When Unwanted Texts Cross the Legal Line

That text you never signed up for? It might be worth $500. Under the Telephone Consumer Protection Act (TCPA), unwanted marketing texts sent without proper consent aren't just annoying — they can be flat-out illegal, and the penalties add up fast.

The core rule is simple: businesses must obtain prior express written consent before sending marketing text messages, according to TCPA compliance guidance. If a consumer opts out, the texts must stop. New opt-out rules that took effect on April 11, 2025 make it easier for consumers to revoke consent "in any reasonable manner," and legal analysis of the amendments notes the burden of proof now sits with businesses to demonstrate why an opt-out request was not reasonable.

So what counts as a violation? Generally, any of the following:

• Sending a marketing text without prior express written consent on file
• Continuing to text after a consumer revokes consent — businesses get 10 business days to honor the request
• Using AI-generated or prerecorded voices for marketing calls without written consent, since these are treated as artificial voices under the TCPA

The financial exposure is real. The TCPA provides a private right of action with statutory damages of $500 to $1,500 per violation, per class member, per FCC rule summaries. Multiply that across thousands of texts and a single campaign can turn into a seven-figure liability. That risk is driving enforcement: industry reporting shows TCPA class actions up 23% year-over-year.

Here's where many businesses trip: assuming "implied permission" is good enough. It isn't. Compliance experts are clear that a past purchase, an existing relationship, or a phone number on an old spreadsheet does not equal consent. Only documented, affirmative consent — with the date, time, and method recorded — holds up when a regulator or plaintiff's attorney comes asking.

This is why list discipline matters more than list size. At My AI Call Center, every campaign begins with a review of list source and consent records before anything launches — because a list without clear permission documentation is a liability, not an asset. The same logic applies to any outbound program: AI voice compliance guidance confirms that prior express consent is required even for informational calls, and written consent for marketing.

The takeaway is straightforward. If you can't produce a record showing the person affirmatively agreed to receive that text, the message is a legal risk — and under the TCPA, every unsolicited text is a separate violation waiting to be counted.

The 2025 Opt-Out Rules That Changed the Game

For years, "text STOP to opt out" was the golden rule of SMS compliance. As of April 11, 2025, that rule no longer tells the whole story — and businesses that haven't updated their practices are exposed.

The FCC's amended TCPA opt-out rules, which took effect on April 11, 2025, fundamentally change how consent revocation works. Consumers can now revoke consent through "any reasonable means" — not just the designated STOP keyword your platform happens to recognize. A reply like "please stop calling me," a verbal request during a phone call, or even a vague "unsubscribe" in an email thread can all qualify as valid revocations.

Once a consumer revokes, the clock starts. Businesses have 10 business days to honor the request, according to the same legal analysis of the new rules. Miss that window, and every subsequent message becomes a potential violation carrying statutory damages of $500 to $1,500 per violation, per class member.

The stakes are climbing. Industry reporting shows TCPA class actions are up 23% year-over-year, and plaintiffs' attorneys know the new rules give consumers more ways to claim their opt-out was ignored.

The most consequential shift is where the burden now sits. If a dispute arises over whether an opt-out request was reasonable, the business must prove it wasn't — not the other way around. That makes record-keeping a legal necessity, not a nice-to-have. Experts recommend maintaining:

• Detailed consent records showing the date, time, and method of consent, per compliance guidance from messaging platforms
• Opt-out logs capturing every revocation request, however it arrives
• Timestamps proving the opt-out was honored within the 10-business-day window
• Documented, affirmative consent — since implied permission doesn't count under the new standards

This is why list discipline has become a core part of campaign planning rather than an afterthought. Services like My AI Call Center now review list sources and consent records before any campaign launches, and log opt-outs immediately — treating the opt-out log as a deliverable as important as the outcome report itself.

The practical takeaway is simple: if your consent and opt-out records live in a spreadsheet someone might forget to update, the April 2025 rules have already outgrown your process. Every reasonable revocation channel needs a capture path, and every capture needs a timestamp.

AI Voices and Texts: The Compliance Standard to Meet

If your business uses AI-generated voices for calls or texts, the law treats that technology exactly the way you might hope it does not: as an artificial or prerecorded voice under the TCPA. That classification carries real obligations, and the penalties for ignoring them are steep — statutory damages run from $500 to $1,500 per violation, per class member, under the TCPA's private right of action (Buchanan Cole).

Under this framework, AI voices require prior express consent for informational messages and prior express written consent for marketing messages, according to TCPA compliance guidance on AI calling. There is no lighter standard because a machine placed the call — if anything, the rules apply more strictly, not less.

Consent also has to be documented. Experts note that implied permission does not count; businesses need affirmative, recorded consent including the date, time, and method of consent (Infobip). A verbal "sure, that's fine" with no log entry behind it offers little protection when a dispute arises.

Opt-out handling matters just as much. Rules effective April 11, 2025 make it easier for consumers to revoke consent "in any reasonable manner," and the burden of proof falls on the business to demonstrate why an opt-out request was not reasonable (Buchanan Cole). Honoring revocations within 10 business days is the compliance deadline businesses must meet.

In practice, a defensible AI calling or texting program comes down to three disciplines:

• Documented consent records — date, time, and method of consent for every contact on the list.
• Immediate opt-out handling — keyword opt-outs like STOP and REVOKE recognized and honored without delay.
• A DNC list that travels — suppression records carried across every campaign, so an opt-out from one message never gets violated by the next.

This is the same list discipline My AI Call Center applies before any campaign launches: list source and consent records are reviewed up front, bought lists without clear permission records are flagged, and opt-outs are logged and honored immediately across all campaigns. TCPA class actions are up 23% year-over-year (Attentive), which makes this standard less a legal nicety and more a cost of doing business. The organizations that stay out of court are the ones that can prove consent, prove suppression, and show the paper trail — before the first call ever goes out.

How to Stay Compliant Before You Send Anything

The difference between a compliant text campaign and a $500-per-message lawsuit usually comes down to a checklist you run before anything sends. With TCPA class actions up 23% year-over-year, according to recent compliance analysis, the prep work matters more than the message itself.

Start with consent — the right kind. Marketing texts require prior express written consent, and experts are blunt that implied permission does not count; you need documented, affirmative consent for every contact on your list. If you are using AI-generated voices, the bar is similar: the TCPA treats them as artificial or prerecorded voices, requiring prior express consent for informational calls and written consent for marketing ones, per AI compliance guidance.

Next, build a system that actually honors opt-outs. New FCC rules effective April 11, 2025 require businesses to process revocation requests within 10 business days, and consumers can now revoke consent "in any reasonable manner." The burden of proof falls on your business to demonstrate why an opt-out request was not reasonable — a position no sender wants to defend.

Your pre-launch checklist should cover four things:

• Consent verification: confirm prior express written consent exists before any marketing text goes out.
• Opt-out handling: a documented process to recognize and honor revocations within 10 business days.
• Consent records: date, time, and method of consent for every contact, maintained in detail.
• Policy review: regular reviews of compliance procedures as rules evolve.

The highest-risk item on most lists is a purchased one. A bought list without clear permission records is exactly where $500-$1,500 per-message statutory exposure hides, since the TCPA's private right of action lets consumers sue for each violation. A list-and-consent review that flags those lists before launch is the single most practical step a business can take — and it is why My AI Call Center checks list source and consent records before any campaign runs, declining bought lists that lack permission documentation rather than discovering the problem after the fines.

One final note: campaign requirements vary by location, industry, contact type, and technology. Confirm appropriate legal guidance before launch, and revisit your compliance policies regularly — the rules, as the April 2025 changes show, do not stand still.