What Makes a Business Text Message Illegal Under US Law

A single text message can cost a business up to $1,500 — and the person suing doesn't even have to prove the message hurt them. Under the Telephone Consumer Protection Act, simply receiving a noncompliant text is enough to establish standing and win a judgment, a principle confirmed by Purdue Global Law School's TCPA compliance analysis. Here are the five triggers that turn a routine business text into an illegal one.

1. No prior express written consent for marketing. The TCPA requires businesses to obtain prior express written consent before sending any marketing text, and consent cannot be a condition of purchase. Informational messages like shipping alerts require only prior express consent — a lower bar — but anything promotional demands the written standard.

2. Invalid consent disclosures. Consent collected the wrong way is no consent at all. If your opt-in fails to disclose the program name, message frequency, a "message and data rates may apply" warning, and links to your Terms of Service and Privacy Policy, the consent is invalid and every text sent under it is a violation.

3. Texting after an opt-out. Under the FCC's Opt-Out Rule, effective April 11, 2025, consumers can revoke consent in "any reasonable manner" — a STOP reply, an email, a voicemail, even telling a cashier in person — and businesses must honor it within 10 business days, according to BCLP's breakdown of the new rules. Continued texting after a STOP request is treated as a willful violation, which is what pushes damages toward the $1,500 per-text ceiling.

4. Texting numbers on the National Do Not Call Registry. The FCC's 2024 Final Rule explicitly extended Do Not Call Registry protections to text messages, closing any doubt that texting a registered number without consent is illegal, per the rule published in the Federal Register.

5. Relying on lead-generator consent that doesn't name you. That same 2024 rule shut down the lead-generator loophole: comparison shopping sites must now obtain consent one seller at a time. A consumer's blanket "agree to be contacted by partners" checkbox no longer covers your business unless you were specifically named.

The exposure compounds fast. Statutory damages run $500–$1,500 per violating text, per class member, with no aggregate cap on regulatory fines — and a single text can trigger multiple violations, one for each noncompliant element. Class action exposure routinely reaches six or seven figures, as Trembly Law notes in its guidance for small businesses.

The most common violation patterns are unglamorous:

• Texting old lead lists without confirming consent is still valid
• Failing to log and store consent documentation
• Omitting opt-out instructions from messages
• Assuming a third-party SMS provider absorbs the liability — the business remains responsible for every message sent under its name

This is why consent can't be an afterthought bolted on after the lead arrives. CallMyLeads builds explicit consent collection directly into its booking flow and honors opt-outs immediately and automatically — because when the first reply goes out in seconds, compliance has to move just as fast.

The April 2025 Opt-Out Rule: Any Reasonable Way Counts

Since April 11, 2025, telling a customer to "reply STOP to opt out" is no longer a complete compliance strategy — it's just one of many ways you might receive a revocation you are legally required to honor. The FCC's Opt-Out Rule, adopted in February 2024 and now in effect, fundamentally changed how businesses must handle consent withdrawal, and the details trip up even well-intentioned companies.

Under the new rule, businesses can no longer designate one exclusive opt-out method. According to BCLP's analysis of the new rules, consumers may revoke consent through traditional keywords — STOP, QUIT, END, REVOKE, OPT-OUT, CANCEL, UNSUBSCRIBE — but also through non-traditional channels like a voicemail, an email, a statement made in person to a cashier, or a phone call to your headquarters.

The rule carries a rebuttable presumption that any method is reasonable, and the burden falls on the business to prove otherwise. In practice, that means if a customer tells anyone at your company to stop texting them, you should treat it as a valid revocation.

Once a revocation lands, the clock starts. Businesses must honor the request within 10 business days — though continued texting after a STOP request is treated as a willful violation, which pushes statutory damages from $500 up to $1,500 per text, per Purdue Global Law School's TCPA compliance overview. Waiting the full ten days is legally permitted but practically reckless.

The rule does allow one narrow follow-up: a single clarification text, containing no marketing content, sent within five minutes of the revocation request. This exists so a business can confirm scope — for example, whether the customer wants to stop appointment reminders as well as promotions. Anything beyond that one message is a violation.

Here is the trap buried in the rule: opting out of a marketing message stops only marketing messages, but opting out of an informational message — like an appointment reminder or order update — kills ALL future non-emergency calls and texts, including marketing. As BCLP explains, a customer who replies STOP to a shipping notification has just revoked consent for your entire texting program.

This asymmetry makes opt-out handling a systems problem, not a training problem. Your compliance setup needs to:

• Capture revocations from every channel — text, email, voicemail, and live conversations
• Route informational-message opt-outs to a full suppression of all future texts
• Suppress the number immediately rather than waiting out the 10-business-day window
• Log what triggered each opt-out, since marketing and informational revocations carry different scopes
• Coordinate with any third-party vendors, since you remain responsible for texts sent under your name

That last point matters more than most businesses realize. Financial industry associations actually petitioned the FCC to delay the rule to April 2026, citing the administrative burden of coordinating revocation handling with third-party messaging vendors — a request the FCC did not grant, per BCLP's reporting.

This is exactly why automated opt-out handling has shifted from convenience to necessity. Services like CallMyLeads build compliance into the response flow itself — honoring opt-outs immediately and automatically the moment they arrive, across every channel, rather than relying on a staff member to remember a hallway conversation three days later. When a single missed revocation can cost $1,500 per subsequent text, manual processes are the most expensive option on the table.

Quiet Hours, State Mini-TCPAs, and the Rules That Stack on Top

Federal law gives businesses a window to send marketing texts — and several states have decided that window is too generous. Miss either one, and a single message can trigger liability under multiple laws at once.

At the federal level, the rule is straightforward: marketing texts may only be sent between 8:00 a.m. and 9:00 p.m. recipient local time. Critically, "local time" means the recipient's physical location, not their area code — a detail that trips up businesses texting customers who have moved or travel, according to Purdue Global Law School's TCPA compliance overview.

State "mini-TCPA" laws stack stricter requirements on top of that baseline:

• Florida and Oklahoma cut the sending window off at 8 p.m. and cap frequency at 3 texts on the same subject per rolling 24-hour period. Both states also ban any automated system used to select or dial numbers, eliminating the Facebook v. Duguid autodialer defense that protects senders under federal law.
• Connecticut prohibits unsolicited texts before 9 a.m. and after 8 p.m. local time, with penalties reaching $20,000 per infraction.
• Texas requires businesses texting without documented consent to pay a $200 registration fee and post a $10,000 bond — and unsolicited texting triggers full enforcement, with penalties up to $5,000 per noncompliant text under the Texas Deceptive Trade Practices Act.
• California mandates that every commercial text include the business name and clearly indicate the message is an advertisement.
• Virginia requires opted-out numbers to stay on a do-not-text suppression list for 10 years — twice the recommended 5-year retention period for consent logs.

Location presumptions add another wrinkle. Florida, Maryland, and Oklahoma apply a rebuttable presumption that a consumer with an in-state area code is physically located in that state, per the same compliance analysis. A lead with a Miami number texting back from Denver still pulls your campaign into Florida's 8 p.m. cutoff.

The real danger is stacking. Because the TCPA does not supersede state laws, plaintiffs can sue under federal and state law simultaneously — and a single text can trigger multiple violations, one for each noncompliant element, with consumers stacking penalties. With statutory damages of $500 to $1,500 per violating text and no requirement to prove actual injury, according to BCLP's analysis of the FCC's opt-out rules, one mistimed campaign to a large list becomes serious exposure fast.

Practitioners report a major uptick in TCPA lawsuits targeting small and mid-sized businesses, many of which had no idea they were violating the law, notes Trembly Law's small-business TCPA guide — an anecdotal but telling observation.

This is why location-aware sending windows and automatic opt-out handling matter more than ever. Done-for-you lead response services like CallMyLeads build quiet-hours compliance and immediate opt-out honoring directly into the follow-up flow, so a fast reply to a new lead never turns into a late-night text that costs $1,500.

The 2026 Court Split — and Why It's Not a Free Pass

In July 2026, a federal appeals court handed text marketers what looked like a win — and compliance lawyers immediately warned businesses not to celebrate. The ruling is real, but its scope is far narrower than the headlines suggest.

On July 14, 2026, the Seventh Circuit held in Steidinger v. Blackstone Medical Services that text messages are not "telephone calls" under TCPA Section 227(c)(5). The practical effect: consumers in Illinois, Indiana, and Wisconsin can no longer bring private do-not-call lawsuits over unwanted marketing texts. The court's reasoning was historical — as BT Law explains, when Congress passed the TCPA in 1991, a "telephone call" meant communicating by sound, and text messages — which didn't exist until 1992 — don't fit that definition.

The Ninth Circuit reached the opposite conclusion in Howard v. Republican National Committee, holding that texts are calls under the TCPA. That direct conflict between two federal appeals courts sharply increases the likelihood of Supreme Court review, meaning the Seventh Circuit's rule could be reversed.

Here's why Steidinger is not a free pass. The decision touches exactly one statutory provision — the private right of action under Section 227(c)(5), which requires more than one unwanted call from the same company in a 12-month period. Everything else remains fully in force:

• Section 227(b) autodialer liability — consent requirements for automated texts are completely untouched, with statutory damages of $500–$1,500 per violating text and no proof of actual injury required.
• FCC enforcement — the 2024 Final Rule still extends Do Not Call Registry protections to texts, and carriers must still block numbers the FCC identifies as sources of illegal texts.
• State mini-TCPA laws — Florida, Oklahoma, Texas, Connecticut, and others impose their own consent rules, hour limits, and penalties (up to $20,000 per infraction in Connecticut), and plaintiffs can stack state and federal claims.
• The Opt-Out Rule — businesses must still honor revocation made in any reasonable manner within 10 business days.

Holland & Knight's analysis calls the ruling "a favorable development" but stresses that companies should continue complying with Section 227(b) and state laws. BT Law is blunter: don't treat Steidinger as a green light to ignore opt-out requests, and plan for the possibility that the Supreme Court reverses it.

The math hasn't changed either. A single noncompliant text can trigger multiple violations — one for each noncompliant element — and class action exposure routinely reaches six or seven figures. The federal maximum civil penalty now stands at $53,088 per violation with no aggregate cap.

The practical takeaway: compliance infrastructure matters more than court headlines. Consent collected explicitly at first contact, opt-outs honored instantly and automatically, quiet hours enforced by recipient location — these controls protect a business regardless of how the circuit split resolves. It's why CallMyLeads builds explicit consent collection into its booking flow and honors opt-outs immediately, by design rather than by reaction.

Businesses that treat a three-state, single-provision ruling as permission to relax are betting their entire texting program on a Supreme Court that hasn't ruled yet.

How to Text Leads Fast Without Breaking the Law

Fast texting wins jobs — the lead that gets a reply first usually wins — but a wrong move can cost $500 to $1,500 per text in statutory damages, with no proof of actual injury required. A single noncompliant campaign can reach six or seven figures in class action exposure. The good news: staying fast and staying legal use the same playbook.

Start with consent, captured where the lead already is. Marketing texts require prior express written consent under the TCPA, and the disclosure has to include the program name, message frequency, a data-rates warning, and links to your Terms of Service and Privacy Policy. The cleanest way to satisfy all of that is to build the consent checkbox into the booking form itself, so every lead agrees before the first message ever goes out. Since a 2024 FCC rule closed the lead-generator loophole, consent must be collected one seller at a time — generic fine print from a comparison site no longer covers you.

Next, make opt-outs automatic and instant. Under the FCC's Opt-Out Rule, effective April 11, 2025, consumers can revoke consent in "any reasonable manner" — a STOP text, an email, a voicemail, even telling someone in person — and you must honor it within 10 business days. You can send one clarification text within 5 minutes, with no marketing content. Manual opt-out handling can't keep up with that standard, which is why automated honoring across every channel is now a compliance necessity, not a convenience.

Then enforce quiet hours by location, not area code. Federal rules allow marketing texts only between 8 a.m. and 9 p.m. in the recipient's local time zone. States add their own layers:

• Florida and Oklahoma cut off commercial texts after 8 p.m. and cap it at 3 texts on the same subject per rolling 24 hours
• Connecticut bans unsolicited texts before 9 a.m. and after 8 p.m. local time
• California requires every commercial text to name the business and clearly flag itself as an advertisement
• Virginia keeps opted-out numbers on a do-not-text list for 10 years

Because the TCPA doesn't override state laws, a plaintiff can sue under both at once — so your sending windows need to follow where the person actually is.

Finally, keep the paper trail. The TCPA carries a 4-year statute of limitations, and compliance sources recommend keeping time-stamped consent logs for at least 5 years. Scrub your lists against the National Do Not Call Registry before campaigns — a 2024 FCC rule extended DNC protections to text messages — and remove reassigned numbers automatically.

One caution: a 2026 Seventh Circuit ruling that texts aren't "telephone calls" under one TCPA provision is not a green light. The Ninth Circuit disagrees, and legal analysts warn businesses to plan for a possible Supreme Court reversal. Autodialer, consent, and opt-out liability remain fully intact.

Doing all of this by hand while racing to answer leads in seconds is a losing math problem. A done-for-you response system like CallMyLeads handles the mechanics for you — A2P 10DLC registration, consent captured at booking, opt-outs honored immediately and automatically, and quiet hours enforced by location — so every lead gets a reply in seconds and nothing lands outside the rules. Your leads, your data, and your calendar stay yours.

Stop paying for leads you never get to talk to. Get every new lead answered in seconds, 24/7/365, with compliance built in.