TCPA SMS Compliance: What Text Marketers Need to Know

What is the TCPA and does it apply to text messages?

Yes. The Telephone Consumer Protection Act of 1991 covers text messages the same way it covers calls, and the FCC writes the rules that implement it. For marketers, the practical rule is simple: get prior express written consent before sending marketing texts, and stop when someone asks you to.

Two parts of the rules matter most for SMS programs:

• Automated marketing texts. Telemarketing texts sent with an autodialer or artificial or prerecorded content require prior express written consent (47 CFR 64.1200). The Supreme Court narrowed the federal autodialer definition in Facebook v. Duguid (2021), but several state laws define automated systems more broadly, and carriers expect written consent regardless.
• Do Not Call rules. Marketing texts to numbers on the National Do Not Call Registry need consent or an established business relationship, whatever technology sends them. The FCC confirmed in December 2023 that these protections apply to texts.

One more change affects how courts read FCC guidance. In McLaughlin Chiropractic v. McKesson (June 20, 2025), the Supreme Court held that district courts are not bound by FCC interpretations of the TCPA in enforcement suits. FCC orders still carry weight, but results can now differ by jurisdiction.

What does prior express written consent require?

Prior express written consent is a signed written agreement, and an electronic signature under the E-SIGN Act counts, that clearly authorizes a specific seller to send marketing messages to a specific phone number. It must also disclose that consent is not a condition of purchase.

• Written: a web form checkbox, a keyword text-in, or a signed paper form, stored so you can produce it later.
• Express: an affirmative act by the consumer. Silence, pre-checked boxes, and consent buried in general terms do not qualify.
• Prior: obtained before the first marketing message, not after.
• Seller-identified: the disclosure names who will text and what kind of messages to expect.
• Not a condition of purchase: the consumer can buy or submit the form without agreeing to texts.

What happened to the FCC one-to-one consent rule?

It never took effect. On January 24, 2025, the Eleventh Circuit vacated the rule in Insurance Marketing Coalition v. FCC, one business day before its effective date, and the FCC later removed the language from its rules in 2025.

The rule would have required consent to name a single seller and limited messages to topics "logically and topically" related to the original interaction. Both requirements were struck down. Federal law now uses the earlier definition of prior express written consent, which does not forbid naming more than one seller in a disclosure.

That does not make shared lead consent low-risk. CTIA's Messaging Principles and Best Practices say an opt-in "should not be transferable or assignable" and that senders should not use opt-in lists that were rented, sold, or shared. Carriers and messaging platforms enforce this during 10DLC review. Plan for consent that names your own brand.

How do you capture consent that holds up?

Use a clear call to action, an unchecked optional checkbox, and a complete record of what the consumer saw and did. Each step below is something carriers or plaintiffs' lawyers check.

1. Write specific disclosure language. Name the brand, the message type, the frequency, "Msg and data rates may apply," and how to get HELP and opt out with STOP. See our SMS opt-in language guide.
2. Use a separate, unchecked checkbox. SMS consent should not be bundled with email consent or with accepting your Terms, and the form should submit without it.
3. Link your Privacy Policy and Terms from the form. CTIA expects the privacy policy to be reachable from the call to action and to explain how mobile information is used and shared.
4. Send a confirmation text. For recurring programs, CTIA recommends a first message that names the program, gives HELP and STOP instructions, and states frequency and any charges.
5. Store the evidence. CTIA lists timestamp, capture method, the exact language shown, the campaign, IP address, phone number, and the identity of the person who consented.

What are the current opt-out and consent revocation rules?

Since April 11, 2025, consumers can revoke consent by any reasonable means, and you must honor the request within 10 business days. A second FCC rule that would stretch one opt-out to every message you send has been delayed and is being rewritten.

Ten business days is a legal ceiling, not a target. Carriers and CTIA expect STOP to work right away, and every message sent after an opt-out is potential evidence of a willful violation. Process opt-outs automatically and sync them to every platform that sends on your behalf.

Do quiet hours and state laws apply to texts?

Yes. The FCC bars telephone solicitations before 8 a.m. or after 9 p.m. in the recipient's local time, and several states set stricter limits. Since late 2024, a wave of class actions has targeted marketing texts sent outside those hours.

Whether federal quiet hours apply to texts people consented to is unsettled. The FCC's definition of telephone solicitation excludes messages sent with prior express invitation or permission, and the Ecommerce Innovation Alliance petitioned the FCC in March 2025 to confirm that. The FCC had not ruled as of this update. The safest practice is to send marketing texts only between 8 a.m. and 8 p.m. recipient-local time.

What are the penalties for TCPA violations?

Statutory damages are $500 per violation, or actual damages if higher, and courts can triple that to $1,500 per message when the violation is willful or knowing. Because each text is a separate violation, class actions multiply quickly.

For example, 10,000 class members who each got 5 unconsented texts add up to 50,000 violations, which is $25 million at the $500 minimum. State laws such as Florida's and Oklahoma's add their own statutory damages. Carriers can also suspend your campaign over complaints, lawsuit or not.

Which texts do not need written consent?

Informational and transactional texts need prior express consent rather than written consent. True emergency messages need no consent. Giving your number for a transaction usually counts as consent to texts about that transaction.

• Transactional and informational: order confirmations, shipping updates, appointment reminders, and account alerts. Keep them free of marketing; adding a promotion can turn them into telemarketing.
• Emergency purposes: messages about a health or safety risk to the recipient.
• Responses to a consumer's own text: a single reply with the information they asked for, with no follow-up marketing.

Which red flags lead to lawsuits or carrier blocks?

Most TCPA suits and carrier suspensions trace back to missing consent records, weak opt-out handling, or bought data. Check your program for these:

• Texting purchased, rented, or co-registration lists that do not name your brand
• Pre-checked SMS boxes, or SMS consent required to submit a form
• No privacy policy, or one that does not address mobile information
• Opt-outs that do not sync across every sending platform
• Marketing texts sent late at night or early in the morning, recipient-local time

How do you get started?

Start with an audit: confirm you can show a consent record for every number you text, test STOP and HELP end to end, and check your forms and policies against carrier requirements.

Our free Landing Page QA tool scans a page for 10DLC and TCPA consent signals. If you need the compliance work done for you, our SMS and 10DLC compliance service covers consent-form language, brand and campaign registration prep through The Campaign Registry, and TCPA and CTIA alignment. This article is general information, not legal advice. Have counsel review your program.

Stephen Ventura founded Full Percent in Boca Raton, Florida. He has built email systems since 1997 and SMS platforms since before the iPhone. stephenventura.com