TCPA compliance software: what each layer actually does

"TCPA compliance software" covers a lot of different products. One vendor means a litigator scrub. Another means a consent-capture widget for web forms. A third means its dialer holds calls outside legal hours. They are all real, they are all useful, and none of them is the whole job. If you're a compliance or ops lead with a budget line labelled "TCPA," you need to know which layer each purchase covers. Otherwise you can end up paying twice for scrubbing and having nothing at all for consent records.

This post splits TCPA compliance into five layers: consent capture, DNC and litigator scrubbing, number validation, calling-hour controls and audit logs. For each one, it covers what the layer does, what it doesn't do, and whether your SMS platform or dialer should handle it natively or whether a separate tool is the right call. We make Ready, so we'll say where Ready covers a layer and where it doesn't.

The five layers, side by side

Notice what the table doesn't have: a row that says "you're covered." Compliance stays the sender's responsibility no matter how many layers you buy. The tools reduce risk. They don't transfer it.

Consent capture: the layer most software doesn't own

The TCPA case usually comes down to one question: can you prove this person agreed? Marketing texts generally need prior express written consent. Our post on prior express written consent vs implied consent covers that distinction.

The proof that answers the question gets created at the moment of opt-in, which is on your website form, checkout page or lead vendor's landing page. It is not created at the moment of sending. So the system that holds the consent record is usually your form tool, your ecommerce store or your CRM, not your texting platform. A useful consent record keeps:

• The phone number and the timestamp of opt-in
• The exact disclosure wording the person saw
• The page URL or source
• Ideally the IP address or session data

Be skeptical of any SMS platform that claims to "handle consent" for you. Ready doesn't store per-contact opt-in records. What Ready records is the sender's attestation: every bulk send and every API send that sets consent_attested logs who sent it, to how many people and when, and the sender confirms that recipients agreed. In the API, that is the consent_attested field: (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)

POST https://api.tryready.com/v1/messages
X-API-Key: <key>
Idempotency-Key: 7c1e4f2a-9b3d-4e8a-a1f0-2d6c5b8e9f13

{"to": "+12125550199", "body": "Your order #1042 has shipped.", "consent_attested": true}

That attestation is a useful audit artifact. It shows a named sender took responsibility for consent on a specific send. It doesn't replace the opt-in record, and a keyword reply doesn't create one either. Keep the opt-in record in the store or CRM where the opt-in happened. How to document SMS consent so it holds up walks through what to save. If you buy leads, the vendor's consent proof matters as much as your own.

Native or add-on? Add-on, or more accurately "your own systems." No messaging platform sees the form your contact filled out.

DNC and litigator scrubbing: two lists, one purchase

These lists get lumped together, but they catch different people:

• The DNC registry catches people who said "don't contact me" to everyone.
• Litigator lists catch people who file TCPA suits often. Some are on the DNC registry and some aren't.

You can scrub a list against the national DNC and still text a serial plaintiff. Our post on the three lists compliance teams confuse explains why that happens.

Ready's TCPA and DNC Litigator Scrub checks each number against known TCPA-litigator lists and DNC-complainer lists in one pass, and flags matches. There are two ways to pay for it:

1. Standalone scrub: $0.005 per contact. Run it on a list before you import it, or one number at a time through GET /v1/scrub/:phone.
2. Send-time scrubbing: $0.003 extra per segment on every send, when it's switched on for the account. It's off by default.

Worked example: scrubbing a 10,000-contact opted-in list

Assumptions: 10,000 consented contacts, and a single-segment message of 160 GSM-7 characters or fewer with no emoji.

• Standalone scrub before import: 10,000 × $0.005 = $50, paid once per list pull.
• Send-time scrubbing on one campaign: 10,000 × 1 segment × $0.003 = $30, added to the base send cost of 10,000 × $0.0075. The rate part of that base cost is $75.
• If the message runs to 2 segments, send-time scrubbing doubles to $60. It's metered per segment, not per contact.

Ready's all-in prices per segment include the carrier fee but not screening: Scrub lists and Number validation, the two switches in Settings under Compliance, each add $0.003 per segment when switched on, shown as screening on your bill, and both are off by default. Unless you turn the opt-out footer off, the first text to each contact, and one again from time to time, also gets "Reply STOP to opt out" and your business name if the message does not already have them, so a text close to the segment limit can bill one more segment.

TCPA statutory damages run $500 to $1,500 per text. A single matched litigator on a 3-text drip campaign represents up to $4,500 in exposure before legal fees. That's the reason $50 for a list scrub is usually an easy yes. The math on one lawsuit vs scrubbing your whole list works through it in more detail.

For a stable list you text often, the standalone scrub before import is usually the cheaper of the two. Send-time scrubbing is better when contacts flow in continuously from forms and integrations and nobody owns the "scrub before import" step.

Native or add-on? Either works. What matters is that the scrub actually happens on every list, every time. A scrub built into the send path is harder to forget.

Number validation: the quiet cost saver

Texting a landline wastes money and tells you nothing. Validation flags landlines and invalid numbers before the send. Ready offers a per-number lookup at GET /v1/validate/:phone, plus account-level landline validation at $0.003 per segment, which is off by default.

Ready refuses numbers it has already seen as landlines on every account, and landline validation adds a send-time lookup for the rest. Don't assume your platform drops every landline unless you've checked how it knows.

Validation also doesn't tell you whether a number has been reassigned to a new person since they opted in. That's a separate check against the FCC's database, covered in our guide to the reassigned numbers database. Ready doesn't query that database. If your lists age (old leads, re-engagement campaigns), budget a separate tool for it.

Calling-hour controls: this one has to be native

A quiet-hours rule that lives in a policy document gets broken the first time someone schedules a campaign at 7 PM Eastern for a list that includes Hawaii. Quiet hours only work when the sending system enforces them per recipient, using the recipient's local time rather than the sender's. Several states also set narrower windows than the federal 8 AM to 9 PM baseline. TCPA calling hours by state lists them.

Ready holds campaign and drip texts that would land outside permitted local hours, based on the recipient's area (a one-off or API text is held only if the window opens within about 6 hours, otherwise it is refused). It sends held texts once the window opens, and charges for each text only when it actually sends. If a text can't go out within 24 hours of its window, or before your campaign's deadline, it's skipped and the campaign shows why.

Native or add-on? Native, and close to non-negotiable. If a platform can't hold a send per recipient time zone, that's a gap no add-on fills cleanly.

Opt-out handling: also non-negotiable

Here is the test question for any vendor: if someone replies STOP to a marketing campaign, can any other campaign, drip campaign or API call on the account still text them? The answer should be no.

On Ready, inbound STOP and UNSUBSCRIBE are honored automatically, and the opt-out propagates across campaigns. A later send to that number is refused up front and not charged. You can read the list through GET /v1/opt-outs, or check one number with GET /v1/opt-outs/:phone, and sync it into your CRM. That list holds only this account's opted-out contacts, so check GET /v1/opt-outs/:phone before another tool texts a number. The messages API docs cover the details.

Where the dialer fits

Voice brings its own TCPA questions: autodialer rules, prerecorded messages and recording consent. Buy dialer tools with those questions in mind.

The Ready Dialer is deliberately narrow. It offers manual click-to-call from the dial pad (in the dashboard or GoHighLevel), consented call recording and transcripts, inbound calls that ring the open pad, and a Missed call card in the Inbox thread for each call you miss. It's billed at $0.025/min, and only answered time is billed. It doesn't auto-dial, run queues or drop voicemails. That keeps it out of the automated-dialing territory where much TCPA voice litigation happens, but it also means it isn't a call-center auto-dialer. If you need queue or automated dialing, evaluate that category on its own terms. Dialer software for call centers lists the questions to ask.

A buying checklist that maps to the layers

Before you sign anything, get a yes or no from the vendor on each of these:

1. Does STOP suppress the number across every campaign and the API, not just the one campaign?
2. Are quiet hours enforced per recipient's local time, automatically?
3. Is there a litigator and DNC scrub, and is it per contact, per segment, or both?
4. Can I validate landlines, and is that on or off by default?
5. What audit record exists for each send?
6. Where does my per-contact consent record live? (If the vendor says "with us," ask what fields it stores.)
7. Does the platform handle 10DLC registration? Unregistered traffic gets carrier-filtered regardless of how compliant your list is.

On the last point: Ready handles brand and campaign registration in-app, and most approvals take 2 to 7 days.

The practical takeaway

Opt-out handling, quiet hours, audit logs and registration should come native to whatever sends your texts. Scrubbing and validation can be native or add-on, as long as they run every time. Consent capture belongs to the system where the opt-in happens. Reassigned-number checks are their own purchase.

If you want to see how the native layers behave before committing, sign up. The first 20 one-to-one texts are free, so use them to test STOP handling and quiet hours before you register. Pricing is on the pricing page.