The Telephone Consumer Protection Act is the federal law that decides whether your marketing texts are legal. It has real teeth: statutory damages run from hundreds to over a thousand dollars per violating message, with no cap, which is why TCPA lawsuits are a staple of class-action practice. The core of the law is simple, though. Before you send a marketing text, you need the recipient’s proper consent. This guide explains what “proper” means.
This article is general information, not legal advice. TCPA rules and FCC interpretations change, and state laws can add stricter requirements. Talk to a qualified attorney about your specific situation.
The Two Levels of Consent
The TCPA treats marketing and informational texts differently:
Prior express written consent is required for marketing texts, meaning any message that promotes or sells something. “Written” here includes electronic records like a submitted web form or a texted keyword, but the key word is express: the person must affirmatively agree, with clear disclosure of what they are agreeing to.
Prior express consent (not necessarily written) covers purely informational or transactional texts, like appointment reminders, order confirmations, or fraud alerts, when the person gave you their number in a relevant context. Even here, the safest practice is to treat consent as something you document, not something you assume.
Most compliance pain comes from marketing texts, so that is where this guide focuses.
What Valid Written Consent Looks Like
For a marketing opt-in to count under the TCPA, it needs these elements:
- An affirmative act. The person checks the box themselves, submits the form, or texts the keyword. Pre-checked boxes do not count. Silence does not count.
- Clear and conspicuous disclosure. The language must plainly state that the person agrees to receive marketing text messages, including autodialed or automated messages where applicable.
- Your business name. The disclosure must identify who will be sending the messages.
- No bundling. Consent cannot be a condition of purchase, and it cannot be buried inside general terms acceptance. The SMS opt-in must stand on its own.
- Frequency and cost disclosures. State how often messages will arrive (or a reasonable range) and include “message and data rates may apply.”
- Opt-out instructions. Explain how to stop messages, typically “Reply STOP to unsubscribe.”
A compliant example: “By checking this box, you agree to receive recurring automated marketing text messages from Bloom Salon at the number provided. Msg frequency varies. Msg & data rates may apply. Reply STOP to unsubscribe. Consent is not a condition of purchase.”
The One-to-One Consent Rule
An FCC rule that took full effect recently closed a major loophole: consent is now one-to-one. Each company sending marketing texts needs its own direct consent from each subscriber. You cannot buy a list and claim that consent given to someone else covers your messages. Lead generators and comparison sites must identify each specific seller at the point of consent, not hide behind a general privacy policy.
Practically, this means purchased or rented lists are off the table for SMS marketing unless every person on the list gave consent specifically to you. Build your own list, document every opt-in, and this rule is easy to satisfy.
Keep Proof of Every Opt-In
Consent you cannot prove is consent you do not have. For each subscriber, record:
- The phone number
- The date and time of opt-in
- Where it happened (the URL, the store location, the keyword)
- The exact disclosure language shown at the time
- The IP address for web signups, where available
Store these records for at least four years. When a dispute arises, and they do, this paper trail is the difference between a quick dismissal and a painful fight.
Honor Revocation Immediately
People can revoke consent at any time, through any reasonable method: replying STOP, calling you, emailing, or using a form on your site. The rule of thumb is to process opt-outs immediately and certainly within the required window. Keep texting someone after they opted out and every subsequent message is its own violation.
Make opting out as easy as opting in. “Reply STOP to end” in your messages, plus a working unsubscribe path everywhere else you operate, keeps you compliant and, frankly, keeps your list full of people who actually want to hear from you.
Transactional vs. Marketing: Know the Line
Order confirmations, shipping updates, and appointment reminders sit on the informational side of the line and face lighter consent requirements. But the line moves the moment you add promotional content. An order confirmation that tacks on “check out our new arrivals” is now a marketing message and needs marketing-level consent.
When in doubt, apply the stricter standard. Many businesses simply collect full marketing consent from everyone and stop worrying about which category each message falls into.
State Laws Layer on Top
The TCPA is the federal floor, not the ceiling. States like Florida, Texas, California, and others impose additional requirements: stricter quiet hours, registration or bonding obligations, and in some cases higher per-message damages. Build your program for the strictest state in your audience rather than trying to segment compliance state by state, because one mis-mapped number can undo the whole scheme.
Quiet hours deserve special attention. The widely observed window is 8 AM to 9 PM in the recipient’s local time, but states vary. Our quiet hours by state reference lays out the differences.
Putting It Into Practice
Consent compliance is mostly a checklist discipline. Before any campaign, confirm every number has documented opt-in with the right disclosures, confirm your messages identify your business and include opt-out instructions, and confirm your sending window respects quiet hours. The SMS campaign checklist covers these points and the 10DLC sample campaign descriptions show what compliant registration language looks like.
Frequently Asked Questions
Does a customer giving me their phone number count as consent to marketing texts?
No. A phone number handed over for checkout, delivery updates, or account purposes is not consent to receive marketing texts. Marketing requires prior express written consent with the specific disclosures described above.
Can I text a list I purchased from a data provider?
Only if every person on that list gave prior express written consent specifically to receive marketing texts from your business. In practice, purchased lists almost never meet this bar, which is why texting them is so risky.
What should I do when someone replies STOP?
Stop texting them immediately, confirm the opt-out if your system does that, and keep a record. Do not text them again for marketing purposes. Continuing to message after an opt-out creates per-message liability.
How long should I keep consent records?
At least four years is the commonly cited retention period, matching the TCPA’s statute of limitations. Keep the timestamp, source, and exact disclosure language for each opt-in.
Do transactional messages need the same consent as marketing?
No, purely informational messages like order confirmations have lighter requirements, but adding any promotional content converts them into marketing messages. Many businesses collect full marketing-level consent from everyone to keep things simple.