When Is Cold Texting Illegal: TCPA, Consent, and Penalties

Cold texting is illegal the moment you send a commercial text message to someone who has not given you the consent the Telephone Consumer Protection Act requires. The TCPA allows the recipient to sue for $500 for every unwanted text, and a court can triple that to $1,500 per message if it finds the violation was willful. Each text counts as its own violation, so a single campaign to a few thousand numbers can generate seven-figure exposure before a class action lawyer gets involved.

Consent Is the Line

The TCPA, codified at 47 U.S.C. § 227, was written for unwanted phone calls but explicitly covers text messages, and Congress removed any doubt through the Consolidated Appropriations Act of 2018.¹ The FCC fills in the details through 47 CFR § 64.1200.²

Whether a given text is legal almost always turns on one question: did the recipient consent before you sent it? The statute recognizes two tiers, and mixing them up is one of the most common compliance failures.

Prior express consent covers informational or transactional texts like appointment reminders, order confirmations, and account alerts. The recipient only needs to have provided their phone number in connection with a transaction, and the consent can be oral or implied from the relationship.
Prior express written consent is required for marketing or advertising texts. The recipient must sign a written agreement, which can be electronic, that clearly says they agree to receive marketing messages sent using automated technology. A phone number written on a sign-up sheet is not enough unless the form discloses the marketing purpose.³

Cold texting, by definition, reaches people who have given neither. That is what makes it so legally dangerous. You are starting from zero in a system that demands affirmative permission.

One assumption trips businesses up repeatedly: buying a contact list does not carry consent with it. Consent belongs to the individual, not to whoever sold the number. If the people on that list never agreed to receive your marketing texts, every message is a potential violation.

What Turns a Text Into a Violation

Several specific actions can convert a cold text into a lawsuit:

Sending marketing texts without prior express written consent. Using an autodialer or prerecorded message to send a promotional text to someone who did not agree to receive it violates 47 U.S.C. § 227(b)(1).¹
Failing to provide an opt-out mechanism. Every commercial text must give the recipient a way to stop future messages. Replying “STOP” is standard, but any reasonable revocation method the recipient chooses must be honored.
Ignoring opt-out requests. Under 47 CFR § 64.1200(a)(10), once a recipient revokes consent by any reasonable method, that revocation is definitive and the sender must stop all robocalls and robotexts. The full compliance deadline for the expanded revocation rule is April 11, 2026.⁴
Texting outside permitted hours. FCC regulations prohibit telephone solicitations, including marketing texts to wireless numbers, before 8 a.m. or after 9 p.m. in the recipient’s local time zone. Some states impose narrower windows.²
Texting numbers on the National Do Not Call Registry. FCC regulations extend the registry’s protections to telemarketing text messages sent to wireless numbers, so a marketing text to a registered number without express consent creates a separate layer of liability.⁵
Spoofing caller identification. The TCPA separately prohibits transmitting misleading or inaccurate caller ID information with the intent to defraud or cause harm.¹

Texts That Fall Outside the Strictest Rules

Not every unsolicited message triggers TCPA consent requirements. Political campaign texts sent manually, meaning a person physically types or taps each one, do not require prior consent. Political texts sent using an autodialer do require prior express consent. Either way, campaigns must honor opt-out requests.⁶

Emergency messages are also exempt. The statute specifically carves out calls made for emergency purposes from its prohibitions on autodialer use.¹

State Laws Add Another Layer

Many states have their own telemarketing and texting statutes that pile requirements on top of the TCPA. A business that satisfies federal law can still violate a state one. Common state provisions include narrower permitted sending hours, additional consent requirements, mandatory disclosures in commercial messages, and per-violation damages ranging from $50 to $10,000. Some state attorneys general can pursue civil penalties that exceed federal amounts.

Because these laws vary widely, any multi-state texting campaign has to comply with the most restrictive state law that could apply to a recipient. Federal compliance alone is not enough.

What Illegal Cold Texting Costs

The damages scale fast because each text is its own violation. Under 47 U.S.C. § 227(b)(3), a recipient of an illegal text can sue in state court for the greater of actual monetary loss or $500 per violation. If a court finds the sender acted willfully or knowingly, it can increase the award up to three times that amount, or $1,500 per text.⁷

The arithmetic gets serious quickly. A campaign that sends 10,000 unauthorized texts faces $5 million in baseline damages, or $15 million if the court finds willfulness. The TCPA also creates a separate private right of action under subsection (c)(5) for Do Not Call violations, with the same $500/$1,500 damage structure, though that provision requires the recipient to have received more than one violating text within a 12-month period from the same sender.¹

Class Actions

The real exposure comes from class actions. A plaintiff’s attorney who aggregates thousands of recipients into a single case multiplies the per-text damages across the entire class, and TCPA class settlements routinely reach tens of millions of dollars. These cases attract plaintiffs’ lawyers because the damages are statutory. Recipients do not need to prove actual harm, only that they received the text without consent.

Government Enforcement

Both the FCC and FTC can bring enforcement actions. The FCC acts under the TCPA itself, and the FTC enforces the Telemarketing Sales Rule and the Telemarketing and Consumer Fraud and Abuse Prevention Act.⁸ State attorneys general can also pursue enforcement under federal and state telemarketing laws. Government actions typically seek injunctions, civil penalties, and disgorgement of profits from the illegal campaign.

How Long the Risk Lasts

Recipients have four years from the date of the violation to file a TCPA lawsuit. The deadline comes from 28 U.S.C. § 1658, which sets a four-year statute of limitations for civil actions arising under federal statutes that do not specify their own, and the TCPA does not.⁹ Every text you send today can trigger a lawsuit up to four years from now.

You Cannot Outsource the Liability

Hiring a third-party marketing firm to send texts on your behalf does not shield you from TCPA liability. The FCC has been clear that companies cannot avoid responsibility by outsourcing telemarketing operations. A company can be held vicariously liable through three paths: a formal agency relationship where the marketer acts on its behalf, apparent authority where the recipient reasonably believes the marketer represents the company, or ratification where the company knowingly accepts the benefits of the marketer’s unlawful activity.³

If you provide the contact list, approve the messaging strategy, or profit from the campaign, you own the liability. Courts have consistently rejected the defense that a contractor “acted independently” when the company directed or benefited from the texting.

Reassigned Numbers: A Trap Even With Consent

One of the trickier TCPA traps involves reassigned phone numbers. You might have valid consent from a customer, but if that customer’s old number has been reassigned to a new person, texting that number means you are contacting a stranger without consent. That is a violation.

The FCC’s Reassigned Numbers Database, operational since November 2021, addresses the problem. Businesses can query the database before texting to check whether a number has been disconnected or reassigned since the date they obtained consent. If the database incorrectly reports that the number has not been reassigned, the caller gets safe harbor protection against TCPA liability for that text.¹⁰ For any business maintaining a large contact list over time, regular checks are one of the most cost-effective ways to avoid accidental violations.

1
Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
2
eCFR. 47 CFR 64.1200 – Delivery Restrictions
3
Federal Communications Commission. 47 USC 227 – Restrictions on the Use of Telephone Equipment
4
Federal Communications Commission. FCC Order on Consent Revocation Rules
5
National Do Not Call Registry. National Do Not Call Registry
6
Federal Communications Commission. Political Campaign Robocalls and Robotexts Rules
7
GovInfo. 47 USC 227 – Restrictions on Use of Telephone Equipment
8
Federal Trade Commission. Telemarketing and Consumer Fraud and Abuse Prevention Act
9
Office of the Law Revision Counsel. 28 USC 1658 – Time Limitations on the Commencement of Civil Actions Arising Under Acts of Congress
10
Federal Communications Commission. Reassigned Numbers Database