Prior express written consent vs implied consent for texting

Marketing texts need prior express written consent: a signed (electronic counts) agreement that names your business, covers the phone number, and says consent isn't a condition of purchase. Implied consent, such as a past purchase, a business card or a number written on a form for some other reason, may support a related informational text, but it does not cover marketing. That is the short version of prior express written consent vs implied consent, and most texting lawsuits start with someone getting it wrong.

This post covers the consent levels that matter under the Telephone Consumer Protection Act (TCPA), what a valid written consent disclosure contains, how to keep proof that will hold up, and how revocation works now that the rules have changed. We make Ready, a texting platform and API, so we'll also say exactly what our software records and what it doesn't. This is general information and not legal advice. You are responsible for your own compliance, and if your program is large or unusual, have a TCPA lawyer look at it.

The three consent levels, and which messages need which

The TCPA and the FCC rules under it sort business messages by what they say, not by how friendly the sender is. In practice there are three consent levels to know.

Prior express written consent (PEWC). The highest bar. It applies to telemarketing and advertising messages: promos, sales, "come back and save 20%", new-product announcements, upsells. It has to be in writing, signed (an e-signature, checkbox or keyword reply that meets the E-SIGN Act can count), and it has to include specific disclosures, covered below.

Prior express consent. A lower bar that applies to informational messages: appointment reminders, shipping updates, fraud alerts, account notices. The FCC has long treated someone giving you their number as part of a transaction as consent to related informational messages about that transaction. It doesn't need to be written, though having it in writing is still smarter.

Implied consent. What people mean when they say "they're a customer, so it's fine." A past purchase, a business card dropped in a fishbowl, a number on an invoice, someone who called you once. None of these is written consent to marketing texts. At best they support narrow informational contact about the thing the person actually gave you the number for.

Why "established business relationship" doesn't save you

There is an established business relationship (EBR) exemption in the TCPA, and people stretch it. It applies to Do Not Call rules for live telemarketing calls. It does not turn a past purchase into written consent for marketing texts. If your plan for a promo campaign is "they bought from us last year," you are relying on implied consent for a message type that needs written consent.

Prior express written consent vs implied consent: where the line actually falls

The same contact can be fine to text one message and not fine to text the next. A few examples, labelled as illustrations:

• Example: a dental office. A patient books online and enters a mobile number. Texting "Your cleaning is Tuesday at 9 AM, reply C to confirm" is informational and tied to why the number was given. Texting "Teeth whitening is 30% off this month" is marketing and needs written consent the booking form probably didn't collect.
• Example: an ecommerce store. A shopper checks out and enters a phone number for delivery updates. Shipping notifications are informational. A "you left something in your cart" text is marketing in most readings, and needs the checkbox with disclosure at checkout, not just a phone field.
• Example: a trade show. A rep collects 200 business cards. Those cards are implied consent at best, for nothing that involves marketing texts. The right channel for that list is a phone call or mail, and texting starts only once someone opts in.

The mixed-message trap

An appointment reminder with a promo stapled to the bottom ("See you Tuesday! Also, ask about whitening") is a marketing message. Regulators and plaintiffs' lawyers look at the content as a whole. If a message would need written consent on its own, adding it to a reminder doesn't lower the bar. It just turns the reminder into a marketing text.

Carriers ask for consent regardless of the legal fine print

The legal analysis gets technical. The 2021 Supreme Court decision in Facebook v. Duguid narrowed what counts as an autodialer, and some senders read that as permission to relax. Two problems with that. State laws such as Florida's and Oklahoma's mini-TCPAs reach further than the federal definition. And the carriers don't care about the autodialer debate: 10DLC campaign registration requires you to describe how you collect opt-in, and carriers expect consent for every business text. Messages without it get filtered, and complaints can get a campaign suspended. Our post on the opt-in wording that clears 10DLC registration covers what reviewers look for.

What a valid written consent disclosure contains

Under 47 CFR 64.1200(f)(9), written consent has to show the person agreed to receive marketing messages from you at a specific number, and the disclosure has to be clear and conspicuous. Adding the carrier-side expectations, a solid disclosure includes:

1. Your business name. The specific seller, not "our partners" or "affiliates."
2. What they're agreeing to. Recurring automated marketing texts, stated plainly.
3. The phone number. The number the person enters on the form, tied to the consent.
4. "Consent is not a condition of purchase." Required for PEWC. Missing this line is one of the most common defects.
5. Message frequency. "Up to 4 msgs/month" or "Msg frequency varies."
6. "Msg & data rates may apply."
7. How to opt out and get help. "Reply STOP to opt out, HELP for help."
8. Links to your terms and privacy policy.
9. An affirmative action. An unchecked checkbox the person ticks, a signature, or a keyword they text in. A pre-checked box is not affirmative.

An example disclosure next to an unchecked checkbox:

I agree to receive recurring automated marketing texts from Brightside Dental at the number provided. Consent is not a condition of purchase. Msg frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. Terms: [link] Privacy: [link]

Keep the marketing consent separate from any terms-of-service acceptance. Burying it in a "by clicking Submit you agree to our Terms" line weakens it.

A note on "one-to-one" consent

In 2023 the FCC adopted a rule requiring consent to name a single seller, aimed at lead generators who collected one checkbox for dozens of companies. A federal appeals court vacated that rule in January 2025, before it took effect. Even so, a disclosure that names one business is the safer design, and it's what carrier reviewers expect anyway. If you buy leads, check the current status with your lawyer, because this area keeps moving.

Keeping proof: whose job it is

Whether you obtained consent comes down to whether you can prove it, and the burden is on the sender. A good consent record for each contact holds:

• The phone number
• Timestamp of the opt-in
• The exact disclosure text the person saw (versioned, since your wording will change)
• Where it happened: page URL, form ID, keyword and short code or number, or a paper form scan
• IP address or device data for web opt-ins
• The confirmation text you sent back

Your business keeps that record, in your CRM, your form tool or your own database. Our guide on how to document SMS consent so it holds up goes field by field.

What Ready records, and what it doesn't

On Ready, every bulk send and every API send that sets consent_attested records the sender's consent attestation: who sent, to how many contacts, and when. An API send without the field still goes out and records none. Through the API, that's the consent_attested field on POST /v1/messages and POST /v1/messages/bulk (docs), which is your statement that the recipients agreed to receive texts. That builds an audit trail of what your team claimed at send time.

It is not a per-contact consent record. Ready does not store a recipient's opt-in time, the disclosure wording, or the page URL, and a keyword reply that comes in through Ready does not create a consent record on its own. Your store, form or CRM keeps that. The one exception is a contact who signs up on a Ready-hosted opt-in page: Ready stores that sign-up (time, IP address and exact wording), and support@tryready.com can send you a copy. If you run a platform that sends on behalf of your own customers, the same split applies one layer down: each sub-account's business owns its consent records, and your product should make it easy for them to capture and export them.

Revocation: how consent ends

Consent is revocable at any time, and the FCC's 2024 order made the revocation rules stricter for senders.

• Any reasonable means counts. "STOP" is the classic keyword, but the FCC treats replies like "quit," "end," "revoke," "opt out," "cancel" and "unsubscribe" as revocation, and a plain-language "please stop texting me" can count too. See the opt-out variants carriers don't catch for how to handle the odd ones.
• Honor it quickly. The rule that took effect in April 2025 gives senders no more than 10 business days to process a revocation. Faster is better. A text sent on day 9 still annoys the person and invites a complaint.
• One confirmation text, no marketing. You can send a single reply confirming the opt-out. It shouldn't try to win them back.
• Scope is still settling. Part of the 2024 order would make a revocation apply to all of a sender's unrelated robocalls and texts, not just the message type the person replied to. Its effective date has been pushed back. Check the current status before relying on a narrow reading.

On Ready, STOP, UNSUBSCRIBE and the other standard keywords (QUIT, END, REVOKE, CANCEL, OPT OUT) are honored automatically, and so are plain requests like "please stop texting me" or "remove me." The opt-out propagates so the contact can't be messaged again across campaigns. Sends to opted-out numbers are refused up front and not charged. You can read the list through GET /v1/opt-outs. A revocation worded some other way still needs a person to catch it, so read the inbox.

Consent is necessary, not sufficient

Consent is the foundation, but a fully consented list can still create exposure. A few other habits reduce risk:

• Quiet hours. Federal rules limit telemarketing to 8 AM to 9 PM in the recipient's local time, and some states are tighter. Ready holds sends outside permitted local hours based on the recipient's area and charges only when the message actually goes out. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.
• Litigator and DNC scrubbing. Numbers get reassigned, and some people deliberately collect TCPA claims. Ready's standalone TCPA and DNC litigator scrub is $0.005 per contact. When scrubbing is switched on for an account, it adds a $0.003 per-segment compliance surcharge. It's off by default. More on why in TCPA litigator scrubbing explained.
• Message content matching the consent. If someone opted into order updates, keep promos out of those texts.

Statutory damages run $500 per text, and up to $1,500 if the violation is willful, so a campaign to a few thousand contacts without proper consent can produce a very large number. None of these tools makes you immune. They cut down the most common ways senders get into trouble.

The practical takeaway

Sort every message you send into marketing or informational. Marketing needs prior express written consent, with the disclosure elements above, collected through an affirmative action you can prove. Informational messages need prior express consent tied to why the person gave you the number. Implied consent from a past purchase or a business card covers no marketing at all. Keep the per-contact record in your own systems, honor revocation in any reasonable form, and get a lawyer's eyes on anything you're unsure about.

If you want STOP handling, quiet hours and send-level attestation handled for you, you can create a Ready account. The first 20 texts are free one-to-one sends, and after that Standard pricing is $0.0075/segment plus a $0.0045 carrier fee. To send, you add a card and get a number, which is $2 a month with the first month charged when you get it.

Frequently asked questions

Do I need written consent to send marketing texts?

Yes. Marketing and promotional texts need prior express written consent under the TCPA, and carriers expect documented opt-in for them during 10DLC registration. An e-signature, a ticked checkbox with the right disclosure, or a keyword opt-in can all count as "written."

Is a past purchase enough consent to text a customer?

Not for marketing. A past purchase is implied consent at most, and it doesn't meet the written consent standard for promotional texts. It can support informational texts related to that purchase, such as shipping updates.

What's the difference between prior express consent and prior express written consent?

Prior express consent covers informational messages and can come from someone giving you their number for a related purpose. Prior express written consent covers marketing and requires a signed agreement with specific disclosures, including that consent isn't a condition of purchase. The message content decides which one you need.

How long do I have to stop texting someone who opts out?

Under the FCC's current rule, no more than 10 business days from the request. Faster is safer, and automated STOP handling processes keyword opt-outs immediately. You can send one non-marketing confirmation text.

Does my texting platform store proof of consent for me?

Usually not in the form you need, so check. Ready records the sender's attestation for each bulk send and each API send that sets consent_attested (who sent, to how many, when), but not a per-contact opt-in record, except for contacts who sign up on a Ready-hosted opt-in page. The opt-in time, disclosure wording and source belong in your own form tool, store or CRM.

How does prior express written consent differ from implied consent?

Prior express written consent is a signed, documented agreement that names the number and the kind of texts, and marketing texts need it. Implied consent is inferred from conduct, such as giving your number when you ask a question, and it only stretches to messages tied to that request. When in doubt, get the written kind and keep the proof.