SMS marketing laws and rules: a plain-English overview for US businesses

Texting customers in the US is governed by several separate sets of rules. They come from different authorities and carry different penalties. Federal law can cost you $500 to $1,500 per text. Carrier rules can get your messages filtered before anyone reads them. State laws add their own time windows and frequency caps. Most businesses get into trouble because they handle one layer well and assume it covers the others.

This post maps each layer, says what it actually asks of you, and points to deeper guides for each one. It is not legal advice. If your texting program is large or unusual, an hour with a TCPA attorney costs far less than one demand letter. The basics below cover most of what an owner needs to know before the first send.

The four layers at a glance

The first three are law. The fourth is a contract you accept by using carrier networks. Carriers cannot sue you, but they can stop your messages, which for a business that depends on texting is often the more immediate threat.

The TCPA: consent is the whole game

The Telephone Consumer Protection Act dates from 1991, and courts have long treated texts as calls under it. In practice it comes down to one question: did this person agree to receive this kind of message from you?

Marketing vs informational texts

The level of consent you need depends on what you send:

• Marketing texts (promotions, sales, "come back and buy"): the safe standard is prior express written consent. That means a clear, signed agreement (an online checkbox or keyword opt-in counts under the E-SIGN Act) naming your business and saying the person agrees to receive marketing texts. Consent cannot be a condition of purchase.
• Informational texts (appointment reminders, order updates, account alerts): prior express consent is generally enough. Someone giving you their number for that purpose usually covers it.

The Supreme Court's 2021 Facebook v. Duguid decision narrowed what counts as an "autodialer" under federal law. Some people read that as "consent doesn't matter for texts anymore." That reading is wrong for two reasons. Several states rewrote their own laws in response, and carriers require documented opt-in no matter what federal courts say. Our guide on prior express written consent vs implied consent covers where the line sits.

One more recent change: the FCC's 2023 "one-to-one consent" rule would have required consent to name a single seller, which would have ended shared lead-form consent. A federal appeals court struck it down in early 2025, before it took effect. Naming your business specifically in the opt-in language is still good practice.

Opt-outs under the TCPA

The FCC's revocation rules say a person can withdraw consent by any reasonable means. That includes "stop", "cancel", "unsubscribe", "quit", or a plain "please stop texting me". You have to honor it within 10 business days. In practice, honor it immediately. A single confirmation text acknowledging the opt-out is allowed. A follow-up trying to win them back is not.

The Do Not Call Registry is not the same as an opt-out list

The National DNC Registry bars telephone solicitations to registered numbers, and courts have applied it to marketing texts. There are two main exceptions: the person gave you express consent, or you have an established business relationship (generally a purchase within 18 months, or an inquiry within 3 months).

Three different lists get confused here:

1. The national DNC registry: people who don't want solicitations from anyone.
2. Your internal opt-out list: people who told you to stop.
3. Known TCPA litigator lists: numbers tied to people who file TCPA suits often.

Scrubbing against one does nothing for the other two. We cover this in detail in the three separate lists compliance teams confuse.

State laws: stricter than federal in the places that matter

A growing number of states have their own telemarketing laws, often called "mini-TCPAs." The specifics change, so check your states with counsel. The common patterns are:

• Broader autodialer definitions. Florida's FTSA and Oklahoma's OTSA were written after Duguid and cover automated systems the federal definition no longer reaches.
• Narrower hours. Florida limits solicitation texts to 8 AM to 8 PM in the recipient's time zone, one hour earlier than the federal 9 PM cutoff.
• Frequency caps. Florida caps solicitations at three per 24 hours on the same subject to the same person.
• Private lawsuits. Most of these laws let individuals sue directly, which is why they produce so many claims.

The practical approach: build to the strictest state your contacts live in, rather than tracking state by state. A program that obtains written consent, sends between 9 AM and 8 PM local time, and doesn't send more than a couple of promos a day stays within most of these laws.

Carrier rules: 10DLC registration and what carriers check

This layer isn't legislation, but it decides whether your texts arrive. Business texting from a regular 10-digit number runs over A2P 10DLC. Carriers require you to register your brand (the business) and a campaign (what you send and why). Unregistered traffic gets filtered. If you're new to this, start with what 10DLC is.

When reviewers look at a campaign, they check:

• An opt-in path they can see: a web form, keyword or checkout box with disclosure language naming your business, message frequency, "msg & data rates may apply", and STOP/HELP instructions.
• Sample messages that match your use case. If you register as reminders and then send promos, you're exposed.
• Content limits. Sex, hate, alcohol, firearms and tobacco (cannabis is usually included too, the "SHAFT" categories) are restricted or banned on most routes.
• A privacy policy stating you don't share mobile numbers or opt-in data with third parties for marketing.

Our post on 10DLC rules and requirements goes through each check. On Ready, registration runs in the app. The charge at submit is the first month, $25, and the monthly cost is $25/mo for registration plus $2 per number. Most approvals take 2 to 7 days.

Quiet hours: the rule that depends on where the recipient is

Federal rules bar telephone solicitations before 8 AM or after 9 PM in the recipient's local time. Some states narrow that window (see Florida above). The trap is time zones. A campaign scheduled for 9 AM Eastern arrives at 6 AM in California, and the recipient's time is what counts, not yours.

Ready holds sends that fall outside permitted local hours, based on the recipient's area, and releases them when the window opens. Through the API, a held text is charged only when it actually sends. This lowers your risk, but your own scheduling still matters. Send marketing messages in the late morning or afternoon and you rarely come close to the edges. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.

Record keeping: what to keep, and for how long

If a TCPA claim arrives, you defend it with records. The federal statute of limitations for TCPA claims is generally four years, so keep consent records at least that long. For each contact you need:

• The exact opt-in wording they saw
• The date and time they opted in
• The source (page URL, form, keyword, paper form)
• The IP address or phone number they used, where available
• Their opt-out date, if any, and when you honored it

Your store, CRM or form tool is where per-contact consent lives. Ready records the sender's attestation for each bulk send and each API send that sets consent_attested: who sent it, to how many, and when. Through the API, that's the consent_attested field on POST /v1/messages. It gives you an audit trail of what you promised at send time, but it is not a per-contact consent record and doesn't replace one. A keyword reply alone doesn't create a consent record either. Our guide on documenting SMS consent shows what a defensible record looks like.

What a platform can handle, and what stays with you

A good platform removes the mechanical failure points. On Ready:

• STOP and opt-out handling is automatic, and an opt-out propagates so the contact can't be texted again from any campaign. Opt-outs are refused up front and not charged.
• Quiet-hours holds run on the recipient's local time.
• Litigator and DNC scrubbing screens known TCPA-litigator and DNC-complainer numbers before send. It's off by default. Turned on for sending, it adds $0.003 per segment. The standalone scrub is $0.005 per contact.
• Registration is handled in-app, so you aren't sending on unregistered routes.

Some things stay with you no matter what tool you use. You have to collect consent honestly, word your opt-in correctly, send what you registered to send, and keep your own consent records. Texting goes to people who opted in or replied to you. Cold outreach belongs to phone and mail, where the rules differ. Compliance is ultimately the sender's responsibility, and no platform makes you lawsuit-proof.

The short version

If you remember five things:

1. Get written consent for marketing texts, naming your business.
2. Honor every opt-out, however it's worded, right away.
3. Register your brand and campaign, and send only what you registered.
4. Send between 9 AM and 8 PM in the recipient's time zone.
5. Keep consent records for at least four years.

If you want the mechanical parts (opt-outs, quiet hours, scrubbing, registration) handled for you, you can sign up for Ready. Your first 20 one-to-one texts are free, so use them before you register. The consent wording on your forms is still your job, and the linked guides above are the best place to start.