TCPA Compliance Checklist for Franchise SMS Programs
A self-audit for brands running text messaging across multiple locations.
Reflects federal and state rules as of September 15, 2026. Telemarketing rules change frequently — verify current requirements before relying on this document.
Audit details
- 1
Every number on our marketing list came from an affirmative opt-in.
A past purchase, a website visit, a loyalty signup, or a period of inactivity does not by itself create marketing consent.
[ ] —
- 2
No pre-checked boxes anywhere in our opt-in flows.
[ ] —
- 3
Our opt-in disclosure identifies the specific business sending the messages by name.
[ ] —
- 4
The disclosure states that consent is not a condition of purchasing any goods or services.
[ ] —
- 5
The disclosure tells the consumer they'll receive marketing or promotional texts, and says so plainly.
[ ] —
- 6
The disclosure discloses automated technology where our sending method requires it.
[ ] —
- 7
The disclosure includes message frequency, "message and data rates may apply," and STOP/HELP instructions.
[ ] —
- 8
We capture and store, for every opt-in: phone number, timestamp, source (web form, keyword, POS, paper), and the exact disclosure text shown at that moment.
Storing a link to your current terms is not enough. If the language changed, you need the version the customer actually saw.
[ ] —
- 9
We version our consent language and can reconstruct which version any given subscriber agreed to.
[ ] —
- 10
We retain consent records for at least four years after the last message sent.
TCPA claims generally carry a four-year limitations period. Longer is safer.
[ ] —
- 11
We know which legal entity owns each consent record — franchisor, franchisee, or both — and that's documented, not assumed.
Regulators are actively looking at whether consent given to a brand extends to its affiliates and separate divisions. Document your position now.
[ ] —
Your documented position: — - 12
Locations cannot add numbers to a sending list by any path that bypasses the approved opt-in flow.
Manually typed lists, uploaded spreadsheets from a POS, and "she gave me her number" are the three most common sources of exposure in multi-location programs.
[ ] —
- 13
We honor opt-out requests made by any reasonable method, not just exact keywords.
[ ] —
- 14
Our platform recognizes at minimum: STOP, QUIT, END, CANCEL, UNSUBSCRIBE, OPT OUT, and REVOKE.
[ ] —
- 15
We detect natural-language revocations — "stop texting me," "take me off this list," "remove me," "don't contact me again."
This is where most legacy platforms fail. Keyword-only matching is no longer sufficient.
[ ] —
- 16
Opt-outs are processed as soon as practicable, and in every case within 10 business days.
Build to a shorter internal SLA than the legal deadline. Regulators have signaled interest in tightening this window, and near-immediate processing is the defensible posture regardless of where the rule lands.
[ ] —
- 17
An opt-out from any marketing message stops all marketing messages from our brand to that number.
[ ] —
- 18
We send at most one confirmation message after an opt-out, and it contains no promotional content.
[ ] —
- 19
A suppression at one location propagates to every location and every campaign under our brand.
This is the single highest-risk failure mode for franchise programs. A customer who opts out at Location A and gets a text from Location B has a claim.
[ ] —
- 20
Suppressed numbers cannot be re-added by a list upload, a re-import, or a new integration sync.
[ ] —
- 21
We have documented whether an opt-out from one message category also stops other categories, and our platform enforces that decision consistently.
The scope of a category-specific opt-out is an area of active regulatory change. Whatever your position, it should be a deliberate choice that's written down and enforced in the platform — not an accident of configuration.
[ ] —
Your documented position: — - 22
If we designate a specific channel as our opt-out method, that channel is disclosed clearly and conspicuously in our messages, and we have confirmed with counsel that designation is permitted under current rules.
Do not rely on a single designated channel without checking the current federal rule and the states you operate in. Several states mandate keyword recognition regardless.
[ ] —
Your documented position: — - 23
We log every opt-out with timestamp and the exact message text that triggered it.
[ ] —
- 24
Every campaign is classified as transactional or promotional before it sends.
[ ] —
- 25
Transactional messages stay transactional — no offers, no upsells appended.
Adding "and here's 20% off your next visit" to a shipping confirmation converts it into a marketing message requiring marketing consent.
[ ] —
- 26
Promotional sends go only to subscribers with documented marketing consent.
[ ] —
- 27
Local operators cannot reclassify a campaign type without brand approval.
[ ] —
- 28
We check numbers against the FCC's Reassigned Numbers Database before campaigns to aged segments.
A correct database check can create a safe harbor if a number was reassigned. A valid opt-in from a previous owner is worth nothing against the new one.
[ ] —
- 29
Dormant subscribers are re-engaged or removed on a defined schedule.
[ ] —
- 30
Our actual send frequency matches what we told subscribers to expect at opt-in.
[ ] —
- 31
Frequency caps are enforced at the brand level, not just per campaign.
Three locations each sending "only one text a week" is three texts a week to a customer who lives near all of them.
[ ] —
- 32
We monitor opt-out rate and complaint rate by location and investigate outliers.
[ ] —
- 33
Quiet hours are enforced against the recipient's time zone, not the sender's.
[ ] —
Select the states where your locations operate in the intake block above to surface them first.
All states
- 34
We have identified every state where our locations operate and where our subscribers reside.
[ ] —
- 35
We apply the strictest applicable consent standard across our national program, or we apply state-specific settings by subscriber.
[ ] —
- 36
Our quiet-hours configuration accounts for state-specific windows, including Pennsylvania's Sunday restriction beginning October 18, 2026.
[ ] —
- 37
We have a documented method for determining which state's rules apply to a given subscriber — residence, area code, and known location can all differ.
[ ] —
Your documented position: — - 38
Someone owns tracking state legislative changes, and the review happens at least quarterly.
State telemarketing law is currently moving faster than federal law. This is the item most programs skip and most often regret.
[ ] —
Your documented position: —
- 39
Our brand is registered for A2P 10DLC and every campaign is registered under it.
[ ] —
- 40
Any toll-free numbers we use have completed toll-free verification.
[ ] —
- 41
Our registered sample messages match the messages we actually send.
Carriers run automated matching of live traffic against registered samples. Drift gets you filtered before it gets you fined.
[ ] —
- 42
Our opt-in flow is documented with a live, publicly accessible URL — not a screenshot.
[ ] —
- 43
Terms of service and privacy policy URLs appear on the opt-in form itself.
[ ] —
- 44
Registration details are updated when campaigns, use cases, or opt-in flows change.
[ ] —
- 45
No campaign touches SHAFT content (Sex, Hate, Alcohol, Firearms, Tobacco) without confirming carrier-specific requirements and age gating.
[ ] —
- 46
We monitor delivery and filtering rates by location and investigate sudden drops.
[ ] —
- 47
There is a written policy defining what local operators may and may not send.
[ ] —
- 48
Local operators are trained on opt-in and opt-out requirements before they get sending access.
[ ] —
- 49
Operators acknowledge the policy in writing, and we retain those acknowledgments.
[ ] —
- 50
Templates are approved at the brand level; operators customize within guardrails rather than composing freely.
[ ] —
- 51
New locations cannot send until registration, consent flow, and training are complete.
[ ] —
- 52
We can produce, for any individual subscriber, a complete record: consent source, every message sent, and any opt-out — within one business day.
This is the practical test. If you can't assemble this quickly, you can't defend a claim cheaply.
[ ] —
- 53
A named person owns TCPA compliance for the brand.
[ ] —
Your documented position: — - 54
We audit this checklist on a defined cadence and keep prior completed audits.
[ ] —
Your open gaps
Assign an owner and a date to each gap before you circulate this.
Nothing marked as a gap yet. Items you mark Gap collect here automatically.
Disclaimer
This checklist is for informational purposes only and does not constitute legal advice. Telemarketing laws, FCC rules, and court decisions change frequently, and requirements vary by state, message type, and sending technology. Consult qualified legal counsel for advice specific to your business.
Voxie helps franchise brands run SMS across hundreds of locations with brand-level consent, suppression, and sending controls. Talk to us →