SMS Marketing Compliance: TCPA, GDPR, and Consent Best Practices

SMS marketing has some of the highest engagement rates in digital marketing. It also has some of the most consequential compliance requirements. The difference between a compliant SMS programme and a non-compliant one is not just a legal technicality — the fines for TCPA violations in the United States run up to $1,500 per message per recipient, and enforcement actions against brands that ignore consent requirements have resulted in settlements in the tens of millions of dollars.

Before you send your first promotional text, you need to understand the regulatory framework your programme operates within. This guide covers the key requirements in the US and UK/EU markets, the specific consent rules that govern how you collect numbers, how opt-outs must be handled, and how the leading SMS platforms support compliance.

TCPA Compliance in the United States

The Telephone Consumer Protection Act (TCPA) is the primary regulatory framework governing SMS marketing in the United States. Enforced by the Federal Communications Commission (FCC), TCPA violations are one of the most litigated areas of digital marketing law.

TCPA requires that you obtain “prior express written consent” before sending marketing text messages to US consumers. This consent must be:

In writing (which includes electronic forms, checkboxes, and digital signatures)
Clearly and conspicuously disclosed — the consumer must understand they are agreeing to receive marketing texts from your brand
Signed by the consumer
Not a condition of purchasing any product or service

The disclosure accompanying the consent must clearly state that they are agreeing to receive automated marketing texts, must identify your brand by name, and must include the message frequency (or state that frequency may vary). It must also include any applicable message and data rate disclosures.

A compliant form might read: “By checking this box, you agree to receive marketing text messages from [Brand Name] at the number provided. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe.”

Opt-Out Handling

Once a consumer sends STOP (or any recognised opt-out keyword), you must stop sending them marketing messages within a reasonable time frame. Most platforms process opt-outs in real time. If a consumer who has previously opted out attempts to opt back in, that new consent is valid and you may resume sending.

The required opt-out keywords include STOP, QUIT, END, CANCEL, and UNSUBSCRIBE. Your programme must honour all of them, regardless of which keyword the consumer uses.

Quiet Hours

TCPA also governs the timing of SMS messages. In the absence of state-specific rules, federal guidelines discourage sending before 8:00 AM or after 9:00 PM in the recipient’s local time zone. Several US states have stricter quiet hour rules — California, Florida, and Texas have been active in SMS enforcement — and your platform should be configured to respect time zone-based quiet hours automatically.

For brands marketing to consumers in the United Kingdom or European Union, GDPR (and in the UK, the UK GDPR as retained post-Brexit) governs SMS marketing in combination with the Privacy and Electronic Communications Regulations (PECR).

Under GDPR, consent must be freely given, specific, informed, and unambiguous. For SMS marketing, this means:

The subscriber must actively opt in — pre-ticked boxes are not valid consent
The purpose of the processing must be clearly stated (e.g., “to send you marketing offers via text message”)
Consent must be separate from other terms and conditions — bundling SMS consent into your general terms of service is not sufficient
You must be able to demonstrate that consent was given — this is the accountability principle under GDPR

Legitimate interest is not an available basis for direct marketing SMS messages under PECR. Consent is required.

Right to Erasure and Data Minimisation

GDPR’s right to erasure means that consumers can request that you delete their personal data, including their phone number. Your SMS programme must have a process for handling erasure requests and removing contacts from both your active list and your records within 30 days of a valid request.

Data minimisation means you should only collect and retain the phone number information that is actually necessary for your SMS programme. Collecting additional personal data (demographic information, purchase preferences) requires a separate justification under GDPR.

Under GDPR, you must be able to demonstrate the consent you obtained — not just claim it exists. Your SMS platform or CRM should store a consent record for each subscriber that includes: when consent was obtained, what method was used (which form or opt-in mechanism), and what the consent disclosure said at the time.

Double Opt-In for SMS

Double opt-in for SMS is a two-step consent process: the consumer first submits their phone number, then receives a confirmation text asking them to reply YES (or similar) to confirm their subscription.

The Case For Double Opt-In

Double opt-in eliminates typos and invalid numbers before they enter your list — receiving an SMS confirmation at their number confirms the consumer has access to that specific phone. It also provides a stronger consent record, which is valuable for both compliance documentation and deliverability with carriers.

In terms of list quality, double opt-in SMS programmes consistently show higher engagement rates than single opt-in, because every subscriber has taken two deliberate steps to join.

The Case Against Double Opt-In

The primary argument against double opt-in is volume reduction. Brands typically see 20-35% fewer confirmed subscribers through double opt-in compared to single opt-in. For brands prioritising rapid list growth, this can feel like a significant cost.

For most brands, especially those operating in regulated markets or those with premium customer bases, the quality improvement and reduced compliance risk of double opt-in outweighs the volume reduction.

Platform-Level Compliance Tools

The major SMS marketing platforms have invested significantly in compliance infrastructure. Understanding what your platform handles automatically versus what requires manual configuration is important.

Klaviyo SMS

Klaviyo’s built-in SMS compliance features include automatic opt-out keyword handling (STOP, QUIT, END, CANCEL, UNSUBSCRIBE), quiet hour enforcement by time zone, and consent data storage on subscriber profiles. Klaviyo is a registered 10DLC sender in the US, which is required for commercial SMS sending on major carriers.

Klaviyo also provides GDPR-relevant features including consent timestamps on profiles and data deletion capabilities through their data privacy API.

Postscript

Postscript is a dedicated SMS marketing platform with strong US compliance tooling. It handles opt-out keywords, quiet hours, and TCPA-required disclosures as part of its opt-in flow templates. Postscript also provides compliance-focused onboarding documentation and maintains updated guidance as TCPA regulations evolve through FCC rulemaking.

Attentive

Attentive offers a “two-tap” mobile opt-in experience specifically designed for TCPA compliance — the two-step process is both legally sound and optimised for conversion. Attentive also manages 10DLC registration and carrier compliance on behalf of its customers.

Consequences of Non-Compliance

The consequences of operating a non-compliant SMS programme range from expensive to catastrophic, depending on the scale of the violation.

At the platform level, consistent opt-out keyword violations or excessive spam complaints will result in your shortcode or long code being suspended by carriers, shutting down your ability to send SMS entirely.

At the regulatory level, the TCPA’s $500-$1,500 per-violation penalty structure means that a single campaign sent to a list that includes non-consented numbers can generate liability at scale. Class action TCPA lawsuits have become a significant risk for brands with sloppy consent practices — plaintiffs’ attorneys have recognised the per-message penalty structure as a reliable basis for large settlements.

Under GDPR, fines of up to 4% of annual global turnover or €20 million (whichever is higher) are available for serious violations, though regulators have generally focused on larger enterprises for the highest penalties.

The bottom line: the compliance investment required to run an SMS programme correctly is small compared to the risk exposure of running one incorrectly. Build the consent capture, documentation, and opt-out infrastructure properly from day one.

At Excelohunt, every SMS programme we build is designed with compliance as a foundation, not an afterthought. We configure consent capture, double opt-in flows, quiet hour rules, and opt-out handling correctly before the first message is sent — and we keep programmes updated as regulatory requirements evolve.

Looking to implement these strategies with expert support?

SMS Marketing — learn how we implement this for clients Book a free strategy call with Excelohunt →

SMS Marketing Compliance: TCPA, GDPR, and Consent Best Practices