SMS compliance — TCPA, opt-in requirements, and best practices
Sending business text messages in the United States is governed by federal law, carrier policies, and industry standards. Non-compliance can result in lawsuits, fines of 500−1,500 per unsolicited message, and permanent carrier blocking. This guide covers everything you need to stay compliant when sending SMS through the HoopAI platform.
The Telephone Consumer Protection Act (TCPA) is the primary federal law governing text messaging and telemarketing in the United States. Enacted in 1991 and updated multiple times, it applies to any message sent using an autodialer or prerecorded/artificial voice — which includes virtually all messages sent through the HoopAI platform.
No messages before 8 AM or after 9 PM (recipient’s local time)
Identification
Messages must identify the sender
Record keeping
Maintain proof of consent for each contact
TCPA violations carry penalties of 500perunsolicitedmessage∗∗andupto∗∗1,500 per message for willful violations. A single campaign sent to 1,000 contacts without consent could expose your business to $1.5 million in statutory damages. Class action lawsuits for TCPA violations regularly result in multi-million dollar settlements.
Clear disclosure that the person agrees to receive text messages
Identity of the sender — your business name
Description of messages — what type of texts they will receive
Frequency disclosure — how often (e.g., “up to 4 messages per month”)
Message and data rates — “Msg & data rates may apply”
Opt-out instructions — “Reply STOP to unsubscribe”
Consent is not a condition of purchase — must be stated explicitly
Signature — physical signature, e-signature, or checkbox click (with timestamp)
Example opt-in disclosure:
By checking this box, you agree to receive marketing text messages from [Business Name] at the phone number provided. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe. Reply HELP for help. [Privacy Policy link] [Terms link]
The most common and most defensible opt-in method:
Add a separate, unchecked checkbox for SMS consent (do not bundle with email consent)
Include full disclosure text near the checkbox
Log the timestamp, IP address, and form URL for each opt-in
Link to your privacy policy and terms of service
Example web form with SMS opt-in checkbox and required disclosure language
Do not pre-check the SMS consent checkbox. Pre-checked boxes do not constitute valid consent under TCPA.
In the HoopAI platform, use a custom field checkbox on your forms and map it to a consent-tracking field on the contact record. This creates an auditable consent trail.
Contacts text a keyword to your number to opt in:
Advertise the keyword (e.g., “Text JOIN to (555) 123-4567 to receive updates from [Business Name]. Msg & data rates may apply. Reply STOP to opt out.”)
When they text the keyword, auto-reply with a confirmation message:
“[Business Name]: You’re now subscribed to our updates! Msg frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe. Reply HELP for support.”
Log the opt-in with timestamp and phone number
This creates clear evidence of consent since the contact initiated the interaction.
For in-person opt-ins (events, retail, appointments):
Include the full SMS disclosure on the form
Have the contact sign and date next to the SMS consent section
Scan and store the signed form digitally
Enter the contact and opt-in record into the HoopAI platform
After any initial opt-in, send a confirmation text:
“[Business Name]: Reply YES to confirm you’d like to receive text messages from us. Msg & data rates may apply. Reply STOP to cancel.”
Only add the contact to your SMS campaigns after they reply YES. This provides the strongest legal protection and is recommended for marketing campaigns.
Verbal consent is valid for transactional messages only (not marketing):
Acceptable when a customer provides their phone number during a conversation
You must record the call and retain the recording
The script must clearly state the person is consenting to receive text messages
Document the date, time, and context of the verbal consent
Verbal consent does not meet the “written” requirement for marketing messages
When a contact replies with an opt-out keyword, the platform automatically sends a confirmation:
“You have been unsubscribed and will not receive any more messages from this number. Reply START to resubscribe.”
The HoopAI platform handles opt-out keyword processing automatically. When a contact replies STOP (or any opt-out keyword), they are added to the Do Not Disturb (DND) list and no further messages will be sent.
Every marketing message must include opt-out instructions. Best practice is to include them in every message:
“Reply STOP to unsubscribe”
This can be placed at the end of the message. For recurring message programs, include it at least once per month even in transactional messages.
Do not attempt to override or work around DND status. Sending messages to a contact who has opted out is a direct TCPA violation and can result in legal action and platform suspension.
A contact who previously opted out can re-subscribe only through their own action:
The contact texts START, YES, or UNSTOP to your number
The platform removes the SMS DND flag
A confirmation message is sent
The re-opt-in is logged with a timestamp
You cannot re-subscribe a contact manually or through a workflow. The contact must initiate the re-opt-in themselves by texting your number. Only remove DND manually if the contact has explicitly requested to resubscribe through another channel (email, phone call, in person) and you document it.
Carriers prohibit SHAFT content on standard messaging campaigns:
Category
Examples
S — Sex/sexual content
Adult content, dating services with explicit content
H — Hate/harassment
Discriminatory content, threats, harassment
A — Alcohol
Alcohol sales, promotions, or advertising
F — Firearms
Gun sales, ammunition, weapons
T — Tobacco/cannabis
Tobacco products, vape, cannabis, CBD
Some SHAFT categories can be sent through special campaign types with age-gating and additional carrier approval, but standard A2P 10DLC campaigns cannot include this content.
Even with proper A2P registration and consent, carriers may still filter messages. Common triggers:
Trigger
Why it happens
How to avoid
URL shorteners (bit.ly)
Associated with spam and phishing
Use your branded domain for links
High-frequency sending
Sudden spikes look like spam
Ramp up gradually
Identical messages to many recipients
Pattern matches spam behavior
Personalize messages with contact fields
ALL CAPS
Spam signal
Use normal capitalization
Special characters / emojis overuse
Can trigger filters
Use sparingly
”Free”, “Winner”, “Prize”
Spam keywords
Avoid or rephrase
Unregistered number
No A2P 10DLC
Complete registration
Shared short link domains
Flagged across many senders
Use your own custom tracking domain
High opt-out rates
Indicates unwanted messaging
Only message opted-in contacts; provide value
Number warm-up strategy: When you activate a new phone number, start with low-volume, high-engagement messages (appointment confirmations, direct replies). Gradually increase volume over 2-4 weeks before using it for marketing campaigns.
Maintaining thorough consent records is your primary defense in a TCPA dispute. If you cannot prove consent existed, the law presumes it did not.
Record
Retention period
Details
Opt-in timestamp
5+ years
When consent was given
Opt-in method
5+ years
Web form, keyword, paper, verbal
Opt-in source URL / form
5+ years
Which form, URL, or campaign
IP address (web forms)
5+ years
For web-based opt-ins
Exact consent language
5+ years
The disclosure text shown at time of opt-in
Opt-out timestamp
5+ years
When they opted out
Message logs
5+ years
Content and delivery status
Double opt-in confirmation
5+ years
Timestamp of YES reply
The TCPA statute of limitations is 4 years. Retain all consent records for a minimum of 5 years from the date of the last message sent to that contact. Many compliance attorneys recommend 6 years to account for delayed claims.
Use custom fields on the HoopAI contact record to store consent metadata (date, source, method). Tag contacts with their consent type so you can segment and audit your lists.
Can I text someone who gave me their business card?
Having someone’s phone number does not equal SMS consent. A business card exchange gives you permission to call them (arguably), but not to send automated text messages. You need explicit opt-in for SMS, ideally in writing for marketing messages.
Do I need consent for appointment reminders?
Yes, but only express consent (not written consent). When a contact provides their phone number during booking, that generally constitutes express consent for transactional messages like appointment reminders. However, you cannot use that same consent to send promotional messages. Always include opt-out instructions.
Can I text existing customers without opt-in?
Having a customer relationship does not automatically grant SMS consent. You need at minimum express consent (they knowingly provided their phone number) for transactional messages, and express written consent for marketing. Obtain explicit opt-in from all contacts.
Can I buy a phone number list and text them?
Absolutely not. Purchased lists have no consent whatsoever. Texting a purchased list is one of the most common and most expensive TCPA violations. There is no shortcut — you must build your own opted-in list.
What if a contact replies STOP and then wants to resubscribe?
They can text START, YES, or UNSTOP to your number to resubscribe. The platform will automatically remove the DND flag. You can also manually remove DND status from their contact record if they request resubscription through another channel — but document the request.
Are automated workflow messages subject to TCPA?
Yes. Every SMS sent from your business, whether manual or automated through workflows, is subject to TCPA. In fact, automated messages are more regulated because they are sent via an autodialer by definition. Ensure every workflow that sends SMS only targets contacts with valid consent.
Do these rules apply to messages sent through the mobile app?
Yes. Messages sent through the HoopAI mobile app are sent through the same phone system and are subject to all the same compliance requirements.
What if a contact opts out by saying something other than STOP?
The platform automatically handles standard opt-out keywords (STOP, UNSUBSCRIBE, CANCEL, END, QUIT). If a contact sends a non-standard message like “please don’t text me anymore,” the system may not catch it automatically. Train your team to manually apply DND status when they see any opt-out intent in conversations.
Is there a difference between SMS and MMS compliance?
No. MMS (picture messages) are subject to the same TCPA, A2P, and carrier compliance requirements as SMS text messages.
What about text messages to Canadian numbers?
Canada is governed by CASL (Canadian Anti-Spam Legislation), not TCPA. CASL has similar consent requirements but different enforcement. If you message Canadian contacts, research CASL requirements separately. Other countries have their own regulations (GDPR for the EU, PECR for the UK, etc.).
Can I send political campaign messages?
Political messages have some TCPA exemptions but still require consent and are subject to carrier filtering. A2P 10DLC has specific political campaign use cases. Consult a compliance attorney for political messaging.
How long is SMS consent valid?
TCPA does not specify an expiration for consent, but industry best practice is to consider consent stale after 18-24 months of no interaction. Re-confirm consent periodically for contacts who have not engaged.
When you register a new A2P 10DLC campaign or activate a new phone number, your messaging throughput starts at a lower limit and increases over time as your sender reputation builds.
Recent carrier and regulatory updates affecting SMS compliance:
FCC one-to-one consent rule (effective 2025): Consent must be specific to the sender. Consent given to a lead generator does not transfer to the buyer of the lead.
Increased carrier filtering: Carriers are using AI to detect spam patterns. Messages with identical content sent to large lists are more likely to be filtered.
Short link restrictions: Major carriers block common URL shorteners (bit.ly, tinyurl.com). Use your own branded domain for links.
10DLC throughput tiers: The Campaign Registry has updated trust scores and throughput limits. Higher trust scores are awarded to brands with verified identities and clean sending histories.
