TCPA & SMS Compliance Guide

Understanding federal text messaging regulations and how to maintain compliance while communicating with your insurance clients.

Estimated time: 15 minutes

Related Guides: This guide focuses on legal requirements. For practical implementation tips, see our SMS Best Practices Guide. For carrier registration, see A2P 10DLC Compliance.

Disclaimer: This guide provides general educational information about SMS compliance. It is not legal advice. Consult with qualified legal counsel to ensure your specific practices comply with all applicable laws and regulations.

What is the TCPA?

The Telephone Consumer Protection Act (TCPA) is a federal law enacted in 1991 that regulates telemarketing calls, auto-dialed calls, prerecorded calls, text messages, and unsolicited faxes. While originally focused on phone calls, the law has been interpreted by the FCC and courts to apply to SMS text messaging.

Key TCPA Provisions for Texting:

  • Prior consent required: You must have consent before sending text messages to consumers
  • Written consent for marketing: Marketing/promotional messages require prior express written consent
  • Opt-out must be honored: Recipients must be able to opt out, and you must honor those requests immediately
  • Time restrictions: Messages should not be sent before 8 AM or after 9 PM in the recipient's time zone
  • Identification: Messages must identify who is sending them

The TCPA works alongside other regulations like the CAN-SPAM Act (for email), state telemarketing laws, and carrier policies to create a framework for lawful business communication.

Why TCPA Compliance Matters

Financial Risk

TCPA violations carry significant statutory penalties:

  • $500 per violation for negligent violations (each text to each recipient is a separate violation)
  • $1,500 per violation for willful or knowing violations (treble damages)
  • Class action exposure: TCPA lawsuits are frequently brought as class actions, multiplying exposure dramatically

Example: A campaign of 1,000 messages sent without proper consent could result in $500,000 to $1.5 million in statutory damages — before attorney fees and costs.

Reputation & Deliverability

  • Consumer complaints to carriers can result in your number being flagged or blocked
  • Poor compliance practices damage client trust and agency reputation
  • Repeated violations can lead to your messaging capabilities being suspended

E&O Considerations

For insurance agencies, compliance failures can create E&O exposure. If a client misses an important policy communication because your texting privileges were suspended, or if compliance issues affect your ability to service accounts, it could have professional liability implications.

Message Categories for Insurance Agencies

Understanding which category your messages fall into determines what level of consent you need:

Transactional/Informational Messages

These typically require only prior express consent (phone number + agreement to receive texts):

  • Policy renewal reminders
  • Payment due notices
  • Claims status updates
  • Appointment confirmations and reminders
  • Policy change confirmations
  • ID card delivery notifications
  • Responses to client inquiries
  • Coverage verification

Marketing/Promotional Messages

These require prior express written consent:

  • Cross-selling additional coverage
  • New product announcements
  • Special discounts or promotions
  • Referral program invitations
  • Holiday greetings with promotional content
  • "Bundle and save" offers

Gray Area: Some messages blur the line between transactional and marketing. A renewal reminder that mentions "this is a great time to review your coverage and potentially save" could be considered marketing. When in doubt, err on the side of caution and obtain written consent.

Opt-Out Requirements

Under TCPA, you must provide a way for recipients to opt out, and you must honor opt-outs immediately.

Standard Opt-Out Keywords

Carriers and industry standards recognize these keywords as opt-out requests:

STOPUNSUBSCRIBECANCELENDQUIT

Best Practices for Opt-Outs

  • Immediate: Stop all messages as soon as an opt-out is received
  • Confirmation: Send a single confirmation message acknowledging the opt-out
  • No exceptions: Even transactional messages must stop after an opt-out (use other communication channels)
  • Maintain records: Keep a list of opted-out numbers and check against it before sending

Voley automatically detects opt-out keywords and blocks further messages to that contact. You'll see an indicator that the contact has opted out. If they later want to opt back in, they can text START.

Do Not Call Registry

The National Do Not Call (DNC) Registry is a separate regulation administered by the FTC. It primarily applies to telemarketing calls, but some state laws extend similar protections to text messages.

Your Responsibility

Voley does not automatically scrub numbers against the DNC registry. You are responsible for checking numbers against the National DNC Registry and any applicable state DNC lists before sending marketing messages.

When DNC Applies

  • Marketing messages: Check the DNC registry before sending promotional content
  • Cold outreach: Always check before contacting prospects you don't have an existing relationship with

Exemptions

The following may be exempt from DNC requirements (but consult legal counsel):

  • Existing business relationship: You may contact customers you've done business with in the past 18 months
  • Inquiry exemption: You may contact someone who inquired about your services in the past 3 months
  • Prior express consent: If someone specifically gave consent, DNC doesn't apply
  • Purely informational: Non-marketing transactional messages are typically exempt

Accessing the DNC Registry

You can access the National DNC Registry at telemarketing.donotcall.gov. Businesses must pay a fee to download the list and must download updated lists at least every 31 days.

State Laws & Regulations

Many states have their own telemarketing and consumer protection laws that may be more restrictive than federal TCPA requirements.

States with Notable SMS/Telemarketing Laws

StateNotable Requirements
CaliforniaAutomatic DNC registration with cell phone purchase; CCPA privacy considerations
FloridaRequires written consent for ALL commercial text messages (effective 7/1/2021)
OklahomaRequires written consent for commercial texts; specific insurance solicitation rules
MarylandExpress written consent required for all commercial texts
WashingtonState DNC list; additional consumer protection requirements

Insurance-Specific Regulations: Many states have specific rules about insurance solicitation and marketing that may affect your texting practices. Check with your state insurance department and legal counsel to understand requirements in your operating states.

How Voley Helps You Stay Compliant

Voley provides several features to support your compliance efforts. However, these tools are assistive — they don't transfer legal responsibility and don't guarantee compliance.

Consent Tracking

Track when contacts were added and how they consented to receive messages. Record consent sources and maintain audit trails.

Automatic Opt-Out Detection

Voley automatically detects standard opt-out keywords (STOP, UNSUBSCRIBE, etc.) and blocks further messages to that contact. Opt-out status is clearly visible in the contact record.

Message Guardrails

Configure compliance warnings that alert users when messages contain potentially problematic content (coverage guarantees, binding language, etc.). Users can still send but must acknowledge the warning.

Complete Message Archive

All messages are retained with timestamps, supporting audit and compliance review requirements. Access historical conversations when needed.

Sender Identification

Messages are sent from your agency's registered phone number, and templates can include agency identification to meet disclosure requirements.

A2P 10DLC Registration

Voley handles carrier registration for your phone number, which is required by carriers but is separate from TCPA consent requirements. See our A2P 10DLC guide.

What Voley Does NOT Do

  • Verify that your consent is valid — you must ensure consent meets TCPA requirements
  • Scrub numbers against the DNC registry — this is your responsibility
  • Determine if a message is transactional or marketing — you must categorize your messages
  • Ensure state-specific compliance — you must know the laws in your operating states
  • Provide legal advice — consult qualified legal counsel

Best Practices for Compliant Messaging

1. Get Consent First, Message Second

Never assume consent. Have a documented process for obtaining consent and always verify consent status before sending messages to a contact for the first time.

2. Keep Transactional and Marketing Separate

Be intentional about categorizing your messages. Don't sneak marketing content into transactional messages. If you want to market, obtain the proper written consent.

3. Always Identify Yourself

Include your agency name in messages so recipients know who's contacting them:

"Hi John, this is Sarah from ABC Insurance. Your auto policy renewal documents are ready..."

4. Respect Time Restrictions

Don't send messages before 8 AM or after 9 PM in the recipient's time zone. Be mindful of clients in different time zones than your office.

5. Include Opt-Out Instructions

Particularly for marketing messages, include opt-out instructions:

"...Reply STOP to opt out of marketing messages."

6. Document and Audit

Keep records of consent, opt-outs, and messaging activities. Periodically audit your practices to ensure compliance.

7. Train Your Team

Everyone who sends messages on behalf of your agency should understand these requirements. A single team member's violation exposes the entire organization.

Insurance-Specific Considerations

Common Insurance Messaging Scenarios

ScenarioLikely CategoryConsent Needed
Policy renewal reminderTransactionalPrior express consent
Payment due noticeTransactionalPrior express consent
Claims status updateTransactionalPrior express consent
Appointment confirmationTransactionalPrior express consent
"Bundle and save" offerMarketingPrior express written consent
New product announcementMarketingPrior express written consent
Referral requestMarketingPrior express written consent
Policy review invitationGray area*Written recommended

*Policy review invitations can be transactional (service-related) or marketing (upsell opportunity) depending on context and wording. When in doubt, treat as marketing.

Sensitive Information

Do NOT send via text:

  • • Protected Health Information (PHI) — Voley is not HIPAA compliant
  • • Full Social Security numbers
  • • Complete credit card or bank account numbers
  • • Detailed medical information
  • • Login credentials or passwords

Penalties for Non-Compliance

TCPA Statutory Damages

$500 per violation

For negligent violations. Each text message to each recipient is a separate violation.

$1,500 per violation

For willful or knowing violations (treble damages). Courts can assess this for continued violations after receiving complaints.

Additional Consequences

  • Class action lawsuits: TCPA violations commonly result in class actions with thousands or millions of class members
  • State AG enforcement: State attorneys general can bring actions under state consumer protection laws
  • Carrier suspension: Your phone number or messaging capabilities may be suspended
  • FCC enforcement: The FCC can investigate complaints and impose additional penalties

Prevention is far less expensive than defense. Implementing proper compliance practices costs a fraction of what a single TCPA lawsuit could cost in damages, legal fees, and settlement.

TCPA Compliance Checklist

Use this checklist to evaluate your current practices:

Consent

Opt-Out

Message Content

DNC & Records

Training & Policy

Additional Resources

For more information on messaging compliance:

Need Help?

If you have questions about how Voley can support your compliance efforts, or need help configuring compliance features, we're here to help.