Marketing texts: what consent has to look like, and what you have to keep

The Telephone Consumer Protection Act treats a text message as a call. That single move imports a body of rules written for telemarketing into a channel most marketing teams run out of the same dashboard as their email. The requirements are not similar, and the penalty structure is not similar either: statutory damages attach to each message, not to the campaign.

What the law requires before the first message goes out

Under 47 CFR § 64.1200(a)(2), no advertisement or telemarketing message may be sent to a mobile number using an automatic telephone dialing system or an artificial or prerecorded voice other than with the prior express written consent of the called party. There is no volume threshold and no exception for a single message.

The free-choice line is the requirement people find surprising, and it has a commercial consequence: you cannot make marketing texts the price of checkout. If the box is mandatory, the consent it collects is defective even though the box was ticked deliberately.

Buying from you is not consent — though it does one useful thing

Paragraph (a)(2) has no established-business-relationship exception. A customer who bought yesterday and gave you a mobile number for delivery updates has not authorised advertising messages, and the rules do not read one into the transaction.

What the relationship does do is narrower. The definition of a telephone solicitation in paragraph (f)(15) excludes a message to someone the caller has an established business relationship with, which takes that message outside the national do-not-call registry rules. The relationship runs eighteen months from a purchase and three months from an enquiry, and ends the moment the person asks you specifically not to contact them. So a past purchase answers the registry question. It does not answer the written-consent question, and the two arrive together.

The one-to-one consent rule was vacated, and is not in force

In December 2023 the FCC rewrote the definition of prior express written consent so that one agreement could authorise no more than one identified seller, and so that any resulting call had to be logically and topically associated with the interaction that produced it. The target was lead generators selling a single form fill to forty buyers.

It never took effect. On 24 January 2025 the Eleventh Circuit held in Insurance Marketing Coalition Ltd. v. FCC that the Commission had exceeded its authority, and vacated the rule. The definition in force today is the pre-2023 text, which carries none of that language. If you read a compliance article written in 2024, this is the paragraph that has since stopped being true.

The practical position moved much less than the headlines suggested. Where a number is on the national do-not-call registry, paragraph (c)(2)(ii) still requires a signed written agreement stating that the consumer agrees to be contacted by this seller and including the number to be called. Carrier rules go further still, treating consent as non-transferable between brands. A consent form promising messages from "our trusted partners" therefore remains a poor foundation, and if you buy leads the affiliate agreement is where responsibility for the underlying opt-in should be allocated in writing.

Why "our platform is not an autodialer" is a thin defence

In Facebook v. Duguid (2021) the Supreme Court held that an automatic telephone dialing system must use a random or sequential number generator to store or produce the numbers it dials. Most messaging platforms send to an uploaded list and so arguably fall outside it, which removes the written-consent claim. Senders sometimes stop reading there.

The second regime does not care what equipment you used. Paragraph (e) applies the do-not-call rules to telephone solicitations and telemarketing messages sent to wireless numbers, and those rules turn on the purpose of the message, not the technology behind it. They require a written do-not-call policy available on demand, trained staff, a request recorded at the time it is made, and a suppression that lasts five years.

That private right of action opens once someone receives more than one message in a twelve-month period — a low bar for any weekly campaign. There is a defence for a sender who established and implemented reasonable practices and procedures with due care, which is a defence made of documents you either wrote in advance or did not.

The opt-out is a deadline, not a keyword

Since April 2025 the revocation rules have been explicit. A recipient may revoke consent by any reasonable method. Replying with stop, quit, end, revoke, opt out, cancel or unsubscribe is a reasonable means per se — and if a reply uses different words, you must treat it as revocation where a reasonable person would understand it that way. "Please leave me alone" counts. You also may not designate an exclusive route: if your platform cannot receive replies, every message has to say so and offer another way out.

That last date has moved twice: due on 11 April 2025, waived to 11 April 2026, and extended again on 6 January 2026 to 31 January 2027 while the FCC consults on changing the requirement. Everything else in the rule has been live throughout. Build for the end state anyway — a suppression list covering only one campaign is a bug you will fix under time pressure.

Revocations that arrive by other routes still bind you. A voicemail or an email asking you to stop creates a rebuttable presumption that consent is revoked once the person produces evidence of sending it, and you then have to argue the totality of the circumstances. In practice, a reply-to email address nobody monitors is a liability.

Consent is a records problem, not a copywriting problem

Consent is an affirmative defence. The recipient need not prove they never agreed; you have to prove they did. That is why these disputes turn on database exports rather than on the elegance of the opt-in language, and why "we would never have added them without consent" is not evidence of anything.

Price the exposure before deciding how much record-keeping is worth. Statutory damages are $500 per offending message, trebled to $1,500 where the violation was wilful or knowing, with no need to show any loss. A modest list and a few sends reach a number that dwarfs the cost of storing a row per subscriber.

State laws and carriers are the two layers people meet first

Several states run their own telemarketing statutes, with their own definitions and damages, and they do not track the federal rules. Florida is the one most texting programmes meet: section 501.059 of the Florida Statutes requires a recipient to reply STOP and gives the sender fifteen days to stop before a claim over text solicitations can be brought at all. That is a safe harbour, but it is Florida's, and it does nothing in the next state over.

The layer that bites soonest is not legal at all. Mobile carriers apply the CTIA Messaging Principles and Best Practices through 10DLC campaign registration, and they decide whether your traffic is delivered. A campaign whose described opt-in does not match the form on your site tends to fail registration or get filtered, which is a marketing outage arriving months before any regulator would. The consent flow, the terms of service it references and the registered campaign description all have to describe the same thing.

One more question decides who carries the risk: whose customer the number is. Consent belongs to whoever was named in the agreement the person signed, so on a platform that is a term to settle in the marketplace terms before anyone imports a list. Which surrounding pages you must publish at all is covered in which legal pages your website needs.

What to do with a list you cannot document

Most established programmes hold numbers whose origin nobody can reconstruct: an event badge scan, a phone field on a delivery form, an acquired customer base. The instinct is to keep sending until someone complains. The arithmetic argues the other way, because every message to an undocumented number is its own violation.

The workable route is one re-permission send to that segment, with a fresh compliant opt-in and a record written at the moment of the click, then deletion of everyone who does not answer. It shrinks the list and it is uncomfortable to sign off. It is also the only version of the list you can defend — a text programme is worth what its consent records can prove, and nothing more.