Picture this: It’s Black Friday. You’ve queued up a massive SMS blast to your 50,000 subscribers using Klaviyo or Attentive. You hit send. Sales start rolling in, and you feel like a genius.
Three weeks later, the sales have stopped, but a certified letter arrives at your office. It’s not a fan letter. It’s a demand letter from a law firm you’ve never heard of, representing a “customer” you don’t know. They are suing you for violating the Telephone Consumer Protection Act (TCPA). The penalty? $1,500 per text message. Do the math. That’s a bankruptcy-level event.
In 2026, SMS marketing is the Wild West. While open rates are huge, so is the risk. There is an entire industry of “Professional Plaintiffs”—people who buy burner phones, sign up for lists specifically to catch you slipping, and then sue for millions. I’ve seen profitable brands wiped out because they forgot a simple checkbox. Here is how to keep your business safe without killing your revenue.
The “Pre-Checked” Box Trap
This is the most common mistake I see on Shopify stores. You want to grow your list, so you make it easy.
The Scenario: A customer gets to your checkout page. The box that says “Sign up for exclusive offers via text” is already checked by default. Or maybe you buried the consent language in a tiny font that no human can read.
The Reality: Illegal. Period.
Under the latest FCC rulings, consent must be “Express Written Consent.” The user must physically click the box themselves. It cannot be pre-filled. If you are using a legacy theme or an old pop-up tool that pre-checks that box, turn it off immediately. You are practically inviting a class-action lawsuit.
The “Quiet Hours” Nightmare (Florida & Oklahoma)
You live in New York. You send a text blast at 8:30 PM EST. It seems reasonable, right?
The Trap: Your customer lives in California, where it’s 5:30 PM. Totally fine.
But wait. You have a customer in Florida. In Florida, the “Mini-TCPA” laws are incredibly strict. If you text a resident outside of the hours of 8 AM to 8 PM (their local time), you are liable.
The Fix: Stop trying to guess time zones manually. Ensure your SMS platform (Attentive, Postscript, Yotpo) has “Smart Sending” or “Quiet Hours” enforcement enabled by default. If your software doesn’t automatically suppress messages based on the recipient’s zip code, switch software. It’s not worth the risk.
The “Litigator Scrub” Strategy
Here is a secret that the gurus don’t tell you. You can actually block the people who are likely to sue you.
The Tech: Services like The Blacklist Alliance or generic “Litigator Scrub” databases maintain lists of known serial plaintiffs—people who have filed dozens of TCPA lawsuits.
The Move: Before you import a new list of CSV contacts you got from a trade show (which is already risky, by the way), run it through a scrubber. If a phone number matches a known litigator, purge it. Delete it. Burn it.
Why would you invite a shark into your swimming pool?
The Abandoned Cart “Harassment”
We all love abandoned cart flows. They print money. But in 2026, volume matters.
The Rule: “One is marketing; two is aggressive; three is harassment.”
If a customer leaves a cart and you send them:
1. A text after 15 minutes.
2. A text after 4 hours.
3. A text the next morning.
You are walking a very thin line.
The Best Practice: Limit your SMS abandoned cart flow to one single message. Use email for the follow-ups. Email is regulated by CAN-SPAM, which is far more lenient than the TCPA. Don’t poke the bear with text messages.
The “Human” Audit (Do It Yourself)
Don’t trust your settings. Software glitches happen.
The Test: Go to your own website. Buy something. Abandon a cart.
Take screenshots of the signup flow.
Does the legal disclaimer explicitly say: “Consent is not a condition of purchase”?
Does it link to your Privacy Policy?
Take a screenshot of the text you receive. Does it have “STOP to opt out” clearly visible?
Save these screenshots. In court, these are your “Exhibits A and B.” Proving that you tried to comply can sometimes be the difference between a willful violation (triple damages) and an accidental one.
Final Word: SMS is powerful, but it’s a loaded gun. Don’t hand it to an intern. Review your legal language today. If you aren’t sure, pay a TCPA defense lawyer for one hour of their time to audit your checkout. Spending $500 now is better than spending $500,000 later.