Monday through Saturday and 12:00 p.m.–9:00 p.m. on Sundays, although consent-based messaging is treated differently under Texas law and Postscript provides optional enforcement settings for merchants.

Because state laws continue to evolve, many compliance experts recommend using a more conservative nationwide sending window of 9:00 a.m.–8:00 p.m. local time whenever possible.

Postscript includes built-in safeguards that help merchants avoid sending promotional SMS during quiet hours. Depending on the message type:

• Campaigns scheduled during quiet hours are delayed until the next permitted sending window.

• Automation messages (such as abandoned cart or browse abandonment flows) triggered during quiet hours are automatically held until waking hours begin in the subscriber's local time zone.

• Subscribers can still receive required transactional messages, such as opt-in confirmations and opt-out confirmations, even during quiet hours when required by law.

While these automated protections are valuable, brands remain responsible for ensuring their SMS program complies with all applicable federal and state regulations.