SMS Marketing Laws

Is It Legal to Text Customers Without Consent? The 2026 Rules.

The most expensive sentence in SMS marketing is "it's just a text." The TCPA's autodialer rules treat a marketing text like a robocall. Here is which texts need which consent, and what a mistake costs.

Free 30-minute demo
National + state DNC scrubbing
10DLC registered for you

Carrier-grade infrastructure we own and operate

10DLC Compliant
TCR-Registered
We Own Our CSP
High-Risk Approved
Quick answer

Is It Legal to Text Customers Without Consent?

No, for marketing texts. A text that advertises or sells, sent to a cell phone by an autodialer, needs prior express written consent under the TCPA (47 CFR 64.1200(a)(2)). Autodialed informational texts need prior express consent, which can be oral. Federal damages are $500 per text, up to $1,500 if a court finds it willful or knowing (October 2026).

The TCPA compliance guide for SMS marketing has the consent language and record-keeping detail; the SMS marketing hub has the rest.

Last reviewed: October 2026.

Which texts need which consent

Five kinds of business text, and the consent each one needs.

The rule turns on whether the text sells something, whether an autodialer sent it, and whether the person agreed to get it. This is the federal baseline (47 CFR 64.1200); the state layer below adds to it.

Message type Consent needed Governing rule Who can sue, for how much
Marketing or promotional text (offer, sale, coupon) sent with an autodialer Prior express written consent: a signed agreement (e-signature allowed) naming the number and disclosing that signing is not a condition of purchase 47 CFR 64.1200(a)(2), (f)(9); FCC 12-21 (February 15, 2012) TCPA, 47 U.S.C. 227(b)(3): $500 per text or actual loss; a court may raise that up to $1,500 if willful or knowing. Several states have their own private actions
Informational or transactional text (delivery update, appointment reminder, fraud alert) Prior express consent if sent by autodialer; oral is enough. A coupon code can make it promotional (CTIA guidance) 47 CFR 64.1200(a)(1)(iii); FCC 12-21; CTIA, May 2023 Same TCPA action if sent with no consent
Text to an existing customer (account notice or offer) Account notices sent by autodialer: prior express consent. Offers: an established business relationship lifts the do-not-call and quiet-hour rules but does not replace written consent for a marketing text sent by autodialer 47 CFR 64.1200(a)(1)(iii), (f)(15), (a)(2) TCPA action if sent without the consent its type needs
Text to a business number (B2B) The autodialer rule covers any number assigned to a cell service, a salesperson's included. The national do-not-call rule is written for residential subscribers. CTIA expects consent for every business text FCC 03-153, paragraph 165; 47 CFR 64.1200(c)(2); CTIA, May 2023. Texas registration unless exempt or texting only with prior consent (SB 140; Secretary of State Form 3400 notice) TCPA action if the number is a cell phone
Text after someone replied STOP Consent is revoked: send no further marketing texts. Any reasonable method revokes it; stop, quit, end, revoke, opt out, cancel and unsubscribe always count. Honor it within 10 business days at most. One confirmation text with no marketing is the only further message allowed; within five minutes it is presumed inside consent 47 CFR 64.1200(a)(10), (a)(12), since April 11, 2025 Each later text is its own violation; Florida gives a 15-day STOP clock before suit; Virginia honors a STOP for at least 10 years

One caveat on the last column: the TCPA has two private actions. The autodialer action (47 U.S.C. 227(b)(3)) pays $500 per violation. The do-not-call action (227(c)(5)) pays up to $500, needs more than one call in 12 months, and on July 14, 2026 the Seventh Circuit held in Steidinger v. Blackstone Medical Services that it does not cover texts. After McLaughlin Chiropractic v. McKesson (June 20, 2025), district courts in TCPA enforcement suits are not bound by the FCC's interpretation of the statute and must decide its meaning themselves. Treat that route as unsettled.

The federal baseline

Texts count as calls under the TCPA's autodialer rules. Six rules follow.

The Telephone Consumer Protection Act (47 U.S.C. 227) dates from December 20, 1991. The FCC read it to cover texts in 2003 (FCC 03-153, paragraph 165), and the Supreme Court treated a text as a call in Campbell-Ewald v. Gomez (2016).

Consent

  • Marketing needs prior express written consent. A signed agreement that clearly authorizes marketing texts by autodialer to a named number and discloses that signing is not a condition of buying anything (47 CFR 64.1200(f)(9)). Web form, email, text reply, keypress or voice recording all count (FCC 12-21). If consent is disputed, you prove it.
  • Duguid narrowed "autodialer"; consent still matters. Since Facebook v. Duguid (April 1, 2021) a device is an autodialer only if it uses a random or sequential number generator. Consent stays on the table because the do-not-call rule needs no autodialer, and CTIA and the carriers expect written consent for every marketing text. Florida, Oklahoma and Maryland also require written consent for sales texts sent with an "automated system", under their own statutes.
  • The one-to-one consent rule is gone. The Eleventh Circuit vacated it on January 24, 2025 (Insurance Marketing Coalition v. FCC) and the earlier rule text returned to the CFR on August 29, 2025.

After consent

  • The national Do Not Call Registry covers texts (FCC 23-107, December 2023). Scrub against a registry copy no older than 31 days, keep your own do-not-call list, honor requests within 10 business days and keep them for 5 years (47 CFR 64.1200(c)(2), (d)(3), (d)(6)).
  • Sending window: 8 a.m. to 9 p.m. in the recipient's local time (47 CFR 64.1200(c)(1), extended to texts by 64.1200(e)). The window attaches to "telephone solicitation", so a text the person asked for sits outside it. Treat it as the floor; Maryland (8 p.m. to 8 a.m.) and Connecticut (9 a.m. to 8 p.m.) are tighter.
  • Revocation: any reasonable method, honored within 10 business days. Since April 11, 2025 the reply words stop, quit, end, revoke, opt out, cancel and unsubscribe count automatically, and you may not limit revocation to one channel (47 CFR 64.1200(a)(10)). FCC 26-67, adopted September 30, 2026, will let senders designate an exclusive opt-out method, including a reply text with any of those seven words. It takes effect 30 days after Federal Register publication, which had not happened as of October 17, 2026. The 10-business-day clock stays.
Cold texting

Cold texting is a different question, with its own page.

Cold texting a consumer who never gave you their number is a marketing text without consent; the table above answers it. Cold texting a business is murkier because the autodialer rule covers any cell phone while the do-not-call rule is written for residential subscribers. The cold texting page takes both state by state.

Consumers

Prior express written consent first. The only exceptions in 47 CFR 64.1200(a)(2) are tax-exempt nonprofits and HIPAA health-care messages.

Businesses

A business cell phone is still a cell phone under the autodialer rule. Since September 1, 2025 Texas counts a sales text to a Texas buyer as a telephone solicitation. The seller needs a registration certificate unless exempt or, per the Secretary of State's Form 3400 notice, texting only with prior consent. CTIA expects consent for every business text and rejects rented, sold or shared lists.

What non-compliance costs

$500 per text. Up to $1,500 if a court finds it willful or knowing.

Under 47 U.S.C. 227(b)(3) a recipient can sue for $500 per violation or actual loss, whichever is greater; a court may raise that up to three times for a willful or knowing violation. Each text can count as its own violation.

Per text, per recipient

One non-compliant send to 10,000 numbers is 10,000 potential violations. At $500 each, statutory damages on that campaign could reach $5 million before anyone argues willfulness.

Class actions, up 95%

1,052 TCPA class actions were filed in the first half of 2025 against 539 a year earlier, a 95.2% rise (WebRecon data published by TCPAWorld, July 25, 2025).

State damages

Florida: $500 per violation, up to three times that if willful or knowing (Fla. Stat. 501.059). Texas: $500 per violation in state court, up to $1,500 if knowing or intentional (Bus. & Com. Code 305.053). Virginia: $500, then $1,000, then $5,000 per violation.

The state layer

Mini-TCPAs: where the rules get stricter than federal law.

A text that clears the TCPA can still break a state statute. Florida and Texas go furthest and get their own pages; a second tier sets tighter hours, lower damages or longer opt-out memories.

Florida

Fla. Stat. 501.059 counts a text as a "telephonic sales call". An unsolicited one sent with an automated system for selecting and dialing numbers needs prior express written consent, and a checked box or affirmative text reply is a signature. Since May 25, 2023 (HB 761) a recipient must reply STOP and wait 15 days before suing over texts. The 8 a.m. to 8 p.m. window and three-per-24-hours cap in 501.616(6) are written for phone calls; courts have not settled whether they reach texts. Florida SMS marketing law.

Texas

SB 140, effective September 1, 2025, makes a marketing text a "telephone solicitation". A seller texting Texas buyers needs a Secretary of State registration certificate ($200 filing fee plus $10,000 in security, renewed yearly) unless exempt. One exemption covers a business soliciting its former or current customers that has operated under the same name for at least two years. The Secretary of State's Form 3400 notice adds that a business texting only with the consumer's prior consent need not register; confirm your fit with counsel. Texas SMS marketing law lists the other exemptions.

Other states with their own text rules

Maryland: prior express written consent for automated texts (since January 1, 2024), no solicitations 8 p.m. to 8 a.m., three per 24 hours on one subject. Connecticut: telephonic sales calls, texts included, only 9 a.m. to 8 p.m. Virginia: a STOP reply holds for at least 10 years (since January 1, 2026). Washington: clear advance consent for commercial texts; damages cut to $100 per violation on June 11, 2026. Oklahoma: written consent for automated texts, with hour and frequency limits worded for phone calls, like Florida. California: text advertisements barred outside listed exceptions (Bus. & Prof. Code 17538.41); see the California rules.

Compliance, built in

How BestText keeps you on the right side of the rules.

We run on carrier-grade routes we own and operate and register your brand and campaigns directly with The Campaign Registry. Consent collection stays your job; the 10DLC form asks you to attest to it. The same account also sends ringless voicemail, under its own rules.

DNC and litigator scrubbing

At upload, scrub against the national registry, state lists and known-litigator data; results are cached 90 days and a list can be re-scrubbed without re-uploading. Every send is also checked against your own do-not-call list and a platform-wide blacklist.

Opt-outs handled on reply

Every account starts with a keyword list (stop, unsubscribe, cancel, end, quit and more). A matching reply opts the contact out, stops their drips and chase follow-ups, and is flagged in the inbox. Add your own keywords, including the FCC's "revoke".

10DLC registered for you

Our team registers your brand and campaigns and attaches the campaign to your numbers; you fill in the brand and campaign forms with your use case, sample messages and opt-in flow. Fee questions are answered on the demo. How 10DLC registration works.

Sending windows by local time

You set the hours; bulk campaigns default to 9 a.m. to 9 p.m. in each contact's own time zone, inside the federal window. Tighten it for Maryland and Connecticut lists, and use the "Exclude Texas numbers" switch at import (it drops Texas area codes) and suppression lists for numbers you should not text.

Sources: 47 CFR 64.1200 (consent, do-not-call, quiet hours, revocation); 47 U.S.C. 227 (private actions and damages); FCC 03-153 (2003, texts under the autodialer ban); FCC 12-21 (2012, prior express written consent); FCC 23-107 (2023, do-not-call registry and texts); FCC 26-67 (adopted September 30, 2026, revocation rewrite); Facebook v. Duguid (2021); Steidinger v. Blackstone Medical Services (7th Cir., July 14, 2026); CTIA Messaging Principles and Best Practices (May 2023); Fla. Stat. 501.059.

This page is educational information about SMS marketing laws, not legal advice. Regulations change, courts disagree, and your situation is specific to you. Consult a qualified telecommunications attorney before launching campaigns, especially in regulated verticals.

Questions

Everything you need to know.

Is it illegal to text a customer without permission?

For a marketing text sent with an autodialer, yes. The TCPA requires prior express written consent first (47 CFR 64.1200(a)(2)), and the recipient can sue for $500 per text. An informational text, such as a delivery update, needs only prior express consent, which the FCC allows to be oral.

What are the TCPA rules for texting?

Get prior express written consent before any marketing text sent by autodialer. Scrub against the national Do Not Call Registry with a copy no older than 31 days. Send telephone solicitations only between 8 a.m. and 9 p.m. local time. Honor any reasonable opt-out within 10 business days. The SMS TCPA compliance guide covers each.

Can I sue a company for texting me without permission?

Under the TCPA's autodialer provision, yes: $500 per text or your actual loss, up to $1,500 if the court finds the violation willful or knowing (47 U.S.C. 227(b)(3)). The separate do-not-call claim pays up to $500, needs more than one call in 12 months, and on July 14, 2026 the Seventh Circuit held it does not cover texts; elsewhere it is unsettled.

Is cold texting illegal?

Cold texting a consumer is a marketing text without consent, so the written-consent rule, the state mini-TCPAs and the $500 per text all apply. Cold texting a business is less settled, because the autodialer rule covers any cell phone while the national do-not-call rule is written for residential subscribers. The cold texting page walks both.

What counts as consent for text messages?

For marketing texts, a written agreement bearing the person's signature that clearly authorizes marketing texts by autodialer to a stated number and discloses that signing is not a condition of purchase (47 CFR 64.1200(f)(9)). E-signatures count: web form, email, text reply, keypress or voice recording. For informational texts, oral prior express consent is enough (FCC 12-21).

How quickly must I honor a STOP?

Within a reasonable time and never more than 10 business days (47 CFR 64.1200(a)(10), in force since April 11, 2025). One confirmation text is allowed, and one sent within five minutes is presumed inside consent. Florida gives senders 15 days after a STOP before suit; Virginia makes the STOP stick for at least 10 years.

Free 30-minute demo

Send compliant campaigns from day one.

Pick a time and we walk your exact use case, consent flow and 10DLC registration on a free 30-minute call. No card required.