TCPA rules for texting: consent, quiet hours and cold texts explained

The Telephone Consumer Protection Act was passed in 1991, before most people had ever sent a text message. It still decides whether a single promotional text costs you two cents or $1,500. The statute is short, but the FCC orders, court rulings and state copycat laws layered on top of it are not, and most of the "TCPA guides" out there either bury the rules under legal citations or reduce them to "get consent" and stop there.

This post covers what the TCPA requires for text messages in plain terms: which kind of consent you need for which kind of text, when you can send, how opt-outs work now, why cold texting is a bad bet, and what the penalties look like in real dollars. We make Ready, a texting platform with compliance controls built in, so we will also say where those controls help and where they don't. One caveat applies to the whole post: this is a practical overview, not legal advice. If your business model depends on a gray area, pay a TCPA attorney for an hour.

What the TCPA covers when you text

The FCC has treated text messages as "calls" under the TCPA since 2003, and the Supreme Court accepted that reading in 2016. Anything the law says about calls to cell phones generally applies to texts. If you want the longer version of that history, we covered it in does the TCPA apply to text messages.

The TCPA governs four things that matter for texting:

1. Consent. Whether you had permission to text that number, and what kind of permission.
2. Timing. Telemarketing texts are restricted to certain hours in the recipient's local time.
3. Do Not Call. Numbers on the National DNC Registry can't receive marketing texts unless you have consent or an established business relationship.
4. Opt-outs. Once someone revokes consent, you have to stop.

Two things sit outside the TCPA but affect you almost as much. State "mini-TCPA" laws in Florida, Oklahoma, Maryland and elsewhere add stricter hours, broader definitions of automated systems and their own private lawsuits. Carrier rules (A2P 10DLC registration, CTIA guidelines) aren't law at all, but a carrier can filter or block your traffic for breaking them, which in practice is its own penalty.

A note on the 2021 Facebook v. Duguid decision: the Supreme Court narrowed the federal definition of an "autodialer," and some people read that as a license to text anyone from a platform. Don't. The Do Not Call rules, quiet hours and state laws apply regardless of autodialer status, several states rewrote their own definitions afterward, and carriers still expect consent for every A2P message.

Consent: which kind you need for which text

Consent is the TCPA question that matters most, and it comes in levels. The level you need depends on what the message is for.

Prior express consent

This is the lower bar. If a customer gives you their cell number in connection with a transaction, such as booking an appointment or placing an order, courts and the FCC have generally treated that as consent to receive informational texts about that transaction. It does not cover marketing.

Prior express written consent

Marketing texts need a clear, signed agreement. "Signed" includes electronic signatures under the E-SIGN Act, so a checkbox on a web form works if the form does the job. A compliant opt-in generally:

• Names your business as the sender
• Says the person agrees to receive marketing texts at the number provided
• States that consent is not a condition of purchase
• Mentions message frequency, that message and data rates may apply, and how to opt out (reply STOP)
• Uses a checkbox that is not pre-checked

The FCC's 2023 "one-to-one consent" rule, which would have required a separate consent for every individual seller on lead-generation forms, was struck down by the Eleventh Circuit in January 2025. That doesn't make bundled lead forms safe. A consent that lists 40 "marketing partners" in a hyperlink is still weak evidence in court. We compared the two consent standards in more depth in prior express written consent vs implied consent.

Proving it

Consent you can't prove is consent you don't have. Keep, per contact: the timestamp, the exact wording the person agreed to, the page URL or form where they agreed, and their IP address or another identifier. That record lives in your website, store or CRM. Our guide on how to document SMS consent covers what holds up.

Quiet hours: 8 AM to 9 PM, sometimes less

Federal rules bar telemarketing calls, and by extension marketing texts, before 8 AM or after 9 PM in the recipient's local time. Your time zone doesn't matter. A campaign scheduled for 8:30 AM Eastern lands at 5:30 AM in California.

Several states are stricter. Florida and Oklahoma both cut the evening window to 8 PM and cap how many messages you can send a person in 24 hours on the same subject. Other states have their own variations, including restrictions on Sundays and holidays. The full state-by-state picture is in TCPA calling hours by state.

The practical problem is that the area code doesn't always match where the person lives. Someone with a 212 number who moved to Phoenix gets your "10 AM Eastern" text at 7 AM. The conservative play is to send marketing texts in the overlap window, roughly 11 AM to 8 PM Eastern, which keeps most of the continental US inside the stricter state windows.

Opt-outs: what changed in 2025

Opting out used to mean replying STOP. Since April 2025, FCC rules say a person can revoke consent by any reasonable means. That includes:

• STOP, QUIT, END, CANCEL, UNSUBSCRIBE, REVOKE, OPT OUT
• Plain-language replies like "please stop texting me" or "take me off your list"
• Requests by email, phone or in person

You must honor a revocation within 10 business days. You may send one confirmation text afterward (within five minutes of the request) that confirms the opt-out. That confirmation can't include marketing. If someone texts "no more promos" and you keep sending, each later message is a potential violation.

The automated handling catches STOP and clear phrases like "stop messaging me." The harder part is an unusual reply, or a spoken request to a front-desk employee that never makes it into the system. Someone on your team needs to own that.

Cold texting: the short answer is don't

Cold texting means sending a text to someone who never gave you their number for that purpose: a purchased list, a scraped directory, a "skip traced" property owner. People ask whether it's legal, and the honest answer is that it's the riskiest thing you can do with a phone number:

• Marketing texts without written consent are what TCPA class actions are built on.
• DNC-listed numbers add a second, separate violation for each text.
• State laws like Florida's make cold texts easier to sue over, not harder.
• Carriers filter unsolicited traffic and can suspend the registration that every text on your account depends on.
• B2B doesn't save you. If the number is a cell phone, the TCPA protects it, even if the owner uses it for work.

Our stance at Ready is simple. Cold outreach happens by phone (manually dialed, scrubbed against the DNC) and by mail. SMS goes to people who opted in or who replied to you first. Once a lead texts you back or fills in a compliant opt-in form, texting is the fastest channel you have. Before that point, it's the most expensive one. If you buy leads, call them (manually dialed and DNC-scrubbed) or mail them. Ready's Acceptable Use Policy does not allow texting purchased numbers, so text a bought lead only after they opt in to you directly.

Penalties: why the per-text math gets scary

The TCPA lets individuals sue for $500 per violation, which goes up to $1,500 per violation if a court finds the violation willful or knowing. There's no cap. Each text is a separate violation, and a text that both lacks consent and goes to a DNC-listed number can count twice.

A worked example

Assumptions: a 5,000-contact promotional campaign, one segment per message (under 160 plain characters, no emoji), sent on Ready Standard at $0.0075 per segment plus a $0.0045 carrier fee per segment.

• Sending cost: 5,000 × $0.0075 = $38, plus 5,000 × $0.0045 in carrier fees.
• Scrubbing cost: with litigator/DNC scrubbing switched on for the account, add $0.003 per segment: 5,000 × $0.003 = $15.
• Exposure if 1% of the list never consented: 50 texts × $500 = $25,000 at the statutory minimum, or $75,000 if found willful.

If that campaign runs weekly for a month, the same 50 people produce 200 violations: $100,000 to $300,000. That's before attorney's fees, and TCPA suits are often filed as class actions, where the plaintiff's lawyer goes looking for everyone else on your list who was in the same position.

The $25 doesn't fix a consent problem. It removes the known serial plaintiffs and DNC complainants, who are the most likely people to turn a mistake into a lawsuit. If you're unclear on why a DNC scrub and a litigator scrub are different checks, see the three lists compliance teams confuse.

Where Ready helps, and where it doesn't

Compliance is the sender's responsibility, whatever platform you use. A tool can lower your risk. It can't give you consent you never collected. Here is what Ready does:

• Automatic STOP handling. Inbound STOP and UNSUBSCRIBE replies are honored, and the opt-out applies across every campaign on the account. Texts to opted-out or numbers on your Ban list are refused before sending and aren't charged.
• Quiet-hours enforcement. A text sent outside the permitted window for the recipient's area is held and sent later, and it's charged only when it actually sends. Campaigns, drip campaigns and automations wait up to 24 hours for the window; a one-to-one or API text is held only if the window opens within 6 hours, otherwise it is refused and must be resent; a one-to-one reply to someone who texted you in the last 24 hours goes out at any hour.
• Litigator and DNC scrubbing. Known TCPA litigators and DNC complainants are screened out before sending. Switched on for an account, it adds $0.003 per segment. It's off by default. You can also run a standalone scrub on a list for $0.005 per contact, paying only for what you check.
• Landline validation. Also off by default and $0.003 per segment when switched on. Known landlines are refused, so you stop paying for texts that can't land.
• Send attestation. Every campaign you send and every API send that attests consent records who sent it, to how many people and when. API sends carry a consent_attested field, which is your promise that the recipients agreed (see the messages API docs). That's an audit trail of your sends, not a per-contact consent record. The opt-in timestamp, wording and page URL still belong in your store or CRM.
• 10DLC registration in-app. The charge at submit is the first month, $25 ($25/mo for registration, plus $2 per number monthly), and most approvals take 2 to 7 days.

Here's what Ready doesn't do: catch a "stop texting me" that arrived by email, or decide whether your opt-in form is good enough. Those are judgment calls for you and your counsel. (Purchased lists are not textable on Ready at all.)

A short TCPA texting checklist

1. Use written, unchecked-box consent for anything promotional, and store the record per contact.
2. Keep informational and marketing consent separate in your data.
3. Send marketing between roughly 11 AM and 8 PM Eastern unless you segment by time zone.
4. Honor every form of opt-out within 10 business days, not just keywords.
5. Scrub against litigator and DNC lists before campaigns, and re-scrub lists you haven't touched in months.
6. Don't cold text. Call (manually, DNC-scrubbed) or mail first, and text once someone opts in or replies.
7. Register for 10DLC before you scale past test sends.

None of this is exotic. Most TCPA lawsuits come from skipping one boring step on that list, not from obscure legal theory. If you want to see how the compliance controls behave on a real account, sign up and use your first 20 free one-to-one texts to test opt-out handling and quiet hours before you send a campaign.