A quick note before we start: this article is practical guidance for builders, not legal advice. The TCPA is a federal statute with real penalties, courts keep refining it, and the FCC changes its rules from time to time. Treat everything here as a starting point, then have a qualified telecom attorney review your actual flows before you send to real customers.
The question every chatbot builder eventually asks
Every SMS chatbot project eventually hits the same question. The bot works, the conversations feel natural, then someone asks: “Are we allowed to text these people?” And the room goes quiet.
The TCPA (Telephone Consumer Protection Act) governs automated texts to US mobile numbers. It treats texts as calls and requires consent before you send. For marketing texts from an automated system, the standard is prior express written consent: a disclosure that says specific things, a recorded affirmative action from the consumer, and a log entry you can produce if anyone asks.
This article maps each legal requirement to the place in your chatbot flow where you implement it.
Marketing vs. transactional: the two consent tiers
The TCPA has two consent standards, and your chatbot probably sends both kinds of messages.
Marketing texts (promotions, offers, lead nurturing, cart reminders) need prior express written consent. The strict tier. Written includes electronic signatures under the E-SIGN Act, so a web form checkbox or keyword reply can qualify when it meets the requirements.
Transactional texts (order confirmations, shipping alerts, appointment reminders, OTPs) need only prior express consent, a lower bar. A customer who gives you their number and asks for delivery updates has generally given it.
The trap: consent is purpose-specific. OTP consent is not marketing consent. When your chatbot wears two hats, log which standard each message was sent under. And a shipping confirmation with a coupon stops being purely transactional. Courts treat mixed messages as marketing. When in doubt, apply the higher standard.
Where consent is captured in a chatbot flow
Consent is a moment in the user experience. Three common patterns:
1. The web form opt-in (before the chat starts)
A visitor enters their phone number and checks an unchecked box next to a clear SMS disclosure. Disclosure, checkbox state, and timestamp are all easy to log, making this the cleanest pattern. Pair it with double opt-in.
2. The keyword text-in
A customer texts JOIN or START to your number after seeing it on a sign or ad. The keyword is the affirmative act. Your bot must immediately reply with a confirmation restating who you are, what they will receive, how often, that message and data rates may apply, and how to opt out.
3. In-chat consent capture
The customer is already talking to your bot and the bot asks permission to send follow-ups. This is where most mistakes happen, and it is the default pattern in lead qualification bots. Compliant:
Bot: “Want appointment reminders by text? Reply YES to get reminders from [Your Brand]. Msg frequency varies. Msg and data rates may apply. Reply STOP to end.”
The user replies YES, and that YES paired with the preceding disclosure is the written agreement. Risky: “Can we text you?” with no disclosure of brand, frequency, or opt-out path. That is a friendly question, not consent.
What does NOT count as consent
None of the following is prior express written consent:
- A phone number sitting in your CRM. Having the number is not consent.
- A pre-checked “send me texts” box. Consent must be an affirmative act.
- Consent bundled into general terms acceptance, unless the SMS disclosure is clear, conspicuous, and separately agreed to.
- Consent to email. Email opt-in has nothing to do with text consent.
- Consent given to a different company. A lead seller’s opt-in does not automatically cover your chatbot.
- An existing customer relationship alone. Purchase history does not substitute for written consent on automated marketing texts.
The disclosure checklist: what the consent language must say
Whether the disclosure lives on a web form or inside the chat, courts and the FCC look for the same elements:
- A clear statement that the consumer agrees to receive marketing text messages.
- Your brand identity. The sending company must be named. “Messages from our partners” is not a name.
- That the messages are automated. “Automated marketing text messages” or “recurring automated texts” are standard.
- The phone number the agreement applies to.
- Message frequency. “Message frequency varies” is common; a specific cadence is better.
- “Message and data rates may apply.” Industry standard and expected by carriers.
- Opt-out instructions. “Reply STOP to end” or equivalent.
- A link to your privacy policy and terms.
- That consent is not a condition of purchase.
Put together:
“By entering your phone number and clicking Subscribe, you agree to receive recurring automated marketing text messages from [Your Brand] at the number provided. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe, HELP for help. Consent is not a condition of purchase. Privacy Policy: [URL]”
How to log consent like someone who expects to be audited
Consent you cannot prove is consent you do not have. TCPA cases are often decided on paperwork: can the sender show what the consumer saw, when, and what they did? For every opt-in, log the phone number, timestamp with timezone, source (form URL, keyword, or chat session ID), the exact disclosure version shown, the affirmative act (checkbox, keyword, or YES reply with the message body), IP address and user agent for web opt-ins, and the program name.
Never overwrite consent records. Append revocations and re-opt-ins as new events. Keep records at least four years after the last message to a number; disputes can surface years later.
Double opt-in deserves a mention. The TCPA does not require it, but it is the strongest proof you can hold: two affirmative steps. Web opt-in, then the bot texts “Reply YES to confirm you want [Your Brand] texts. Msg frequency varies. Msg and data rates may apply. Reply STOP to end.” Only after the YES does the number join the marketing program. It also stops wrong-number signups from becoming your liability.
Revocation: the part chatbot builders underestimate
Consent is not permanent, and since April 2025 the FCC’s revocation rules are more specific.
Any reasonable means counts. Not only STOP. “Please stop texting me” and “take me off your list” are revocations too. For a chatbot, this is an NLP problem: the bot must recognize revocation intent in natural language, not just match keywords.
Certain keywords are presumed revocations. Replies of STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE are definitive revocations. Handle them instantly.
You have 10 business days. Honor revocations within 10 business days at most. Build for immediate suppression; 10 business days is the ceiling, not the target.
One confirmation message is allowed. After a text revocation, one confirmation within 5 minutes is permitted, with no marketing content. After that, silence.
You cannot force a single opt-out method.
The build: one suppression list checked by every sending path before any message goes out. Err toward opting out. A false opt-out costs a subscriber; a missed revocation can cost a lawsuit.
Compliant vs. risky: two flows side by side
Compliant: the appointment reminder upsell.
A dental clinic’s chatbot confirms a booking, then sends the reminder opt-in with full disclosure (brand, frequency, rates, STOP). The patient replies YES; the bot logs the timestamp, session, disclosure version, and the YES. A later “stop the reminders” text opts them out immediately, and that gets logged too.
Risky: the lead-list chatbot.
A real estate investor loads purchased numbers into an AI chatbot that starts “conversations” with each. Nobody on that list gave written consent for automated marketing texts. It does not matter that the messages feel conversational. Each text is a separate potential violation: $500 per message for negligent violations, up to $1,500 for willful ones. This is the pattern behind eight-figure class action settlements.
Quiet hours: your bot needs a clock
Marketing texts should go out between 8 a.m. and 9 p.m. in the recipient’s local time, and several states impose stricter windows. Build timezone-aware scheduling: capture timezone at opt-in where you can, default to the most restrictive window when you cannot, and never let a workflow fire at 2 a.m. Our guides to state quiet hour rules and the quiet hours checker tool cover the state-by-state picture.
A note on the vacated one-to-one consent rule
You may have read that the FCC required separate one-to-one consent for each seller. Adopted in December 2023, then vacated by the Eleventh Circuit in January 2025 (Insurance Marketing Coalition v. FCC); the FCC removed the vacated language in August 2025. It is not currently in effect; the standard reverts to classic prior express written consent. Many guides still describe it as current law; they are out of date. Naming each seller clearly at consent time remains good practice.
Pre-launch compliance checklist
- [ ] Written consent flow per marketing program with all nine disclosure elements
- [ ] No pre-checked boxes, no bundled consent, no “we already had the number”
- [ ] Double opt-in on web captures before marketing starts
- [ ] First bot message identifies the brand and gives opt-out instructions
- [ ] Consent log captures number, timestamp, source, disclosure version, and the affirmative act
- [ ] Transactional and marketing messages logged under their respective standards
- [ ] Bot recognizes opt-out keywords and natural-language revocation intent
- [ ] One suppression list checked by every sending path; revocations honored within hours
- [ ] Quiet hours enforced per recipient timezone; state rules reviewed
- [ ] An attorney has reviewed the actual disclosure wording and flows
FAQ
Does someone texting my chatbot first count as consent?
For a single conversational reply, generally yes. But an inbound text is not a blank check for marketing. Once the bot sends promotions or campaigns, you need proper consent with the full disclosure.
Do I need written consent for appointment reminders and order updates?
Not the written tier. Transactional messages need prior express consent, established when the customer gives you their number for that purpose. Keep them transactional. A reminder with a promotional offer is marketing and needs the written standard.
Can I text numbers I bought from a lead vendor?
Only if you can verify each person gave prior express written consent naming your company, and you can produce that proof. Purchased lists rarely meet this bar. Review the evidence before you text, not after a complaint.
Does email consent count for texts?
No. Consent is channel-specific; an email subscriber has not consented to SMS marketing.
What if someone types “stop” with a typo?
The keyword presumption covers the standard words, but “any reasonable means” is broader. A message that clearly expresses a desire to stop is a revocation even with a typo. Train your bot to catch clear intent, including “don’t text me anymore.”
What are the penalties?
Statutory damages of $500 per violation for negligent violations and up to $1,500 for willful ones, each text counting separately with no cap. That is how individual mistakes become class actions. Carriers can also suspend your numbers on their own.
The bottom line
TCPA consent for an SMS chatbot is not a formality you bolt on at the end. It is a set of moments inside the conversation: the disclosure the user sees, the YES they type, the timestamp you store, and the STOP you honor without argument. Build those moments in from day one, log everything as if a judge will read it, and have a lawyer review the wording before you scale. The bot can be clever. The consent has to be boring, explicit, and documented.
Want this set up for you?
I build SMS chatbots and API integrations for businesses. If you would like what this guide describes, done for you, get in touch.