Texting Compliance in the USA: Rules for Business Texts
Texting compliance in the USA rests on three layers: federal law (the TCPA and FCC rules), state “mini-TCPA” laws, and carrier rules that decide whether your messages get delivered at all. To stay on the right side of all three, get the right level of consent before you text, honor every opt-out quickly, text only in permitted hours, register your numbers, and keep proof of everything for years.
This guide is written for service professionals who text leads: real estate agents, contractors, insurance agents, mortgage brokers and financial advisors. It walks through each layer in plain terms, shows what to record, and ends with a checklist you can run before any automated campaign goes live.
AstreauxRespond to Leads With CareAstreaux automates personalized engagement and follow-ups, helping service professionals manage lead conversations while keeping consent and opt-outs in focus.Book a call
TL;DR
Marketing texts to a mobile number need prior express written consent. Informational texts can rest on oral or written consent, according to the FCC’s consumer guide.
Business-to-business does not mean exempt. The TCPA protects the phone, not the job title.
Any reasonable opt-out must be honored within 10 business days at most, and new FCC revocation rules take effect on November 25, 2026.
Carriers enforce their own rules. Unregistered 10DLC traffic can be blocked even if your texts are legal.
Keep consent records for at least five years. Statutory damages run $500 to $1,500 per message.
Who regulates business texting in the U.S.
There is no single “texting law.” You answer to several parties at once:
Layer | Who sets it | What it controls |
|---|---|---|
Federal law | Congress, the FCC, the FTC | Consent, opt-outs, calling hours, Do Not Call lists, recordkeeping |
State law | State legislatures and attorneys general | Stricter hours, registration, extra penalties |
Carrier rules | AT&T, T-Mobile, Verizon via CTIA guidelines | Registration, content filtering, delivery |
The FCC treats text messages as telephone calls under the TCPA. That brings in the do-not-call provisions for commercial advertising and the limits on automatic telephone dialing systems, as described on the FCC’s unlawful communications page. The same page notes that restrictions are generally tightest for calls and texts to cell phones and protected destinations such as emergency lines and hospital rooms.
The practical takeaway: a text can be legal and still undelivered, or delivered and still illegal under a state statute. Compliance means clearing all three layers.
When the TCPA applies to texts sent to leads
If you send automated or marketing texts to a mobile number, assume the TCPA applies. The law focuses on how a communication is made, especially with mobile phones, automated dialing or prerecorded messages. Consent requirements can apply whether the recipient is a consumer or a business contact, and there is no blanket exemption that makes B2B outreach automatically compliant.
One practical example: a contractor who pulls a business owner’s cell number from a website and sends a promotional text has not escaped the rule. One industry analysis of SMS lead generation makes the same point: the TCPA protects numbers, not job titles, so a salesperson’s personal cell is covered wherever you found it.
Marketing vs. informational texts
The level of consent depends on what the message does:
Marketing or commercial texts (promotions, offers, nurture sequences that sell): prior express written consent.
Informational texts (appointment confirmations, estimate scheduling details, reminders the person asked for): oral or written consent is generally enough.
That split comes from the FCC’s guidance on robocalls and texts, which also confirms that written consent can be given on paper or electronically, including through website forms or a telephone keypress.
Messages often blend both. A reminder that ends with “Ask about our spring promotion” is a marketing text. When in doubt, treat it as marketing and collect written consent.
Does an inquiry count as consent?
A lead filling out your form with a phone number is the strongest starting point, but only if the form tells them what they are signing up for. Consent is tied to what the person agreed to see, so a form that mentions “a quote” does not automatically cover a six-week promotional drip. Write the consent language to cover the replies and follow-ups you actually plan to send.
What good consent language includes
Your opt-in form, keyword or checkbox should state, in clear and conspicuous wording, the following elements. This list follows a TCPA compliance checklist from a business phone provider:
Your business name.
A description of the messages the person will receive.
How often messages may be sent.
A statement that consent is optional and not a condition of purchase.
A notice that standard message and data rates may apply.
Opt-out instructions, such as “Text STOP to unsubscribe.”
Links to your terms of service and privacy policy.
The checkbox must be unchecked by default so the person actively opts in.
Here is a sample you can adapt:
By checking this box, I agree to receive text messages from {{businessName}} about my inquiry, including appointment scheduling and follow-ups, at the number above. Message frequency varies. Consent is not a condition of purchase. Msg and data rates may apply. Reply STOP to opt out. See our Terms and Privacy Policy.
If you want an extra layer of confirmation, a second confirming message can help. Our guide to double opt-in for SMS covers how it works.
Opt-outs: how to handle STOP and everything like it
Under 47 C.F.R. § 64.1200(a)(10), a person may revoke consent by any reasonable method that clearly expresses a desire not to receive further calls or texts. You must honor the request within a reasonable time, not to exceed ten business days from receipt.
In practice, “reasonable method” means you cannot insist on one exact word. Replies like “stop texting me,” “please remove me,” or a call to your office all count.
The November 25, 2026 change
The FCC’s new consent-revocation rules go into effect on November 25, 2026. According to Steptoe’s analysis, senders may designate an exclusive opt-out method, such as standardized keywords or a website or phone number, but must still honor the standardized keywords: STOP, END, CANCEL, UNSUBSCRIBE, QUIT, REVOKE and OPT OUT. For marketing texts, one revocation request opts the person out of future telemarketing communications from or on behalf of that entity.
The original “revoke all” provision, delayed to January 31, 2027, will never take effect as written because the revised rule supersedes it. For informational messages, an opt-out from one type of message, such as bill reminders, does not automatically cover another type, such as fraud alerts.
What to do now:
Make sure your system recognizes all seven keywords, in any capitalization.
Send one short confirmation of the opt-out, then stop.
Sync the opt-out across every tool and every team member who can text from your account.
Log the date, time and method of the request.
Texting hours, Do Not Call and sender identification
Quiet hours
Under 47 CFR § 64.1200, telephone solicitations to residential subscribers are prohibited before 8 a.m. or after 9 p.m. in the recipient’s local time. Leads do not always live in your time zone, so schedule by the lead’s area, not yours. Some states are tighter, and Florida’s window ends at 8 p.m., as noted below. Our guide to quiet hours texting goes deeper on scheduling by local time.
Do Not Call lists
The TCPA prohibits marketing calls and texts to numbers on the National Do Not Call Registry or a state registry without express written consent. Consumer Action’s TCPA overview adds that callers must check for reassigned numbers and keep an internal do-not-call list for people who opt out. Reassigned numbers matter for long-running lead lists: a number that belonged to a past inquiry may belong to a stranger today.
Identify yourself
Solicitors must give the individual caller’s name, the business name and a contact telephone number or address, per the federal regulation text. In a text, that usually means opening with your name and business: “Hi {{firstName}}, this is Dana from {{businessName}}.” Use a real number people can reach.
Carrier rules: 10DLC registration and CTIA guidelines
Carrier rules are not law, but they decide whether your message arrives. Beginning February 1, 2025, CTIA rules require businesses sending A2P texts over 10DLC numbers to register, and carriers may block unregistered traffic.
Registration runs through The Campaign Registry: you register a brand and then a campaign. According to one provider’s 10DLC overview, brand approval can take up to four business days, and campaign approval by the carriers up to five business days, or up to three weeks in high-volume periods. Plan launches around that.
Expect to provide:
Your federal EIN or TIN and legal business name.
How you obtain opt-in consent, plus the text of your opt-in, opt-out and help messages.
Links to a privacy policy and SMS terms that meet carrier requirements.
The CTIA Messaging Principles and Best Practices, updated in May 2023, are treated by carriers as mandatory. Violating them can get legal messages filtered. A scheduling text may need only express consent under federal law, yet carriers still check your consent form through registration. Build one consent flow that satisfies both.
Content categories matter too. Industry guides commonly flag sex, hate, alcohol, firearms and tobacco (SHAFT) content as restricted on U.S. carrier networks. Most service professionals will never touch these, but lead lists and links should be checked so a shared URL does not trigger filtering.
State laws that go further than the TCPA
Federal law is the floor. According to a fall 2025 review of telemarketing compliance, at least 15 jurisdictions were enforcing mini-TCPA statutes. Examples:
State | What to know |
|---|---|
Texas | SB 140, effective September 1, 2025, extends “telephone solicitation” to text and image messages, requires registration with the Secretary of State and $10,000 security, and ties violations to the Deceptive Trade Practices Act with treble damages and attorney’s fees. |
Virginia | SB 1339 requires honoring text opt-out commands for 10 years. |
Connecticut | SB 1058 requires prior express written consent and limits calling hours. |
Georgia | SB 73 removes damage caps and the “knowing” requirement and adds vicarious liability. |
Florida | Calling window of 8 a.m. to 8 p.m., a maximum of three contact attempts per 24 hours on the same subject, and $500 to $1,500 per violation with a private right of action, per a state law comparison. A 2023 amendment added a 15-day STOP cure period for text lawsuits. |
New York | Section 399-z of the General Business Law was amended in 2021 to cover electronic messaging text, with penalties up to $11,000 per violation enforced by the Attorney General, according to a 2025 regulation overview. |
California | Unsolicited advertisements to mobile devices by SMS without prior consent are unlawful, with exceptions for existing relationships that include an opt-out option (same overview). |
States change these rules often. If you text across state lines, apply the strictest standard to your whole list, and confirm current details on the relevant state’s official pages. Real estate agents and contractors who work near state borders should be especially careful with calling hours.
What noncompliance costs
TCPA violations carry $500 per message in statutory damages, $1,500 for willful violations, and no aggregate cap. Multiply that by a campaign of a few thousand texts and a small practice faces existential exposure. Add state penalties and the loss of carrier deliverability, and the cost of a sloppy process is obvious.
Records: what to keep and for how long
If a complaint arrives, your defense is your paperwork. The FTC’s 2024 amendment to the Telemarketing Sales Rule raised the retention period from 24 months to five years and widened the records sellers and telemarketers must keep. A consent record should include, per a summary of the TSR consent requirements:
The provider’s name and telephone number.
A copy of the consent request in the format presented.
The purpose for which consent was requested and given.
A copy of the consent and the date it was given.
For website consent, keep copies of the pages used. For verbal consent, keep recordings. That same source quotes the FTC saying an IP address with a timestamp alone is not sufficient as a record of consent.
A practical log also captures:
The exact wording and version of the consent language shown.
Date and time of consent, the number provided and the source URL or form.
How consent was given: web form, text-to-join or paper.
Every later event: messages sent, opt-outs received, and when they were processed.
Which Do Not Call list version you scrubbed against.
The TCPA’s private-lawsuit statute of limitations is four years in most jurisdictions, so keeping logs for at least five years is a sensible minimum. For templates built around consent logging, see our insurance text templates.
Perspective
Most compliance trouble we see in lead follow-up is not malice. It is speed without structure. A lead comes in, someone texts from a personal phone three days later, and nobody records what the lead agreed to.
We built Astreaux around the opposite idea: reply instantly, in the voice of your business, and let the process carry the compliance load. Instant engagement only helps if the first text is one the lead expects and is entitled to receive. That is why we push teams to write consent language first, then automate the reply that follows from it.
Automation is your ally here. A system never forgets to stop texting someone who said STOP, never sends at 10 p.m. because it lost track of a time zone, and keeps the same log every time. Our approach to personalized nurturing and booking is meant to give service professionals speed and discipline together. Our walkthrough on deploying TCPA-safe AI texting shows how we think about rolling it out.
Jamaal
A pre-launch compliance checklist
Run this before any automated text campaign:
Classify the message. Marketing, informational or both? If both, treat it as marketing.
Confirm consent. Is there written consent with all required disclosures, an unchecked box and wording that covers this message type?
Scrub. Check the National and state Do Not Call registries, your internal list, and reassigned numbers.
Set send windows by lead location. Never before 8 a.m. or after 9 p.m. local time, and earlier cutoffs where state law requires.
Identify yourself. Name, business and a working contact number in the message.
Recognize opt-outs. STOP, END, CANCEL, UNSUBSCRIBE, QUIT, REVOKE and OPT OUT, plus plain-language requests, honored well inside ten business days.
Register your numbers. Complete 10DLC brand and campaign registration and keep your opt-in text consistent with what you submitted.
Check state exposure. Texas registration, Florida contact limits, Virginia opt-out retention and similar rules.
Log everything and store it for at least five years.
Review message tone and length. Brevity helps clarity; see our notes on SMS length and business texting etiquette.
For wording that fits a compliant flow, our lead follow-up templates and SMS call-to-action examples are a starting point. If you text patients or clients about appointments, read our piece on HIPAA text reminders as well. For a broader view of the federal framework, our TCPA guide for SMS goes further.
Putting compliant texting to work with Astreaux
Speed to lead wins appointments, but only when each reply is permitted and traceable. Astreaux is an AI-driven platform for service professionals that responds to new leads instantly, in the voice you train it on, then handles follow-up, appointment booking and bulk SMS campaigns. It connects to CRMs and ad platforms through integrations with over 7,000 apps, with analytics to track your pipeline.
Explore Astreaux AI to see how instant, personalized lead replies can fit into your own consent and opt-out process.
FAQ
Do I need consent to text a business lead?
Yes, in most cases involving mobile numbers. The TCPA does not exempt B2B outreach, because it protects the device and number, not the person’s role. Marketing texts need prior express written consent, while informational texts can rely on oral or written consent.
How fast must I honor a STOP request?
Within a reasonable time that cannot exceed ten business days under the federal rule. Best practice is to stop immediately and confirm once. From November 25, 2026, the standardized keywords (STOP, END, CANCEL, UNSUBSCRIBE, QUIT, REVOKE, OPT OUT) must always be honored.
What hours can I send marketing texts?
Federal rules bar solicitations before 8 a.m. and after 9 p.m. in the recipient’s local time. Some states are stricter, such as Florida’s 8 p.m. cutoff, so schedule by the lead’s location and apply the tightest rule.
Is 10DLC registration a legal requirement?
It is a carrier requirement under CTIA rules, not a statute. Since February 1, 2025, unregistered 10DLC traffic can be blocked, so registration is effectively mandatory if you want delivery.
How long should I keep consent records?
Keep them at least five years, which matches the FTC’s Telemarketing Sales Rule retention period and covers the four-year limitations window for most TCPA lawsuits. Store the consent wording, timestamp, source and every later opt-out.
