Mini-TCPA laws: state texting rules in Texas, Florida, Oklahoma

Several states have their own "mini-TCPA" laws that are stricter than the federal TCPA. They add tighter sending hours, daily frequency caps, written-consent rules and, in Texas, a seller registration requirement, and many give consumers their own right to sue. If you searched "TCPA Texas" because a customer asked whether your platform's texts are covered, the short answer is yes: since 2025, Texas law treats marketing text messages as telephone solicitations.

This post explains what the main state laws require in general terms and how to set up sends to stay inside the strictest of them. We use Ready's quiet hours and opt-out handling as the worked example, because we make Ready. This is not legal advice. These statutes have exemptions and amendments that depend on your facts, so have counsel confirm how they apply to your business before you rely on any summary, including this one.

Why state law matters if you already follow the federal TCPA

The federal TCPA sets the baseline. It requires consent for automated marketing texts, limits contact to 8 AM to 9 PM in the recipient's time zone and puts statutory damages at $500 per violation, up to $1,500 if willful. Most teams build to that standard and stop there.

State mini-TCPAs matter for three reasons:

1. They are stricter. Several states end the sending window at 8 PM, and some start it at 9 AM.
2. They cap frequency. The federal TCPA has no "three per day" rule. Florida and Oklahoma do.
3. They create new plaintiffs. Florida's 2021 amendment produced a wave of class actions because it gave consumers a private right of action under a broader autodialer definition than the federal one.

If you are a platform whose customers send on your infrastructure, the exposure multiplies. Your customers text people in every state, and their contacts don't stay in one time zone. A rule you enforce once, at the platform layer, protects every sub-account at the same time.

TCPA Texas rules: registration, hours and SB 140

Texas is the state with the most search interest right now, and the one that catches people off guard.

Texas registration (Chapter 302)

Texas Business & Commerce Code Chapter 302 requires sellers who make telephone solicitations into Texas to register with the Secretary of State. As we read it, that means a registration statement, a filing fee (historically $200) and a security deposit or bond (historically $10,000). The registration has to be kept current.

Texas SB 140 took effect September 1, 2025. It expanded "telephone solicitation" to cover text messages and images, and it made Chapter 302 violations actionable under the Texas Deceptive Trade Practices Act. That gives consumers a private path to sue. Before SB 140, many text marketers assumed Chapter 302 was a voice-call problem. After it, an unregistered seller texting Texans without an exemption is exposed.

Texas exemptions

Chapter 302 has many exemptions, and a lot of businesses fall under one. Commonly cited examples:

• Soliciting current or former customers, where the business has operated under the same name for a period of time
• Businesses with a retail store that has operated in Texas under the same name for at least two years
• Certain licensed or regulated industries, such as some insurance and real estate activity
• Certain nonprofits and publicly traded companies

Whether one of these fits your business is a question for counsel. Don't assume you qualify because you're small or because your texts are "just promos."

Texas hours

Texas Chapter 301 restricts telephone solicitation hours. As commonly read, solicitations are allowed from 9 AM to 9 PM Monday through Saturday, and from noon to 9 PM on Sunday. The Sunday-morning restriction is the one most scheduling tools miss.

Florida and Oklahoma telephone solicitation acts

Florida Telephone Solicitation Act (FTSA)

Florida amended the FTSA in 2021 to cover text messages sent with automated systems. It requires prior express written consent for those messages and gives consumers a private right of action of $500 per violation, up to $1,500 if willful. The other key rules:

• Hours: 8 AM to 8 PM in the recipient's time zone
• Frequency: no more than three commercial telephone sales calls (texts included) to the same person on the same subject within 24 hours
• 2023 amendment: narrowed the autodialer definition and added a safe harbor for texts. Before suing, the recipient has to reply STOP, and the sender then has 15 days to stop messaging.

That safe harbor makes opt-out handling a frontline legal defense, not just good practice. If a STOP reply is honored immediately and everywhere, that path to a lawsuit closes.

Oklahoma Telephone Solicitation Act (OTSA)

Oklahoma's law took effect November 1, 2022, and is closely modeled on the original FTSA. It requires prior express written consent for automated marketing texts, limits contact to 8 AM to 8 PM local time, caps contact at three per 24 hours on the same subject and includes a private right of action of $500 per violation, up to $1,500 if willful. Oklahoma never adopted Florida's 2023 safe-harbor amendment, so plan as if a plaintiff doesn't have to warn you first.

Other state rules on hours, frequency and consent

Florida and Oklahoma set the pattern, and other states have followed. These are worth knowing about, but confirm each one's current text before relying on it:

• Maryland (Stop the Spam Calls Act, effective 2024): 8 AM to 8 PM, three contacts per 24 hours on the same subject, written consent for automated texts
• Connecticut (2023 amendments): solicitations limited to roughly 9 AM to 8 PM, with consent and disclosure rules that cover texts
• Washington: unsolicited commercial texts are restricted under its consumer protection framework, with a private right of action

Several other states have proposed similar bills, and the list grows most legislative sessions.

State rules at a glance

General summary only. Check the current statute and talk to counsel.

How to configure sends to stay inside the strictest rules

The practical answer is to stop thinking state by state. Build one conservative envelope that satisfies the strictest rule in each category, then apply it to every send on every sub-account.

1. Use a conservative sending window

Combining the table above gives you this window: 9 AM to 8 PM recipient-local, Monday through Saturday, and noon to 8 PM on Sunday. Schedule every campaign and drip campaign inside it.

On Ready, quiet hours act as the backstop. Ready holds the federal 8 AM to 9 PM window. Florida and Oklahoma numbers are held to 8 AM to 8 PM, and Connecticut numbers to 9 AM to 8 PM. The Texas and Maryland limits in the table are yours to schedule. Sends that fall outside permitted local hours are held based on the recipient's area and go out once the window opens. In the API, a held text is charged only when it actually sends. Check the window your account's quiet hours enforce against the envelope above, and schedule campaigns inside the envelope regardless. A backstop should catch the occasional mistake, not do your scheduling for you. For timing that also performs well, see best time to send SMS marketing texts. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.

One honest limitation applies here. "Recipient's area" is inferred from the phone number's area code. A contact with a Miami number who moved to Seattle is three hours behind what the area code suggests. Florida's law refers to the called party's time zone, and no system knows where a mobile phone physically is. Sending in mid-morning and early afternoon gives you margin on both ends.

2. Cap frequency in your automation design

The three-per-24-hours rules in Florida, Oklahoma and Maryland apply per person and per subject. The usual way to break them is stacked automation, not a single campaign. Picture a cart reminder, a promo campaign and a drip step all firing on the same day.

Ready doesn't advertise a per-contact daily cap, so design for it yourself:

• Space the steps of any drip campaign at least several hours apart, and never more than three marketing touches on one subject in a day.
• Exclude contacts who are currently in a drip campaign from any one-off campaign on the same topic.
• Treat transactional messages, such as an order confirmation, separately from marketing. Their status under each statute can differ, so confirm with counsel.

Our abandoned cart SMS guide shows timing that stays well under three touches.

3. Make STOP instant and global

Under Florida's safe harbor, the 15-day clock starts at the STOP reply. On Ready, inbound STOP and UNSUBSCRIBE are honored automatically, and the opt-out propagates so the contact can't be messaged again from any campaign. Through the API, a send to an opted-out number is refused up front and not charged. You can read the list with GET /v1/opt-outs or check one number with GET /v1/opt-outs/:phone. If your platform also keeps contacts in its own database, sync from that list so your app never queues a text Ready will refuse.

4. Keep the consent record where it belongs

Mini-TCPAs require prior express written consent, and in a dispute you need to prove it per contact. Ready records the sender's attestation on every bulk send and every API send that sets consent_attested: who sent, to how many and when. That builds an audit trail, but it is not a per-contact consent record. It doesn't store a recipient's opt-in time, the wording they agreed to or the page URL, and a keyword reply doesn't create one either. Your signup form, CRM or store has to keep those records. (A contact who signs up on a Ready-hosted opt-in page is the exception: Ready stores that sign-up, with the time, IP address and exact wording, and support@tryready.com can send you a copy.)

In the API, attestation is the consent_attested field:

POST https://api.tryready.com/v1/messages
X-API-Key: <key>
Idempotency-Key: 3f1c9a2e-7b4d-4e8a-9c1f-2a6b5d8e0f13

{"to": "+12125550199", "body": "Your order #1042 has shipped. Reply STOP to opt out.", "consent_attested": true}

Only set consent_attested to true when your own records back it up. Full field reference: docs.tryready.com/api/messages.

5. Scrub before sending

Mini-TCPA suits are often brought by repeat plaintiffs. Ready's standalone TCPA & DNC Litigator Scrub costs $0.005 per contact and checks each number against known TCPA-litigator and DNC-complainer lists, flagging matches before you send. You can also switch scrubbing on for an account, where it's billed as a $0.003-per-segment surcharge. It's off by default.

Worked example (assumptions stated): a consented list of 10,000 contacts, one 1-segment text each, on the Standard rate.

• Scrub: 10,000 × $0.005 = $50
• Send: 10,000 × 1 × $0.0075 = $75, plus 10,000 × $0.0045 in carrier fees

Compare that $50 against statutory exposure of $500 to $1,500 per text. A single matched litigator number covers the scrub cost several times over. A scrub reduces risk. It doesn't make you lawsuit-proof, and it doesn't replace consent.

What this means if you're a platform

If your customers send through your product, decide where each control lives. Quiet hours, opt-out propagation and scrubbing work best at the infrastructure layer, so no sub-account can switch them off by accident. Consent records and Texas registration stay with each customer, because those are facts about their business. Our posts on who carries liability when a client's list goes bad and what a 10DLC compliance platform should do for you go deeper on that split. Compliance remains the sender's responsibility. A platform can make the safe path the default, but it can't take on the obligation for them.

The practical takeaway

Build to the strictest envelope: 9 AM to 8 PM recipient-local with noon starts on Sunday, no more than three marketing touches per person per subject per day, STOP honored everywhere at once, per-contact consent stored in your own system, and lists scrubbed before sending. Then have counsel check the Texas registration question for your specific business. If you want to see how quiet hours and opt-outs behave on real sends, the first 20 one-to-one texts on a new account are free. The quickstart walks through the first API call.

FAQ

What is a mini-TCPA law?

A state statute that regulates telemarketing calls and texts beyond what the federal TCPA requires. It typically adds narrower sending hours, frequency caps, written-consent requirements and a private right of action. Florida, Oklahoma and Maryland are the best-known examples.

Does TCPA Texas law apply to text messages?

As of September 1, 2025, Texas SB 140 brought text messages within Chapter 302's definition of telephone solicitation and made violations actionable under the DTPA. Sellers who don't qualify for an exemption may need to register with the Texas Secretary of State.

What hours can I send marketing texts?

It depends on the state. A conservative window that satisfies Texas, Florida, Oklahoma, Maryland and Connecticut is 9 AM to 8 PM in the recipient's local time, Monday through Saturday, and noon to 8 PM on Sunday.

Does Ready's quiet hours feature make me compliant with state law?

No single feature makes you compliant. Quiet hours hold sends outside permitted local hours based on the recipient's area, which reduces exposure. You still need consent, frequency discipline, any required state registration and a counsel review. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.

How many texts can I send one person per day?

Florida, Oklahoma and Maryland cap marketing contact at three per 24 hours to the same person on the same subject. Treat three as a ceiling across all your campaigns and drip campaigns combined, not per campaign.