June 9, 2026 · 5 min read
A TCPA Compliance Close Call in an SMS Marketing Campaign
The campaign had opt-in consent on file for every recipient. The close call came from a detail about how that consent was originally collected.
Every contact on the SMS send list had technically opted in. That's the part that made this close call unsettling — it wasn't a missing-consent problem, which is the failure mode most compliance checklists are built to catch. It was a consent-scope problem, which most checklists don't.
What the consent actually covered
The original opt-in language, collected through a checkout flow months earlier, consented to 'order and shipping updates via SMS.' The campaign we were about to send was a promotional discount offer, not an order update. Under TCPA, consent language scope matters — consent for transactional messages doesn't automatically extend to marketing messages, even from contacts who clearly did opt into something.
Having consent on file isn't the same as having consent for the message you're about to send. The scope of the opt-in matters as much as the fact of it.
How it was caught
A compliance review step we'd added after a different client's near-miss required pulling the exact original opt-in language for any new campaign type before sending, rather than assuming blanket consent from an existing opted-in list. That one review step caught the mismatch two days before send.
- We segmented the list into transactional-consent-only versus marketing-consent contacts, and held the promotional send to the marketing-consent segment only.
- We ran a re-consent campaign for the transactional-only segment, explicitly asking if they wanted promotional messages too, rather than assuming or guessing.
- Original opt-in language is now archived and tagged by consent scope at the point of collection, not reconstructed after the fact when a campaign needs it.
- This cost us roughly 60% of the intended send list for that specific campaign, but it avoided a compliance exposure that would have cost far more than the lost reach.
The uncomfortable lesson is that most TCPA risk reviews ask 'do we have consent' when the sharper question is 'do we have consent for this specific message, collected with language that actually covers it.' Those are different questions, and only one of them is usually being asked.