Statutory damages under the TCPA run from $500 per message, rising to $1,500 for willful violations, with no cap on the total.
Put a campaign against that. Five thousand numbers, no defensible consent record, and the arithmetic reaches $2.5 million before anybody argues about intent. Treble it if a court finds the violation willful.
That is why SMS is the one channel where the compliance work comes before the copy, and it is why the plaintiffs’ bar pays close attention to it.
I am not a lawyer and none of this is legal advice. It is a description of rules that are currently being enforced, written so you know what to ask your own counsel about. Take proper advice on your own setup before you send anything.
The rule everyone still cites, and the one that actually landed
Most SMS compliance guides written in 2024 are now wrong in a specific and expensive way, so start here.
The one-to-one consent rule was struck down. The FCC’s requirement that consent be given to one identified seller at a time was vacated by the Eleventh Circuit in January 2025, in Insurance Marketing Coalition v. FCC, on the basis that the FCC had exceeded its statutory authority. It never took effect.
So the standard is prior express written consent, as it was before, without the one-to-one constraint. If a vendor is selling you a product on the basis that one-to-one consent is a legal requirement you must meet, that particular requirement does not exist. The rest of their product may still be worth having. The premise is out of date.
The revocation rule did take effect, on 11 April 2025, and this is the one to build your process around.
A consumer can revoke consent at any time by any reasonable means, and that applies to informational messages as well as marketing. You have to honor it within ten business days. Note that the FCC granted a limited waiver covering part of this rule, so ask your counsel where that currently stands rather than relying on a blog post, mine included.
The practical reading: you can no longer insist that people use your keyword. If somebody replies “please stop texting me” in a sentence, or emails you, or tells your rep on the phone, that counts.
What prior express written consent looks like on a form
Four things, and most forms I look at miss at least two.
A checkbox that is not pre-ticked. A box the user has to actively click. Pre-ticked is not consent and neither is an inferred agreement buried in your terms of service.
Not a condition of anything. Consent to marketing texts cannot be required to complete a purchase, download a thing, or enter a competition.
A clear statement of who is texting and about what. Your business name, plainly, and what sort of messages they will get.
The standard disclosures next to the box. Message and data rates, rough frequency, and how to stop.
Wording along these lines, adapted with your counsel:
I agree to receive recurring marketing text messages from [Business Name] at the number provided, including messages sent by autodialer. Consent is not a condition of purchase. Message and data rates may apply. Message frequency varies. Reply STOP to opt out or HELP for help.
The phrase “including messages sent by autodialer” matters, and so does “consent is not a condition of purchase”. Both are there for a reason.
Why your texts are not being delivered
A separate problem from the legal one, and the cause of most “SMS does not work for us” conclusions.
Since February 2025, the major US carriers block unregistered application-to-person traffic on ten digit long codes outright. Not throttled, not flagged. Blocked, with no bounce and no error, so from your side the messages simply leave and nothing happens.
If you are sending business texts from a normal ten digit number and delivery looks poor, check whether your brand and campaign are registered before you change anything about the messages.
Registration costs are modest, commonly cited around a few dollars for brand registration, in the region of $100 for campaign vetting, and roughly $20 a month in carrier fees. The thing to understand is that registration is a state you maintain rather than a form you filed once, because carriers now audit campaigns after approval and a campaign that drifts from what you registered can be pulled.
The operational rules people break by accident
Timing. Messages go out within the long-standing window of 8am to 9pm in the recipient’s local time, not yours. If you are in California texting a list that includes Boston, your 7am send is 10am there and your 7pm send is 10pm, which is the one that gets you a complaint.
State law on top of federal. Several states have their own mini-TCPA statutes with tighter windows, extra consent language, or their own private right of action. If you send nationally, the strictest state on your list sets your rules in practice. Worth a specific conversation with counsel about the states you actually reach.
STOP and HELP handling. Your platform handles the keywords automatically. It does not handle the person who replies in a sentence, or who opts out in a different channel. That gap is a manual process you have to build.
Opting out means everywhere. If somebody opts out of marketing texts and your system keeps them on a separate automated flow, that is the sort of detail that turns one complaint into a class action.
The part that is actually your defense
Everything above is prevention. This is what you will be asked for.
For any given phone number, can you produce evidence of when consent was given, through which form, from which IP address, and the exact wording that was displayed on the page at that moment?
Most businesses cannot answer the last part. The form has been redesigned three times since, the old wording is gone, and the record says only that a checkbox was ticked. That is a weak position.
Keep versioned screenshots or saved copies of every consent form you have used, dated. Keep the timestamp and IP with each record. Keep the whole thing for at least the statute of limitations, and ask your counsel how long that is for you.
This is unglamorous and it is the only thing that matters if you are ever challenged. The same principle applies to the review rules that caught a lot of businesses last year: the practice that feels normal in the market is not a defense when the rule is specific.
Before lunch
Four things, about an hour.
Open your own sign-up form on a phone and check the box is not pre-ticked, the disclosures are next to it, and consent is not required to buy anything.
Ask your SMS platform, in writing, whether your brand and campaign are 10DLC registered and currently in good standing.
Write down the process for somebody who opts out in a sentence rather than with the keyword, and who is responsible for it. Then check it against the ten business day requirement.
Then find out whether you can produce a dated copy of the consent wording that was on your form six months ago. If you cannot, start keeping them today.
SMS is a genuinely strong channel with response rates that make email look tired, which is exactly why it attracts both regulation and litigation. It rewards the businesses that treat consent as an asset rather than a formality, in much the same way outbound now rewards restraint.
My notes on lead generation cover where SMS fits alongside everything else. If you’d like to think through your own setup, drop me a line on email, WhatsApp or LinkedIn and we can have a quick chat. I’m contracted full time so this isn’t a pitch.