The 2026 SMS Compliance Checklist: TCPA, 10DLC, and the State Laws Everyone Forgets

Most teams think they are compliant because their 10DLC registration went through. That is the layer that blocks your messages when it is wrong, so it is the one everyone notices. It is also the layer least likely to get you sued.

Here is the part that trips people up: SMS compliance is not one thing, it is three. There is the federal layer (TCPA), the carrier layer (10DLC and A2P), and a fast-growing state layer of texting laws. Finishing your 10DLC registration clears one of the three. This SMS compliance checklist covers all of them, in plain language, so you can actually confirm your program is covered instead of assuming it is.

One note before the list: this is a practical guide, not legal advice. When real money or real volume is on the line, run your program past counsel.

SMS compliance has three layers, not one

Think of it as a stack.

The federal layer is the TCPA, the law that governs consent for calls and texts nationwide. It is old, it is aggressively litigated, and it does not care whether your 10DLC campaign is registered.

The carrier layer is 10DLC and A2P: the registration and vetting system the carriers use to decide whether your traffic is trustworthy enough to deliver. This is the layer that filters or blocks you.

The state layer is the newest and the one most senders have never read. A growing number of states have passed their own texting laws, often stricter than the federal baseline, with their own consent rules and their own quiet hours.

Most senders only see the carrier layer, because it is the only one that interrupts their day. The other two are quiet right up until a complaint or a lawsuit makes them loud.

The federal layer: TCPA consent

The TCPA turns on one idea: consent. You need the right kind of consent before you text, and you have to respect it when someone takes it back.

The essentials:

• Get prior express written consent for marketing messages. Promotional texts require a clear, affirmative opt-in, not a pre-checked box and not a phone number handed over for a different purpose.
• Make the opt-out obvious and honor it promptly. STOP has to work, every time, and revocation has to be processed within the window regulators set. "We will get to it" is not a policy.
• Identify yourself. The recipient should know who is texting them from the first message.
• Respect the calling window. The federal rule limits messages to the 8 a.m. to 9 p.m. window in the recipient's local time.

The direction of travel is toward making it easier for consumers to revoke consent and harder for senders to ignore it. If your opt-out handling is manual or slow, that is the gap to close first, because it is the one plaintiffs look for.

There is a records dimension to all of this that is easy to skip. Consent is only worth as much as your ability to prove it. If a complaint lands and you cannot produce a timestamped record of how and when a person opted in, you are effectively treated as if they never did. Capture consent in a way you can export and defend, and keep it for as long as you keep texting that number.

The carrier layer: 10DLC and A2P

This is the layer you already know, because it is the one that stops your messages when it is wrong. It is table stakes, not a finish line.

• Register your brand and your campaign. Both, accurately. The use case you register has to match what you actually send.
• Mind your trust score. A rushed registration with a vague use case earns a lower score, which means tighter filtering and less headroom, especially in high-scrutiny periods.
• Keep your sample messages current. If what you send drifts from what you registered, you invite a review.

Getting this right is a process worth doing carefully the first time. Our guide on getting A2P approved in 2026 walks through the registration itself. Just remember that clearing it protects your deliverability, not your legal exposure. Those are two different problems, and when messages start getting filtered, a weak registration is usually only part of the story.

The state layer: mini-TCPAs and quiet hours

This is the one that surprises people. A number of states, Florida and Oklahoma among the earliest, have passed their own telephone-solicitation laws, often called mini-TCPAs. They tend to add stricter consent requirements and their own quiet-hour windows on top of the federal rules, and several of them come with private rights of action, which means individuals can sue.

For a national sender, this creates a simple but uncomfortable reality: you have to design your program to the strictest common denominator. It does not matter that your message would be fine in 45 states if it violates the quiet-hour rule in the five where it is not. Your list does not sort itself by statute.

The practical move is to standardize on the tightest rules you are subject to: the narrowest sending window, the clearest consent capture, the fastest opt-out handling. Build to that, and the federal baseline takes care of itself.

There is a timing angle too. Compliance and deliverability are not the same problem, but they feed each other, and both get harder in high-scrutiny stretches. During election season, when carrier filtering tightens across all traffic, a thin consent trail or a sloppy opt-out flow is exactly the kind of weakness that turns into blocked messages and complaints. The cleaner your compliance posture, the less exposed you are when the filters get aggressive.

The 2026 SMS compliance checklist

Here is the working checklist. If you can honestly check every box, you are in good shape across all three layers.

• Consent is captured and logged. Every number on your list has a documented, timestamped opt-in for the type of message you send it.
• Consent is the right kind. Marketing messages have express written consent, not a number collected for another purpose.
• Opt-out works and is honored fast. STOP is processed automatically and revocation is handled within the required window, with a record that it happened.
• You identify yourself in your messages.
• You respect quiet hours in the recipient's local time, defaulting to the strictest window you are subject to.
• Your 10DLC brand and campaign are registered and accurate, with sample messages that match what you send.
• Your content and links are clean: no misleading sender, no public URL shorteners that inherit a bad reputation.
• You retain records: consent, opt-outs, and your registration details, in case you ever have to prove any of it.

Print it, run your program against it, and fix the boxes you cannot check. If you would rather have a second set of eyes, have our compliance team review your setup before your next big send.

What non-compliance actually costs, and how to lower the risk

Get this wrong and the costs land in three places. Your messages get filtered, so your delivery quietly drops. Regulators and carriers can suspend or penalize your traffic. And under the TCPA and the state mini-TCPAs, statutory damages are calculated per message, not per campaign, so the exposure scales with the size of your send. A single non-compliant blast to a large list is the kind of math that turns a marketing mistake into a real legal problem.

If you want the fuller argument for why this belongs near the top of your priority list, not buried under growth goals, we made the case here. The short version: compliance is cheaper than the alternative, every time.

You cannot outsource the legal decisions, but you can lower the operational risk. Carrier-direct routing means fewer points where a compliance-adjacent problem turns into silent filtering, and a 99%+ delivery baseline gives you a cleaner signal when something is actually wrong. Just as important, real human compliance support means that when a registration issue or a carrier flag comes up, a person can help you resolve it instead of a ticket sitting in a queue while your sends pile up.

Compliance is not a one-time project. It is a standard you hold every list and every campaign to. The checklist above is how you hold it. If you want a platform whose team treats compliance as their problem too, talk to Signal House.