Understanding Opt-Out: Beyond the STOP Keyword

For years, "STOP" was the only opt-out language that mattered. That changed in April 2025 when the FCC expanded TCPA requirements so that businesses must now honor revocation requests through any reasonable method — email, voicemail, or even informal language like "take me off your list" — whenever clear consumer intent is shown across any channel.

The new framework gives companies up to 10 business days to process an opt-out, yet industry best practice calls for real-time handling within five minutes and a single non-promotional confirmation text. Infobip notes that continued messaging after a valid revocation is treated as a willful violation carrying statutory damages of $500 to $1,500 per message. A campaign of just 100,000 unsolicited texts can push potential class-action exposure past $150 million.

State laws add another layer of complexity. Virginia requires businesses to retain opted-out numbers on a do-not-text list for 10 years starting January 2026, while Florida enforces a 15-day safe harbor limiting follow-up messages to three per 24 hours. Nelson Mullins emphasizes that companies must apply the strictest applicable standard based on the recipient's state of residence.

Approved opt-out keywords now extend well beyond "STOP":

• Quit
• End
• Revoke
• Opt-out
• Cancel
• Unsubscribe

The FCC also distinguishes between message categories. As of September 2026, replying STOP to a promotional text stops marketing messages but not fraud alerts, appointment reminders, or billing notifications — while telemarketing opt-outs remain "revoke-all" for every future marketing call or text from that sender. TechTimes reports that 62 percent of surveyed consumers feared a blanket revoke-all rule would cut off critical fraud alerts, prompting the category-specific approach.

CallMyLeads builds these requirements into every automated flow so that opt-outs are captured, logged, and honored across SMS, email, and voice channels without manual intervention. The system screens known spam numbers before they reach your team and maintains suppression records that satisfy both federal and state retention rules.

Compliance Timelines and Risk Exposure

Every text you send after someone says "stop" is a liability, and the clock on fixing that starts the moment the request arrives. Under the FCC's April 2025 rules, businesses have a 10-business-day window to process opt-out requests and halt all SMS communications, according to compliance guidance from ActiveProspect.

That window is a ceiling, not a target. Industry best practice treats real-time processing — within roughly 5 minutes — as the standard businesses should aim for, especially for opt-outs received by text. If you send a confirmation message, it must be non-promotional and go out promptly; ActiveProspect's guidance specifies a five-minute turnaround for clarification messages.

The stakes explain the urgency. TCPA statutory damages run $500 to $1,500 per message, with the higher figure applied to willful violations — and legal analysts note that continued texting after a STOP request is treated as willful. Aggregated across a campaign, the numbers escalate fast:

• A campaign of 100,000 unsolicited messages could exceed $150 million in class-action liability, per Infobip's analysis.
• TCPA class actions filed through mid-2025 rose nearly 95% year-over-year, with roughly 36 new cases filed daily.
• The largest TCPA settlement to date — Capital One's $75.5 million payout — involved automated calls to cell phones without consent.
• JPMorgan Chase paid $2.25 million covering 242,000+ consumers who received calls after orally revoking consent.

State laws layer on additional exposure. Virginia now requires businesses to retain opted-out numbers on a do-not-text list for 10 years, while Florida's amended rules impose a 15-day safe harbor after opt-out and cap messages at 3 per 24-hour period per recipient, according to Infobip's compliance breakdown. The practical rule: apply the strictest standard based on the recipient's state.

This is why automated opt-out handling matters. A system that honors STOP requests immediately — like the automatic, real-time opt-out processing CallMyLeads applies to every nurture sequence — removes the human lag that turns a routine request into a statutory damages claim. As Nelson Mullins puts it, those per-message damages "can grow quite large when violations are aggregated into a potential class action lawsuit."

If your follow-up runs on manual lists and memory, one missed opt-out is all it takes to start the clock on a five-figure problem.

State-Specific Rules and Category-Based Opt-Out Handling

Federal rules are only half the opt-out story. State laws and the FCC's evolving framework layer on requirements that can catch even careful businesses off guard.

Virginia, for example, requires businesses to keep opted-out numbers on a do-not-text list for 10 full years, effective January 2026, according to compliance analysis from Infobip. Florida takes a different approach: its amended 2024 law imposes a 15-day safe harbor after an opt-out and caps messaging at 3 messages per 24-hour period per recipient. The practical rule that emerges is simple — apply the strictest applicable standard based on where the recipient lives, not where your business operates.

Other states add their own twists. Purdue Global Law School's compliance guide highlights several:

• Florida and Oklahoma prohibit commercial texts before 8:00 a.m. or after 8:00 p.m., with a three-text-per-subject limit per rolling 24 hours
• Connecticut penalties reach up to $20,000 per infraction for unsolicited texts sent outside 9:00 a.m.–8:00 p.m.
• Texas allows up to $5,000 per noncompliant text, plus a $200 registration fee and $10,000 bond for texting without documented consent

The federal picture is shifting too. Under the FCC framework established September 30, 2026, opt-outs now work category-specifically for informational messages — replying STOP to a promotional text halts marketing but not fraud alerts, appointment reminders, or billing notifications. Telemarketing opt-outs, however, remain "revoke-all", stopping every future marketing call and text from that sender, as TechTimes reports.

This distinction matters for businesses that text both kinds of messages. A customer who opts out of your promotional follow-ups may still need appointment confirmations — but getting that split wrong in either direction carries real risk. Legal analysis on Mondaq notes the FCC is also considering shortening the 10-business-day processing window to 7 days and mandating a universal "revoke all" option.

For services like CallMyLeads that handle appointment reminders alongside lead follow-up, the safest approach is honoring opt-outs immediately and automatically while keeping suppression records that satisfy the strictest state rules. The stakes justify the caution: TCPA statutory damages run $500 to $1,500 per message, and 2025 saw roughly 36 new federal cases filed daily, per recent litigation data.

Building a Compliant Texting System: From Disclosure to Execution

Building a Compliant Texting System: From Disclosure to Execution

Creating a texting system that respects consumer preferences requires more than just honoring "STOP" replies. As of April 2025, the FCC expanded opt-out mechanisms to include any reasonable method—such as email, voicemail, or informal language—meaning businesses must recognize requests across all channels where clear intent is shown. Industry research confirms that failing to honor these expanded methods risks penalties of $500 to $1,500 per message, with class-action liability potentially exceeding $150 million for large campaigns. For a service like CallMyLeads, which handles time-sensitive lead responses across home services and healthcare, this means designing systems that capture opt-out signals wherever they appear—whether in a text reply, a voicemail, or an email—and acting on them without delay.

Real-time processing is now considered best practice, even though the regulatory window allows up to 10 business days. Sending a non-promotional confirmation within five minutes of receiving an opt-out request demonstrates good faith and reduces the chance of accidental follow-up messages. Compliance experts advise that businesses implement centralized tracking to log every opt-out request with timestamps, ensuring no message slips through after consent is withdrawn. This is especially critical for appointment reminders or service updates, where timing is essential but must never override a consumer’s right to opt out.

To navigate varying state laws, businesses should apply the strictest applicable standard based on the recipient’s state of residence. For example, Virginia requires opted-out numbers to be retained on a do-not-text list for 10 years, effective January 2026, while Florida imposes a 15-day safe harbor after opt-out, limiting messages to three per 24 hours per recipient. Regulatory analyses show that aligning with the highest state standard prevents gaps in compliance and simplifies internal protocols. Additionally, maintaining clear disclosures using approved keywords—such as "stop," "quit," "end," "revoke," "opt-out," "cancel," or "unsubscribe"—in every message ensures consumers know how to withdraw consent, whether through a designated channel or any reasonable method.

Finally, category-specific handling helps preserve essential communications while respecting opt-out preferences. Under the current FCC framework effective September 30, 2026, replying "STOP" to a promotional text stops marketing messages but does not halt informational ones like fraud alerts, appointment reminders, or billing notifications. However, telemarketing opt-outs remain "revoke-all," stopping all future marketing calls and texts from that sender. By structuring messaging streams around these distinctions—such as separating promotional follow-ups from service confirmations—businesses like CallMyLeads can reduce legal risk while keeping critical information flowing to those who still want it. This approach supports both compliance and customer trust in an increasingly regulated messaging environment.