TCPA text message rules require businesses to get the right kind of consent before sending, identify themselves clearly, honor opt-out requests promptly, and stay inside a defined time window, with violations carrying $500 per message in statutory damages and up to $1,500 per message when the conduct is willful. The Telephone Consumer Protection Act, passed in 1991, treats every text as a “call,” so a single noncompliant campaign to a modest list can generate seven-figure exposure. Here is what the law actually requires and where the penalties come from.
When the Rules Apply to Your Texts
The strictest TCPA consent requirements kick in when a message is sent using an Automatic Telephone Dialing System, or ATDS. The statute defines an ATDS as equipment that can store or produce phone numbers using a random or sequential number generator and then dial them.1Office of the Law Revision Counsel. 47 US Code 227 – Restrictions on Use of Telephone Equipment Most commercial texting runs through Application-to-Person (A2P) platforms that fire batches of messages to a stored list, and that is exactly the kind of system the law targets.
In Facebook, Inc. v. Duguid (2021), the Supreme Court held that a device qualifies as an ATDS only if it actually uses a random or sequential number generator to store or produce the numbers it dials. A system that dials from a preloaded contact list without any random or sequential generation does not qualify.2Supreme Court of the United States. Facebook Inc v Duguid, No 19-511 That narrowed the ATDS category, but it did not clear the deck. FCC rules still require prior express written consent for marketing messages sent to wireless numbers using an autodialer, and the TCPA separately restricts artificial and prerecorded voice calls.3Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions
True Peer-to-Peer (P2P) texting, where a real person manually initiates each message, generally sits outside the autodialer definition. If a platform automates sending in any way beyond what one human could do by hand, regulators and plaintiffs’ lawyers will argue it functions as an ATDS whatever the vendor calls it.
What Kind of Consent You Need
The type of consent required depends on what the message says, and the sender always carries the burden of proving that valid consent existed at the moment each message went out.
Marketing Messages: Prior Express Written Consent
Any text that advertises or promotes a product or service requires prior express written consent. That means a signed agreement, which can be electronic, in which the consumer clearly authorizes the specific sender to deliver marketing messages using automated technology. A common setup is an unchecked checkbox on a web form that the consumer affirmatively clicks, together with disclosure language stating that consent is not a condition of buying anything.3Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions Pre-checked boxes do not count. Fine print buried at the bottom of a page invites litigation.
Consent has to run to the entity actually sending the messages. Buying a list of numbers from a lead generator and treating those consumers as having consented to your texts is not compliant. In December 2023 the FCC adopted a one-to-one consent rule requiring each seller to obtain its own consent rather than piggybacking on a blanket authorization gathered by a comparison-shopping site.4Federal Communications Commission. FCC Adopts New Rules to Close the Lead Generator Robocall and Robotexts Loophole The FCC postponed the rule’s January 27, 2025 effective date, and the Eleventh Circuit later vacated it. Even so, a consent form that names a company “and its partners” without identifying each one remains a lawsuit risk under existing law.
Informational Messages: Prior Express Consent
Non-marketing texts such as appointment reminders, shipping updates, fraud alerts, and transaction confirmations require only express consent, not written consent. A consumer usually gives this by voluntarily handing their phone number to a business during a transaction. The limit is scope: the messages have to relate to the reason the number was provided. A patient who gave a dental office a cell number for appointment reminders has not consented to whitening promotions.
What Your Opt-In Must Disclose
At the point of collecting consent, the disclosure language should include the sender’s name, a statement that the consumer will receive automated messages, the expected message frequency, and a note that message and data rates may apply. CTIA guidelines, enforced by wireless carriers through their own messaging policies, treat missing disclosures as grounds to block a sender’s traffic entirely.
Marketing texts themselves should identify the sender by name. The TCPA does not prescribe per-message sender identification the way it prescribes consent, but carrier guidelines and FCC enforcement expectations make it standard practice. A consumer who cannot tell who sent a message is far more likely to complain.
How to Handle Opt-Outs
Every recipient must have a free, easy way to stop receiving messages. The traditional path is a keyword reply: the consumer texts “STOP” and the system confirms and cuts off all future messages.
The FCC broadened the rule in 2024. Consumers can now revoke consent through any reasonable method, not just the channel the sender designates. Replies using words like “stop,” “quit,” “end,” “cancel,” “unsubscribe,” “revoke,” or “opt out” count as reasonable per se. Other wording still counts if a reasonable person would understand the consumer wants out. Revocation is also valid by email, phone call, website form, or in person.5Federal Communications Commission. Report and Order and Further Notice of Proposed Rulemaking
Once a revocation comes in, the sender has no more than ten business days to process it and stop all messages to that number.5Federal Communications Commission. Report and Order and Further Notice of Proposed Rulemaking Compliant systems typically stop keyword replies within seconds. The ten-day window matters more for requests that arrive by voicemail or email, where manual handling may be needed. Funneling all opt-outs through a single designated method and ignoring requests that come in other ways violates FCC rules.
Time-of-Day Limits
Marketing texts cannot be sent before 8:00 a.m. or after 9:00 p.m. in the recipient’s local time zone. The same window applies to telemarketing calls. Blasting a campaign from a single time zone without adjusting for where recipients live catches many senders off guard. A text sent at 7:00 a.m. Eastern arrives at 4:00 a.m. in Hawaii, and the sender, not the platform, is responsible.
Recordkeeping
Consent is only as good as the records behind it. In a lawsuit, the business must prove valid consent existed at the time each message was sent. The Telemarketing Sales Rule requires sellers and telemarketers to keep complete records of every consent authorization for at least five years from the date the record was created. A complete record includes the consumer’s name and phone number, a copy of the consent request in the format it was presented, the purpose of the consent, a copy of the consent itself, and the date it was given.6eCFR. 16 CFR 310.5 – Recordkeeping Requirements
Five years is the regulatory minimum. The TCPA does not set its own federal statute of limitations for private suits, so courts generally apply a four-year residual limitations period, though some states apply shorter windows. Holding records for the full five-year TSR period covers the litigation window in most circumstances. Businesses relying on screenshots or vague references to “our sign-up process” without timestamped, consumer-specific records routinely lose these cases.
Penalties You Face for Violations
Enforcement comes from three directions.
Private Lawsuits
Any person who receives a text in violation of the TCPA can sue in state court. The statute provides $500 in damages per violation, meaning per message, regardless of whether the recipient suffered any actual harm. If the court finds the violation willful or knowing, it can triple the amount to $1,500 per message.7Federal Communications Commission (FCC). Telephone Consumer Protection Act 47 USC 227 A campaign of 10,000 unauthorized texts creates $5 million in base exposure and $15 million if trebled. Plaintiffs’ firms actively monitor text campaigns for these cases, and the per-message math makes even modest campaigns worth litigating.
Government Enforcement
State attorneys general can bring civil actions on behalf of their residents under the same $500-per-violation framework, with the same trebling for willful conduct.7Federal Communications Commission (FCC). Telephone Consumer Protection Act 47 USC 227 The FCC can impose forfeiture penalties for violations of its rules, and the FTC enforces the Do Not Call rules with fines that can exceed $50,000 per illegal call or text.8Consumer Advice. National Do Not Call Registry FAQs
Vicarious Liability for Vendor Conduct
Hiring a marketing vendor or lead generator does not insulate a company from TCPA liability. The FCC has ruled that companies can be held vicariously liable under federal common law agency principles for violations committed by telemarketers acting on their behalf. If you authorize a vendor to market your products, share customer data or pricing, allow use of your brand name, or write and review the scripts, a court can hold you responsible for the vendor’s noncompliant texts. Every vendor agreement should include TCPA compliance obligations, indemnification, and audit rights.
State Text Messaging Laws
The TCPA sets a federal floor, not a ceiling. A growing number of states have their own text messaging and telemarketing statutes with additional requirements and, in some cases, higher per-violation penalties ranging from $500 to $5,000 per message. Some state laws apply to a broader set of technologies than the TCPA, so texts that fall outside the federal autodialer definition after Facebook v. Duguid can still violate state law. Campaigns crossing multiple states have to account for the strictest applicable rule in each market, not just the federal one.