Introduction

Texting a customer seems simple — until a single message costs you $500 or more. That's the reality facing businesses today: a text sent without proper consent isn't just a bad look, it's a federal violation under the Telephone Consumer Protection Act (TCPA), with statutory damages running $500 to $1,500 per message and no cap on aggregate damages in class actions. For a business that sends 100,000 unconsented messages, that's potential exposure exceeding $150 million.

The rules have only gotten tighter. The FCC's Opt-Out Rule, effective April 2025, requires businesses to honor revocation requests through any reasonable method within 10 business days. The One-to-One Consent Rule, effective January 2026, closes the lead-generator loophole — consent can no longer be shared across brands or sold to third parties. And the FCC confirmed in February 2024 that AI-generated voices count as "artificial voices" under the TCPA, requiring prior express consent.

It's not just federal law, either. Approximately 12 states have enacted stricter mini-TCPA laws, and litigation is surging — TCPA class actions rose roughly 95% year-over-year through mid-2025. The core requirements every business needs to understand include:

• Prior express written consent for all marketing texts — informational messages alone don't require it, but adding any promotional content reclassifies them.
• Quiet hours of 8am–9pm in the recipient's local time zone, with state-specific variations layered on top.
• Prompt opt-out handling, with documented records of when and how consent was obtained.

Recent court decisions add further complexity. A Seventh Circuit ruling in July 2026 held that text messages are not "telephone calls" under one narrow TCPA provision — but that decision applies only to Illinois, Indiana, and Wisconsin, and does not affect other TCPA provisions, FCC enforcement, or state laws.

This layered landscape is exactly why disciplined list and consent practices matter more than ever. At My AI Call Center, every campaign launches only against approved, permissioned, or reviewed contact lists, with consent records checked before a single message goes out. In the sections that follow, we break down exactly what the law requires — and how to keep your outreach on the right side of it.

Key Concepts

Texting a customer might feel casual, but under U.S. law every message you send carries potential legal exposure of $500 to $1,500 per violation — and class actions are up roughly 95% year-over-year through mid-2025, according to compliance industry analysis.

At the federal level, the Telephone Consumer Protection Act (TCPA) sets the baseline. Marketing texts require prior express written consent, while informational messages like appointment reminders do not — but the line is fragile. Legal experts warn that adding any promotional content to a transactional message reclassifies it as marketing, triggering the full consent requirement (Infobip's TCPA guide).

The rules have also tightened considerably in recent years. The FCC's Opt-Out Rule, effective April 2025, requires businesses to honor revocation requests made through "any reasonable method" within 10 business days, with only one post-revocation clarification message permitted within five minutes (BCLP's legal analysis). And the One-to-One Consent Rule, effective January 2026, closes the lead-generator loophole: each sender must obtain consent directly from the consumer.

State laws add another layer. Roughly 12 states have enacted stricter mini-TCPA statutes that take precedence over federal requirements (state law research shows examples including Florida's 3-message-per-24-hour limit and Connecticut's $20,000 per-violation penalties). Most compliance experts recommend applying the strictest standard that applies to any contact based on their state of residence.

The stakes are substantial:

• $500–$1,500 per message in TCPA statutory damages, with no cap on aggregate exposure (Infobip)
• Up to $43,792 per call or text for Do Not Call registry violations (Infobip)
• 100,000 unconsented messages could mean $150M+ in class action exposure (Infobip)
• Quiet hours restrict all texting to 8am–9pm in the recipient's local time zone (Infobip)

AI adds a new dimension. The FCC's February 2024 ruling confirmed that AI-generated voices count as "artificial voices" under the TCPA, requiring prior express consent and clear disclosure (FCC declaratory ruling). This is why services like My AI Call Center treat AI voice communications with the same consent discipline as conventional automated outreach — checking list source and consent records before any campaign launches, and honoring keyword opt-outs like STOP and REVOKE immediately.

Documentation is your strongest defense. Record when and how consent was obtained, the exact consent language presented, and opt-out history — ideally retained for at least four years to cover the TCPA statute of limitations (ActiveProspect's compliance guidance). Virginia goes further, requiring 10-year opt-out record retention.

Best Practices

Best Practices

To build a compliant texting program, businesses must go beyond basic consent and embed ongoing safeguards into their workflows. With TCPA litigation up approximately 95% year-over-year through mid-2025 and statutory damages reaching $500–$1,500 per violation, proactive compliance is not just advisable—it’s essential for risk mitigation. Start by separating marketing and transactional messaging streams, as adding promotional content to service texts reclassifies them as marketing under TCPA, triggering prior express written consent requirements. This distinction protects against inadvertent violations while ensuring messages remain relevant and welcome to recipients.

Honoring opt-out requests promptly and flexibly is another cornerstone of compliance. The FCC’s Opt-Out Rule, effective April 2025, requires businesses to process revocations through any reasonable method within 10 business days, with only one clarification message allowed within five minutes if needed. Implementing LLM-powered opt-out detection can help identify varied consumer language—such as “STOP,” “QUIT,” or informal phrases like “don’t text me anymore”—and automate timely responses. For organizations using managed services like My AI Call Center, this ensures opt-outs are logged and honored immediately across campaigns, reducing exposure to costly errors.

Finally, align your practices with the strictest applicable standards based on recipient location. State mini-TCPA laws introduce significant variation: Virginia mandates 10-year opt-out record retention, Florida limits messaging to three texts per 24 hours per recipient, and Connecticut requires written consent for all telephonic sales. Pair these with universal requirements like 8 a.m.–9 p.m. quiet hours in the recipient’s local time and 10DLC registration for A2P traffic to create a resilient, audit-ready framework. By treating AI-generated communications as subject to the same TCPA rules as traditional automated messages—including clear disclosure and consent requirements—you maintain compliance without sacrificing efficiency.

Implementation

Knowing the rules is one thing; building workflows that hold up under scrutiny is another. With TCPA class actions up roughly 95% year over year through mid-2025, implementation is where most businesses either protect themselves or expose themselves to penalties of $500 to $1,500 per message.

Start by separating your message types. Prior express written consent is required for marketing texts, while informational communications like appointment reminders generally do not require it, according to legal analysis of the TCPA's consent rules. The moment you add promotional content to a transactional message, it reclassifies as marketing — so keep the workflows strictly separate.

Next, build your consent documentation before you send anything. Compliance experts identify record-keeping as the strongest defense in TCPA disputes: capture when and how consent was obtained, the exact consent language presented, and the recipient's contact details. The FCC's One-to-One Consent Rule, effective January 2026, means consent can no longer be shared across brands or sold to third parties.

Your opt-out handling needs an upgrade too. Since April 2025, businesses must honor opt-outs made through "any reasonable method" — email, voicemail, even informal language — within 10 business days, with only one clarification message permitted within five minutes and no marketing content in it. Experts note that LLM-powered detection systems can help catch opt-outs across varied phrasing, provided they are trained on diverse consumer language.

A practical implementation checklist:

• Maintain a state-specific compliance matrix — Virginia requires 10-year opt-out record retention, Florida caps texts at 3 per 24 hours, and Connecticut mandates written consent with $20,000 penalties per violation.
• Complete 10DLC brand and campaign registration for all A2P traffic, mandatory since February 2025, to avoid carrier blocking.
• Text only between 8am and 9pm in the recipient's local time zone.
• Retain opt-out documentation for at least 4 years to cover the TCPA statute of limitations.

If you use AI-generated voice or text, treat it as fully regulated. The FCC's February 2024 ruling confirms AI-generated voices count as "artificial voices" under the TCPA, requiring prior express consent for AI voice calls. This is why My AI Call Center checks list source and consent records before any campaign launches, treats AI voices as artificial voices under the TCPA, and honors keyword opt-outs like STOP and REVOKE immediately — compliance is built into the workflow, not bolted on afterward.

Finally, apply the strictest standard that applies to any contact based on their state of residence, and get legal counsel before relying on any exemption. Campaign requirements vary by location, industry, and consent status, so a structured review process — one that flags unclear consent records before spend begins — is the safest implementation of all.

Conclusion

Texting customers is legally workable, but the margin for error is thin and shrinking. With TCPA class actions up roughly 95% year-over-year through mid-2025 and statutory damages of $500 to $1,500 per message, a sloppy campaign can turn a routine promotion into a seven-figure liability almost overnight.

The core framework is straightforward once you see it as a checklist rather than a maze. Prior express written consent is required for marketing texts, while informational and transactional messages fall outside that requirement — but adding any promotional content reclassifies the message, so keep those workflows separate. The FCC's April 2025 opt-out rule requires you to honor revocation requests through any reasonable method within 10 business days, with only a single non-marketing clarification message permitted within five minutes.

Your practical next steps should look like this:

• Audit every contact list for documented, sender-specific consent before the One-to-One Consent Rule takes effect in January 2026.
• Build a state-specific compliance matrix — Virginia requires 10 years of opt-out records, Florida caps marketing at 3 messages per 24 hours, and Connecticut mandates written consent for all telephonic sales, per state mini-TCPA analysis.
• Register your brand and campaigns for 10DLC to avoid carrier blocking on A2P traffic.
• Document consent meticulously — when it was obtained, the exact language shown, and the recipient's details — since record-keeping is your strongest defense in any dispute.
• Confirm quiet-hour compliance at 8am–9pm in the recipient's local time zone, not your own.

If your outreach includes AI-generated voice or text, the bar is equally clear. The FCC's February 2024 ruling confirms that AI-generated voices count as artificial voices under the TCPA, requiring prior express consent and clear disclosure on every contact. This is why My AI Call Center treats list discipline as a precondition rather than an afterthought — every campaign runs only against approved, permissioned, or reviewed lists, with consent records checked before launch and bought lists lacking clear permission flagged or declined outright.

That same discipline applies to opt-outs: keyword requests like STOP and REVOKE are logged and honored immediately, and DNC requests carry across all campaigns. Even the recent Seventh Circuit ruling narrowing one private right of action changes little for day-to-day operations, since other TCPA provisions, FCC enforcement, and state statutes still apply.

One final caution: exemptions are nuanced, and legal analysts strongly recommend counsel before relying on any of them. Compliance requirements vary by location, industry, and consent status — so get appropriate legal guidance for your specific situation before your next campaign goes out.