TCPA text message compliance comes down to a few disciplined habits: get the right level of consent before you send, document it, honor time-of-day rules and opt-outs, and keep the paperwork for at least four years. The Telephone Consumer Protection Act lets any individual sue in state court for $500 per unauthorized message, and courts can triple that to $1,500 when the sender acted knowingly or willfully.1Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment Class actions are common, plaintiffs’ attorneys look for noncompliant campaigns, and a single sloppy blast can generate millions in exposure. The details matter here in a way they don’t in most areas of marketing law.
Two Tiers of Consent
The permission you need depends on what the message says. Informational texts — appointment reminders, shipping updates, fraud alerts, account notifications — require “prior express consent,” which in practice means the person gave you their number in a context where those messages are reasonably expected. Creating an account, filling out a form, or handing over a number during a transaction satisfies this standard for non-promotional content.2Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions
Marketing and advertising texts face a much higher bar: prior express written consent. The FCC adopted this stricter standard in 2012, and it requires a signed agreement (paper or electronic) in which the recipient specifically agrees to receive promotional messages sent through automated systems.3eCFR. 47 CFR 64.1200 – Delivery Restrictions A phone number scribbled on a sign-up sheet does not qualify. The signature must follow a clear disclosure, and the person must know exactly what they are agreeing to.
The line between these categories catches a lot of businesses. A shipping notification that ends with “Use code SAVE20 for 20% off your next order” has crossed into marketing. When a text blends informational and promotional content, the stricter written-consent standard governs. Courts look at the primary purpose of the communication, and anything that encourages a purchase gets treated as advertising.
What a Valid Written Consent Form Contains
Federal regulations specify what a written consent form must include. The agreement must clearly disclose that the signer is authorizing a specific seller to send telemarketing messages using automated technology or prerecorded voices, and it must state that signing is not a condition of buying anything from the company.3eCFR. 47 CFR 64.1200 – Delivery Restrictions That second disclosure is not optional. Burying it in fine print invites litigation.
The consent must also identify the specific phone number the person authorizes. Electronic signatures qualify as long as they meet the federal E-SIGN Act or applicable state contract law, so a website checkbox, a reply text, or an email confirmation can serve as a signature when the surrounding disclosures are clear and conspicuous.3eCFR. 47 CFR 64.1200 – Delivery Restrictions
Where businesses consistently fail is the “clear and conspicuous” piece. A consent disclosure crammed into a wall of terms-and-conditions text in 8-point gray font will not survive a legal challenge. The disclosure needs to be prominent enough that a reasonable person would notice it before signing.
One Seller Per Consent
The FCC adopted a rule to close what it called the “lead generator loophole.” Under prior practice, a comparison-shopping site could obtain a single consent and then share it with dozens of sellers, flooding the consumer’s phone with texts from companies they had never heard of.2Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions The new rule requires each consent agreement to authorize no more than one identified seller, so a comparison-shopping site would need a separate check box for each company the consumer wants to hear from. The resulting messages must also be “logically and topically associated” with the site where the consumer gave consent; a mortgage-comparison site cannot generate leads for weight-loss supplements.4Federal Communications Commission. Small Entity Compliance Guide – Targeting and Eliminating Unlawful Text Messages
Important caveat: the FCC postponed the effective date of this rule pending judicial review.5Federal Communications Commission. FCC Postpones Effective Date of One-to-One Consent Rule If you rely on lead-generator consent, watch this closely. Adopting one-to-one practices now reduces exposure regardless, because the underlying TCPA requirement for clear and conspicuous consent to a specific seller has not changed.
When You Can Send
Even with valid consent, you cannot send marketing texts at any hour. Federal rules prohibit telephone solicitations before 8:00 a.m. or after 9:00 p.m. in the recipient’s local time zone.3eCFR. 47 CFR 64.1200 – Delivery Restrictions Your location doesn’t matter. An East Coast company that fires off a promotional blast at 7:30 a.m. Eastern is violating the law for every recipient in the Central, Mountain, and Pacific zones. Your platform needs to track recipient time zones, and the check should be automatic. Human error at scale is what generates complaints.
Opt-Outs and the 10-Day Rule
The FCC has set a clear standard: consumers can revoke consent in any reasonable manner that expresses a desire to stop receiving messages. A business cannot funnel opt-outs through a single exclusive channel and ignore requests made through others.6Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991 – FCC 24-24
Some methods are treated as automatically valid. Replying to a text with “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” is a per se reasonable revocation that must be honored.6Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991 – FCC 24-24 But consumers are not limited to those keywords. Someone who texts “please stop texting me” or calls customer service to be removed has revoked consent. Non-keyword methods like email or voicemail create a rebuttable presumption of valid revocation, and a court will look at the totality of the circumstances.
Once you receive an opt-out, you have no more than 10 business days to stop all marketing messages to that number.6Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991 – FCC 24-24 You may send a single confirmation text acknowledging the request, but it cannot include promotional content or attempt to re-engage the subscriber. Every message sent after a valid revocation is a separate violation carrying its own $500 to $1,500 in damages.1Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
Two Traps That Regularly Sink Campaigns
Misreading Facebook v. Duguid
Many TCPA restrictions apply when a business uses an “automatic telephone dialing system,” and the Supreme Court’s 2021 decision in Facebook, Inc. v. Duguid narrowed that definition. A device qualifies as an autodialer only if it can store or produce phone numbers using a random or sequential number generator.7Supreme Court of the United States. Facebook, Inc. v. Duguid – 19-511 Equipment that dials from a stored customer list, without random or sequential generation, falls outside the definition.
Plenty of companies read Duguid as a blanket shield and regret it. The TCPA separately restricts “artificial or prerecorded voice” messages, and the written-consent requirement for telemarketing applies regardless of the dialing technology used.1Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment Duguid is narrower protection than it looks.
Texting a Reassigned Number
One of the most common accidental violations is texting a number that used to belong to a customer but has been reassigned to someone new. The original customer’s consent does not transfer. The FCC’s Reassigned Numbers Database offers a safe harbor if you use it correctly.
To qualify, a business must show three things: it had consent from the intended recipient, it (or an authorized agent) checked the database before sending to confirm the number had not been reassigned since the consent date, and the database incorrectly returned a “no” response.8Federal Communications Commission. Reassigned Numbers Database Skip the check and you lose the defense.
AI-Generated Messages
In February 2024, the FCC confirmed that the TCPA’s restrictions on “artificial or prerecorded voice” messages cover AI technologies that generate or simulate human voices, including voice cloning.9Federal Communications Commission. Implications of Artificial Intelligence Technologies on Protecting Consumers from Unwanted Robocalls and Robotexts AI-generated voice messages need the same prior express consent (or written consent for marketing) as any other automated communication.
The ruling’s language focused on AI-generated voices rather than text-only AI content. A chatbot composing the words of a text message is a different situation than an AI cloning a voice for a robocall. Still, consent and opt-out requirements for texts turn on how the message is delivered and whether the content is promotional, not on who or what wrote the words. If you use AI to draft or personalize marketing texts, your consent infrastructure needs to meet the same standard.
Narrow Exemptions
Two exceptions get overclaimed. Political campaign texts sent using an autodialer still require prior express consent, though political texts sent manually — a human physically dialing or typing — do not need prior consent. Political campaigns are also exempt from the National Do Not Call Registry, but they must honor individual opt-out requests.10Federal Communications Commission. Political Campaign Robocalls and Robotexts Rules
Emergency messages are exempt from consent requirements, but the FCC defines “emergency” as situations affecting the health and safety of consumers — weather alerts, public safety warnings, urgent health notifications.11Federal Register. Limits on Exempted Calls Under the Telephone Consumer Protection Act of 1991 Routine operational messages don’t qualify just because the sender feels they’re important.
Records You’ll Need if You’re Sued
The statute of limitations for TCPA claims is four years, so retaining consent records for at least that long is the baseline. Every record should include the exact timestamp of the agreement, the phone number authorized, a copy of the consent language displayed to the consumer, and technical data supporting the signature (IP address for web sign-ups, session identifiers for text-based opt-ins).
Archive the specific version of the consent form that was live at the time each consumer signed. If you update disclosure language in March, you still need the February version for anyone who consented before the change. A common defense failure runs like this: the business produces its current form in litigation, the plaintiff argues the form looked different when they signed, and the business has no way to prove otherwise. Version-controlled archives with timestamps close that gap.
These records are your primary evidence in any dispute. A business that can produce a timestamped, version-controlled record with the exact disclosure language shown to a specific consumer is in a fundamentally different position than one reconstructing the past under deposition pressure. Courts and regulators treat thorough documentation as a strong indicator of good-faith compliance, and at $500 to $1,500 per message, that difference is the whole case.