Texting customers legally: TCPA basics for service businesses

Why are the rules for texts stricter than for email?

Email marketing in the U.S. runs on an opt-out system: you can send commercial email as long as you follow CAN-SPAM's rules, and the FTC's compliance guide for the law requires honoring an opt-out request within 10 business days. Marketing texts are different. They fall under the Telephone Consumer Protection Act (TCPA), a 1991 law aimed at robocalls and other automated calls. The FCC has confirmed that a text message sent using an autodialer is a "call" subject to the TCPA (FCC 24-24), and the rules for automated marketing texts start from consent, not opt-out.

The stakes are also different. Under 47 U.S.C. § 227(b)(3), a person can sue for actual losses or $500 for each violation, whichever is greater, and a court can triple that to as much as $1,500 per violation if it was willful or knowing. A separate provision, § 227(c)(5), lets a person who got more than one call within 12 months from the same company in violation of the Do Not Call rules sue for up to $500 per violation, also up to three times that if willful or knowing. A single campaign to a few hundred people without proper consent can turn into a very expensive lawsuit.

What kind of consent do marketing texts need?

For marketing (telemarketing) texts sent to mobile numbers with an autodialer, the FCC's rule at 47 CFR § 64.1200(a)(2) requires prior express written consent. The rule defines that as an agreement in writing, bearing the signature of the person, that clearly authorizes the seller to send them advertisements or telemarketing messages using automated technology, and that includes the phone number they can be sent to. Electronic signatures count: in its 2012 order adopting the rule (FCC 12-21), the FCC said consent that complies with the federal E-SIGN Act, including consent given through a website form or a text message, satisfies it.

The agreement must also clearly disclose that the person isn't required to sign it as a condition of buying anything. The same order says that if a question about consent comes up, the seller bears the burden of showing that the disclosure was clear and the consent unambiguous. In practice, a good consent checkbox on a quote form or checkout looks like this:

Points that matter:

• Unchecked by default. The customer has to choose it.
• Separate from the terms of service. Burying consent in the fine print of a quote acceptance is asking for a dispute.
• Specific to your business. Name the company that will text.
• Recorded. Keep the date, time, page or form, the exact wording shown and the phone number. Your CRM should store this on the customer record, because the burden of proof is yours.

Messages a customer needs to receive about work they asked for, like appointment confirmations or "the crew is on the way", are generally treated differently from marketing. If they're sent to cell phones with an autodialer, the rule still requires the customer's prior express consent (§ 64.1200(a)(1)), but not the signed, written kind. The line between informational and marketing can blur, though. A reminder that also pushes an add-on service is marketing. When in doubt, treat it as marketing and get written consent.

Which of your texts count as marketing?

Most service businesses send a mix. Sorting them up front decides which ones need written consent and which ones need to stop when a customer opts out of marketing.

That last row catches many companies. A customer who gave you a number five years ago to schedule a job did not necessarily agree to promotional texts. Email them instead, and ask them to opt in to texts if they want. Our guide to winning back past customers uses email first for this reason.

What happened to the one-to-one consent rule?

In 2023 the FCC adopted a rule meant to stop lead generators and comparison-shopping sites from collecting one consent that covered many businesses at once. The rule would have required consent to one seller at a time, and limited the calls and texts to topics related to the interaction where consent was given. On January 24, 2025, the Eleventh Circuit federal appeals court vacated both requirements in Insurance Marketing Coalition v. FCC (opinion), days before the rule's original January 27, 2025 effective date (Morrison Foerster analysis).

For a contractor collecting consent on its own website, this changes little. Consent you collect should already name your business and nobody else. It matters more if you buy leads: a lead marketplace's consent form may not give you consent to text marketing to that person. Another reason to build your own list. Our page on owning your leads explains why.

Do the rules apply if your texting tool isn't an autodialer?

Some of them may not, but a texting program built on that argument is fragile. In Facebook, Inc. v. Duguid (2021), the Supreme Court held that to count as an "automatic telephone dialing system" under the TCPA, a device must be able to store or produce phone numbers using a random or sequential number generator (opinion). That narrowed which tools trigger the consent rule for automated texts. Three things still apply to marketing texts:

• The Do Not Call rules. Section 64.1200(e) applies the FCC's Do Not Call rules to marketing texts sent to wireless numbers. A number on the national registry can't receive your solicitations unless the person gave you permission in a signed, written agreement or has an established business relationship with you, which the rule defines as a purchase or transaction in the past 18 months or an inquiry in the past three months (§ 64.1200(c)(2), (f)(5) and (f)(15)).
• Your own do-not-call list. Anyone texting for marketing must keep a list of people who asked not to be contacted, honor each request within ten business days, and keep honoring it for five years (§ 64.1200(d)).
• State law. Some states write their own rules. Florida, for example, requires prior express written consent for sales texts sent with "an automated system for the selection and dialing of telephone numbers", its own wording rather than the federal autodialer definition (Fla. Stat. § 501.059(8)(a)).

That is why most businesses treat written consent as the standard for every marketing text, whatever software sends it.

What time of day can you send marketing texts?

Federal rules bar telephone solicitations before 8 a.m. or after 9 p.m., measured in local time at the recipient's location (47 CFR § 64.1200(c)(1)), and § 64.1200(e) applies that rule to marketing texts sent to cell phones. Some states set narrower windows or limit the number of messages. Florida, for example, sets an 8 a.m. to 8 p.m. window and a limit of three solicitation calls in 24 hours on the same subject for the sellers its telemarketing law covers (Fla. Stat. § 501.616(6)). Check the states where your customers live.

Good practice is tighter than the law. Send marketing texts on weekdays in mid-morning or early evening. Never send a promotion at 8:01 a.m. on a Sunday just because it is technically allowed. Schedule campaigns by the customer's time zone if you serve more than one.

How fast do you have to honor opt-outs?

Under 47 CFR § 64.1200(a)(10), a person can revoke consent using any reasonable method that clearly says they don't want more messages. A reply of "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" to your text counts automatically, and a reply in other words counts too if a reasonable person would understand it as a request to stop. You can't make customers use one specific method. A revocation must be honored within a reasonable time, no more than ten business days from receipt.

You may send one confirmation text that only confirms the opt-out and contains no marketing. Under § 64.1200(a)(12), a confirmation sent within five minutes is presumed to be covered by the person's earlier consent; if it takes longer, you have to show the delay was reasonable.

Operationally, that means:

• Your texting system must catch those keywords automatically and block further marketing to that number.
• Someone must read replies that say it in other words ("please don't text me anymore") and record the opt-out by hand.
• The opt-out must sync everywhere you text from: your CRM, your marketing tool, your phone system.
• Opt-outs must survive a software switch. Our guide to switching CRMs covers carrying consent and opt-outs across.

What is 10DLC and do you need it?

If you text customers from a regular 10-digit business number through software, yes. A2P 10DLC is the standard U.S. carriers use to verify business texting from standard long-code numbers. Per Twilio's A2P 10DLC documentation, anyone using an application to send SMS or MMS to the U.S. over a 10DLC number has to register, and unregistered traffic is charged additional carrier fees. Its error 30034 page says Twilio blocks messages sent from a 10DLC number that isn't tied to an approved campaign.

Registration has two parts. The brand step asks for your business details: for most companies, the legal name as registered with your EIN, a working website, a contact person and an address. Each campaign then needs a description of who is texting whom and why, two to five sample messages, and a description of how people opt in (Twilio's registration checklist). Twilio's approval tips list a business website reviewers can't validate as a common reason for rejection, ask for links or screenshots of the opt-in on your site, and call a privacy policy mandatory for web opt-in. Our guide on 10DLC registration walks through the steps.

What does a careful texting program look like?

1. Separate informational texts (appointments, arrival, invoices) from marketing texts in your system.
2. Collect written consent for marketing with a clear, unchecked checkbox and store the record.
3. Register your number and campaigns for 10DLC before the first marketing send.
4. Name your business in every marketing text and give a phone number or address where you can be reached, which the Do Not Call rules require for telemarketing (§ 64.1200(d)(4)).
5. Schedule sends inside the federal 8 a.m. to 9 p.m. window and any stricter state limits, ideally well inside them.
6. Process STOP and similar replies automatically, read the rest, and sync opt-outs everywhere.
7. Write a short do-not-call policy, train whoever sends texts on it, and honor each do-not-call request for five years (§ 64.1200(d)(1), (2) and (6)).
8. Keep consent and opt-out records for as long as you might need to prove them.
9. Have a lawyer review your consent wording once, and again when the rules change.

Our email and SMS marketing service sets texting up this way, and our business phone service handles the number and 10DLC registration. We will set up consent capture and opt-out handling for you, but compliance still depends on how your business collects consent, so keep your lawyer involved.

Frequently asked questions