.svg%20(1).png)
Key Takeways
- TCPA penalties are $500/message (unintentional) to $1,500/message (willful) with no aggregate cap, making class-action exposure massive for non-compliant senders.
- True transactional OTP is generally exempt from TCPA's prior-express-written-consent requirement, but the boundary is narrow and easy to cross.
- TCPA and 10DLC are separate frameworks; TCPA keeps you out of court while 10DLC keeps your messages flowing through carriers.
- Eight-item compliance checklist: affirmative opt-in, minimal message content, STOP keyword honored, reasonable revocation channels, RND integration, audit logging, time-of-day restrictions, periodic legal review.
- The single most common TCPA violation: reusing OTP infrastructure for marketing without separate marketing consent.
The Telephone Consumer Protection Act of 1991 (TCPA) is the most-litigated consumer-protection statute in US business communications, and OTP messages are squarely in scope. A single non-compliant OTP campaign can produce class-action exposure of $500–$1,500 per message under TCPA's statutory damages; meaning a six-figure fine in weeks for a mid-volume sender that gets it wrong. This guide walks through what TCPA requires for OTP, how it differs from 10DLC compliance, the practical implementation defaults that keep you safe, and how a TCPA-compliant OTP API handles the heavy lifting for you.
What is TCPA and Why Does It Apply to OTP?
The TCPA is a federal US law that restricts businesses from sending automated messages or making automated calls to mobile phones without prior express consent. Originally aimed at telemarketing robocalls, it was expanded by FCC rulings to cover SMS messages — including transactional messages like OTP, in some interpretations.
The current consensus among regulators and case law is that true transactional OTP messages sent at the user's request, in response to a verification action they initiated — are generally exempt from TCPA's prior-express-written-consent requirements. The user effectively consented by entering their phone number and clicking "Send verification code." But the boundary is narrow: combine the OTP with marketing language, send unsolicited follow-ups, or fail to honor opt-out requests, and you cross into TCPA territory.
The FCC's TCPA guidance and the 2024 revocation rule are the authoritative regulatory documents. FTC enforcement records show that the typical TCPA litigation pattern in OTP contexts involves: messages sent after a STOP reply, messages sent to wrong numbers (porting/recycling), and OTP infrastructure used for non-OTP purposes.
TCPA Penalties: What's Actually At Stake
TCPA's statutory damages framework is what makes it the most-litigated consumer statute in the US:
- $500 per violation for unintentional violations
- $1,500 per violation for willful or knowing violations
- No cap on aggregate damages in private right-of-action lawsuits
- Class actions are common, multiplying single-recipient violations across thousands of users
A non-compliant OTP campaign sending 50,000 messages to numbers that should not have received them, classed as willful, faces theoretical exposure of $75 million. Real settlements typically come in well below the theoretical max — but seven and eight-figure TCPA settlements are routine in published case law, and a settlement amount is still a budget-killer.
TCPA vs 10DLC: Different Frameworks, Both Apply
Engineers and product teams new to US compliance frequently conflate TCPA and 10DLC. They're separate and both apply to OTP SMS in the USA:
TCPA10DLCType of ruleFederal statute (consumer protection)Carrier-enforced industry frameworkEnforced byFCC + private right of actionMobile carriers + The Campaign RegistryWhat it regulatesConsent for messages, opt-out handlingBrand and campaign registration for A2P SMSPenalty mechanismStatutory damages ($500–$1,500/message)Throttling, blocking, deregistrationCompliance scopeEvery message you sendEvery long code A2P sender
Practically: 10DLC keeps your messages flowing through carriers. TCPA keeps you out of court. You need both.
Express Written Consent for OTP
For pure transactional OTP at the user's affirmative request, "express written consent" generally means: the user entered their phone number on your website or app, clicked an action labeled clearly as a verification request (e.g., "Send verification code"), and your interface disclosed in plain language that an SMS would be sent and standard message rates may apply.
What raises TCPA risk:
Pre-checked consent boxes
The user must affirmatively check a box (or click a labeled button) — pre-checked checkboxes are not valid consent under TCPA case law.
Bundled marketing consent
Asking for OTP consent and marketing-message consent in the same checkbox is a TCPA red flag. Keep them separate.
Stale consent
Consent obtained more than 18 months prior, or for a different purpose, may no longer cover new OTP traffic. The 2024 FCC revocation rule explicitly clarified that consumers can revoke consent through any reasonable method, and businesses must honor revocation across all campaigns.
Number recycling
Carriers recycle disconnected numbers within months. The FCC's Reassigned Numbers Database is the canonical source for whether a number has been reassigned since you obtained consent. Most CPaaS providers integrate with the RND to automatically prevent sending to reassigned numbers.
TCPA-Compliant OTP Implementation Checklist
Eight defaults to bake in from day one:
1. Affirmative opt-in
The user clicks a clearly-labeled "Send verification code" button (no pre-checked boxes), and your UI discloses an SMS will be sent.
2. Minimal message content
The OTP message contains only the code, your brand name, the use case, and a STOP instruction. No marketing language, no upsells. A typical compliant OTP message: "Your VerifyNow code is 482917. Reply STOP to opt out."
3. STOP keyword honored automatically
Your platform must immediately stop sending to numbers that reply STOP, regardless of which campaign sent the original message.
4. Reasonable revocation channels
Per the 2024 FCC ruling, users can revoke consent through any reasonable method — STOP reply, account settings, customer service. Your support team needs a documented process for handling revocation requests across channels.
5. Reassigned number protection
Either integrate with the FCC's Reassigned Numbers Database directly or use a CPaaS that does. Sending OTP to a recycled number where the new owner didn't consent is a textbook TCPA violation.
6. Audit logging
Maintain logs of every consent capture (timestamp, IP, exact UI shown to user) and every OTP send. TCPA defense relies on producing the consent record. Logs should be retained for at least 4 years (the typical TCPA statute of limitations).
7. Time-of-day restrictions
Although transactional OTP messages are largely exempt from TCPA's 8 AM–9 PM window, building the restriction into your sending logic for non-emergency OTP (e.g., periodic re-verification) provides defense-in-depth.
8. Periodic compliance reviews
TCPA case law evolves. Annual review of your consent flows by counsel familiar with TCPA is cheap insurance. The 2024 revocation rule alone changed several common patterns.
How a TCPA-Compliant OTP API Reduces Your Risk
Compliance is shared between your application and your API provider. A TCPA-aware OTP API handles:
- STOP keyword processing — automatic suppression of the number across all your campaigns
- Reassigned Number Database integration — automatic blocking of OTP sends to recycled numbers
- Audit logging — complete consent and send records exportable for litigation defense
- 10DLC-compliant routing — prevents carrier-side blocking that compounds TCPA exposure
- Sender ID and message template review — flagging marketing-language drift in OTP templates before they ship
VerifyNow for USA inclui todas as cinco proteções na integração padrão, com uma postura de conformidade documentada disponível para clientes corporativos sob NDA. A autoimplementação dessas proteções do zero normalmente exige um quarto do trabalho de engenharia focado; o uso de um CPaaS compatível o reduz a uma opção de configuração.
Erros comuns de TCPA em implementações de OTP
Três padrões que produzem a maioria dos litígios de TCPA no espaço OTP:
Reutilizando a infraestrutura OTP para marketing
“Temos o número de telefone do usuário da OTP, vamos enviar uma promoção.” Esse é o padrão de violação de TCPA mais comum. O marketing exige um consentimento separado, explícito e por escrito que uma inscrição OTP não fornece.
Deixar de honrar o STOP em todas as campanhas
O usuário responde STOP à sua OTP transacional, seu CRM continua enviando atualizações de pedidos de uma campanha diferente. Cada uma dessas mensagens subsequentes é uma violação do TCPA.
Envio de OTP para números obtidos de fontes de dados de terceiros
Os números de telefone nas listas de clientes obtidas de corretores de dados, ferramentas de geração de leads ou integrações de parceiros podem não ter consentimento válido para suas mensagens. Verifique a procedência antes de enviar.
Perguntas frequentes
O OTP está isento do TCPA?
Principalmente, com ressalvas. Mensagens OTP transacionais verdadeiras — enviadas a pedido do usuário, em resposta imediata a uma ação de verificação, com conteúdo limitado ao código de verificação e ao identificador da marca — geralmente são consideradas isentas dos requisitos de consentimento prévio expresso por escrito do TCPA porque o usuário efetivamente consentiu ao iniciar a ação. Mas mensagens OTP com toque de marketing, OTP para números sem consentimento ou infraestrutura OTP reaproveitada para mensagens não OTP podem desencadear a exposição ao TCPA.
Qual é a diferença entre TCPA e CAN-SPAM?
O CAN-SPAM regula o e-mail comercial. O TCPA regula as comunicações por telefone, incluindo SMS. Eles são estatutos separados com diferentes requisitos de consentimento, mecanismos de exclusão e estruturas de penalidades. O marketing por SMS exige tanto a aceitação compatível com TCPA quanto a exclusão no estilo CAN-spam.
O TCPA se aplica a usuários internacionais em números dos EUA?
O TCPA se aplica às mensagens enviado para números de telefone dos EUA, independentemente da origem da mensagem ou de onde o usuário reside. Se suas mensagens OTP forem roteadas para destinos nos EUA, o TCPA se aplica. Os remetentes internacionais não estão isentos.
Envie OTP compatível com TCPA sem a lei legal
Construir a conformidade com o TCPA do zero é um quarto da engenharia e uma carga contínua de revisão legal. VerifyNow para os EUA inclui padrões compatíveis com TCPA — fluxo de aceitação afirmativa, tratamento de palavras-chave STOP, integração com RND e registro completo de auditoria — para que sua equipe possa se concentrar no envio do produto em vez de na estrutura de conformidade. Créditos de teste gratuitos, sem necessidade de cartão de crédito.
.png){kind=small}
