Does the TCPA apply to text messages? Plain-English answers

Yes, the TCPA applies to text messages. The Telephone Consumer Protection Act was written in 1991, years before most people had sent a text, so business owners often assume it only covers phone calls. Courts and the FCC disagree. Under the TCPA, a text message counts as a "call," and the same consent rules, Do Not Call rules and damages apply to it.

This post answers the questions we hear most from businesses that are starting to text customers. It covers what the law reaches, what counts as permission, what a violation costs, and how to set up your texting so you stay on the right side of it. We make Ready, an SMS platform, so we deal with these questions constantly. We are not your lawyer, though. Use this as orientation, and get counsel to review your specific consent flow before you send at scale.

Why a text counts as a "call"

The TCPA restricts calls made with an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice. In 2003 the FCC said this covers text messages. The Supreme Court accepted that reading in Campbell-Ewald Co. v. Gomez (2016). Since then, nobody seriously argues that texts fall outside the statute.

The autodialer question after Facebook v. Duguid

In 2021 the Supreme Court narrowed the ATDS definition in Facebook v. Duguid. The equipment has to use a random or sequential number generator to store or produce numbers. Some businesses concluded that texting from a CRM list is therefore unregulated. That is a risky bet, for three reasons:

• The Do Not Call rules don't depend on an autodialer. Marketing texts to numbers on the National DNC Registry can create liability no matter how they were sent. In 2023 the FCC explicitly confirmed that DNC protections extend to texts.
• State "mini-TCPA" laws in states like Florida and Oklahoma use their own, broader definitions of automated systems. Some also have their own time-of-day rules.
• Carriers enforce consent independently. Even if a lawsuit would fail, carriers can filter or block traffic that lacks opt-in. Read more in our overview of SMS marketing laws and rules.

In practice, the safe operating assumption is simple: treat every business text as covered and get consent first.

What counts as permission

The TCPA has two consent levels. Which one you need depends on what the message says, not on how friendly it sounds.

What "prior express written consent" has to include

For marketing texts, the consent should show:

1. Who is texting. Name the specific business, not "our partners."
2. What kind of messages. Say that marketing texts will be sent, possibly by automated technology.
3. The phone number that is consenting.
4. That consent isn't a condition of purchase.
5. Frequency, "msg & data rates may apply", and how to opt out (reply STOP). Carriers look for these during 10DLC registration.

A checkbox on a web form (unchecked by default) with that language next to it is the common pattern. A number handed over on an invoice, scraped from a website or bought from a list broker is not marketing consent. Our breakdown of prior express written consent vs implied consent goes deeper on the gray areas.

Keep proof, or it didn't happen

In a TCPA dispute, the business has to prove consent. That means storing, per contact, the timestamp, the exact wording shown, the page URL or form, and the IP address or other source. Your website, CRM or form tool is where that record should live. We cover the fields in how to document SMS consent so it holds up.

What a violation costs

The statute sets damages at $500 per violating text. A court can raise that to $1,500 per text if the violation was willful or knowing. Those amounts are per message, not per campaign. Here is a worked example with simple assumptions:

• A list of 2,000 contacts, of which 5% (100 people) never actually consented
• 3 promotional texts sent over a month
• 100 × 3 = 300 violating texts
• 300 × $500 = $150,000 at the statutory minimum, or up to $450,000 if found willful

That math is why TCPA class actions are a business model for some plaintiffs' firms. It is also why a small slice of bad numbers on a list matters more than the overall percentage suggests.

How to text people lawfully: the practical checklist

None of this makes texting risky if you set it up properly. Here is the operating list we recommend:

1. Text only consented or replied contacts. Use phone and mail for cold outreach. SMS is for people who opted in or who started the conversation.
2. Match consent to content. If someone opted in for appointment reminders, don't start sending promos to them without marketing consent.
3. Honor STOP immediately and everywhere. An opt-out has to stop all future texts across every campaign, not just the one they replied to. The FCC has also made clear that people can revoke consent by any reasonable means, not only by typing a keyword.
4. Respect quiet hours. The federal TCPA window for telemarketing is 8 AM to 9 PM in the recipient's local time, and some states are stricter.
5. Scrub before you send. Check marketing lists against the National DNC Registry and known TCPA-litigator numbers.
6. Watch for reassigned numbers. Consent belongs to the person, not the phone number. When a number changes hands, your consent doesn't transfer. The FCC's Reassigned Numbers Database exists for exactly this.
7. Register your traffic. A2P 10DLC registration isn't a legal requirement under the TCPA, but carriers filter unregistered business texts, and registration forces you to write down your opt-in flow.

Where the tooling helps (and where it doesn't)

Software can enforce much of that checklist automatically. It can't create consent you never collected. Here is what Ready does on the compliance side:

• Automatic STOP handling. Inbound STOP and UNSUBSCRIBE are honored, and the opt-out propagates so the contact can't be texted again from any campaign. On the API, opted-out numbers are refused up front and not charged.
• Quiet-hours enforcement. Sends outside permitted local hours, based on the recipient's area, are held and sent later. They are charged only when they actually go out. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.
• Litigator and DNC scrubbing. You can run a standalone scrub at $0.005 per contact. It checks each number against known TCPA-litigator and DNC-complainer lists and flags matches. Scrubbing a 2,000-contact list costs 2,000 × $0.005 = $10, which is 2% of the $500 minimum for a single violating text. You can also switch scrubbing on for every send, which adds $0.003 per segment. It is off by default. There is a GET /v1/scrub/:phone endpoint if you scrub from your own code. More in TCPA litigator scrubbing explained.
• Send-level attestation. Every campaign you send and every API send that attests consent records who sent it, to how many people and when. On the API, the consent_attested field is your promise that recipients agreed to texts (messages docs). This creates an audit trail of sends. It is not a per-contact consent record: it doesn't store when or where each person opted in. Your form or CRM still has to keep that. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)
• In-app 10DLC registration. Registration costs $25/mo, and most approvals take 2 to 7 days.

Messaging itself is billed at the Standard rate of $0.0075 per segment plus a $0.0045 carrier fee. That all-in figure excludes the optional compliance surcharges above.

Treat all of this as risk reduction, not immunity. A platform can stop a text to someone who replied STOP. It can't know that a lead vendor fabricated an opt-in. Compliance stays the sender's responsibility.

Quick answers to the common follow-ups

Does the TCPA apply to B2B texts? Generally yes, especially to mobile numbers. The statute protects the phone, not just consumers.

Is a one-to-one text from my personal phone covered? Manually typed texts are less likely to involve an autodialer. DNC rules can still apply to marketing, though, and carriers still expect business texting to run on registered numbers.

Can I text someone who filled out a contact form? For a reply to their inquiry, usually yes. For ongoing marketing, only if the form carried proper written-consent language.

How long does consent last? It lasts until they revoke it. Very old consent is harder to defend, though, and stale lists are where reassigned numbers pile up.

The practical takeaway

The TCPA covers texts. Marketing texts need written consent that you can prove, and every text needs fast opt-out handling and respect for local hours. Get the consent wording and record-keeping right at the source, and use your platform to enforce STOP, quiet hours and scrubbing so human error doesn't turn into per-text damages. Have a lawyer review your opt-in flow once. It is cheap compared with the alternative.

If you want to see how those guardrails work in practice, you can sign up and use your first 20 free one-to-one texts before you register.