How Clerk.ai Keeps Your Messaging Compliant
Clerk.ai has built-in TCPA and KYC controls that run automatically on every account. You don't need to configure anything, here's a quick overview of what's happening behind the scenes.
Written By Josh Hancock
Last updated 2 days ago
Why this matters
Sending business messages in the US has gotten significantly riskier over the last few years. Federal TCPA violations carry statutory damages of $500–$1,500 per message, and a growing list of states - Florida, Oklahoma, Maryland, Washington, Connecticut, Texas, and Virginia among them - have passed their own "mini-TCPA" laws that add stricter quiet hours, frequency caps, and consent requirements on top of the federal baseline. Because TCPA cases are typically brought as class actions, a single bad campaign can produce settlements in the millions. Most companies that get hit aren't bad actors; they're businesses whose tooling didn't catch a Sunday send to Alabama, a message that crossed a state-specific frequency cap, or a consent record they couldn't produce on demand. The controls below exist so you don't have to track every state law and quiet-hour exception yourself, and so your messages reach the people who actually want to hear from you, with a clean compliance trail behind every one.
When you sign up
We verify your business is legitimate by checking your EIN, domain, business registration, and brand identity. This protects your sender reputation and helps your messages avoid carrier filtering.
Every time you send
Before a message or call goes out, we automatically:
Hold sends that fall outside the recipient's state quiet hours and deliver them at the next valid time
Prevent repeat sends to the same recipient in a short window
Consent tracking
Every opt-in is logged with a timestamp, user, IP, and phone number, whether it was added manually, imported from a CSV, or confirmed at campaign send time. If you're ever asked to prove consent, the record is there.
What you're responsible for
Only message contacts who have opted in
Watch your opt-out rate (we'll alert you if it crosses 3–5%)
Refresh consent for contacts inactive longer than 18 months
Questions about a specific send that was held or blocked? Check the compliance audit log on the message, or contact support.
What you'll see
Compliance is designed to be mostly invisible. The vast majority of the time, you won't notice it running - messages that hit a quiet-hours window, frequency cap, or other timing rule are automatically held and delivered at the next valid time for that recipient. No action needed on your end.
You'll only see a message fail outright if it truly cannot be sent, for example, if the recipient has explicitly opted out of your messages.
On individual messages, every send shows live Sent / Delivered / Failed counts. Click Details to see exactly which recipients fell into each bucket.
On the campaign screen, you'll see a new TCPA column alongside Sent, Delivered, Read, and Opt-Out. The number there reflects messages the compliance firewall acted on, most of which will still be delivered later, just at a valid send time.
Click the number to drill into a per-recipient view that shows each phone number and the specific reason it was held (e.g., "can only call or message between 8:00 and 21:00").
The short version: you don't need to monitor any of this. The visibility is there for when you want it.
Reference: State quiet hours and special rules
You don't need to memorize any of this. Our compliance firewall enforces these rules automatically based on each recipient's state. This table is here for transparency.
Most restrictive
Stricter than federal
8 PM cutoff states
Modified federal hours
Federal default
All other states follow the federal TCPA baseline of 8 AM – 9 PM in the recipient's local time. Local city or county rules may be stricter. If you have a regulated use case in a specific jurisdiction, contact support before launching a campaign.