TCPA Compliance and SMS Caching: Real-Time Opt-Out Verification at Scale

A single TCPA violation costs $500–$1,500 per message. At 1,000 messages per second, a cache that lags by even one second means up to 1,000 messages sent to opted-out numbers — $500K to $1.5M in potential exposure. This is not a performance problem. It is a legal one.

The Telephone Consumer Protection Act is the most expensive compliance failure in the messaging industry. Class-action settlements routinely exceed $10 million. Individual statutory damages of $500 per unsolicited message — trebled to $1,500 for willful violations — turn a cache propagation delay into a balance-sheet event. Messaging platforms that handle millions of messages per day are not just optimizing throughput. They are managing risk exposure that scales linearly with every second their opt-out cache is stale.

Cachee eliminates that exposure window. Opt-out state propagates to the L1 cache immediately on write, with no TTL delay and no replication lag. Every subsequent compliance check resolves in 1.5 microseconds. For A2P messaging platforms, this turns compliance from the primary bottleneck in the routing pipeline into a solved problem.

The Compliance State Problem

Every outbound A2P SMS must pass through a gauntlet of compliance state checks before it reaches the carrier network. The exact number varies by jurisdiction and campaign type, but a typical high-volume messaging platform enforces six to twelve distinct checks per message:

• Opt-out verification — Has this recipient explicitly opted out of this sender or campaign?
• DNC registry lookup — Is this number on the national Do Not Call registry?
• Campaign compliance — Is this campaign registered with The Campaign Registry (TCR) and approved for this message type?
• Carrier routing rules — Which carrier serves this number, and what are its throughput and content restrictions?
• Throughput throttling — Has this sender exceeded the carrier-imposed MPS limit for this short code or 10DLC number?
• Sender reputation scoring — Is this sender's complaint ratio within acceptable bounds?
• Content filtering — Does the message body contain prohibited content for this campaign type?
• Quiet hours enforcement — Is this message being sent within the recipient's time zone quiet hours?

At 1–3 milliseconds per check using standard Redis or database lookups, these compliance gates consume 8–36 milliseconds per message. For a platform targeting 1,000 MPS per server, that is the entire routing budget consumed by compliance alone. The actual message submission to the carrier network — the thing the platform exists to do — has to compete for whatever latency budget remains.

This creates an impossible tradeoff. Either you run all the compliance checks and accept throughput limits, or you batch and defer some checks and accept compliance risk. Most platforms compromise somewhere in the middle, and that middle ground is where TCPA violations happen.

Why Standard Caching Creates Risk

The natural response to slow compliance lookups is to cache the state. Load opt-out lists, DNC registries, and campaign rules into Redis with a TTL. Serve subsequent checks from the cache instead of the database. This works for throughput. It does not work for compliance.

The problem is the TTL window. A Redis cache with a 60-second TTL means that an opt-out submitted at second 1 is not visible to the routing pipeline until the cache entry expires at second 61. During that 60-second window, every message routed to that number is a potential TCPA violation. At 1,000 MPS, a single 60-second window produces up to 60,000 violations against a single opted-out number — $30 million to $90 million in theoretical statutory exposure.

Even aggressive TTLs of 1–5 seconds leave exposure. At 1,000 MPS, a 5-second propagation delay is 5,000 messages. At $500 per violation, that is $2.5 million. And this is the exposure from a single opt-out event. A messaging platform processing millions of messages per day sees thousands of opt-out events. The aggregate exposure from stale caches is measured in billions of dollars of theoretical liability.

Reducing the TTL further creates a different problem. At sub-second TTLs, cache hit rates collapse. The cache is constantly expiring and repopulating, which means most lookups fall through to the backing database. You are back to the original latency problem, paying for Redis infrastructure that is not actually caching anything.

Real-Time Opt-Out with L1 Caching

Cachee solves this by eliminating the TTL model entirely for compliance-critical state. When an opt-out event arrives — whether from a STOP keyword, a web form, or an API call — Cachee pushes the updated state into the L1 cache immediately on write. There is no TTL. There is no propagation delay. The next compliance check against that number, on any routing worker, sees the current state in 1.5 microseconds.

This is possible because Cachee's L1 layer operates in-process, not across a network. Traditional caching architectures require a network round-trip to a centralized Redis instance, which introduces both latency and the potential for replication lag between write and read replicas. Cachee's AI-powered cache sits in the application memory of each routing worker. Write-through invalidation propagates to all workers within the same deployment in under 10 microseconds — faster than a single network packet.

The result is a compliance architecture where the opt-out state is always current. Not eventually consistent. Not consistent within a TTL window. Current. This is the difference between "our cache has a 99.9% hit rate" and "our compliance check is provably correct at every invocation." The first is a performance metric. The second is a legal guarantee.

Write-Through Invalidation Flow

When a recipient sends STOP to a short code, the opt-out event flows through three stages in under 50 microseconds total:

1. Ingest: The opt-out processor receives the STOP keyword and writes the opt-out record to the persistent database.
2. Propagate: Simultaneously, Cachee's write-through layer pushes the invalidation to every L1 cache instance in the routing fleet.
3. Enforce: Any routing worker that checks this number from this point forward reads the opted-out state from L1 in 1.5µs and suppresses the message.

There is no window between steps 2 and 3. The write and the cache update are atomic from the routing pipeline's perspective. The compliance state is either not yet written (pre-opt-out) or fully visible (post-opt-out). There is no intermediate state where a stale cache entry could allow a violation.

31× Throughput on Same Hardware

The compliance benefits are the headline, but the throughput improvement is what changes the infrastructure economics. Consider a typical per-message compliance pipeline with eight state checks:

The compliance overhead drops from 24ms to 12 microseconds — a 2,000x reduction. The per-message total drops from 26ms to approximately 2ms, limited now by the carrier submission itself rather than by compliance checks. Per-server throughput jumps from roughly 100 MPS to over 3,100 MPS. That is a 31x improvement on identical hardware.

For a messaging platform processing 100 million messages per day, this means the compliance layer that previously required 30+ servers now runs on a single server. The infrastructure savings alone pay for the Cachee deployment many times over. But the real value is not the cost reduction — it is the elimination of the architectural compromise between compliance thoroughness and throughput.

DNC Registry and Campaign Compliance

Opt-out state is the most time-sensitive compliance data, but it is not the only state that messaging platforms cache. The national Do Not Call registry contains over 240 million phone numbers. Campaign registration data from The Campaign Registry changes as campaigns are approved, suspended, or revoked. Carrier routing tables update as numbers port between carriers. Each of these data sets has different update frequencies and different compliance implications for stale data.

Cachee handles each category with appropriate warming strategies. The DNC registry is relatively static — it updates monthly — so Cachee pre-warms the full registry into L1 on startup and refreshes incrementally. Campaign compliance data changes more frequently, so Cachee's AI prediction engine monitors TCR webhook events and pre-warms affected campaign rules before they are queried. Carrier routing tables are pre-warmed based on the destination number distribution of recent traffic — if 40% of your volume goes to T-Mobile numbers, Cachee keeps T-Mobile routing rules permanently hot in L1.

Carrier-Specific MPS Limits

Every carrier imposes per-sender throughput limits that vary by number type (short code, 10DLC, toll-free) and campaign class. Exceeding these limits triggers filtering, suspension, or permanent blocking of the sender. The throttling check is one of the most latency-sensitive operations in the pipeline because it requires both a read (current count) and a conditional write (increment if under limit).

With standard Redis, throttle checks require a round-trip for INCR with EXPIRE, adding 2–5ms. With Cachee, the throttle counter lives in L1 with atomic increment operations completing in under 2 microseconds. Rate limit state is always current, never stale, and never the bottleneck in the routing decision.

The Aggregate Compliance Architecture

When every compliance check resolves in microseconds instead of milliseconds, the architecture of the routing pipeline fundamentally changes. Platforms no longer need to make tradeoffs about which checks to run synchronously versus asynchronously. Every check runs synchronously, on every message, with zero throughput impact.

This has a second-order benefit for compliance auditing. When all state checks are synchronous and all state is provably current, the audit trail is deterministic. For every message that was sent, the platform can prove that every compliance check passed with the current state at the exact moment of routing. For every message that was suppressed, the platform can prove which check failed and what state caused the suppression. This level of auditability is difficult to achieve when compliance checks are distributed across asynchronous queues and cached state with variable staleness.

TCPA compliance is not optional, and the penalties for failure are not forgiving. The messaging platforms that survive at scale are the ones that treat compliance state with the same urgency as the message payload itself — not as a side effect to be eventually consistent, but as a hard requirement to be correct at every invocation. Cachee makes that standard achievable without sacrificing the throughput that makes the business viable.