Free SMS Compliance CheckerTCPA & 10DLC

What is the TCPA?

The Telephone Consumer Protection Act is a federal law passed in 1991 and enforced by the Federal Communications Commission, as well as through private lawsuits. It was written for the era of unwanted telemarketing calls, but courts have consistently extended it to text messages — a text is treated as a “call” for TCPA purposes.

In practice, the TCPA means three things for SMS: you need prior express written consent before sending marketing texts, you must give recipients a working way to opt out, and you can only send during permitted hours. “Prior express written consent” is a specific legal term — it means a clear, conspicuous disclosure that the person agreed to, in writing, that names your brand, says messages are automated, and states that consent isn't a condition of purchase.

The reason the TCPA gets so much attention is the math. Statutory damages are $500 to $1,500 per message, per recipient, with no cap. A sloppy campaign to a few thousand people is a genuine existential risk for a small business.

What is 10DLC?

10DLC stands for 10-Digit Long Code — the ordinary local phone numbers businesses use for application-to-person (A2P) texting. To send A2P traffic over 10DLC, you have to register through The Campaign Registry (TCR). It's a two-step process: first you register your brand (your business identity), then you register each campaign (each distinct messaging use case, with sample messages).

Registration isn't a nice-to-have. Since February 1, 2025, US carriers block 100% of unregistered 10DLC traffic. Brand registration is usually fast; campaign vetting can take days, and the sample messages you submit are compared against what you actually send — so your registered content and your live content need to match.

What are the CTIA Messaging Principles?

The CTIA — the wireless industry association — publishes the Messaging Principles and Best Practices. These are industry guidelines, not law, but carriers enforce them through message filtering, which makes them every bit as binding in practice. They cover sender identification, opt-out and HELP handling, frequency disclosure, content restrictions (SHAFT), and link practices. Violating CTIA guidelines doesn't get you sued — it gets your messages silently dropped before they ever reach a handset.

The SHAFT framework

SHAFT stands for Sex, Hate, Alcohol, Firearms, and Tobacco — content categories that carriers restrict on A2P messaging regardless of consent. In practice the restricted list also includes cannabis and CBD, payday loans and debt relief, and unlicensed gambling, all of which are ineligible for standard 10DLC campaigns. If your business operates in one of these categories, standard business SMS is not available to you — you need a specialized channel.

Required SMS opt-in language

Valid express written consent has specific ingredients. Your opt-in disclosure must name your brand, state that messages are automated, disclose the message frequency, include “Msg & data rates may apply”, say that consent is not a condition of purchase, and link to your Privacy Policy and Terms. Here's a gold-standard template you can adapt:

By checking this box, you agree to receive automated
marketing text messages from [Business Name] at the
phone number provided. Consent is not a condition of
purchase. Up to [N] msgs/month. Msg & data rates may
apply. Reply STOP to unsubscribe, HELP for help.
View our Privacy Policy [link] and Terms [link].

Required opt-out keywords

Carriers expect a specific set of opt-out keywords to work on every program: STOP, UNSUBSCRIBE, CANCEL, END, and QUIT. STOP is the universal one and should appear in your message copy. The opt-out has to be free and text-based — you can't require a phone call or a website visit — and your program must also respond to HELP with support information.

The FCC one-to-one consent rule (effective Jan 27, 2026)

The FCC's one-to-one consent rule closes the “lead generator loophole.” Before it, a single checkbox could capture consent that was shared across dozens of “partners.” Now, consent must go to one clearly identified seller at a time, and the message must be logically related to the site where consent was obtained. If your opt-in language says “and our partners” or “select third parties,” it no longer produces valid consent. Lead-generation businesses, affiliate marketers, and multi-brand campaigns are the most affected.

Quiet hours

The TCPA limits solicitation messages to 8 AM–9 PM in the recipient's local time zone — not yours. That means timezone-aware sending logic isn't optional: a 9 PM Eastern send is already a violation for anyone on the West Coast if your system didn't adjust. Build your scheduler to message each recipient inside their own window.

State-level “mini-TCPA” laws to know

• Texas SB 140 — brings text messages under the Texas telemarketing statute, with treble-damages exposure for violations.
• Virginia SB 1339 — requires opt-out records to be retained for 10 years.
• Florida FTSA — imposes a stricter prior-express-written-consent standard than the federal TCPA, and has driven a wave of class actions.

How to fix a failing SMS in 60 seconds

1. Run it through the checker above and read the flagged issues.
2. Add a clear opt-out: “Reply STOP to opt out.”
3. Identify your brand in the message body.
4. Add or fix your frequency and “Msg & data rates” disclosure at opt-in.
5. Replace any bit.ly or public shortener with a branded HTTPS link.
6. Re-run the checker and confirm the score moved into the green.