Is Text Message Marketing Legal? The Rules, in Plain English

By Kevin Graham · Updated September 2026

Most owners I meet want a text program and are quietly afraid of it. They have heard there are rules, they do not know what the rules are, and the safest-feeling choice is to do nothing. That fear costs far more than compliance does, because the rules are not complicated once someone lays them out.

Here they are, in order of how much trouble they can cause you.

Three sets of rules, not one

People say "the TCPA" as if it were the only thing to follow. There are three layers, and they are enforced by different people:

• The TCPA is the federal law. Consumers sue under it, usually as class actions, and damages are $500 to $1,500 per message.
• The CTIA guidelines are the wireless industry's rules. Carriers enforce them, and they can shut your texting off without any regulator getting involved.
• 10DLC registration is the carrier approval that lets your business number send at volume at all. Since 2021, unregistered business texting gets filtered or blocked.

The practical order of risk is the reverse of what people expect. A lawsuit is the expensive tail risk. Getting your number suspended by a carrier is the thing that actually happens, and it happens quietly.

What counts as consent

Marketing texts require prior express written consent. That is a specific thing, and three common assumptions do not meet it:

• A phone number on a receipt or a reservation is not consent. Someone giving you their number for a booking has not agreed to marketing.
• A purchase is not consent, and you cannot make consent a condition of buying anything.
• A purchased list is never consent. If you did not collect it, you cannot text it. There is no version of this that is safe.

What does count is a clear, affirmative action: checking an unchecked box, texting a keyword to join, or tapping to join on a kiosk at your counter, where the disclosure is on the screen in front of them. Keep the record. In a dispute, you are the one who has to prove consent existed, and the record is what does it.

What your sign-up has to say

Before someone joins, five things must be clear and conspicuous. Not buried, not in grey four-point type:

• Who is texting them. Your business name.
• What they will get, and roughly how often.
• "Msg & data rates may apply."
• How to get help. Reply HELP.
• How to stop. Reply STOP.

It should also say consent is not a condition of purchase, and link to your terms and privacy policy. Here is the kind of line that satisfies it:

Quiet hours: 8 a.m. to 9 p.m., their time

No marketing texts before 8 a.m. or after 9 p.m. in the recipient's time zone, not yours. That last part catches people. A 8:30 p.m. blast from San Diego lands at 11:30 p.m. for a customer visiting family on the East Coast. Any decent platform handles this for you; if you are texting from your own phone, nothing does.

Opt-outs, which got stricter

You have to honor an opt-out sent by any reasonable method, and you have 10 business days to process it. Since April 2025, you cannot insist on one magic word. Reasonable includes STOP, QUIT, END, CANCEL, UNSUBSCRIBE, REVOKE and OPT OUT, and it also includes a customer replying in plain language, or telling you by email, voicemail, or at your counter.

That is the rule small businesses break most often, and almost never on purpose. Someone says "please stop texting me" to a staff member, nobody writes it down, and the next campaign goes out.

One more piece is coming. The FCC's "revoke-all" provision, which would treat one opt-out as a request to stop nearly all automated messages from you, has been delayed to January 31, 2027. It is not in force yet. Plan for it, do not panic about it.

What getting it wrong costs

• $500 per message, and up to $1,500 if the violation is willful. Per message, not per campaign. A careless send to 400 people is not a $500 problem.
• Class actions. Text cases are attractive to plaintiffs' firms precisely because the math multiplies so fast.
• Carrier suspension. The quiet one. Your messages stop being delivered and your program is dead until it is sorted out.

The seven-item checklist

• Every number on your list has a recorded, affirmative opt-in.
• Your sign-up shows all five disclosures where people actually read them.
• You are registered for 10DLC, or your provider registered you.
• Nothing sends outside 8 a.m. to 9 p.m. in the customer's time zone.
• STOP works automatically, and verbal or emailed opt-outs get entered the same day.
• Your consent records are kept, with dates, and you could produce them.
• Someone owns this. If it is nobody's job, it is not being done.

Why a managed program is usually the answer

Every item above is doable on your own. The problem is that compliance is not a one-time setup, it is a habit, and habits are what a busy counter loses first. The value of a real platform is that the rules are enforced by the software instead of by someone remembering: the kiosk shows the disclosure before it takes the number, opt-outs process themselves, quiet hours are built in, and the consent record exists whether or not anyone thought about it.

That is what I set up for local businesses as an agent for Sentext Solutions' Repeat Business Program. Carrier registration is handled, the opt-in language and signage are done for you, and you still own your customer list. If you want to see what that list is worth first, run your own numbers, or read what a program costs.

One honest caveat: I sell and run text programs, I am not a lawyer, and this is general information rather than legal advice. The rules change, and they changed twice in the last two years. For your specific situation, talk to an attorney.