A mistimed text can cost $500 to $1,500. Here's the compliance SOP that turns 'we think we're fine' into 'we can prove it.'
SMS is the highest-converting channel most DTC brands own, and the most legally loaded. The Telephone Consumer Protection Act sets the rules, and the penalty for getting them wrong is $500 to $1,500 per text. Not per campaign. Per message. Class actions built on those numbers settle in the millions, and a cottage industry of plaintiff firms now scans brands for slip-ups.
Here's the part most operators miss: the brands that get caught usually weren't reckless. They had a consent box that came pre-checked, a quiet-hours setting that ignored state rules, an opt-out keyword that quietly stopped working after a platform update, or consent records they couldn't produce when asked. Every one of those is drift, the same slow gap between what you set up and what's actually running that breaks every other operational doc.
A compliance SOP closes that gap. It turns 'we think we're compliant' into 'we can prove it,' which is the only version that holds up. This is the SOP we use with DTC brands running Postscript, Attentive, or Klaviyo SMS: what the law requires in plain language, where brands actually trip, and the repeatable checks that keep your program safe as laws and tools change underneath it.
This is operational guidance, not legal advice. TCPA and state-level SMS rules change, and your situation may have specifics this SOP doesn't cover. Use it to build your process, then have counsel review it before you rely on it.
The instinct is to treat SMS compliance as a one-time setup: switch on the platform's compliance features, paste in a consent line, move on. That works right up until something changes. A new opt-in form goes live without the consent language. A state updates its quiet-hours window. A platform migration drops your opt-out automation. The setup was compliant; the running system isn't anymore.
Compliance is a moving target because three things underneath it keep moving: the law, your tools, and your own marketing. An SOP beats a setup because it builds in the recheck. It names what to verify, how often, and who signs off, so a setting that silently broke gets caught on a schedule instead of in a demand letter.
Compliance isn't a switch you flip once. It's a routine you run. The brands that stay safe aren't the ones with the best initial setup; they're the ones who re-verify consent capture, quiet hours, and opt-out handling on a schedule.
You don't need to be a lawyer to run a compliant program, but your team needs the four requirements in plain language. Strip the legalese and TCPA marketing compliance comes down to four things:
That's the spine. Most of what a compliance SOP does is make sure each of these four keeps working after you set it up, and that you can prove each one if a regulator or a plaintiff's lawyer asks.
Violations cluster in a handful of predictable places. These are the failure points to check first, because they're where the drift hides:
Configure consent capture, quiet hours, and opt-out handling inside your SMS platform.
Consent is where compliance is won or lost, because a flawed opt-in poisons every message that follows it. Lock down the capture first:
Every opt-in point added after launch is the most likely place to drift, because it's built by whoever is shipping that campaign, not by whoever owns compliance. Route new forms through the same checklist before they go live.
If you run SMS and email from one platform, the consent rules still apply separately to each channel.
These two are the easiest to automate and the easiest to let rot, because they live in platform settings nobody revisits. Both need to be set against the rules and re-verified after any platform change.
Quiet hours run on the recipient's local time, not your office's. The federal window is 8am to 9pm. Several states are tighter: Florida, Oklahoma, and Washington run 8am to 8pm, and Texas restricts marketing texts to 9am to 9pm on weekdays and Saturdays and noon to 9pm on Sundays. The safe move is to send within the narrowest window your audience spans, or to use a platform that enforces local-time quiet hours per recipient.
Opt-outs have to be effortless and absolute:
Test the opt-out flow yourself on a real device after any platform migration or automation change. This is the check brands skip, and it's the one a plaintiff's firm tests first.
Compliance you can't prove is compliance you don't have. If a complaint lands, the question isn't whether you believe you had consent; it's whether you can show it. Build the record-keeping into the SOP:
This is the difference between a scary letter and an expensive one. Brands with clean, exportable consent and opt-out logs resolve most disputes quickly. Brands without them negotiate from zero leverage.
Compliance fails when it's everyone's job, which means it's no one's. Name an owner and a cadence:
Pull legal in once to review the SOP and the consent language, then keep them on call for changes. You don't need a lawyer for every send. You need one to bless the process and to weigh in when a law moves.
The same quarterly-audit discipline, applied to the marketing flows that quietly drift out of date.
An SMS compliance SOP drifts faster than most, because the ground moves on three sides at once. States pass new SMS laws and adjust quiet-hour windows. Your platform ships an update that changes a setting or a default. Your own team launches a new popup, a new keyword, a new flow. Any one of these can quietly break a control the SOP assumed was solid.
Review the SOP every quarter, and immediately after any platform migration or any change to SMS law in a state you sell into. This is ordinary documentation drift, and on a compliance SOP the cost of drift isn't a confused new hire. It's per-message penalties on every text you sent while the control was broken.
Why every operational doc, including this one, degrades within 90 days unless you catch it.
Don't try to perfect the whole program at once. Do the two checks that catch the most exposure first. Open every SMS opt-in point you have and confirm not one is pre-checked or missing its disclosure. Then text every opt-out keyword to your own number and confirm each one suppresses you.
Those two checks, the opt-in audit and the opt-out test, cover the violations that draw the most lawsuits. Once they're clean, put the quarterly audit on the calendar and name its owner, so the checks keep happening after this week.
ReccordSOP turns a process like this into a documented SOP with timestamped screenshots, and flags drift when your tools, forms, or state rules change underneath it. Generate your first SOP free at reccordsop.com.
Yes. The TCPA governs marketing text messages to US consumers regardless of your store's size or platform. If you send promotional SMS, you need express written consent, you have to respect quiet hours and opt-outs, and you have to keep records. The rules don't scale down for small brands.
Quiet hours are the times you can't send marketing texts, measured in the recipient's local time. The federal window is 8am to 9pm. Some states are stricter: Florida, Oklahoma, and Washington use 8am to 8pm, and Texas limits texts to 9am to 9pm on weekdays and Saturdays and noon to 9pm on Sundays. Send within the narrowest window your audience spans, or use a platform that enforces local quiet hours per recipient.
An active, unchecked opt-in for marketing texts specifically: a box the customer ticks or a keyword they send, shown with a clear disclosure of who's sending, that it's recurring marketing, the frequency, that rates apply, and how to opt out. A pre-checked box, a bundled 'I agree to terms,' or an existing email subscription does not count.
At least five years. For each opt-in, store the date, time, method, and the exact consent language the customer agreed to, and keep your opt-out suppression logs too. If a complaint comes, those records are your evidence, and a deleted record is the same as never having had consent.
$500 to $1,500 per message under the TCPA, applied per text rather than per campaign. For a brand sending thousands of messages, a single non-compliant send scales into serious liability, which is why class actions in this space settle in the millions.
I built ReccordSOP after watching too many DTC ops teams lose months to undocumented workflows. These SOPs are battle-tested with Shopify operators running $1M to $50M brands.
Last reviewed June 15, 2026
Most brands set up Klaviyo flows once and never revisit them. Here's the audit framework to keep them earning.
Macros silently break. Customers notice before you do. Here's the audit that catches broken macros before CSAT slides.
Most SOPs are wrong within 90 days of publishing. Here's how to detect it before it costs you a customer.
We use essential cookies for sign-in and a small amount of analytics to improve the product. Privacy policy.