The Six Ways Texting Crosses the Line

In 2026, "inappropriate texting" isn't a matter of etiquette. It's a legal category, and the cost of getting it wrong keeps climbing: TCPA class actions were up nearly 95% year-over-year through mid-2025, with statutory damages of $500 to $1,500 per message and no aggregate cap. A single 100,000-message campaign sent without proper consent could theoretically exceed $150 million in exposure.

Here are the six ways a text crosses the compliance line.

1. The wrong consent tier. Marketing texts require prior express written consent. Informational texts, like appointment reminders, only need the lower prior express consent standard. Sending a promotional message to someone who only gave you their number in passing is the classic mismatch. And under the one-to-one consent rule in effect since January 2026, consent can't be transferred to third parties or related brands; each sender needs its own.

2. Quiet-hours violations. No texts before 8 a.m. or after 9 p.m. in the recipient's local time, and some states are stricter. This has to be enforced per recipient, not per campaign, because a message sent at noon in one time zone lands at 10 p.m. in another.

3. Ignored or evaded opt-outs. This is the leading litigated failure and one of the easiest violations to document. Since April 2025, businesses must honor opt-outs by "any reasonable method," including informal wording like "quit" or "cancel", the STOP keyword alone no longer suffices. One messaging platform reports processing more than a million of these fuzzy opt-outs, and describes opt-out evasion as a real and growing tactic. Requests must be processed within 10 business days, and the confirmation message can't contain any promotional content.

4. Promotional content smuggled into transactional messages. Drop a discount code into an order update and you've reclassified the whole message as marketing, which triggers the higher written-consent standard. Vendors recommend keeping transactional and promotional workflows completely separate for exactly this reason.

5. DNC-registered or reassigned numbers. The FCC has codified that National Do Not Call Registry protections extend to text messages, and DNC violations carry penalties up to $43,792 per call or text. Lists also need scrubbing against the Reassigned Numbers Database, since a number that once belonged to a consenting customer may now belong to a stranger. This is why, at My AI Call Center, list source and consent records are reviewed before any campaign launches, and bought lists without clear permission records are flagged and usually declined.

6. Restricted content. SHAFT content (sex, hate, alcohol, firearms, tobacco/CBD) is off-limits regardless of consent, and marketing messages must identify the sender and include opt-out instructions. AI-generated messages count too: the FCC's February 2024 ruling treats AI-generated voices as "artificial voices," and AI-assisted SMS faces the same consent and registration requirements as any other automated send.

One wrinkle worth knowing: a 2026 Seventh Circuit ruling held that texts aren't "telephone calls" under one TCPA provision, but only in Illinois, Indiana, and Wisconsin, and state mini-TCPA laws still treat unsolicited texts as actionable. Legal analysts expect this to augur an era of increased complexity, not relief. Requirements vary by location and industry, so get legal guidance before you launch anything.

Consent Tiers and Opt-Out Handling: Where Most Violations Happen

Most TCPA violations don't come from sending to the wrong number. They come from sending to the right number without the right kind of permission, or from ignoring someone who asked to be left alone.

The law draws a sharp line between two consent tiers. Marketing texts generally require prior express written consent, a signed, documented agreement that names the seller and the message type. Informational texts, like appointment reminders, delivery notices, or password resets, sit under the lower prior express consent standard, which can be oral or implied, such as handing over a number during a transaction (ActiveProspect). The moment you slip a discount code into an order update, that message stops being transactional and inherits the higher marketing standard.

A few common shortcuts don't hold up. Pre-ticked boxes on a signup form do not count as valid opt-in (Infobip). Texting a keyword like "SAVE" to a short code has been challenged in "numerous TCPA lawsuits" as too thin for full marketing consent (ActiveProspect). And since January 2026, the FCC's one-to-one consent rule means a customer who opts in to one brand cannot be marketed to by a sister brand or a third-party partner; each sender has to earn its own permission (Infobip).

Where things actually go wrong in court is opt-out handling. Sending to someone who already said stop, so-called "STOP failures," was the leading driver of audit requests in 2026 and one of the easiest violations to document and litigate (Attentive). Since April 2025, businesses must honor opt-outs through "any reasonable method", email, voicemail, and informal phrases like "quit" or "cancel" all qualify, so relying on the STOP keyword alone is no longer enough (Infobip). Attentive has processed more than a million of these "fuzzy opt-outs" and describes opt-out evasion as "a real and growing tactic" (Attentive).

The day-to-day impact is real. A confirmation reply is allowed after an opt-out, but it has to ship within five minutes and contain zero promotional content (Infobip). Requests must be processed within ten business days. Florida gives senders a 15-day safe harbor and caps frequency at three messages per 24 hours per recipient. Virginia now requires opt-out records to be retained for ten years. None of this is theoretical: statutory damages run $500 to $1,500 per message with no aggregate cap, and a 100,000-message campaign without proper consent can clear $150 million in class-action exposure (Infobip).

For any team running multi-touch outreach, the practical takeaway is to treat consent as a per-recipient, per-sender, per-message-type artifact, and treat opt-outs as the single highest-priority signal in the system. My AI Call Center applies the same logic to outbound calling: every list is reviewed for source and consent records before launch, and opted-out and DNC numbers are logged and honored immediately across every campaign. If you're not sure whether your list will support the campaign, that's the conversation to have before you spend anything.

AI-Generated Messages Are Fully Regulated Communications

If your marketing platform writes the message with AI, you might assume the rules soften. They don't. The FCC settled this in February 2024, and the ruling treats AI content the same as any other automated send.

The declaratory ruling confirmed that AI-generated voices count as "artificial voices" under federal law, and that AI-generated or AI-assisted SMS messages are subject to the same consent and registration requirements as conventional automated messages, according to compliance analysis of the ruling. In plain terms: if a tool drafts or personalizes your text, that text still needs the right consent tier behind it. "It was written by AI" is not a defense.

The enforcement side has teeth now, too. Since February 2025, carriers block unregistered 10DLC traffic outright, so a text campaign that never went through registration may never reach an inbox at all. Carriers also filter messages flagged as spam or unwanted, which means sloppy compliance now shows up as deliverability failure before it shows up as a lawsuit.

The Do Not Call Registry applies to texts as well. The FCC codified that DNC protections extend to text messages in its rule targeting unlawful text messages, and DNC violations carry penalties up to $43,792 per call or text. Scrubbing your list against the DNC Registry and the Reassigned Numbers Database before launch is not optional housekeeping.

This matters most inside multi-touch campaigns, where calls, texts, and emails work together. Each AI touch needs the same disclosure and consent framework as a human one:

• Consent records verified for every contact before the first send, not after
• AI disclosure handled the same way across calls and texts in the sequence
• Opt-outs logged immediately and honored across every channel in the campaign
• Quiet hours enforced per recipient's local time, with state-specific rules layered on top

This is how we approach it at My AI Call Center. Every campaign runs against approved, permissioned, or reviewed lists only, with list source and consent records checked before launch, and AI disclosure and opt-out handling built into the script approval step. A text touch in a database reactivation campaign gets held to the same standard as the call that precedes it.

One caution as you build your own framework: the legal ground is shifting. A 2026 Seventh Circuit ruling narrowed one TCPA private-right-of-action pathway for texts, but only within Illinois, Indiana, and Wisconsin, and only for that provision. State mini-TCPAs still treat unsolicited texts as actionable, and legal analysts expect increased complexity and ambiguity ahead. Keep your compliance structure in place regardless of where you operate, and get legal guidance specific to your location before launch.

State Rules, Court Rulings, and the Case for Keeping Your Compliance Structure

Federal law sets the baseline, but state laws and court rulings keep shifting the ground beneath it. If you text across state lines, you're operating under multiple rulebooks at once.

About a dozen states have passed their own "mini-TCPA" laws that go beyond federal requirements. Florida caps sends at three messages per 24 hours per recipient and offers a 15-day safe harbor after an opt-out. Virginia requires you to retain opt-out records for 10 years. Texas and Florida both impose stricter consent and timing rules than the federal standard, and more states are expected to follow within the next 12 to 24 months.

Then there's the Seventh Circuit. In 2026, the court ruled in Steidinger v. Blackstone Medical Services that text messages are not "telephone calls" under TCPA § 227(c)(5)'s private right of action. The reasoning: Congress passed the TCPA in 1991, the first text message arrived in 1992, and the statute distinguishes "call" from "message" in other provisions.

That ruling sounds like a green light. It isn't. It binds courts in Illinois, Indiana, and Wisconsin only, and it addresses one specific provision. State mini-TCPAs in Florida and New York explicitly define texts as actionable. As WilmerHale's analysis puts it, companies with nationwide texting operations will likely need to keep their compliance structures in place, and the decision signals an era of increased complexity and ambiguity.

Here's what that means in practice if you text nationally:

• Build to the strictest rule you touch. Florida's frequency cap and Virginia's record-retention rule become your operating standard, not exceptions.
• Don't relax consent tiers based on one circuit's ruling. Marketing texts still require prior express written consent everywhere.
• Keep opt-out records long and detailed. Virginia's 10-year retention rule is the floor; documented opt-outs are your strongest defense in any dispute.
• Scrub every list against the National Do Not Call Registry and the Reassigned Numbers Database before you send.
• Watch for further rulings. The Supreme Court's McLaughlin decision opened the door to more challenges against FCC interpretations.

At My AI Call Center, multi-touch campaigns that include text touches run against approved, permissioned, or reviewed lists only, with state-specific timing and frequency rules honored per recipient. Opt-outs get logged and carried into client DNC records immediately.

One more thing: TCPA class actions filed through mid-2025 were up nearly 95% year-over-year. The legal floor isn't dropping. It's rising.

This article provides general information, not legal advice. Campaign requirements vary by location, industry, contact type, consent status, and technology. Consult qualified legal counsel before launching any outbound campaign.

Your Pre-Launch Safeguard Checklist

Before any text message goes out, a short pre-launch review catches most of the problems that later turn into lawsuits. The stakes justify the discipline: TCPA statutory damages run $500 to $1,500 per violation with no cap on aggregate liability, and compliance analysis estimates a single 100,000-message campaign without proper consent could exceed $150 million in class action exposure.

Start with the list itself. Scrub every number against the National Do Not Call Registry and the Reassigned Numbers Database before launch. The FCC has codified that DNC protections extend to text messages, and violations carry penalties up to $43,792 per call or text.

Then verify consent, and verify it precisely. Pull the actual opt-in records and read the exact language the customer agreed to. Marketing texts generally require prior express written consent, while informational texts need only the lower prior express consent standard. Watch for weak evidence: pre-ticked boxes don't count, and merely texting a keyword to a number has been challenged in numerous lawsuits as insufficient for marketing consent.

A few more checks belong on the list:

• Confirm quiet hours per recipient's time zone, not the campaign's home base. Federal rules bar texts before 8 am or after 9 pm local time, and some states are stricter.
• Set up keyword handling that catches fuzzy opt-outs like "quit" or "cancel." Since April 2025, businesses must honor opt-outs by any reasonable method, and logging them immediately into DNC records is what keeps you safe.
• Keep transactional and promotional workflows completely separate. A discount code slipped into an order update reclassifies the whole message as marketing and triggers the higher consent standard.
• Document everything: consent language, timestamps, scrub dates, opt-out logs. Defensible record-keeping is repeatedly cited as the strongest defense in a TCPA complaint.

This is the review process we run at My AI Call Center before any campaign launches. List source and consent records get checked first, and bought lists without clear permission records are flagged and, in most cases, declined. We tell you plainly if the list won't support the campaign, before you spend anything.

If you'd rather not build this review from scratch, the first campaign review is free. It surfaces consent gaps, timing risks, and list quality issues while the only thing at stake is a conversation, not a statutory damages letter.