Compliance · 11 min read

TCPA Compliance for Review Request SMS: 2026 Playbook

By the ApexReviewPro Team · Published April 25, 2026 · Updated April 25, 2026

The Telephone Consumer Protection Act (TCPA) imposes statutory damages of $500 to $1,500 per non-compliant text message. For a business sending 200 review requests a month, that's potential exposure of $1.2M annually for a single violation pattern. This guide covers the rules, common pitfalls, and the safe-harbor patterns that keep your review-generation program legal in 2026.

What the TCPA actually is and who it applies to

The Telephone Consumer Protection Act of 1991 was originally written to combat robocalls. The FCC and federal courts have interpreted it to cover virtually all automated SMS to mobile numbers — including the kind of "fire an automated review request when the customer leaves" workflow that powers every review-generation platform.

The statutory damages are what make TCPA dangerous: $500 per violation, trebled to $1,500 if the violation is "willful." Violations are per-message. Class actions can stack hundreds of thousands of recipients into a single suit. Settlements in the $5M–$50M range are routine.

The TCPA also provides a private right of action — meaning the recipient can sue you directly without involving the FCC. There is a cottage industry of plaintiffs' attorneys who specifically scout for non-compliant business SMS programs. Avoiding that target is the whole point of this guide.

The consent rules: express, written, and prior

The core TCPA rule for review requests: you need prior express written consent before sending an automated SMS to a mobile number. Three words, each load-bearing:

• Prior: consent must exist before the first message goes out, not after.
• Express: implied consent (i.e., "well, they gave us their phone number") is not enough.
• Written: you must have a record. An e-signature, a checked box on a form, or a documented verbal-with-recording all qualify.

How to actually capture this: at the moment you collect the phone number — intake form, online booking, point-of-sale — include a clear consent line:

"By providing your mobile number, you agree to receive transactional and review-request SMS messages from {BusinessName}. Message and data rates may apply. Reply STOP at any time to opt out. Reply HELP for help."

Save the timestamp, the IP address, and the exact wording shown to the customer. If you're ever audited or sued, this record is your defense.

The most common compliance failure: pulling phone numbers from your existing customer database that were collected for transactional purposes (appointment confirmations) and using them for review requests. Even if those customers gave you their number for one purpose, that consent does not automatically extend to marketing SMS.

A2P 10DLC registration in 2026

Beyond TCPA, all US-bound business SMS now requires A2P 10DLC (Application-to-Person 10-Digit Long Code) registration with The Campaign Registry. This is a separate requirement from TCPA — it's a carrier-imposed framework, not a federal law — but the consequence of non-compliance is just as bad: your messages get filtered, throttled, or blocked entirely.

To register:

1. Your SMS provider (Twilio, Telnyx, Bandwidth, etc.) registers your business as a "Brand" with The Campaign Registry.
2. You register specific "Campaigns" (e.g., "Review Requests") with sample message content and use case classification.
3. Carriers approve the campaign and assign a throughput tier.

If you use a managed review-generation service like ApexReviewPro, this is handled for you as part of onboarding. If you DIY, plan 1-3 weeks for full registration. Don't attempt to send US business SMS without 10DLC — it doesn't work in 2026.

Opt-out language and STOP handling

Every commercial SMS to a US recipient must include a clear opt-out mechanism. The standard is recognition of these keywords without case sensitivity:

• STOP, END, QUIT, CANCEL, UNSUBSCRIBE → must immediately remove the recipient from all future messaging from that sender.
• HELP, INFO → must respond with sender identification and a way to contact the business.

Best practice is to include "Reply STOP to opt out" in every message, even though the carrier handles STOP keywords automatically. The recipient should never be in doubt about how to make it stop.

Your opt-out database must be honored across all sending. If a customer texts STOP after a review request, you cannot then send them an appointment-reminder SMS the following week from the same number — the opt-out is global to the sender phone number.

Time-of-day restrictions

The TCPA itself sets a window of 8 AM to 9 PM in the recipient's local time zone for telephone calls. The FCC has not formally extended this to SMS, but plaintiffs' attorneys treat it as the standard, and most SMS platforms enforce it programmatically. Best practice: do not send any commercial SMS outside the 8 AM – 9 PM window in the recipient's zip code.

For review requests specifically, the optimal window is 9 AM – 7 PM local — late enough that customers are awake, early enough that they're not winding down for the evening.

Safe-harbor message templates

A compliant review-request SMS should include all of the following:

1. Sender identification (business name)
2. Recipient first name (humanizes, reduces spam-flag rate)
3. Clear purpose (asking for a review)
4. Single tappable link
5. Opt-out instructions

Compliant SMS template

"Hi {FirstName}, this is {BusinessName}. Thanks for visiting today! If we earned a 5-star review, would you take 30 seconds to share one on Google? {ReviewLink} — Reply STOP to opt out."

Compliant follow-up template (1 reminder allowed)

"Hi {FirstName}, just a quick reminder from {BusinessName} — if you have a moment, your Google review really helps our small business. {ReviewLink} — Reply STOP to opt out."

What to avoid:

• Multiple reminders. One follow-up is the safe ceiling. More than that increases harassment-claim risk.
• Sending after STOP. Even an "are you sure?" confirmation message after STOP can violate TCPA in some circuits.
• Wrong-number messaging. If you receive a "wrong number" reply, opt the recipient out immediately.
• Group SMS. Each recipient must receive an individually addressed message; group sends are categorically risky.

Compliance audit checklist

Run through this checklist before your review-generation program goes live, then quarterly thereafter:

• ☐ Express written consent captured at point of phone number collection, with documented timestamp + IP
• ☐ Consent disclosure mentions review-request SMS specifically (not just "appointment reminders")
• ☐ A2P 10DLC Brand and Campaign registered and approved
• ☐ STOP keyword honored automatically across all sender numbers
• ☐ HELP keyword returns sender identification
• ☐ All sends limited to 8 AM – 9 PM recipient local time
• ☐ One follow-up message maximum per customer per service event
• ☐ Suppression list reviewed monthly and applied across all campaigns
• ☐ Message templates include sender ID + opt-out language
• ☐ Records of consent retained for at least 4 years (TCPA statute of limitations)

If you can't check every box, you have exposure. Either fix the gap or stop sending until it's fixed. A managed service like ApexReviewPro handles all of these requirements as part of the standard onboarding — if you don't have the operational bandwidth to run compliance internally, that's the cleanest path.

FAQ