TCPA Compliance Checklist: Avoid Costly Fines in 2026

By SalesCaptain Team · Updated October 20, 2026

One unsolicited text to the wrong person can cost you. We’re talking $500 to $1,500 per violation. Multiply that across a batch of promotional texts, and you’re looking at six-figure penalties before you even realize there’s a problem. A solid TCPA compliance checklist isn’t just nice-to-have for service businesses that rely on calls and texts to reach customers. It’s the difference between growing your revenue and funding someone else’s lawsuit. Sound familiar?

A TCPA compliance checklist is a set of required procedures to follow federal Telephone Consumer Protection Act regulations when contacting customers by phone, text, or fax. It helps businesses avoid $500-$1,500 per-violation penalties by ensuring all communications have proper consent, accurate caller ID, and correct opt-out mechanisms.

What Is TCPA Compliance?

The Telephone Consumer Protection Act (TCPA) is a federal law passed in 1991. It governs how businesses can contact consumers by phone, text, and fax. Originally designed to curb aggressive telemarketing, its reach now covers virtually any business communication sent to a mobile phone—including appointment reminders, promotional offers, and follow-up texts. The Federal Communications Commission (FCC) enforces the TCPA and regularly updates its rules to reflect how modern businesses communicate.

TCPA compliance means your business follows every rule around consent, calling hours, opt-out procedures, and record-keeping before reaching out to customers. Violations get enforced two ways: through FCC action and private lawsuits. The second one’s where most businesses get burned. Plaintiffs’ attorneys actively seek out non-compliant businesses because statutory damages are so high. So even if you’re a five-person plumbing company sending text reminders, these rules apply to you.

Why TCPA Compliance Matters More Than Ever for Service Businesses

Service businesses rely heavily on outbound communication. You’re texting appointment confirmations, sending promotional blasts to past customers, and following up with leads who filled out a form on your website. Every single one of those touchpoints falls under TCPA regulation. And the enforcement environment’s gotten stricter. What does that look like in practice?

The FCC’s 2024 ruling closed the “lead generator loophole.” It previously allowed businesses to rely on broad, bundled consent obtained by third-party lead forms. Now, consent must be one-to-one. A consumer has to agree to hear from your specific business, not a list of ten companies at once. Fenwick’s analysis of the shifting telemarketing landscape breaks down how these changes affect businesses buying leads from aggregators.

The Financial Risk Is Real

TCPA lawsuits aren’t rare anymore. They’re one of the most common types of class action litigation in the United States. Statutory damages range from $500 per violation for negligent conduct to $1,500 per willful violation. Here’s the thing: a “violation” is each individual call or text, not each campaign. That means a single SMS blast to 2,000 people without proper consent could expose your business to $1 million or more in liability.

Beyond lawsuits, carriers themselves are cracking down. Major carriers now filter messages aggressively, and businesses that don’t follow proper registration and consent protocols often find their texts blocked entirely. Your messages simply never arrive. And you don’t get notified.

The Complete TCPA Compliance Checklist

Here’s what your business needs in place. This checklist covers both calls and text messages, since most service businesses use both channels. Print it, share it with your team, and audit against it quarterly.

1. Get Proper Consent Before Every Contact

Consent is everything. It’s the foundation of TCPA compliance. Without it, nothing else matters. There are two types you need to understand:

• Express consent: Required for informational messages like appointment reminders and delivery notifications. The customer provides their phone number voluntarily, knowing you’ll contact them.
• Express written consent: Required for marketing and promotional messages. The customer must sign (or e-sign) a clear disclosure that specifically authorizes your business to send marketing texts or make promotional calls using automated technology.

Your consent language can’t be buried in a terms-of-service document. It must be conspicuous, and it must clearly identify your business by name. The Sinch US SMS Compliance Guide provides detailed examples of compliant opt-in language you can model.

2. Store and Maintain Proof of Consent

Getting consent means nothing if you can’t prove it later. Every consent record should include:

• The date and time consent was given
• The method (web form, in-person signature, text keyword opt-in)
• The exact language the customer agreed to
• The phone number associated with the consent
• The IP address or device identifier if captured digitally

Keep these records for at least five years. In a TCPA lawsuit, the burden of proof falls on your business. No consent record? Courts typically side with the plaintiff.

3. Write Clear, Compliant Disclosure Language

Your opt-in disclosure must tell the customer exactly what they’re agreeing to. Vague language like “we may contact you” isn’t enough. A compliant disclosure should include:

• Your business name
• The type of messages they’ll receive (promotional, transactional, or both)
• The approximate frequency of messages
• A statement that message and data rates may apply
• Instructions on how to opt out (e.g., “Reply STOP to cancel”)
• A link to your privacy policy

Don’t make consent a condition of purchase. The TCPA explicitly prohibits requiring customers to agree to marketing texts as a prerequisite for buying your service.

4. Honor Opt-Out Requests Immediately

When someone replies STOP, texts “unsubscribe,” or asks verbally to be removed from your list, you must stop contacting them right away. “Right away” means within the same business day at most, and ideally within minutes. Your system should handle this automatically.

Also track opt-outs permanently. A customer who opted out three years ago and never opted back in? They’re still opted out. Re-adding them to a list without fresh consent is a violation.

5. Respect Calling and Texting Hours

Federal TCPA rules restrict telemarketing calls to between 8:00 AM and 9:00 PM. But here’s the catch: it’s the recipient’s time zone. Many states have even narrower windows. This state-by-state TCPA reference shows the variations, and some states restrict calls to as late as 9 AM start times or as early as 8 PM cutoffs.

While the TCPA doesn’t explicitly define texting hours the same way it does calling hours, courts have increasingly applied the same standard. Sending a promotional text at 10 PM is asking for trouble.

6. Scrub Against the Do Not Call Registry

Before making outbound sales or marketing calls, check your list against the National don’t Call Registry. You must also maintain your own internal DNC list of people who’ve asked not to be called. Scrub against both lists at least every 31 days.

7. Register for 10DLC (Text Messaging)

If you’re sending business text messages from a standard 10-digit phone number, carriers now require 10DLC registration. This process verifies your business identity and the types of messages you send. Without it, your messages may be filtered or blocked entirely, and you could face carrier-level penalties on top of TCPA exposure.

Common TCPA Mistakes That Service Businesses Make

Even well-intentioned businesses trip up. Here are the patterns that lead to complaints and lawsuits most often:

• Buying lead lists and texting them immediately. Purchased lists almost never include valid TCPA consent for your specific business. The 2024 FCC ruling makes this even riskier.
• Using a customer’s phone number from a job booking to send marketing texts. Consent to receive an appointment reminder doesn’t equal consent to receive a summer promotion.
• Not training staff on opt-out handling. If a customer tells your receptionist “stop calling me” and no one logs it, you’re exposed.
• Relying on a single blanket consent form. Consent should be specific to message type and channel. A consent for phone calls doesn’t cover text messages.

Consumer complaints about unwanted calls and texts remain consistently high. Research from the Public Interest Network documents just how frustrated consumers have become with unsolicited outreach. That frustration fuels both regulatory action and private lawsuits.

How SalesCaptain Helps

Following a TCPA compliance checklist is much easier when your communication platform is built with compliance guardrails from the start. SalesCaptain’s AI Phone Agent and AI Chat Agents handle inbound communication, meaning customers are contacting you first. That naturally reduces TCPA risk compared to cold outbound campaigns.

For outbound messaging, SalesCaptain’s Workflow Automation lets you build trigger-based follow-ups that only fire after a customer takes a specific action. Like submitting a form or completing a booking. Because these workflows are tied to customer-initiated events, they align with how consent should work under the TCPA. Your Unified Inbox keeps every interaction—across calls, texts, webchat, and social DMs—in one place with full contact history, making it straightforward to verify when and how a customer engaged with your business.

SalesCaptain’s AI Summaries and Transcriptions create automatic records of every call. You’ll know what was discussed and any opt-out requests made verbally. Instead of relying on staff memory, you’ve got a searchable transcript that documents the conversation. That kind of record-keeping is exactly what you need if a consent question ever comes up.

Key Takeaways

A thorough TCPA compliance checklist protects your business from lawsuits, carrier blocks, and reputational damage. Here’s what to remember:

• Always get express written consent before sending marketing messages, and store proof of that consent for at least five years.
• Write disclosures that are specific, conspicuous, and include opt-out instructions.
• Honor every opt-out request immediately and permanently.
• Respect calling and texting hour restrictions in the recipient’s time zone, including stricter state-level rules.
• Scrub your lists against both the National DNC Registry and your internal DNC list every 31 days.
• Register for 10DLC before sending business texts from a local number.

TCPA compliance isn’t optional. It isn’t something you set up once and forget. Audit your processes quarterly, train every team member who touches customer communication, and use tools that build compliance into the workflow rather than bolting it on as an afterthought.

Frequently Asked Questions

Does the TCPA apply to text messages or just phone calls?

Both, actually. The TCPA covers any communication to a mobile phone using an automatic telephone dialing system or prerecorded voice, and courts have consistently held that text messages fall under the same rules. If you’re sending promotional texts, you need express written consent, just like you would for a marketing call.

Do I need consent to send appointment reminders?

You need express consent, but not necessarily express written consent. If a customer voluntarily provides their phone number when booking an appointment, that typically qualifies as express consent for transactional messages like reminders and confirmations. However, it doesn’t cover promotional content. Adding a sale or upsell to a reminder text? That can reclassify the entire message as marketing.

What’s the penalty for a single TCPA violation?

Statutory damages are $500 per negligent violation. Up to $1,500 per willful violation. Each individual call or text counts as a separate violation, so costs escalate quickly. A batch of 500 texts without consent could mean $250,000 to $750,000 in exposure.

How long do I need to keep consent records?

There’s no single federal requirement, but the statute of limitations for TCPA claims is four years in most jurisdictions. Keeping records for at least five years gives you a safety margin. Store the date, method, exact disclosure language, and the phone number associated with each consent.

Does the TCPA apply to existing customers?

Yes. Having an existing business relationship doesn’t exempt you from TCPA requirements for marketing messages. You still need express written consent to send promotional texts or make automated marketing calls to current customers. Transactional messages, like service updates related to work you’re actively performing, are treated differently but should still be sent only to numbers the customer provided voluntarily.