A2P SMS compliance means pairing A2P 10DLC registration with documented opt-in consent, an SMS-specific privacy policy, a complete business website, and opt-out handling that actually works. A2P 10DLC registration gets your number approved to send SMS — it doesn’t, by itself, make your actual messaging practices legally compliant. This checklist covers the opt-in, privacy policy, and website requirements that sit alongside registration, pulling together what’s needed for both carrier approval and genuine TCPA compliance in one practical reference.
This is deliberately the most legally-oriented piece in this series — the rest of this A2P guide collection focuses on getting messages to deliver technically; this one focuses on what has to be true about how you collect consent and handle opt-outs so that delivering those messages doesn’t expose your business to real financial and legal risk. Both matter, and neither substitutes for the other.
$500–$1,500
Statutory TCPA damages per violation, per message sent
2 systems
A2P registration (carrier) and TCPA (federal law) are separate requirements
1 record
Per-contact, timestamped opt-in proof — not just a general policy
A2P registration vs. TCPA compliance: not the same thing
This distinction trips up a lot of businesses who assume getting approved by carriers means they’re legally covered. They’re related but genuinely separate:
Governed by
- A2P 10DLC Registration
- Carriers / The Campaign Registry
- TCPA Compliance
- Federal law (FCC)
What it affects
- A2P 10DLC Registration
- Whether messages deliver at all
- TCPA Compliance
- Legal liability for how you message
Penalty for non-compliance
- A2P 10DLC Registration
- Filtering, throttling, suspension
- TCPA Compliance
- Statutory damages, $500–$1,500/violation
One covers the other?
- A2P 10DLC Registration
- TCPA Compliance
| A2P 10DLC Registration | TCPA Compliance | |
|---|---|---|
| Governed by | Carriers / The Campaign Registry | Federal law (FCC) |
| What it affects | Whether messages deliver at all | Legal liability for how you message |
| Penalty for non-compliance | Filtering, throttling, suspension | Statutory damages, $500–$1,500/violation |
| One covers the other? |
You need both. Being fully A2P-registered and approved doesn’t protect you from a TCPA claim if your actual consent practices are inadequate — and conversely, solid TCPA-compliant consent practices don’t help your messages deliver if you’re not properly A2P registered (see our complete guide to what A2P 10DLC is for the registration side).
| Item | Value |
|---|---|
| Negligent violation | 500 |
| Willful violation (up to) | 1500 |
What does a compliant SMS opt-in need?
A compliant SMS opt-in needs a clear consent statement, a “message and data rates may apply” disclosure, STOP opt-out instructions, a privacy policy link, an unchecked checkbox, and a captured consent timestamp.
☐
Clear statement of what the contact is consenting to receive
☐
"Message and data rates may apply" disclosure included
☐
Opt-out instructions clearly stated (typically "Reply STOP")
☐
Link to privacy policy included near the consent point
☐
Checkbox not pre-checked (affirmative, active consent)
☐
Consent timestamp and source captured and retained
A pre-checked consent checkbox is one of the more common compliance mistakes we see, and it’s a meaningful one — affirmative consent generally requires an active action from the contact, not a default state they’d need to notice and uncheck. If your GoHighLevel form has a pre-checked SMS consent box, that’s worth fixing before it becomes a documented pattern across your contact list.
If you registered through GoHighLevel’s Chat Widget (Pre-Built) Campaign path, the chat widget itself is your opt-in point: its disclosure language is locked, it shows separate consent checkboxes when you choose Mixed messaging, and it must be the only place your site collects SMS consent — so remove SMS consent checkboxes from every other form. The path is available to both Standard and Sole Proprietor accounts (HighLevel changelog).
What does an SMS privacy policy need to include?
An SMS privacy policy needs to state that you collect phone numbers for SMS, what message types to expect, that message and data rates may apply, how to opt out, and whether numbers are shared with third parties.
A generic privacy policy that never mentions SMS specifically is weaker evidence of compliant practice than one with a dedicated section. At minimum, your privacy policy should address:
- That you collect phone numbers for SMS communication purposes
- What types of messages contacts can expect (transactional, promotional, or both)
- That message and data rates may apply
- How a contact can opt out at any time
- That phone numbers aren’t shared with third parties for their own marketing purposes (unless you genuinely do this, in which case disclose it explicitly)
Website requirements beyond the opt-in form itself
Carriers and TCPA both benefit from — and in the case of A2P registration, actively check for — a business website that’s genuinely complete and consistent with what you’re registering:
A live, accessible website — not under construction, not returning errors, with basic business information (what you do, how to contact you) clearly present. If you don’t have one yet, a professionally built business website is the first item to check off.
A findable privacy policy, linked from a standard location (footer is typical) and specifically addressing SMS as covered above.
Terms of service, if you have one, that don’t contradict your privacy policy’s SMS language — a mismatch between two policy documents on the same site is a subtle but real credibility problem if either is ever scrutinized.
Documenting consent properly in GoHighLevel
Beyond having the right language on your forms, you need to actually capture and retain proof of consent per contact. In GoHighLevel, this generally means: using a native form or survey with the consent checkbox built in (rather than an external form whose consent capture isn’t tied to your CRM record — worth double-checking if leads arrive through a Facebook Lead Ads to GoHighLevel webhook integration), confirming the form submission timestamp and source are retained on the contact record, and — for verbal opt-ins (a customer agreeing to texts over the phone) — documenting that consent explicitly in the contact’s notes or a custom field at the time it happens, not relying on memory or assumption later.
If you’re importing a contact list from a previous system or acquiring contacts through a source other than your own opt-in form (a purchased list, a trade show sign-up sheet), don’t assume SMS consent transfers automatically. Verify what, specifically, those contacts consented to, and consider a re-permission campaign (via email, which carries different consent rules than SMS) before adding them to SMS automation.
Honoring opt-outs correctly
“STOP” needs to actually stop everything, immediately. A contact who replies STOP to one campaign or workflow should stop receiving messages from your business entirely, not just from that specific automation — partial opt-out handling (stopping one workflow while others continue messaging the same contact) is both a poor practice and a compliance risk.
Confirm your STOP handling with a real test. Text STOP from a test number to your live number and confirm no further automated messages fire to that number afterward, across every active workflow — don’t just assume your platform’s default STOP handling covers every GoHighLevel automation and workflow you’ve built.
Keep an opt-out list separate from simple contact deletion. Deleting an opted-out contact from your CRM entirely can, depending on how your systems interact, result in that number being re-added later (via a new form submission, a data import) without carrying forward their opt-out status. Maintaining an explicit suppression list, not just relying on deletion, is a safer long-term pattern.
Auditing an existing SMS program for compliance gaps
If you’re not launching fresh but reviewing an SMS program that’s already running, a focused audit is more useful than trying to rebuild everything from scratch. Pull a random sample of 10–15 contacts currently receiving automated SMS and, for each one, verify you can answer: when and how did they opt in, is that timestamp and source still retrievable in their contact record, and does their consent scope (what they agreed to receive) match what they’re actually being sent today. Gaps found in this kind of sample audit are worth treating as representative of your broader list, not isolated exceptions — if 3 of 15 sampled contacts have no retrievable consent record, that ratio likely holds roughly across your full list, and it’s worth treating as a program-wide gap to close rather than a handful of individual oversights.
A pre-launch compliance checklist, all in one place
☐
A2P 10DLC (or toll-free) registration approved and linked
☐
Opt-in checkbox present, unchecked by default, clearly worded
☐
Privacy policy specifically addresses SMS data use and opt-out
☐
Consent timestamp and source captured on the contact record
☐
STOP handling tested and confirmed across all active workflows
☐
No purchased or unverified lists added to SMS automation without re-permission
Not sure whether your business should register a 10-digit number or verify a toll-free one for that first item? Our toll-free vs. A2P 10DLC comparison for GoHighLevel walks through the trade-offs.
TCPA basics every GoHighLevel user should understand
The Telephone Consumer Protection Act is the primary federal law governing SMS (and call) consent in the US, and a few of its core provisions are worth understanding directly rather than just following a checklist without knowing why:
Express consent is generally required before sending marketing/promotional texts. This means an affirmative action from the recipient — checking a box, replying to opt in, verbally agreeing on a recorded or documented call — not an assumption based on an existing business relationship alone.
Written consent requirements can be stricter for certain message types. Some categories of messaging (particularly anything using an autodialer for marketing purposes) require “express written consent” specifically, a higher bar than general express consent, which is part of why documenting the exact form and timestamp of consent matters, not just that consent existed in some general sense.
Consent can be revoked at any time, through any reasonable means. A contact doesn’t have to use your specific “Reply STOP” mechanism to revoke consent — a clear verbal or written request to stop texting them, through any channel, legally counts as revocation, and continuing to message after any such clear request creates exposure regardless of whether they used your preferred opt-out method.
Time-of-day restrictions apply. Most SMS marketing guidance (extending from parallel telemarketing call restrictions) recommends avoiding sends before 8 AM or after 9 PM in the recipient’s time zone — GoHighLevel workflows sending to a national contact list should account for recipient time zone, not just your own business hours, when scheduling automated sends.
This section is a practical overview, not legal advice — TCPA case law and FCC guidance continue to evolve, and specific situations (multi-state operations, certain industries with additional regulatory layers) can have nuances beyond general guidance. For anything beyond straightforward, well-documented consent practices, consulting an attorney familiar with TCPA specifically is a reasonable investment relative to the statutory damages at stake.
State-level laws beyond TCPA
TCPA is a federal floor, not a ceiling — several states have their own additional SMS/telemarketing consent laws that can impose stricter requirements than federal law alone. Florida’s Telephone Solicitation Act and Washington’s Commercial Electronic Mail Act are commonly cited examples with SMS-relevant provisions beyond TCPA’s baseline. If your contact list spans multiple states (common for any business with an online presence or a website drawing inquiries beyond its immediate local area), it’s worth at least being aware that state-level requirements can layer on top of TCPA rather than assuming federal compliance alone covers you nationwide.
A worked example: compliant vs. non-compliant opt-in
Non-compliant pattern: A website form has a single “Submit” button with small, gray text below it reading “By submitting you agree to our terms,” where “terms” links to a generic terms-of-service page that doesn’t mention SMS at all. No separate SMS consent checkbox exists. Contacts who submit the form are added directly to an SMS nurture sequence.
Compliant pattern: The same form includes a clearly visible, unchecked checkbox reading “I agree to receive appointment reminders and occasional promotional texts from [Business Name]. Message and data rates may apply. Reply STOP to opt out. See our Privacy Policy.” The privacy policy link opens to a policy with a dedicated SMS section. The form submission timestamp and the checked state of the SMS consent box are both captured on the resulting GoHighLevel contact record.
Non-compliant vs. compliant opt-in, from the worked example above
| Element | Non-compliant pattern | Compliant pattern |
|---|---|---|
| SMS consent checkbox | None — a single Submit button | Clearly visible and unchecked by default |
| Consent language | "By submitting you agree to our terms" | Names the message types, rates disclosure, and "Reply STOP" |
| Policy link | Generic terms of service with no SMS mention | Privacy policy with a dedicated SMS section |
| Consent record | Contact added straight to an SMS nurture sequence | Submission timestamp and checkbox state captured on the contact record |
The difference in actual friction to implement is minimal — a checkbox and a sentence of policy language — but the difference in compliance posture and evidentiary record if consent is ever questioned is substantial.
How long should you keep SMS consent records?
Keep SMS consent records for as long as you’re actively messaging a contact, plus a buffer commonly recommended at 4+ years to align with typical statute-of-limitations windows.
There’s no single universal retention period mandated for SMS consent records, but a reasonable, defensible practice is retaining consent documentation for as long as you’re actively messaging that contact, plus a reasonable buffer afterward (commonly recommended at 4+ years, aligning with typical statute-of-limitations windows for related claims) rather than treating it as safe to delete as soon as a contact goes inactive. If you’re using GoHighLevel’s native form and workflow logging, this retention often happens automatically as part of standard contact record history — but it’s worth confirming that history isn’t being purged by an overly aggressive data-cleanup process or automation that doesn’t distinguish between removing stale marketing data and removing legally relevant consent records.
Industry-specific compliance considerations
Healthcare and dental practices should ensure SMS consent and privacy language accounts for HIPAA-adjacent considerations if appointment-related texts could reference any protected health information — generic appointment reminders without specific health details are lower-risk, but anything more specific deserves a closer compliance look. The same care applies to the opt-in forms on a dental practice website.
Financial services face TCPA’s already-strict requirements plus additional scrutiny given the categories of debt-related and lending-related messaging that are restricted or prohibited outright at the A2P registration level, covered in our guide to A2P registration rejection reasons and fixes.
Real estate and mortgage (including teams capturing leads on a real estate website) should be particularly careful about consent scope specificity — a contact who consented to receive listing alerts hasn’t necessarily consented to broader marketing texts, and treating all consent as interchangeable across message types is a common, avoidable compliance gap in this industry specifically.
Frequently asked compliance questions
“If a contact texts my business first, can I text them back without separate opt-in?” Generally yes for direct replies within that conversation — responding to an inbound text is different from initiating new automated marketing to that number. This doesn’t necessarily extend to adding them to a broader automated nurture sequence without more explicit consent for that specific use.
“Does GoHighLevel handle TCPA compliance for me automatically?” No — GoHighLevel provides the tools (forms, consent checkboxes, workflow logic, contact record fields) to build compliant consent capture and honor opt-outs correctly, but the actual compliance outcome depends entirely on how you configure and use those tools. The platform doesn’t enforce compliant consent language or block a poorly-configured form from collecting numbers without proper consent.
“What should I do if I discover I’ve been messaging contacts without adequate consent documentation?” Stop sending to any contact whose consent status is unclear or undocumented until you can verify or re-establish proper consent, and consider a compliant re-permission campaign (via email, which carries different consent rules) for affected contacts rather than continuing to text an unverified list while you sort it out.
Bringing it together
A2P registration and genuine SMS compliance are two different requirements that both need to be satisfied — one governs whether your messages deliver, the other governs your legal exposure for how you message. Build real, documented consent capture into your GoHighLevel forms and workflows from the start, keep your privacy policy specific to SMS rather than generic, and treat opt-out handling as something to test and verify, not just assume works correctly. Getting both pieces right isn’t just risk mitigation — it’s also, not coincidentally, exactly the kind of business carriers trust with better throughput and fewer carrier filtering problems over time.
Treat this checklist as a living reference, not a one-time setup task — revisit it whenever you launch a new SMS workflow, add a new lead-capture form, or import a new contact list, rather than assuming the compliance work you did once at the very beginning still covers everything you’ve built since. This guide closes out our full A2P 10DLC series — for the registration mechanics this compliance layer sits alongside, start with our complete A2P 10DLC guide if you haven’t already, or revisit any of the other guides linked throughout this piece for the specific step you’re working through.
Written by the Hireaghlva GoHighLevel team
We build and run GoHighLevel accounts, automations, dashboards, and websites for agencies and local businesses across the US and Canada. This guide reflects that hands-on work, with sources cited inline where we reference outside data.
