AI Agent WorxVisit Website →
← Back to blog

TCPA SMS Compliance: A Plain-English Guide for Small Businesses

November 12, 2026
TCPA SMS Compliance: A Plain-English Guide for Small Businesses

If you text customers or patients from a business number, the Telephone Consumer Protection Act (TCPA) applies to you. The short version: get clear written consent before you send marketing texts, say who you are and what you'll send, honor every opt-out fast, text only at reasonable hours, and keep proof of all of it. Skip those steps and the damages add up per message, not per campaign.

This guide walks through each piece in order, then covers the extras for clinics (HIPAA) and the state laws that can be stricter than the federal rules. It's general information, not legal advice. Have a TCPA attorney review your final consent language and workflows.

Aiagentworx
Make Customer Follow-Up More Consistent
Aiagentworx builds tailored systems to automate repetitive tasks such as appointment scheduling, lead follow-ups, and call answering for small businesses.
Visit

TL;DR

  • The FCC treats texts like calls, so autodialed marketing texts need prior express written consent. Informational texts can often rely on a lighter consent standard.
  • Your opt-in has to be clear, unchecked by default, name the sender, and say consent is not a condition of purchase.
  • Honor STOP and its variants right away, and keep records you can actually produce later.
  • Violations run $500 to $1,500 per text, with no cap on statutory damages.
  • Clinics also need HIPAA safeguards: a Business Associate Agreement with any texting vendor and a plan for protected health information.

Table of Contents

Does the TCPA apply to text messages?

Yes. The FCC treats text messages as telephone calls under the TCPA, including the do-not-call provisions and the autodialer restrictions. So the rules for robocalls and prerecorded messages carry over to SMS and MMS.

The statute defines a "text message" as an SMS or MMS sent to or from a device identified by a 10-digit number or N11 service code. It excludes messages sent over an IP-enabled service to another user of the same service, per 47 U.S.C. § 227. That's why iMessage to iMessage falls outside the TCPA's definition: it runs over IP, not SMS or MMS. Don't build a compliance plan around that, though. Your customers use Android phones, your platform may send as SMS, and messages fall back to SMS all the time.

Two more things to know early:

  • The TCPA covers more than marketing. Appointment reminders, payment notices and follow-ups are "informational" texts. They get a lighter consent standard, but they're not exempt from the law.
  • Size doesn't protect you. A two-chair dental office is subject to the same statute as a national retailer.

What consent do you need before you text?

The FCC's rule of thumb: autodialed texts to a mobile phone need the owner's prior consent, unless the message is for an emergency. Commercial texts require written consent, while informational texts may rely on oral consent.

For marketing, that means prior express written consent. In practice, a valid opt-in is:

  • In writing. A signed form, a digital signature, a web form checkbox, or a keyword text all work.
  • Clear and conspicuous. The person knows they're agreeing to automated marketing texts.
  • Not pre-checked. The customer takes the action.
  • Specific. It says who is sending, what kind of messages, and about how often.
  • Not a condition of purchase. Nobody should have to agree to texts to buy or book.

That list tracks published guidance on valid written consent, and the FCC's own consumer guide confirms that consent can be given on paper or electronically, including website forms.

What a good opt-in disclosure says

Put this next to the box or button where someone gives you their number:

  1. Your business name and what the messages are (for example, offers and appointment follow-ups).
  2. How often you'll text ("up to 4 msgs/month" or "frequency varies").
  3. That messages may be sent with an automated system.
  4. That consent isn't required to buy anything.
  5. How to stop (reply STOP) and how to get help (reply HELP).
  6. That message and data rates may apply.
  7. Links to your terms and privacy policy.

Watch out for the classic mistake: burying SMS consent inside a general terms-of-service checkbox, or bundling it with a form submission. If a lead filled out a form for a quote and you start sending promotions, that may not be what they agreed to.

A note on what changed in 2025 and 2026

The FCC's "one-to-one" consent rule, which would have limited each consent to a single seller, was vacated on January 24, 2025. The same source says the revoke-all requirement was pushed to January 31, 2027. The practical takeaway is that the pre-2023 written consent standard still governs, and TCPA lawsuits rest on the core statute. Being able to prove consent matters more than any single new rule.

Opt-outs: honor them fast

When someone replies STOP, treat it as final. The FCC's recent order covers the standardized opt-out words: stop, quit, end, revoke, opt out, cancel and unsubscribe. Text senders can name just one word as their instruction but must still honor any of the seven. Build your system to recognize all of them.

What "honoring" looks like:

  • Send one confirmation text, nothing more.
  • Remove the number from active lists right away and suppress it across every campaign and tool.
  • Don't ask the person to explain or re-confirm.

Federal rules give you an outer limit: honor the request within a reasonable time and no later than 10 business days, with the system automatically blocking future texts. Treat that as the ceiling. An automated suppression list that updates in seconds is the safer design.

There's a wrinkle that matters for appointment-based businesses. Per the same Ashurst Perkins Coie analysis, an opt-out in reply to an informational message, like a payment reminder, needs to be implemented for that type of message, not necessarily for others such as appointment reminders. But an opt-out in response to a text that contains an advertisement or telemarketing revokes consent to all future advertising and telemarketing texts from that caller. Keep marketing and operational texts clearly separate, and track opt-outs by message type.

If your phones go unanswered, an automated reply is a common way to recover the lead. Done right, missed call text back fits neatly with a clean suppression list, because the reply goes only to people who just called you and the opt-out path works the same way.

When you can text: hours and frequency

Federal rules limit telephone solicitations to 8 a.m. to 9 p.m. in the recipient's local time. Some states are tighter: Florida, Oklahoma and Maryland end at 8 p.m., and Connecticut runs 9 a.m. to 8 p.m., according to that same source. Because your list may include people in other time zones, store a time zone with each contact, or default to the narrowest window that fits everyone.

Federal and state text solicitation time windows

The TCPA doesn't set a strict frequency cap. Still, hammering people with messages invites complaints and opt-outs. Some practitioners suggest capping same-topic messages at three a day and sending between 9 a.m. and 8 p.m. recipient time. That's a sensible guardrail, not a legal line.

Records: your real defense

When a TCPA claim lands, the question is rarely "did you mean well." It's "can you prove this person agreed?" Keep, for every number:

  • The exact consent language shown at the time.
  • The date and time, and how consent was given (form URL, keyword, signed document).
  • The phone number and, where available, the IP address or device information.
  • Every opt-out, with timestamp.

One source recommends keeping opt-out records for at least 10 years. That's a conservative practice rather than a statute, but storage is cheap compared with a lawsuit. We go deeper on this in our piece on a 15-minute response SLA and consent trail for lead capture.

What violations can cost

TCPA violations carry penalties of up to $500 per violation, trebled to $1,500 for willful violations, with no cap on statutory damages. The same source notes civil penalties of up to $10,000 per call for intentional violations of federal robocall laws.

Do the math on a small list. A 2,000-contact campaign with no valid consent could, in theory, mean $1,000,000 at the $500 level. That's why plaintiffs' lawyers go after text programs, and why the paperwork matters more than the copy.

State rules can be stricter

Federal compliance is the floor. Texas SB 140, effective September 1, 2025, expanded "telephone solicitation" to include text and image messages. It created a private right of action with statutory damages up to $5,000 per violating text, according to that source. Florida has its own mini-TCPA as well. If you text across state lines, check each state where your customers live, and confirm details against the state statute or with counsel before you rely on any summary.

Texting patients: TCPA plus HIPAA

Clinics have two rulebooks. The TCPA governs consent and opt-outs. HIPAA governs what you put in the message and how it's protected.

  • Standard SMS isn't end-to-end encrypted, so carriers can access message content. HIPAA's Security Rule treats encryption as "addressable" rather than mandatory in every case, but it remains the standard safeguard for protected health information (PHI).
  • Vendors need a BAA. Any vendor that creates, receives, maintains or transmits PHI for your practice must sign a Business Associate Agreement covering permitted uses, Security Rule compliance and breach reporting, per the same article.
  • Keep reminders minimal. A text with a time, a location and a reply option does the job without detailing a diagnosis or treatment.

For dental, medical and men's health clinics, a practical pattern is: informational reminders under a documented consent, marketing under separate written consent, and anything clinical moved into a secure portal. Our posts on SMS appointment reminders and HIPAA chatbot controls cover the operational side.

A compliance checklist you can use today

  1. List every text you send and label it marketing or informational.
  2. Rewrite your opt-in with the seven disclosure items above, unchecked by default.
  3. Store the consent language, timestamp and source for every number.
  4. Make STOP work across every tool, including the CRM, the scheduler and any automation.
  5. Set sending windows by recipient time zone.
  6. Add state rules for each state you text into.
  7. For clinics, sign a BAA with each texting vendor and keep PHI out of plain SMS.
  8. Have an attorney review the final setup.

Our perspective

Most texting problems we see at small businesses aren't malicious. They're messy. One tool sends reminders, another sends promos, a third answers the phone, and nobody knows which one holds the consent record or which one saw the STOP.

That's why we build this as one connected system, not a pile of apps. When your CRM, scheduler and messaging all share the same consent status and the same suppression list, an opt-out in one place is an opt-out everywhere. You get the speed of automation without the guesswork.

For owner-led businesses and clinics, our approach is hands-on: we set up the capture forms, the follow-up logic and the records, then stay on to keep it running. Your attorney sets the legal rules. We make sure your systems actually follow them.

Brian

Put compliant texting on autopilot

If you'd rather not stitch this together yourself, we build and maintain done-for-you systems for owner-led businesses: appointment scheduling and follow-up that runs on your consent records, and CRM, messaging and nurture automation that keeps opt-outs in sync across every channel. See who we help, including dental, medical and men's health clinics, or start at our services page.

Aiagentworx

FAQ

Are iMessages subject to the TCPA?

No, not when they stay on iMessage. The statute excludes messages sent over an IP-enabled service to another user of the same service, and iMessage is IP-based. If the message goes out as SMS or MMS, for example to an Android phone, the TCPA applies.

Informational texts can generally rely on oral consent rather than written consent, according to the FCC's consumer guidance. Keep a record of how the patient or customer gave their number and agreed to reminders. If a reminder includes promotional content, treat it as marketing.

Is HIPAA the same as TCPA compliance?

No. The TCPA is about consent, opt-outs and sending practices. HIPAA is about protecting health information, including vendor agreements and safeguards like encryption. A clinic texting patients needs to satisfy both.

What happens if someone replies STOP to a reminder?

Stop sending that type of message and send a single confirmation. Under the FCC's recent order, an opt-out to an informational message may apply only to that message type, but an opt-out to a marketing text covers all future marketing texts. Track both separately.

Sources