To text customers legally in the U.S., get the right consent before the first message, say clearly who you are and how to opt out, honor every STOP right away, and keep a record of all of it. Marketing texts need prior express written consent. Service texts like appointment reminders need consent too, but it can be less formal. The details below show how to run this without slowing your team down. 🚦
This is a practical guide, not legal advice. For anything unusual, like buying lists, running promotions across several states or texting in a regulated field, talk to a telecommunications or consumer-protection attorney.
TL;DR
- The TCPA treats texts as calls. Autodialed or prerecorded texts to mobile numbers need prior express consent, and marketing texts generally need prior express written consent.
- Consent belongs to one seller. The FCC's one-to-one rule bars shared consent from comparison-style lead forms, and consent from third-party lists is not yours to use.
- STOP means stop. Honor opt-out words immediately, never make customers use only one method, and log every request.
- Carriers add their own rules. CTIA standards and 10DLC registration sit on top of the law, and breaking them can get your messages blocked.
- Records win disputes. Store the consent language, timestamp, number and source for every contact.
Table of Contents
- When the TCPA applies to your texts
- Consent: the foundation of everything
- Opt-outs: how to handle STOP
- Content, frequency and sending hours
- Penalties and state laws
- TCPA versus carrier rules
- A pre-send checklist
- Perspective: speed and safety are not a trade-off
- Putting it into practice by use case
- Run compliant outreach with Signal Engine
- FAQ
- Sources
- Ready to Stop the Revenue Leak?
When the TCPA applies to your texts
The Telephone Consumer Protection Act (TCPA) is a 1991 federal law. The FCC says it treats text messages as calls: autodialed or prerecorded calls and texts to mobile numbers require prior express consent, and advertising or telemarketing generally requires prior express written consent.
In plain terms, three questions decide your exposure:
- Who are you texting? A mobile number a person gave you is covered. A landline is a different bucket.
- What is the message for? Selling, promoting or upselling is marketing. Confirming a booking or sending a delivery update is informational.
- How is it sent? Texting through software that sends in bulk or on a schedule should be treated as covered, so plan for consent every time.
If you use a platform to send texts from a list, assume the TCPA applies. Treating it as optional is how small businesses end up in class-action letters.
Consent: the foundation of everything
Marketing versus service texts
The two types need different levels of consent:
| Message type | Examples | Consent you need |
|---|---|---|
| Marketing or promotional | Seasonal discounts, new service offers, win-back campaigns, review requests tied to a sale | Prior express written consent |
| Informational or transactional | Appointment reminders, delivery updates, security codes | Express consent, which can be verbal or implied by the business relationship |
That split follows a 2026 explainer on A2P rules. Keep the line bright. A reminder that slips in a coupon becomes a marketing text, and you need written consent for it.
What a compliant opt-in shows
CTIA's Messaging Principles and Best Practices say a call-to-action should make people aware of:
- the program or product description
- the phone number or short code the messages come from
- the specific identity of the organization sending them
- clear and conspicuous opt-in language, plus any fees or charges
- the terms and conditions, including how to opt out, customer care contact details and any privacy policy
Practical implementation guidance, like Iterable's SMS compliance guide, adds message frequency, a "Message and data rates may apply" line, links to your SMS terms and privacy policy, a standalone opt-in and disclosures on the same screen where the person opts in.
A sample opt-in line you can adapt:
By checking this box, I agree to receive recurring marketing text messages from [Business Name] at the number I provided, sent using automated technology. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help. See our Terms and Privacy Policy.
Have your attorney review the final wording. Then keep it identical across forms so your records match what customers saw.
Rules that trip up small businesses
- Separate your consents. Consent for marketing and for transactional use should be separated, and SMS consent does not carry over from email or other channels, per Iterable.
- Never buy or borrow consent. Consent cannot be shared or sold, including through list providers or affiliates, per the same guidance.
- Know the one-to-one rule. The FCC's one-to-one consent rule, effective January 27, 2025, requires comparison shopping websites to obtain consent one seller at a time. Follow-up texts must be logically and topically associated with the site where consent was given. The FCC's example: consent on a car-loan comparison site does not cover loan-consolidation texts.
- Why the rule exists. Law-firm analysis explains it was designed to close the lead-generator loophole, where broad consent given to one business was stretched to unrelated ones.
For a local service company, the safest lead-form setup is simple: one business named on the form, one clear checkbox, texts that match what the form promised.
Opt-outs: how to handle STOP
The FCC's revocation rulemaking lists "stop," "quit," "end," "revoke," "opt out," "cancel" and "unsubscribe" as reasonable ways to revoke consent by reply text. Other clear requests, like "please don't text me anymore," also have to be assessed and honored when reasonable.
The same rulemaking adopted a requirement to honor revocation requests within a reasonable time, no later than 10 business days. The FCC delayed the effective date of the relevant amendments indefinitely, so check the FCC's current status before you design around that number. Our advice: don't wait for a deadline. Suppress the number the moment the request arrives.
A clean opt-out routine looks like this:
- Auto-detect keywords and suppress the number across every campaign, not just the one that triggered it.
- Send one confirmation that the person is unsubscribed, with no sales pitch attached.
- Catch free-text requests. Route replies like "stop texting me" to a human or an AI flag for review.
- Sync suppression everywhere. If your CRM, dialer and texting tool each keep their own list, one stale list creates a violation.
- Keep the log. Time of request, time of suppression, number.
Content, frequency and sending hours
The federal calling-time rule bars telemarketing calls and texts before 8 a.m. and after 9 p.m. in the recipient's local time. Several states set tighter windows, so text inside a conservative window such as 9 a.m. to 8 p.m. recipient time, and use area code or stored location to avoid sending to the wrong time zone.
On frequency, the TCPA itself sets no fixed cap, but heavy messaging raises complaints and opt-outs, and carriers watch complaint rates. Tell people up front how often to expect texts, then stick to it.
For content, every marketing text should:
- identify your business by name
- include opt-out instructions, at least in the first message and regularly after
- avoid anything misleading about price, urgency or who is texting
- avoid prohibited content categories under carrier rules, which CTIA's principles describe
Short and specific beats clever. "Hi Dana, it's Ridgeline HVAC. Your spring tune-up slot is open Thursday. Reply STOP to opt out" is a message you can defend.
Penalties and state laws
The TCPA lets individuals sue. Statutory damages are $500 per violation, and a court can raise that to as much as $1,500 per violation if it finds the violation willful or knowing. Because each text can count as a violation, a single campaign sent to a large list can add up fast. That is why plaintiffs' firms watch small businesses with sloppy opt-in records.
States add their own layers. Some have so-called mini-TCPA laws with their own consent, calling-hour and registration rules, and some reach texts that federal law treats differently. If you text across state lines, check each state where your customers live, or ask counsel which states matter for your footprint.
Health care adds another layer. If you text patients, read our guide on how CMS QSO-24-05 changes HIPAA texting rules alongside this one.
TCPA versus carrier rules
They are two different systems, and you must satisfy both.
| TCPA (law) | CTIA and carrier rules | |
|---|---|---|
| Source | Federal statute and FCC regulations | Industry standards enforced by carriers |
| Enforced by | FCC, courts, private plaintiffs | Carriers and messaging platforms |
| Main risk | Lawsuits and fines | Blocked or filtered messages, suspended numbers |
| Focus | Consent, calling hours, opt-outs | Opt-in disclosures, content categories, brand and campaign registration |
To send from a standard 10-digit local number, businesses register their brand and campaign through the carrier ecosystem, known as 10DLC. Your texting provider walks you through it. Register truthfully, describe your use case accurately and match your sample messages to what you actually send. A mismatch between your registration and your real traffic is a common reason for filtering.
A message can pass carrier review and still break the law, and the reverse is true too. Treat them as two checklists.
A pre-send checklist
Run this before every new campaign:
- ✅ Every recipient gave consent to you, for this type of message.
- ✅ Marketing recipients gave it in writing, with clear disclosures.
- ✅ The opt-in language names your business, frequency, rates and opt-out method.
- ✅ No purchased, rented or shared lists.
- ✅ Send time falls inside the legal window for the recipient's time zone.
- ✅ The message names your business and includes opt-out instructions.
- ✅ STOP and similar replies suppress the number everywhere.
- ✅ Consent records are stored: number, timestamp, source page, exact language shown.
- ✅ Your 10DLC registration matches your real use.
Perspective: speed and safety are not a trade-off
Most small businesses we talk to treat texting compliance as a tax on growth. We see it the opposite way. The owners who recover the most revenue are the ones whose texting is clean enough to run every day without fear.
That is why Signal Engine is built around approval. We draft the next action, whether a missed-call follow-up, a win-back or a reminder, and hold it for one-click approval before anything reaches a real customer. You keep the judgment call, and the busywork disappears.
Our advice: start with the highest-intent moments. Missed calls, no-shows and customers showing churn signals are where a well-timed, consented text pays off most, and they are the easiest to document. Get consent right at the front door and the rest of the system gets easier.
Bernard
Putting it into practice by use case
Compliance looks a little different depending on what you do:
- Missed calls (home services, contractors). A text-back goes to someone who just called you, and you should still identify your business and offer an opt-out. See how it works in our breakdown of missed call text back for contractors.
- Appointments and no-shows (dental, salons, medical). Reminders are informational, but a follow-up offering a discount is marketing. Our missed appointment text templates keep that line clear.
- Real estate follow-up. Lead forms, portals and open-house sign-ins all need consent that names you. We cover it in TCPA-safe real estate follow-up automation.
- Choosing a channel. If consent is thin for a segment, email may be the better first touch. Our SMS and email playbook shows how to split them.
Run compliant outreach with Signal Engine
Signal Engine scores customers on buy-readiness, flags churn risk and drafts SMS and email campaigns, with everything held for your approval before it goes out. 🎯 Missed call recovery, campaign automation and pipeline analytics live in one dashboard, with no per-seat pricing and all features in every plan.
Published plans include Growth at $149 per month and Scale at $297 per month, and a Free plan is available too. See Signal Engine pricing for what each includes, or look around in the live demo. Our legal page and terms of service explain how we handle your data. Software supports your compliance process, but you remain responsible for getting consent and following the law.
FAQ
Does the TCPA apply to texts from a small local business?
Yes. The FCC treats texts as calls, and the law has no small-business exemption. Autodialed marketing texts to mobile numbers need prior express written consent, and informational texts need express consent.
Can I text a customer who gave me their number when they booked?
For informational messages tied to that booking, like a confirmation or reminder, consent can be implied by the relationship or given verbally. Marketing texts, such as promotions, need written consent that clearly covers them, so add a separate checkbox for that.
What happens if someone replies STOP?
Suppress the number from all campaigns immediately and send a single confirmation. The FCC treats words like stop, quit, cancel and unsubscribe as reasonable revocation requests, and you cannot require customers to use only one method.
How much can a TCPA violation cost?
The statute allows $500 per violation, rising to as much as $1,500 per violation for willful or knowing violations. Since each text can be counted, a large campaign can generate large claims. Records of consent are your best defense.
Is TCPA compliance the same as carrier compliance?
No. The TCPA is law enforced through courts and the FCC. CTIA standards and 10DLC registration are carrier requirements that decide whether your messages get delivered. You need to meet both.
Sources
- FCC: Unlawful Communications, Robocalls and Caller ID Spoofing
- Federal Register: Targeting and Eliminating Unlawful Text Messages
- Federal Register: Strengthening the Ability of Consumers to Stop Robocalls
- CTIA Messaging Principles and Best Practices
- Iterable: Best Practices for SMS Compliance
- A2P Messaging: Rules, Registration, and Compliance
- BCLP: FCC's new 1:1 consent rule
Ready to Stop the Revenue Leak?
Signal Engine gives small and local businesses 31 AI-powered tools to score leads by buying intent, predict churn before it happens, auto-generate email and SMS campaigns, and recover missed calls automatically — all in one dashboard starting at $49/month.
Start your free 7-day trial — no credit card required. Setup takes 5 minutes.