Privy strives to provide quality services that empower our merchants to comply with legal standards and create highly engaging messaging.  Privy takes compliance and subscriber messaging seriously — and you should, too. We’ve put together this guide to make it easy for you to ensure your SMS/MMS marketing campaigns comply with U.S. laws and regulations, including the Telephone Consumer Protection Act (TCPA).
Consent is the cornerstone of SMS compliance. Unlike email marketing, where certain forms of implied consent might be acceptable, SMS marketing requires explicit, written consent from your customers.

​
What is TCPA?

The Telephone Consumer Protection Act (TCPA) establishes mandatory requirements for businesses using SMS and MMS messaging for marketing communications. The fundamental requirement is clear: businesses must obtain explicit written consent before sending automated marketing messages to consumers. This consent must clearly disclose the marketing nature of future communications, specify message types and frequency, and acknowledge that consent is not a condition of purchase. TCPA compliance requires maintaining comprehensive records of consumer consent, including when and how consent was obtained, along with proper documentation of opt-out requests. Businesses must implement clear opt-out mechanisms and immediately honor all consumer requests to discontinue communications. Violations can result in significant penalties, including fines of $500-$1,500 per violation and potential class action litigation. For additional guidance, the Cellular Telecommunications Industry Association (CTIA) provides supplementary guidelines covering message frequency, content standards, and technical requirements. Organizations should consult legal counsel to ensure their SMS marketing programs fully comply with current TCPA regulations and industry standards. In addition, several states including Arizona, Florida, Georgia, Maryland, Mississippi, Tennessee and Washington have passed ‘Mini-TCPA’ laws that are often more strict than the federal TCPA law. It is your responsibility to ensure that when using Privy to send messages to consumers, you understand and are complying with all relevant TCPA regulations and compliance with laws imposed by other jurisdictions. Privy’s default text opt-in messages include TCPA and CTIA-compliant consent language. We do not allow you to modify this consent language. If you are collecting SMS consent outside of Privy, ensure your consent statement is compliant across all opt-in points:
“By providing your phone number, you agree to receive recurring automated marketing text messages from [Company Name]. Consent is not a condition of purchase. Msg & data rates may apply. Msg frequency varies. Reply STOP to cancel. View our Terms of Service and Privacy Policy.”
The language must be clearly visible before submission and cannot be hidden in scrollable text or behind links. Keep the font size legible and ensure the text contrasts with the background. While the exact wording may be adjusted for space constraints, all core elements (consent statement, frequency disclosure, opt-out information, and rate notice) must be preserved.

​
Privacy Policy and Terms & Conditions

You must update the links in your display’s SMS Opt-In disclaimer to match your brand’s Privacy Policy and Terms of Service. To do this, click directly on the SMS Opt-In disclaimer element in your display, and then paste your brand’s Privacy link and Terms link in the fields on the right:
At this time, these links must be updated individually for any of your displays that are collecting SMS Consent.

​
Quiet Hours

In the US, quiet hours relate to guidance from the TCPA and FCC that suggests text messages should not be sent before 8:00 am and after 9:00 pm in the recipient’s time zone. Some states such as Florida and Washington impose stricter requirements that mandate text messages only be sent between the hours of 8:00 am and 8:00 pm in the recipient’s time zone. At Privy, we automatically enforce quiet hours of 8:00am to 8:00pm if we have the recipient’s time zone information. If we do not have the recipient’s time zone information, we conservatively only send when it would be a valid time in all continental US timezones (12:00pm ET to 8:00pm ET). This system helps ensure compliance while simplifying campaign management for merchants. All scheduled messages outside of permitted hours are automatically delayed until the next available sending window.

​
SMS Import Compliance

If you are new to Privy, you may be able to upload a list of SMS subscribers you collected on another platform. These subscribers need to have been collected in a TCPA-compliant manner in order to be uploaded into Privy. Please note that by submitting a list for upload, you certify that you collected subscribers in a TCPA-compliant manner. If you’re not sure, please consult your attorney. To get started, read more about Importing and Managing Contacts.

​
SHAFT Compliance + Prohibited Materials

SMS marketing compliance requires strict adherence to SHAFT guidelines, which prohibit content related to Sex, Hate, Alcohol, Firearms, and Tobacco. Carriers actively monitor messages and may block content that violates these restrictions. At this time, Privy is unable to support SMS marketing for brands who sell items that fall within any SHAFT category. Brands that sell alcohol and adhere to specific CTIA requirements (including age-verifying both on the website and in the SMS thread) are able to promote their brand via SMS marketing.  Certain materials and content are prohibited from being sent via SMS. Please ensure you follow our Acceptable Use Policy, as this is agreed upon in our Terms and Conditions when you first sign up for an account with Privy. 

​
Compliance Best Practices

  • Ensure clear consent language and process. Clearly display TCPA and CTIA-compliant opt-in language wherever you collect SMS marketing consent. Do not pre-check boxes on opt-in forms.
  • Set content expectations. Have you conveyed what your subscribers should expect when signing up for your communications? A recipient who provided explicit marketing consent may unsubscribe or report a violation if it is not quickly recognizable and does not align with what they expected. 
  • Quickly honor any and all opt-out requests.
  • Avoid spammy habits and deceptive, unwanted or illicit content in your messages. Never send messages promoting illegal goods or services, misleading offers, or excessive caps/punctuation. Keep messaging frequency reasonable and stick to your stated purpose.
  • Make sure your company/brand is easily identifiable within messages.
If you have any additional questions about SMS and/or Email Compliance, please don’t hesitate to email our team at compliance_team@privy.com.