Key Takeways
- TCPA penalties are $500/message (unintentional) to $1,500/message (willful) with no aggregate cap, making class-action exposure massive for non-compliant senders.
- True transactional OTP is generally exempt from TCPA's prior-express-written-consent requirement, but the boundary is narrow and easy to cross.
- TCPA and 10DLC are separate frameworks; TCPA keeps you out of court while 10DLC keeps your messages flowing through carriers.
- Eight-item compliance checklist: affirmative opt-in, minimal message content, STOP keyword honored, reasonable revocation channels, RND integration, audit logging, time-of-day restrictions, periodic legal review.
- The single most common TCPA violation: reusing OTP infrastructure for marketing without separate marketing consent.
The Telephone Consumer Protection Act of 1991 (TCPA) is the most-litigated consumer-protection statute in US business communications, and OTP messages are squarely in scope. A single non-compliant OTP campaign can produce class-action exposure of $500–$1,500 per message under TCPA's statutory damages; meaning a six-figure fine in weeks for a mid-volume sender that gets it wrong. This guide walks through what TCPA requires for OTP, how it differs from 10DLC compliance, the practical implementation defaults that keep you safe, and how a TCPA-compliant OTP API handles the heavy lifting for you.
What is TCPA and Why Does It Apply to OTP?
The TCPA is a federal US law that restricts businesses from sending automated messages or making automated calls to mobile phones without prior express consent. Originally aimed at telemarketing robocalls, it was expanded by FCC rulings to cover SMS messages — including transactional messages like OTP, in some interpretations.
The current consensus among regulators and case law is that true transactional OTP messages sent at the user's request, in response to a verification action they initiated — are generally exempt from TCPA's prior-express-written-consent requirements. The user effectively consented by entering their phone number and clicking "Send verification code." But the boundary is narrow: combine the OTP with marketing language, send unsolicited follow-ups, or fail to honor opt-out requests, and you cross into TCPA territory.
The FCC's TCPA guidance and the 2024 revocation rule are the authoritative regulatory documents. FTC enforcement records show that the typical TCPA litigation pattern in OTP contexts involves: messages sent after a STOP reply, messages sent to wrong numbers (porting/recycling), and OTP infrastructure used for non-OTP purposes.
TCPA Penalties: What's Actually At Stake
TCPA's statutory damages framework is what makes it the most-litigated consumer statute in the US:
- $500 per violation for unintentional violations
- $1,500 per violation for willful or knowing violations
- No cap on aggregate damages in private right-of-action lawsuits
- Class actions are common, multiplying single-recipient violations across thousands of users
A non-compliant OTP campaign sending 50,000 messages to numbers that should not have received them, classed as willful, faces theoretical exposure of $75 million. Real settlements typically come in well below the theoretical max — but seven and eight-figure TCPA settlements are routine in published case law, and a settlement amount is still a budget-killer.
TCPA vs 10DLC: Different Frameworks, Both Apply
Engineers and product teams new to US compliance frequently conflate TCPA and 10DLC. They're separate and both apply to OTP SMS in the USA:
TCPA10DLCType of ruleFederal statute (consumer protection)Carrier-enforced industry frameworkEnforced byFCC + private right of actionMobile carriers + The Campaign RegistryWhat it regulatesConsent for messages, opt-out handlingBrand and campaign registration for A2P SMSPenalty mechanismStatutory damages ($500–$1,500/message)Throttling, blocking, deregistrationCompliance scopeEvery message you sendEvery long code A2P sender
Practically: 10DLC keeps your messages flowing through carriers. TCPA keeps you out of court. You need both.
Express Written Consent for OTP
For pure transactional OTP at the user's affirmative request, "express written consent" generally means: the user entered their phone number on your website or app, clicked an action labeled clearly as a verification request (e.g., "Send verification code"), and your interface disclosed in plain language that an SMS would be sent and standard message rates may apply.
What raises TCPA risk:
Pre-checked consent boxes
The user must affirmatively check a box (or click a labeled button) — pre-checked checkboxes are not valid consent under TCPA case law.
Bundled marketing consent
Asking for OTP consent and marketing-message consent in the same checkbox is a TCPA red flag. Keep them separate.
Stale consent
Consent obtained more than 18 months prior, or for a different purpose, may no longer cover new OTP traffic. The 2024 FCC revocation rule explicitly clarified that consumers can revoke consent through any reasonable method, and businesses must honor revocation across all campaigns.
Number recycling
Carriers recycle disconnected numbers within months. The FCC's Reassigned Numbers Database is the canonical source for whether a number has been reassigned since you obtained consent. Most CPaaS providers integrate with the RND to automatically prevent sending to reassigned numbers.
TCPA-Compliant OTP Implementation Checklist
Eight defaults to bake in from day one:
1. Affirmative opt-in
The user clicks a clearly-labeled "Send verification code" button (no pre-checked boxes), and your UI discloses an SMS will be sent.
2. Minimal message content
The OTP message contains only the code, your brand name, the use case, and a STOP instruction. No marketing language, no upsells. A typical compliant OTP message: "Your VerifyNow code is 482917. Reply STOP to opt out."
3. STOP keyword honored automatically
Your platform must immediately stop sending to numbers that reply STOP, regardless of which campaign sent the original message.
4. Reasonable revocation channels
Per the 2024 FCC ruling, users can revoke consent through any reasonable method — STOP reply, account settings, customer service. Your support team needs a documented process for handling revocation requests across channels.
5. Reassigned number protection
Either integrate with the FCC's Reassigned Numbers Database directly or use a CPaaS that does. Sending OTP to a recycled number where the new owner didn't consent is a textbook TCPA violation.
6. Audit logging
Maintain logs of every consent capture (timestamp, IP, exact UI shown to user) and every OTP send. TCPA defense relies on producing the consent record. Logs should be retained for at least 4 years (the typical TCPA statute of limitations).
7. Time-of-day restrictions
Although transactional OTP messages are largely exempt from TCPA's 8 AM–9 PM window, building the restriction into your sending logic for non-emergency OTP (e.g., periodic re-verification) provides defense-in-depth.
8. Periodic compliance reviews
TCPA case law evolves. Annual review of your consent flows by counsel familiar with TCPA is cheap insurance. The 2024 revocation rule alone changed several common patterns.
How a TCPA-Compliant OTP API Reduces Your Risk
Compliance is shared between your application and your API provider. A TCPA-aware OTP API handles:
- STOP keyword processing — automatic suppression of the number across all your campaigns
- Reassigned Number Database integration — automatic blocking of OTP sends to recycled numbers
- Audit logging — complete consent and send records exportable for litigation defense
- 10DLC-compliant routing — prevents carrier-side blocking that compounds TCPA exposure
- Sender ID and message template review — flagging marketing-language drift in OTP templates before they ship
VerifyNow for USA incluye las cinco protecciones de la incorporación estándar, con una postura de cumplimiento documentada disponible para los clientes empresariales en virtud de un acuerdo de confidencialidad. La implementación automática de estas protecciones desde cero suele requerir una cuarta parte del trabajo de ingeniería específico; el uso de una CPaaS que cumpla con las normas lo reduce a una opción de configuración.
Errores comunes de TCPA en las implementaciones de OTP
Tres patrones que producen la mayoría de los litigios de la TCPA en el ámbito de la OTP:
Reutilización de la infraestructura OTP para la comercialización
«Tenemos el número de teléfono del usuario de OTP, enviemos una promoción». Este es el patrón de infracción de la TCPA más común. El marketing requiere un consentimiento por escrito, explícito y por separado, algo que no proporciona el registro de una OTP.
No cumplir con STOP en todas las campañas
El usuario responde STOP a tu OTP transaccional y tu CRM sigue enviando actualizaciones de pedidos de una campaña diferente. Cada uno de esos mensajes posteriores constituye una infracción de la TCPA.
Envío de OTP a números obtenidos de fuentes de datos de terceros
Es posible que los números de teléfono de las listas de clientes obtenidos de intermediarios de datos, herramientas de generación de clientes potenciales o integraciones de socios no tengan un consentimiento válido para sus mensajes. Verifica la procedencia antes de enviarlos.
Preguntas frecuentes
¿OTP está exenta de la TCPA?
En su mayoría, con salvedades. Los mensajes OTP transaccionales auténticos (que se envían a petición del usuario, en respuesta inmediata a una acción de verificación, con un contenido limitado al código de verificación y al identificador de marca) generalmente se consideran exentos de los requisitos de consentimiento previo y expreso por escrito de la TCPA porque el usuario ha dado su consentimiento efectivo al iniciar la acción. Sin embargo, los mensajes OTP con tintes de marketing, la OTP dirigida a números que no dan su consentimiento o la infraestructura OTP reutilizada para mensajes que no son OTP pueden provocar la exposición a la TCPA.
¿Cuál es la diferencia entre TCPA y CAN-SPAM?
CAN-SPAM regula el correo electrónico comercial. La TCPA regula las comunicaciones telefónicas, incluidos los SMS. Son leyes independientes con diferentes requisitos de consentimiento, mecanismos de exclusión y estructuras de penalización. El marketing por SMS requiere tanto la aceptación voluntaria que cumpla con la TCPA como la opción CAN-SPAM.
¿Se aplica la TCPA a los usuarios internacionales con números de EE. UU.?
La TCPA se aplica a los mensajes enviado a números de teléfono de EE. UU., independientemente de dónde provenga el mensaje o de dónde resida el usuario. Si sus mensajes OTP se envían a destinos de EE. UU., se aplica la TCPA. Los remitentes internacionales no están exentos.
Envíe OTP que cumpla con la TCPA sin la factura legal
Construir el cumplimiento de la TCPA desde cero es una cuarta parte de la ingeniería y una carga de revisión legal continua. VerifyNow para EE. UU. incluye valores predeterminados que cumplen con la TCPA (flujo de suscripción afirmativa, gestión de palabras clave de parada, integración de RND y registro de auditoría completo) para que su equipo pueda centrarse en enviar el producto en lugar de en los andamios de cumplimiento. Créditos de prueba gratuitos, no se requiere tarjeta de crédito.
.png){kind=small}
