TCPA and SMS Marketing: Consent Rules in the US
Text messages get read, which is exactly why US law protects people from unwanted ones. The Telephone Consumer Protection Act (TCPA) lets consumers sue businesses directly for each unlawful text, and the damages add up fast. This guide explains the consent rules, quiet hours and opt-out duties that every small business texting customers in the US should follow.
Key takeaways
- Marketing texts sent using an autodialer generally need prior express written consent from the recipient.
- Federal rules limit telemarketing to 8 a.m. to 9 p.m. in the recipient's local time, and several states go further.
- Honor opt-outs made by any reasonable means, such as replying "stop", within 10 business days under FCC rules.
- Private lawsuits allow $500 per violation, up to $1,500 if willful, so a single bad campaign can be costly.
- Carriers expect 10DLC registration for business texting from standard phone numbers.
SMS marketing is attractive for small businesses: messages are short, cheap to send and usually read within minutes. A restaurant can fill quiet tables, a salon can fill cancellations and an online shop can announce a sale to its best customers. Our SMS marketing guide covers campaign ideas and copywriting. This article focuses on one thing: staying on the right side of the consent rules.
The main federal law is the Telephone Consumer Protection Act, enforced by the Federal Communications Commission (FCC). It covers calls and texts, and it gives consumers a private right to sue. That is what makes it different from many marketing laws: you do not need a regulator to notice you, because any recipient (or a law firm acting for many) can bring a claim.
This is general information, not legal advice. TCPA rules are shaped by FCC orders and court decisions that keep changing, and states add their own laws. Check the FCC's current rules and talk to a qualified attorney before you launch a large texting program.
What the TCPA covers
The TCPA applies to calls and text messages sent to phones in the US. For marketing, the key points are:
- Texts count as calls. Courts and the FCC treat text messages as calls for TCPA purposes, so the same rules apply.
- Marketing versus informational. Messages that promote your products or services face stricter consent requirements than purely informational messages, such as order confirmations or appointment reminders. A reminder with a promotional coupon tacked on can become marketing.
- How the message is sent matters. Marketing texts sent using an autodialer generally need prior express written consent. Most SMS marketing platforms send in bulk, so plan as if your messages are covered.
- Business-to-business is not automatically exempt. If you text a business owner's mobile phone, the rules can still apply.
Common mistake
Treating every customer phone number as permission to market. A customer who gives you their number to receive a delivery update has not agreed to receive promotions. Keep transactional and marketing consent separate.
Prior express written consent, explained
"Prior express written consent" sounds formal, but in practice it can be collected online. The key elements are that the consent is given before you send, it is clearly about marketing messages, it identifies your business and the phone number, and it is signed in a way the law recognizes, which can include an electronic signature such as ticking a box or texting a keyword.
Good consent language usually tells the person:
- Who will text them (your business name)
- That the messages are marketing and may be sent using automated technology
- Roughly how often you will text
- That consent is not a condition of purchase
- That message and data rates may apply
- How to opt out (for example, reply STOP) and how to get help (reply HELP)
- Where to find your terms and privacy policy
Example
For example, a made-up shop called Juniper Supply adds an optional checkbox at checkout: "Yes, send me marketing texts from Juniper Supply at the number above. Up to 4 messages a month, sent by automated technology. Consent is not required to buy. Msg and data rates may apply. Reply STOP to cancel, HELP for help." The box is unticked by default, and the shop's system records the date, time, page version and phone number when a customer ticks it.
Keep proof of consent
If someone sues, you will need to show that they agreed. Store a consent record for each number: the date and time, the source (web form, keyword, paper sign-up), the exact wording shown, and the IP address or device details where available. Keep records for as long as you text the person and for a sensible period afterwards; ask your attorney what period fits your risk.
Pro tip
Use a double opt-in: when someone signs up, send one confirmation text asking them to reply YES. It filters out mistyped numbers and people who entered a friend's phone, and it gives you a clean record of the subscriber confirming from the phone itself.
Quiet hours, Do Not Call and state laws
Consent is the first hurdle. Timing and registries are the next.
Send marketing texts inside this window based on where the recipient is, not where your business is. If your list spans time zones, schedule campaigns by area code or stored location, and remember that a mobile number's area code does not always match where someone lives now. Many businesses play it safe with a narrower window, such as mid-morning to early evening.
The National Do Not Call Registry
Consumers can add their numbers to the National Do Not Call Registry. Telemarketing to registered numbers is generally restricted unless you have the person's prior express written consent or, in some cases, an established business relationship. If you buy or import lists, check them against the registry and your own internal do-not-contact list before sending anything.
State "mini-TCPA" laws
Several states have passed their own telemarketing and texting laws, sometimes called mini-TCPAs. They can be stricter than federal rules, for example with narrower calling hours, limits on how many messages you send in a day, or broader definitions of automated systems. If you text customers in several states, check each state's rules, or follow the strictest one across your whole list.
Opt-outs: make stopping easy
Unsubscribe handling is where many small businesses slip up, often because their texting tool only recognizes one keyword. FCC rules say consumers can revoke consent by any reasonable means, and businesses must honor opt-out requests within 10 business days.
"Any reasonable means" includes replies such as "stop", "unsubscribe", "cancel", "end" or "quit", and plain-language messages like "please stop texting me". It can also include requests made by email, by phone or in person at your shop. Practical steps:
- Configure keywords. Set your SMS platform to recognize the common opt-out words and treat them all the same way.
- Watch free-text replies. Have someone review replies that the system does not recognize, and process opt-out requests manually.
- Connect your channels. If a customer tells staff or support "no more texts", log it in the same suppression list your platform uses.
- Confirm once. A single confirmation that the person has been unsubscribed is generally accepted practice; do not use it to send more marketing. Check the FCC's current rules on what that confirmation may contain.
- Suppress across tools. If you switch platforms or run more than one, carry your suppression list with you so nobody is re-added by accident.
The cost of getting it wrong
The TCPA lets individuals sue for each violation. Because each text can be a separate violation, a campaign sent to a list without proper consent can multiply quickly.
| Damages | Amount per violation | When it applies |
|---|---|---|
| Statutory damages | $500 | Each unlawful call or text |
| Enhanced damages | Up to $1,500 | Where the violation is found willful or knowing |
For example, imagine a made-up gym sends three promotional texts to 200 people who never gave written consent. That is 600 texts, and at $500 each the potential exposure reaches $300,000 before legal fees, even though the campaign may have cost very little to send. Class actions under the TCPA are common, so do not assume a small business is too small to be targeted.
10DLC registration and carrier rules
Separate from the law, US mobile carriers have their own rules for business texting. If you send from a standard 10-digit long code number (often called 10DLC), carriers generally require you to register your brand and each campaign through your SMS provider. Unregistered traffic may be filtered, blocked or charged extra.
Registration asks for your business details, the type of messages you send, sample messages and how you collect consent. Your consent flow therefore needs to be clear and visible, because carriers and providers may review it. Your SMS platform will usually walk you through the process; follow its current requirements, since they change.
Signs your SMS program is in good shape
- Unticked, optional consent box with clear wording
- Consent records stored for every number
- Sends scheduled inside local quiet hours
- All common opt-out words recognized
- Registered brand and campaigns with your provider
Warning signs to fix now
- Texting numbers collected for receipts or deliveries
- Imported or purchased lists with no consent trail
- Campaigns sent at one fixed time across all time zones
- Only "STOP" in capital letters works
- No idea whether your number is registered
Your TCPA texting checklist
- Write clear consent language naming your business and marketing texts
- Make the consent box optional and unticked
- Store a consent record for every phone number
- Send a confirmation text and use double opt-in
- Schedule sends between 8 a.m. and 9 p.m. recipient time, or narrower
- Scrub lists against the National Do Not Call Registry and your suppression list
- Recognize all common opt-out words and log manual requests
- Honor opt-outs well within 10 business days
- Check state mini-TCPA rules for every state you text
- Complete 10DLC brand and campaign registration
Frequently asked questions
Do I need consent to send appointment reminders by text?
Purely informational texts face lighter consent rules than marketing, and a customer who gives you a number for that purpose has usually agreed to related reminders. Keep reminders free of promotions, and check the current FCC rules for your industry.
Can I text customers who bought from me in the past?
Not for marketing, unless they gave prior express written consent. A past purchase alone is generally not enough for automated marketing texts, even though it may help with some calling rules.
Is it safer to send texts one by one from my own phone?
Manual texting may fall outside some autodialer rules, but Do Not Call, quiet hours, state laws and opt-out duties can still apply, and it is hard to keep records. Most businesses are better off using a compliant platform with proper consent.
Does the TCPA apply if my business is outside the US?
If you text people on US phone numbers, assume the TCPA and state laws apply. If you also text UK or EU customers, local rules such as PECR and GDPR apply to those messages too.
Related reading
The bottom line
SMS marketing works best when every subscriber clearly asked to hear from you. Collect prior express written consent, keep the proof, send within quiet hours, and make stopping as easy as replying with a word. Register with your carrier through your provider and check state laws before expanding.
Because TCPA rules shift with FCC orders and court cases, review your process once a year and talk to an attorney before any large campaign.
