Summary. The TCPA pays $500 per message with no cap, which turns an ordinary campaign into eight-figure exposure and makes the compliance question purely evidentiary: can you produce, for every number on the list, proof of what the person saw and agreed to. This checklist builds that capability — consent capture and the disclosure elements that must appear adjacent to the checkbox, the records and version history retained, suppression across every sending system, revocation handling under the FCC's current standard, curfews by the recipient's actual time zone, vendor and lead-source diligence, and the governance that keeps a second platform from creating exposure nobody knew existed.

What this checklist is for. Building or auditing a calling and texting program. For the legal framework, see The TCPA and Text Message Marketing.

Phase 1 — Consent capture

  • Use a separate, unchecked checkbox for marketing messages. Never bundle it with terms of service acceptance or with any other consent.
  • Display the complete disclosure adjacent to the checkbox, not behind a link:
    • who is sending;
    • what kind of messages;
    • approximate frequency;
    • that automated technology may be used;
    • that message and data rates apply;
    • that consent is not a condition of any purchase; and
    • how to opt out.
  • Confirm the checkout or signup flow proceeds without the box checked. A flow that will not proceed violates the not-a-condition requirement regardless of the disclosure.
  • Capture the phone number within the consent record, not merely in the account profile.
  • For keyword opt-ins, retain the inbound message and send an immediate confirmation stating the program name, frequency, rates, and opt-out instructions.
  • Confirm the signature satisfies ESIGN, which an ordinary electronic assent does.
  • Do not treat a number provided for a receipt, a shipping notification, or an account alert as consent for telemarketing.

Phase 2 — The consent record

Retain, per consent, and be able to produce within a day:

  • The exact disclosure text displayed, retained by version with effective date ranges.
  • A screenshot or rendering of the page as the consumer saw it.
  • Timestamp, IP address, and session identifier.
  • The phone number as entered.
  • The method — web form, keyword, paper form, or verbal with recording.
  • For keyword opt-ins, the inbound message and the confirmation sent.
  • Retention for at least five years, which exceeds the four-year federal limitations period and matches the internal do-not-call retention requirement.

Why this matters. The burden of proving consent is on the caller. A plaintiff who signed up in 2023 and sues in 2026 will be met with whatever the company can produce, and a current disclosure page proves nothing about a prior version.

Phase 3 — Suppression

  • Maintain one authoritative internal do-not-call list that every sending system consults before every send — marketing platform, CRM, loyalty tool, franchise systems, and any tool a department bought independently.
  • Scrub against the National Do Not Call Registry within 31 days of any telemarketing send, and retain the scrub records showing the date and the process.
  • Scrub against state registries where they exist.
  • Honor opt-outs across all programs and brands by default, consistent with the FCC's cross-program revocation rule.
  • Query the Reassigned Numbers Database and retain the query results, which supply a safe harbor for calls to a number reassigned after consent was given.
  • Maintain the internal list for five years and honor requests within a reasonable time not exceeding 30 days.
  • Maintain a written do-not-call policy, available on demand, and train all telemarketing personnel on it.
  • Identify the caller, the entity on whose behalf the call is made, and a contact number in every telemarketing message.

Phase 4 — Revocation

  • Accept revocation by any reasonable means. Do not designate an exclusive method.
  • Treat "stop," "quit," "end," "revoke," "opt out," "cancel," and "unsubscribe" in reply to a text as per se reasonable.
  • Honor a request within a reasonable time not to exceed ten business days.
  • Apply revocation across all robocalls and robotexts from the sender, unless the consumer indicates otherwise.
  • Send at most one confirmation message, within five minutes, with no marketing content.
  • Honor revocations received by phone, email, chat, in person, or through customer service, and route them to the suppression list automatically.
  • Log every revocation with its date, channel, and the confirmation of suppression.

Phase 5 — Timing and content

  • Enforce the 8:00 a.m. to 9:00 p.m. curfew in the recipient's local time, determined by a carrier lookup rather than by area code inference, which number portability makes unreliable.
  • Confirm no message is scheduled to send into a time zone outside the window.
  • Include "Reply STOP to opt out" and "HELP for help" as the messaging guidelines require.
  • Confirm content complies with carrier and CTIA restrictions, including categorical blocks for cannabis, firearms, certain lending products, and gambling on many carriers.
  • Register the brand and each campaign for 10DLC messaging, with the use case, sample messages, and opt-in mechanism disclosed. Unregistered traffic is filtered or blocked.

Phase 6 — Vendors and lead sources

  • Conduct diligence before engagement, and require contractual TCPA compliance obligations flowing downstream.
  • For purchased leads, require per lead: the disclosure text, the URL, a rendering of the page, and the full metadata.
  • Audit a sample independently rather than accepting a certification.
  • Confirm the disclosure gave consent to your company specifically, not to an undifferentiated list of marketing partners.
  • Negotiate an indemnity backed by insurance and confirm the vendor could actually fund a claim.
  • Exercise audit rights at least annually, and terminate on complaint patterns.
  • Recognize that vicarious liability attaches through actual authority, apparent authority, or ratification — and that contract language alone does not defeat it.

Phase 7 — Governance

  • Assign one named owner with authority over every sending system in the company.
  • Require pre-approval of every campaign against a checklist covering list source, consent basis, disclosure version, curfew, and content.
  • Maintain a campaign log — list source, consent basis, send date, volume, and approver.
  • Track complaints and act on them; an unaddressed pattern is what converts $500 into $1,500 per message.
  • Confirm insurance. Most CGL policies exclude TCPA claims through the statutory-violation exclusion; obtain a specific endorsement or a media liability policy and confirm the limit.
  • Bring franchisee and affiliate channels onto the corporate platform, or impose a written policy with audit rights — the brand's name on the message is enough for apparent authority.
  • Review state mini-TCPA requirements for every state where recipients are located, and build to the strictest.

Phase 8 — On receiving a demand or a complaint

  • Issue a litigation hold covering the marketing platform, CRM, consent database, vendor communications, and complaint records; vendor data disappears first.
  • Pull the individual plaintiff's record — consent, disclosure version, opt-out history, and the actual messages sent.
  • Assess the class: how many numbers, from what sources, with what documentation.
  • Check whether the plaintiff has an account governed by arbitration terms with a class waiver, and whether assent is provable.
  • Notice every potentially applicable insurance policy immediately.
  • Fix the practice. Continuing after notice is what produces willfulness findings.

Common mistakes

  1. One consent for everything, bundled with terms of service.
  2. Disclosures behind a link rather than adjacent to the checkbox.
  3. No disclosure versioning, so what a 2022 signup saw cannot be proved.
  4. A second sending platform that never sees the suppression list.
  5. Point-of-sale numbers collected for receipts and loaded into the marketing list.
  6. Curfew enforced by area code, sending at 5 a.m. to a ported number.
  7. Purchased leads with generic "marketing partners" consent.
  8. Franchise or affiliate channels using the brand's name outside any policy.
  9. A CGL policy assumed to cover TCPA claims when it excludes them.
  10. Continuing to text after an opt-out received through a channel the company did not monitor.

Primary authority

Related

This checklist is educational and not legal advice. FCC rules change frequently and several are subject to pending litigation, and state statutes impose additional and sometimes stricter requirements. Consult qualified counsel before launching a calling or texting program.