TCPA Compliance for Text Outreach: The 2026 Operator Guide

What consent means under TCPA#

TCPA consent means the person handed you their number knowing what they would get. For marketing texts the standard is prior express written consent: clear disclosure, an affirmative act, a stored record of both.

On January 24, 2025 the Eleventh Circuit vacated the FCC's stricter one-to-one consent rule, so ordinary consent meaning governs. It still has to be voluntary and clear, and a stored checkbox proves little alone.

Two traps for B2B teams: bought or scraped numbers are not consent, and a work-used personal cell buys no exemption. The Ninth Circuit treats mixed-use numbers on the Do Not Call registry as presumptively residential.

• Timestamp, source URL or form ID, and the submitted number stored in E.164 format
• The exact disclosure text as it was worded on that date, versioned so you can reproduce it years later
• The affirmative act itself: checkbox state, button label, or the inbound keyword that started the opt-in
• IP address or device identifier plus every other field value submitted alongside the number
• The scope you asked for, written in plain words, because scope is what a plaintiff's lawyer will attack first

What changed April 11, 2025#

Three things became enforceable on April 11, 2025. You can no longer designate one exclusive opt-out method. Revocation must be honored as soon as practicable and never later than ten business days.

A set of replies revokes consent per se under 47 CFR 64.1200(a)(10): stop, quit, end, revoke, opt out, cancel, unsubscribe. The rule permits one clarifying reply within five minutes, with no marketing content.

If they do not answer, you stop everything. On June 20, 2025 the Supreme Court held in McLaughlin Chiropractic that district courts are not bound by the FCC's TCPA readings, so build to the statute and rule text.

System design for 10-day revocation#

Ten business days is the legal ceiling for revocation, not your target. Every day a revoked contact stays reachable is another chance for a workflow to fire, and each message is its own violation.

The ladder is a webhook, a suppression table, and a nightly reconciliation job. Key the suppression list on the phone number in E.164, not the CRM contact ID.

The same number turns up on duplicates, on second records made by different reps, and on leads two years old. Suppress the identifier the person actually holds.

Why keyword-only opt-out detection fails#

The seven per se keywords are a floor, not a filter. Revocation is valid by any reasonable method that clearly expresses a desire to stop, and you carry the burden of showing a request was not reasonable.

What arrives in a B2B thread is "Please take me off", "Wrong person", "Who is this? Remove me". A regex for STOP catches none of them, and opt-outs sent by email, voicemail or to a rep count too.

The payoff matrix is lopsided: a false positive costs one lead, a false negative costs $500 a message, trebled to $1,500 if willful. Bias the classifier hard toward suppression and review after.

• Tier A, per se keywords: auto-suppress instantly, no human involved, no confirmation needed beyond the permitted single clarifying reply
• Tier B, intent classifier flags a negative reply with stop intent: auto-suppress instantly, then queue for human review after the fact
• Tier C, ambiguous or hostile with no explicit stop language: freeze all sends to that number, route to a human within one business day, resolve to suppress or resume with a logged reason
• Off-channel opt-outs: give every rep a one-click suppression path from email, phone, or a live call, and train them that it's mandatory rather than courteous
• Written policy: 47 CFR 64.1200(d)(1) requires a written do-not-call policy available on demand, and most outbound teams simply don't have one. Write the page.

Quiet hours prevent cheap lawsuits#

Quiet hours under 47 CFR 64.1200(c)(1) bar solicitations to residential subscribers before 8am or after 9pm local time. Plaintiff firms industrialized this in late 2024 because a timestamp proves itself.

State law stacks on top and runs earlier. Florida and Oklahoma both cut off at 8pm local. Maryland stops at 8pm and caps contact at three calls in 24 hours on the same subject.

Gate on the recipient's timezone if your CRM holds it, on the area code's zone if not. Knowing neither, 11:00am to 8:00pm Eastern is safe across the continental US and respects Florida.

Identification requirements#

Identification rules in 47 CFR 64.1200(d)(4) require three things from anyone making a telemarketing call: the caller's name, the entity's name, and a number or address that reaches that entity.

Texts are treated like calls, so the opening message of every new thread carries all three. Identity and opt-out language pull against each other on length, which is where teams start cheating.

Split them: identity and contact route in the first message, opt-out instructions in every promotional message. Use the rep's real first name, the registered company name, and a route that reaches a human.

Logging and retention rules#

Log consent, every outbound message, every inbound reply and every suppression event, then keep it all for at least five years. Two clocks drive that number.

TCPA claims run four years under 28 U.S.C. 1658, and 47 CFR 64.1200(d)(6) requires a do-not-call request honored for five years from when it is made. The longer clock wins.

So retention runs five years from the later of the last message sent or the last revocation received. Keep the suppression table append-only: deleting an entry is how you re-add someone you lost the right to text.

• Consent record: timestamp, source URL or form ID, disclosure text version as rendered, IP or device identifier, number in E.164, all submitted field values
• Every outbound: number, timestamp with timezone, campaign or workflow ID, full message body, and the delivery state the platform returned
• Every inbound: full body, timestamp, and the classification your system assigned along with the classifier version that assigned it
• Every suppression: the trigger text, the channel it arrived on, timestamp received, timestamp suppressed, and confirmation from each downstream system that the sync landed
• Every human override: reviewer name, decision, and the reason in their own words
• Your written do-not-call policy, versioned, so you can show which version was live on any given date

Cost of a TCPA violation#

TCPA damages run $500 per message under 47 U.S.C. 227(b)(3), trebled to $1,500 for a willful or knowing violation. There is no cap, and the plaintiff need not show any actual harm.

Run it on a real program. You text 5,000 contacts a month on a four-message sequence. Two percent opt out, and one downstream system has a 30-day propagation gap, so roughly two messages each land after revocation.

That is 200 violating messages, $100,000 for one month of one gap, $300,000 trebled. The fix is a webhook and a nightly reconciliation job, about two days of work.

• WebRecon counted 2,810 TCPA filings in calendar 2025, up 0.8% on 2024
• Composition matters more than the count: the plaintiff bar has industrialized the claims needing least discovery, which is why quiet-hours and post-revocation claims are the ones showing up

The operator checklist#

The checklist below is an operator's guide, not legal advice. I am not a lawyer, and nothing here replaces one who knows your industry and your states. Take it to counsel and get the applicable parts signed off.

Blue Reacher fires webhooks on every inbound reply and delivery state, with STOP auto-detection, so the suppression ladder wires in a day rather than a quarter.

Native to GoHighLevel, HubSpot, Close, Salesforce, Pipedrive and Follow Up Boss, plus Zapier, Make, n8n and a REST API. No A2P registration required, and the obligations above attach to you as the sender either way.

• Consent records store the rendered disclosure text and its version, not just a boolean
• No purchased or scraped mobile numbers in any sendable audience, with an import gate that enforces it
• Suppression list keyed on E.164 number, append-only, never purged
• Opt-out propagates to the messaging thread instantly, CRM within an hour, all other systems within 24 hours
• Nightly reconciliation job diffs suppression against every sendable audience and alerts on any miss
• Intent classification on inbound replies, not keyword matching alone, tuned to over-suppress
• One-click suppression available to every rep for opt-outs that arrive by email, phone, or in conversation
• Quiet-hours gate on recipient local time, defaulting to 11:00am to 8:00pm Eastern when timezone is unknown
• State overlays applied for Florida, Oklahoma, and Maryland at minimum
• First message of every thread carries rep name, company name, and a working contact route
• Opt-out instructions in every promotional message
• Written do-not-call policy exists, is versioned, and someone can produce it on demand today
• Full message, reply, classification, and suppression logs retained five years from the later of last send or last revocation
• Someone owns this. Name them. Compliance with no owner is compliance theater.

Frequently asked questions