Why This Question Costs Marketers Millions

A single promotional text sent to the wrong list can cost $500. Multiply that by thousands of messages, and a routine marketing campaign becomes a courtroom exhibit. That's the reality businesses face under the Telephone Consumer Protection Act (TCPA), and it's why the opt-in versus opt-out question deserves more than a shrug.

The numbers explain the urgency. According to recent compliance analysis, TCPA class actions filed through mid-2025 were up nearly 95% year-over-year. Each violation carries statutory damages of $500 per message — or up to $1,500 for willful or knowing violations — with no aggregate cap on total exposure.

Scale makes this dangerous fast. The same analysis estimates that a campaign of 100,000 non-compliant messages could mean exposure exceeding $150 million in a class action. Even a modest blast to 1,000 recipients without valid consent could result in $500,000 to $1.5 million in damages.

The stakes don't stop at the federal statute. Regulators have recently increased the federal civil penalty to $53,088 per violation, and several states layer on their own consequences:

• Texas allows up to $5,000 per noncompliant text under its Deceptive Trade Practices Act, per law school commentary.
• Connecticut imposes quiet-hour penalties of up to $20,000 per infraction.
• Virginia now requires opt-out records retained for 10 years.

Here's where most businesses go wrong: they treat opt-in and opt-out as competing marketing strategies — a choice about list size rather than a question with a legally mandated answer. As TCPA compliance guidance makes clear, prior express written consent is required before sending marketing texts in the US. Opt-out isn't the alternative; it's mandatory infrastructure layered on top of a consent framework the law already settled.

That misunderstanding is precisely where the legal risk begins. A team that assumes an opt-out model gives them a bigger list to text may be building an eight-figure liability instead. As carrier-enforced documentation bluntly puts it: if someone gave you their phone number, that does not mean they gave you permission to send them SMS.

This is why consent handling can't be an afterthought bolted onto a lead-response workflow. Services like CallMyLeads treat it as foundational — collecting explicit consent during booking flows and honoring opt-outs immediately and automatically — because the cost of getting consent wrong dwarfs any marketing upside. The question isn't really which model grows your list faster. It's which one keeps you out of court.

The Answer for Texting: Opt-In Is the Law, Opt-Out Is Mandatory Infrastructure

For text messaging in the United States, the debate is over: opt-in is the law, and opt-out is mandatory infrastructure. The TCPA requires prior express written consent before any marketing text is sent — pre-ticked boxes and verbal agreements do not count, and consent must be documented through methods like a "Reply Y" text or an online form. Every message must also include a simple opt-out mechanism such as "STOP," and as of April 2025, the FCC requires businesses to honor opt-out requests through any reasonable method within 10 business days. Continued texting after a STOP request is treated as a willful violation, exposing senders to $1,500 per message in statutory damages.

• Marketing texts are restricted to 8 a.m.–9 p.m. in the recipient's local time federally; Florida and Oklahoma tighten this to 8 a.m.–8 p.m., while Connecticut requires 9 a.m.–8 p.m. with penalties up to $20,000 per infraction.
• Florida caps marketing SMS at three messages per rolling 24-hour period, and Texas imposes up to $5,000 per noncompliant text under its Deceptive Trade Practices Act.
• Virginia mandates opt-out records be retained for 10 years starting January 2026, and consent logs are recommended for at least five years.
• The FCC's January 2026 one-to-one consent rule will prohibit sharing or selling consent across brands — each sender must obtain direct consent.

These rules are not theoretical. TCPA class actions surged nearly 95% year-over-year through mid-2025, and a single campaign of 100,000 non-compliant messages can trigger exposure exceeding $150 million. For businesses that rely on speed-to-lead, the compliance burden is real — but it is also manageable. CallMyLeads bakes consent collection, quiet-hours enforcement, and immediate STOP processing into every text flow so that lead response stays fast without creating legal risk. When opt-outs are honored automatically and consent records are synchronized across your CRM, the system protects itself.

Beyond Texting: When Opt-Out Models Actually Apply

Texting is the easy case: opt-in is legally mandatory under the TCPA, so there's no real strategic debate there. The genuine opt-in versus opt-out choice only exists when you step outside SMS — into website tracking, cookies, and the broader handling of customer data. And that choice depends heavily on where your audience lives and what kind of data you're touching.

The biggest dividing line is geography. If you serve users in the EU, the GDPR requires explicit opt-in, with fines reaching up to €20 million or 4% of global annual turnover. California takes the opposite approach: the CCPA/CPRA operates on an opt-out model, requiring a "Do Not Sell or Share My Personal Information" link and honoring opt-outs for at least 12 months before asking a customer to opt back in.

Each model carries a real trade-off. Opt-in builds smaller, more engaged lists — people who chose exactly what they're getting tend to engage more strongly. Opt-out grows bigger lists by default, but draws more regulatory scrutiny and user pushback when handled carelessly. As privacy experts at Transcend put it, a company-wide opt-out approach is "over-exposed in GDPR territory," while a strict opt-in model "under-collects everywhere CCPA would allow opt-out."

The consensus among experts is that neither model wins outright. The mistake is applying one model to every use case instead of matching the consent model to the data and jurisdiction. In practice, that means:

• Use opt-in for sensitive data and any GDPR-covered users.
• Opt-out may suffice for lower-risk data processing under CCPA-style regimes.
• Consider a hybrid approach for web and cookie contexts, offering both opt-in and opt-out options.
• Treat consent as per-user, per-purpose, per-jurisdiction — not a single binary flag across your systems.

Regulators are also scrutinizing how consent is collected, not just whether it exists. France's CNIL fined Google €325 million in September 2025 for a consent interface that steered users toward accepting personalized ads, and twelve US states now recognize Global Privacy Control as a valid automated opt-out mechanism.

For most US businesses, the practical takeaway is simple: keep your texting program strictly opt-in, honor opt-outs immediately, and match your web and data consent approach to each jurisdiction you serve. That's exactly how CallMyLeads handles it — every booking flow collects explicit consent, and opt-outs are honored immediately and automatically, so the compliance burden never lands on your team.

How to Build a Compliant Consent System That Still Converts

Building a compliant consent system doesn’t require sacrificing speed-to-lead — it requires smart design. For US text-message marketing, the TCPA makes prior express written consent non-negotiable, and double opt-in methods like a "Reply Y" text provide both handset verification and a documented record that strengthens compliance defenses according to industry guidance. This approach ensures consent is affirmative, timestamped, and tied to a specific purpose, which is critical given that TCPA violations can carry $500–$1,500 per message in statutory damages with no aggregate cap as recent research highlights.

Equally important is treating opt-out as a first-class feature, not an afterthought. Since April 2025, the FCC requires businesses to accept opt-out requests through any reasonable method — not just keywords like "STOP" — and to honor them within 10 business days, though real-time suppression is best practice per regulatory updates. Maintaining suppression lists and scrubbing against the National Do Not Call Registry and Reassigned Numbers Database before campaigns helps prevent costly errors, especially in states like Virginia where opt-out records must be retained for 10 years as noted in legal analysis. CallMyLeads integrates these requirements directly into its workflow: consent is collected during the booking flow, A2P 10DLC registration ensures carrier compliance, and opt-outs are honored instantly and automatically across all channels, so businesses never trade speed for risk.

• Use double opt-in (e.g., "Reply Y") for handset verification and a auditable consent trail
• Keep timestamped consent logs for at least 5 years (10 years in Virginia)
• Accept opt-outs via any reasonable method and suppress immediately
• Scrub against DNC Registry and Reassigned Numbers Database before messaging
• Honor opt-out requests within 10 business days — real-time is ideal

By embedding these practices into lead response automation, businesses protect themselves from enforcement actions while maintaining the rapid engagement that wins jobs. When consent is built into the process — not bolted on afterward — compliance becomes a foundation for trust, not a barrier to conversion.