What Is the TCPA?
The Telephone Consumer Protection Act (TCPA) is the federal law that restricts telemarketing calls, autodialed calls, prerecorded or artificial voice messages, unsolicited faxes and, under FCC interpretation and court decisions, text messages. Congress passed it in 1991; it is codified at 47 U.S.C. § 227, and the Federal Communications Commission (FCC) implements it through rules at 47 CFR 64.1200. For any business that texts customers, the TCPA decides what consent you need, when you may send, how opt-outs must be honored, and what it costs when you get it wrong.
Short answer: Get the right consent for each kind of text (prior express consent for informational messages sent with regulated technology, prior express written consent for marketing), honor opt-outs made by any reasonable means, respect the National Do Not Call Registry and your internal do-not-call list for telephone solicitations, send solicitations only between 8 a.m. and 9 p.m. in the recipient's local time, and keep records that prove all of it. Violations carry statutory damages of $500 per message, up to $1,500 if willful or knowing.
Who Enforces the TCPA
| Enforcer | How |
|---|---|
| FCC | Writes and interprets the rules; brings enforcement actions and forfeitures |
| State attorneys general | Can sue on behalf of state residents |
| Consumers | Private right of action, individually or as a class, for statutory damages |
Most TCPA exposure for businesses comes from private lawsuits, often class actions, because damages are set per message and multiply quickly across a list. See real-world TCPA enforcement cases and class action lawsuit prevention.
Does the TCPA Apply to Text Messages?
Yes. The FCC has treated text messages as "calls" under the TCPA for many years, and the Supreme Court accepted that treatment in Campbell-Ewald Co. v. Gomez (2016). Texts sent with an automatic telephone dialing system (ATDS) to mobile numbers, and texts that are telephone solicitations, fall under the TCPA's consent and Do Not Call rules. See TCPA text message rules.
Consent: The Core of TCPA Compliance
| Message type | Example | Consent standard |
|---|---|---|
| Informational, sent with regulated technology | Appointment reminders, order updates, account alerts | Prior express consent (for example, the consumer gave you the number for that purpose) |
| Marketing or telemarketing | Promotions, offers, sales outreach | Prior express written consent |
| Conversational reply | Answering a text the consumer sent first | Consumer-initiated; reply within the scope of the request |
Prior express written consent requires a written agreement, which can be electronic, signed by the consumer, that clearly authorizes the seller to deliver marketing messages using regulated technology to the number provided, and that discloses that consent is not a condition of purchase. A pre-checked box, bundled terms or vague "we may contact you" wording does not meet the standard. See express written consent for SMS, TCPA opt-in requirements and SMS opt-in language templates.
Revocation and Opt-Out
Consumers can revoke consent at any time, by any reasonable means. Under the FCC's 2024 revocation order, texts such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE are treated as reasonable revocation requests, and businesses must honor revocations within a set period (10 business days under the order). A single confirmation text that does not include further marketing is permitted. Build your systems so an opt-out in one channel suppresses texting across all your tools. See SMS opt-out requirements and consent withdrawal across channels.
Do Not Call Rules
The TCPA's Do Not Call rules apply to telephone solicitations, including marketing texts, to residential subscribers, and the FCC treats wireless numbers as eligible for the National Do Not Call Registry.
- National Do Not Call Registry. Do not send telephone solicitations to registered numbers unless you have the consumer's prior express invitation or permission, or an established business relationship exemption applies. Scrub lists against the registry regularly. See National Do Not Call Registry and text messages.
- Internal do-not-call list. Keep your own list of consumers who asked you to stop, honor it, and maintain a written policy.
- Telemarketing Sales Rule. The FTC's TSR has parallel Do Not Call provisions for telemarketing. See DNC provisions of the TSR.
Time-of-Day Rules
FCC rules prohibit telephone solicitations before 8 a.m. or after 9 p.m. in the called party's local time. Several states set stricter windows or limit the number of messages in a period. Schedule marketing texts by the recipient's time zone, not yours. See TCPA calling hours and TCPA quiet hours and state variations.
What Counts as an Autodialer
The TCPA's consent requirements for non-marketing texts turn on whether the message was sent using an ATDS. In Facebook, Inc. v. Duguid (2021), the Supreme Court held that equipment must have the capacity to store or produce numbers using a random or sequential number generator to qualify. That narrowed the federal definition, but it did not affect the Do Not Call rules, and several states have mini-TCPAs with broader definitions. See ATDS after Facebook v. Duguid.
TCPA Penalties
| Exposure | Amount |
|---|---|
| Statutory damages per violation | $500 |
| Willful or knowing violation | Up to $1,500 (treble damages) |
| Do Not Call violations | Private action available after more than one violating call in 12 months |
| FCC forfeitures | Set by the FCC per violation |
Because each text can be a separate violation, a single campaign to a list without valid consent can create very large exposure. See TCPA text message penalties and the 10DLC fine avoidance guide.
Exemptions
Some messages are exempt from certain TCPA requirements, including some healthcare, financial and package-delivery notifications that meet strict conditions set by the FCC, and messages from government entities acting in an official capacity. Exemptions are narrow and conditional. See TCPA exemptions.
State Mini-TCPAs
States including Florida (Florida Telephone Solicitation Act), Oklahoma (Telephone Solicitation Act), Maryland and others have their own telemarketing and texting laws. They can add consent requirements, broader autodialer definitions, stricter hours and frequency limits, and their own private rights of action. Apply the strictest rule that covers each subscriber.
How TCPA Rules Developed
| Year | Development | Why it matters for texting |
|---|---|---|
| 1991 | Congress passes the TCPA | Restricts autodialed and prerecorded calls and telemarketing |
| 2003 | FCC confirms the autodialer restrictions cover text messages and creates the National Do Not Call Registry rules | Texts are treated as calls |
| 2012 | FCC adopts the prior express written consent requirement for telemarketing to mobile numbers, effective October 2013 | Marketing texts need written consent |
| 2015 | FCC omnibus order addresses revocation, reassigned numbers and autodialers | Consumers may revoke consent by reasonable means |
| 2018 | ACA International v. FCC (D.C. Circuit) sets aside parts of the 2015 autodialer interpretation | Autodialer definition left unsettled |
| 2021 | Facebook v. Duguid narrows the autodialer definition; the FCC's Reassigned Numbers Database launches | Fewer systems are autodialers; a safe harbor for checking reassigned numbers |
| 2024 | FCC revocation order on how and how fast opt-outs must be honored | STOP-style replies count; firm deadline to honor them |
Rules keep changing, so build your program around principles that survive changes: clear consent, easy opt-out, accurate records.
Building a TCPA Compliance Program
A program that holds up has owners, processes and evidence:
- Owner. One person accountable for messaging compliance, with authority to pause campaigns.
- Inventory. A list of every texting program, its purpose, consent standard, opt-in points, templates, vendors and sending numbers.
- Policies. Written consent, opt-out, Do Not Call and time-of-day policies, including your internal do-not-call policy.
- Templates and approvals. Pre-approved message templates per program, with review before new campaigns go out.
- Technology controls. Consent capture that stores evidence, automatic suppression of opt-outs across tools, time-zone scheduling, Do Not Call scrubbing and reassigned-number checks.
- Vendor management. Contracts that require vendors to follow your consent and opt-out rules and to give you access to logs.
- Training. Staff who talk to customers know how to recognize and record revocations.
- Monitoring and audit. Monthly review of opt-out rates, complaints and samples of sent messages, with fixes logged.
Record Retention
TCPA claims can be brought years after a message is sent; the federal limitation period that courts commonly apply to TCPA claims is four years. Keep consent records, disclosure versions, message logs and opt-out records for at least that long, and longer if counsel advises. Records should show, for any number, when and how consent was obtained, what the consumer saw, what you sent, and when they opted out. See consent record keeping.
Common TCPA Mistakes in Business Texting
- Texting purchased or rented lists. Consent given to a list seller or another brand does not authorize your marketing texts.
- Treating a phone number as consent. A number collected for billing or delivery is not written consent to marketing.
- Bundling consent. Burying SMS consent in general terms or making it a condition of purchase undermines it.
- Slow opt-out processing. Continuing to text after STOP, or only honoring the exact word STOP, invites claims.
- Ignoring time zones. Sending a national campaign at 8 a.m. Eastern reaches Pacific subscribers at 5 a.m.
- No records. Without proof of consent, a valid opt-in is hard to defend.
- Assuming 10DLC approval means compliance. Carrier approval does not review or guarantee your TCPA consent.
TCPA and 10DLC: Two Separate Systems
10DLC registration with The Campaign Registry is a carrier requirement for A2P texting from local numbers. It is not TCPA compliance. A registered Campaign can still violate the TCPA if consent is missing, and TCPA-compliant consent does not register your Campaign. Carriers do, however, check the same evidence: your opt-in language, privacy policy and samples. Building your consent process once, to TCPA and CTIA standards, serves both. See 10DLC compliance guide.
TCPA Compliance Checklist for Business Texting
- [ ] Map every message type to the consent it requires
- [ ] Use separate, unchecked opt-ins for marketing, with "consent is not a condition of purchase"
- [ ] Publish SMS terms and a privacy policy with an SMS section; see the SMS terms template
- [ ] Show a full SMS disclaimer at every opt-in point
- [ ] Store consent records with timestamp, source and disclosure version
- [ ] Honor STOP and other revocation methods across all channels
- [ ] Scrub marketing lists against the National Do Not Call Registry and your internal list
- [ ] Check reassigned numbers before texting old contacts
- [ ] Send solicitations only between 8 a.m. and 9 p.m. recipient local time, or stricter state windows
- [ ] Review vendors and platforms for consent and opt-out handling
- [ ] Have counsel review programs in regulated industries
TCPA Compliance by Industry
| Industry | Key TCPA issue | Guide |
|---|---|---|
| Healthcare | Exemption conditions; keep PHI out of texts | Healthcare SMS and TCPA compliance |
| Debt collection | TCPA plus FDCPA and Regulation F | Debt collection texting compliance |
| Real estate | Purchased leads and marketing consent | Real estate SMS marketing |
| Retail and e-commerce | Checkout consent and promotions | 10DLC for e-commerce |
| Agencies | Consent owned by each client brand | A2P compliance platform for agencies |
FAQ
What is the TCPA?
The Telephone Consumer Protection Act of 1991, 47 U.S.C. § 227, a federal law restricting telemarketing, autodialed and prerecorded calls, faxes and text messages, implemented by the FCC.
Who regulates and implements the requirements of the TCPA?
The FCC writes and interprets the rules. State attorneys general and private plaintiffs enforce it through lawsuits.
Does the TCPA apply to text messages?
Yes. Texts are treated as calls under the TCPA, so consent, Do Not Call and timing rules apply.
What consent do I need for marketing texts?
Prior express written consent: a signed written or electronic agreement that authorizes marketing texts to that number and discloses that consent is not a condition of purchase.
What are the TCPA fines for text messages?
Statutory damages are $500 per violation and up to $1,500 if willful or knowing, per message.
What hours does the TCPA allow for marketing texts?
Telephone solicitations are allowed between 8 a.m. and 9 p.m. in the recipient's local time. Some states are stricter.
Is 10DLC registration the same as TCPA compliance?
No. 10DLC is a carrier registration requirement; the TCPA is federal law. You need both.
How long do I have to honor an opt-out?
Under the FCC's 2024 revocation order, revocations made by reasonable means must be honored within 10 business days. Honoring STOP immediately is best practice.