The Real Legal Threshold: Consent, Not Count

If you're searching for a magic number — five texts a day, ten a week — you won't find one. No federal law sets a numeric message limit that turns texting into harassment. The legal line is drawn somewhere else entirely: consent.

The FCC's 2024 final rule on unlawful text messages focuses on consent and illegality, not message volume. Law firm analyses confirm the same reading: the boundaries run through consent requirements and illegal-text blocking rather than cadence. In other words, one unwanted text can violate the law, while twenty welcomed ones may not.

So where exactly is the line? Under the TCPA and FCC rules, texting becomes unlawful when any of these conditions apply:

• The recipient never gave valid prior express written consent for marketing texts.
• The consent doesn't match the specific seller and topic — consent must be obtained one seller at a time, closing the old lead generator loophole.
• The number sits on the National Do Not Call Registry without the consumer's prior express invitation or permission.
• The recipient texts STOP and the messages keep coming anyway.

That last point deserves emphasis. Continuing to text after an opt-out is the clearest harassment signal that exists. Confirmed STOP-reply handling is a mandatory campaign requirement under carrier rules, and sample messages must include the business name and opt-out language, according to 10DLC compliance guidance. This is exactly why CallMyLeads honors opt-outs immediately and automatically — the moment a lead says stop, the conversation ends.

The financial stakes explain why regulators care less about counting messages than policing permission. TCPA statutory damages run $500 to $1,500 per violating text, with no requirement to prove actual injury. A business sending hundreds of unconsented messages isn't facing one complaint — it's facing per-text liability that multiplies fast.

Consent scope matters as much as consent itself. The FCC now requires that permission be "logically and topically" tied to where it was given — consent collected on a car loan comparison site doesn't cover texts about loan consolidation. And leads gathered before the one-to-one consent rule's January 27, 2025 effective date may no longer be valid, which is why CallMyLeads builds explicit consent collection directly into its booking flow rather than relying on aged lead lists.

One caveat: the legal ground is still shifting. A July 2026 Seventh Circuit ruling rejected the FCC's extension of DNC protections to texts for private lawsuits — but only in Illinois, Indiana, and Wisconsin, and autodialer liability under Section 227(b) remains fully intact nationwide. The safe posture in every jurisdiction is the same: document consent carefully, respect its scope, and treat every STOP as final.

What Actually Triggers Liability: The Four Consent Failures

The law doesn't count your texts. It checks your paperwork. Under the Telephone Consumer Protection Act, a single message sent without valid consent can cost a business $500 to $1,500 per text — and plaintiffs don't have to prove any actual harm to collect, according to legal analysis from BCLP.

There are four consent failures that turn ordinary follow-up texting into unlawful texting.

• No valid written consent. Automated marketing texts require prior express written consent from the recipient. No signature, no legal text.
• Consent that doesn't match the seller or topic. Consent must be "logically and topically associated" with the website where it was given — a consumer who opted in on a car loan comparison site hasn't consented to texts about loan consolidation, per Cooley's analysis of the FCC's TCPA rules. Passing leads along to a "daisy-chain of partners" isn't permitted either.
• Texting DNC-registered numbers. The FCC's 2024 rule formally extended National Do Not Call Registry protections to text messages, so texters need the consumer's prior permission even for numbers on the Registry, per the FCC's final rule. (A 2026 Seventh Circuit ruling limited this claim in Illinois, Indiana, and Wisconsin, but autodialer liability and state-law claims remain fully intact, per Holland & Knight.)
• Ignoring STOP replies. Opt-out handling is non-negotiable. Campaigns require confirmed opt-out handling for STOP replies, and carriers treat it as a baseline requirement, according to compliance research. Texting someone after they've asked you to stop is the clearest harassment signal there is.

The consent rules also got stricter for anyone buying leads. As of January 27, 2025, consent must be obtained one seller at a time — a single form covering a list of companies no longer counts. BCLP warns that leads collected before that date may no longer be valid, and businesses that keep texting them face significant financial exposure.

For lead-driven businesses, this is where the risk hides. A roofing company that buys shared leads from a comparison site may inherit consent that was never really theirs. That's why CallMyLeads' booking flow collects explicit consent directly, and why opt-outs are honored immediately and automatically — the reply that ends the conversation is the one you can't afford to miss.

One caveat: the rules are still moving. Some analyses note the one-to-one consent rule was later vacated, though carriers and reviewers still expect consent documented per brand, per industry compliance guidance. The safe posture is the same either way: document consent, match it to the seller and topic, and stop the moment someone says stop.

How Carriers Enforce Frequency Without a Legal Number

While no law says "X texts per day equals harassment," the phone carriers have quietly built a frequency-control system that hits harder — and faster — than any courtroom. If you text too aggressively, your messages simply stop arriving.

Registration is no longer optional. Since February 2025, all major US carriers — AT&T, T-Mobile, and Verizon — block unregistered A2P 10DLC business texts entirely. As compliance analyses put it, the traffic isn't throttled or delayed: it's blocked. This applies even to small businesses sending a handful of automated texts per month.

Once registered, your sending speed is governed by a Trust Score — a 0–100 rating that maps directly to throughput caps. The gap between tiers is dramatic: a Class E brand on AT&T can send roughly 10 messages per minute, while a Class A brand can push 4,500+ per minute, according to 10DLC registration guidance. In other words, carriers have effectively created the numeric frequency threshold that no statute provides.

Carrier filtering adds another layer of unpredictability. Messages are scanned for spam patterns, and the rules shift constantly — industry observers note that a message that got through fine last month can be filtered today. Non-compliance carries real financial teeth too: T-Mobile can levy fines of up to $10,000 per incident, per A2P 10DLC breakdowns.

The practical frequency controls outside of court look like this:

• Throughput caps tied to Trust Scores, mechanically limiting messages per minute regardless of intent
• Dynamic spam filtering that re-evaluates your traffic monthly, with no published rulebook
• Mandatory confirmed opt-out handling — campaigns require working STOP-reply processing before approval
• Full blocking of unregistered traffic, effective since February 2025

This is why monitoring send velocity matters even without a statutory harassment count. A burst of texts that trips carrier filters doesn't just hurt deliverability — it signals the kind of aggressive cadence that generates consumer complaints, STOP replies, and eventually TCPA claims carrying $500–$1,500 in statutory damages per message, with no requirement to show actual injury.

This is also why CallMyLeads registers all business texting under A2P 10DLC and builds opt-out handling directly into its follow-up flows — a lead response system that gets blocked mid-cadence stops setting appointments, so compliance and performance point in the same direction. Speed wins the lead; restraint keeps the channel open.

The Legal Split You Need to Know: DNC Protections for Texts

The FCC's 2024 rule made it official: National Do Not Call Registry protections now extend to text messages, requiring prior express invitation or permission before messaging registered numbers. But a July 2026 Seventh Circuit decision in Steidinger v. Blackstone Medical Services rejected that interpretation for private lawsuits in Illinois, Indiana, and Wisconsin — holding that texts aren't "telephone calls" under TCPA Section 227(c)(5). The split means consumers in those three states can't bring a DNC claim based on unwanted marketing texts, even after texting STOP.

• Section 227(b) autodialer liability remains fully intact nationwide — $500 to $1,500 per violating text with no injury required
• State laws like Florida's Telephone Solicitation Act provide independent remedies regardless of the federal split
• FCC enforcement authority and mandatory carrier blocking of illegal texters are unaffected

The practical reality? Compliance discipline is the only safe harbor. Carriers now block all unregistered A2P business texts outright, and throughput caps tied to Trust Scores — 10 messages per minute for a Class E brand versus 4,500+ for Class A — act as a mechanical frequency control. CallMyLeads registers every texting campaign under A2P 10DLC, documents consent per seller and topic, and honors opt-outs instantly so frequency never becomes the issue.

How CallMyLeads Keeps Texting Compliant by Default

Knowing where the legal line sits is one thing; running a texting operation that never crosses it is another. That gap is exactly where most compliance failures happen — not because businesses ignore the rules, but because nobody built consent, opt-outs, and carrier requirements into the workflow itself.

CallMyLeads treats compliance as a default setting, not a checklist. Business texting runs on registered A2P 10DLC numbers under US carrier rules, which matters more than ever: since February 2025, all major US carriers block unregistered business texts entirely — not throttled, not delayed, blocked. Registration keeps messages deliverable while keeping the sending identity accountable to carrier standards.

Consent is collected the way regulators now expect. The FCC's rules require consent one seller at a time, tied logically to the business the customer actually contacted, and the booking flow captures exactly that — explicit, single-seller consent at the moment a lead requests an appointment. This matters financially, too: TCPA statutory damages run $500 to $1,500 per violating text, with no requirement to prove actual injury.

Once consent exists, the system polices the boundaries automatically:

• Immediate opt-out handling — STOP replies are honored instantly and automatically, since confirmed opt-out handling is a mandatory campaign requirement and continuing after STOP is the clearest harassment signal.
• Spam screening before sending — known spam numbers are filtered before messages go out, so junk traffic never enters the cadence.
• Quiet-hours adherence — telemarketing time-of-day rules are built into the messaging schedule.
• HIPAA-aligned configuration for dental and medical clients — approved scripts only, no diagnosis or treatment advice.

Frequency, the question this article started with, gets handled mechanically rather than by guesswork. Carrier throughput caps tied to Trust Scores — roughly 10 messages per minute for low-trust brands versus 4,500+ for high-trust ones — act as a built-in frequency control, and dynamic carrier filtering means a message that passed last month can be filtered today. The operational layer manages registration, throughput, and filtering so clients never touch carrier mechanics.

The result is a simple posture: consent in, opt-outs honored, cadence conservative. That is the practical answer to "when does texting become harassment" — and the way to make sure your business never finds out the hard way.