What is TCPA compliance? The rules for business calls and texts
13 min readRules read 2026-10-22
For the owner or ops lead of a business that texts or calls customers: what the Telephone Consumer Protection Act asks of you, which consent each message needs, and which parts of the rule moved in 2025 and 2026. Every figure comes from the statute, the FCC's rule or a court opinion read on 2026-10-22.
The short answer
TCPA compliance means running your calls and texts so that each one has the consent the law asks for, reaches nobody who opted out or sits on a Do Not Call list, goes out at a lawful hour, and leaves a record that proves all of it. The Telephone Consumer Protection Act (47 U.S.C. § 227) sets the frame; the FCC's rule at 47 CFR § 64.1200 fills in the detail. Six lines carry most of it.
What the TCPA covers and who it binds
The Telephone Consumer Protection Act of 1991 restricts abusive telemarketing: autodialed and prerecorded calls, junk faxes and calls to people who asked not to be called. It binds “any person within the United States, or any person outside the United States if the recipient is within the United States”, so a vendor overseas sending your texts is inside it. The statute has four working parts.
| Part of the law | What it reaches | What it asks for |
|---|---|---|
| § 227(b)(1)(A) | Calls and texts by an autodialer or an artificial or prerecorded voice to cell phones, emergency lines and hospital rooms | Prior express consent; written consent for marketing (FCC rule) |
| § 227(b)(1)(B) | Artificial or prerecorded voice calls to home landlines | Prior express consent, with exemptions the FCC sets |
| § 227(b)(1)(C) | Unsolicited advertisements by fax | An established business relationship and an opt-out notice |
| § 227(c) | Telephone solicitations to residential subscribers: the national Do Not Call registry, calling hours, internal lists | No call to a registered number without permission or a business relationship |
Texts count as calls. In Facebook v. Duguid the Supreme Court noted that neither side disputed the ban reaches unsolicited text messages, and the FCC's rule applies its Do Not Call sections to calls and texts sent to wireless numbers (§ 64.1200(e)). The same case narrowed what an autodialer is:
“To qualify as an ‘automatic telephone dialing system’ under the TCPA, a device must have the capacity either to store a telephone number using a random or sequential number generator, or to produce a telephone number using a random or sequential number generator.”
That ruling shrank the autodialer half of the law, but not the rest: prerecorded and artificial voices, the Do Not Call rules and calling hours apply whatever dials the number. Our autodialer guide walks through what still counts.
The consent tiers
Consent under the TCPA comes in two strengths, and which one you need depends on how the message is sent and what it is for. A hand-dialled call or a text typed one at a time needs neither, though the Do Not Call rules below still apply to sales calls. Anything sent by an autodialer or spoken by a prerecorded or artificial voice needs one of these.
Prior express consent
The person agreed to receive the call or text, out loud or in writing. It covers informational messages to a cell phone: appointment reminders, delivery alerts, fraud warnings, account updates. Nothing in the message may sell.
Prior express written consent
Marketing by autodialer or recorded voice needs the written kind. The rule defines it at § 64.1200(f)(9):
“an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and the telephone number to which the signatory authorizes such advertisements or telemarketing messages to be delivered”
The form must also say, clearly and conspicuously, that signing authorises those calls and that the person is not required to sign as a condition of buying anything. An electronic signature counts where federal or state law recognises it, which is how a web form can carry written consent. The written-consent guide takes each element apart, and the consent form builder drafts the disclosure.
Which consent does this need?
Federal tier
Prior express written consent
Marketing texts sent by a platform to a cell phone are treated as autodialed: get a signed agreement (an electronic signature counts where federal or state law recognises it) naming the number and saying consent is not a condition of purchase. Whether a given platform is an autodialer after Facebook v. Duguid is argued case by case, and 10DLC carriers ask for opt-in on every campaign anyway.
47 CFR § 64.1200(a)(2)
Opt-outs and revocation
Consent can be withdrawn at any time, and since 2025-04-11 the rule says how. A person may revoke “by using any reasonable method to clearly express a desire not to receive further calls or text messages” (§ 64.1200(a)(10)).
Seven reply words count as a revocation on their own:
- STOP
- QUIT
- END
- REVOKE
- OPT OUT
- CANCEL
- UNSUBSCRIBE
Other wording counts too if a reasonable person would read it as a request to stop, so “please don't text me again” is a revocation. You have a reasonable time, not more than 10 business days from receipt, to stop. You may send one confirmation with no marketing in it; sent within five minutes, it is presumed to fall within the consent the person gave. The opt-out keywords guide covers the carrier side of STOP and HELP.
Do Not Call lists
Two lists govern sales calls and texts. The national Do Not Call registry, run for the federal government, holds numbers whose owners want no telephone solicitations; a registration is honoured indefinitely, until the owner cancels it or the number is removed. Your internal list holds everyone who asked you in particular to stop.
A solicitation to a registered number is allowed only with the person's prior express invitation or permission, or within an established business relationship: a purchase or transaction in the last 18 months, or an inquiry or application in the last three. A request to stop ends that relationship for calling purposes even if the customer keeps buying from you.
The safe harbor protects you only when a call to a registered number was the result of error and all five elements were in place. The internal list has its own floor: a written policy available on demand, trained staff, each request recorded and honoured within 10 business days, and kept for 5 years. More in the Do Not Call guide for business.
Reassigned numbers
A consent belongs to a person, not a number, and numbers change hands; providers wait at least 45 days before reassigning a disconnected number. The FCC's Reassigned Numbers Database gives a safe harbor if you had consent from the intended person, checked the database before calling, and it wrongly answered “no”.
Calling hours and caller identification
“No person or entity shall initiate any telephone solicitation to: (1) Any residential telephone subscriber before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)”
The clock that matters is the customer's, not your office's. A Florida number whose owner now lives in California rings in California time, so check the area code and the address you hold and, when they disagree, send only in the hours both allow. State laws can add limits of their own; see mini-TCPA state laws and check a send time with the quiet hours checker.
Every sales call must give the caller's name, the business it is made for, and a number or address where that business can be reached. A prerecorded message must name the business at the start and give a callback number during or after the message. Dialers have one more limit: no more than three percent of live-answered telemarketing calls in a campaign may be abandoned over each 30-day period, and a call counts as abandoned if no live agent comes on within two seconds of the greeting.
What a violation costs
The TCPA gives the person who got the call or text the right to sue, not only the FCC. Damages run per call or text, so a campaign to a list multiplies quickly.
A text blast to 2,000 numbers without the right consent is 2,000 potential violations before anyone asks whether it was willful. Run your own numbers in the TCPA penalty estimator; some teams also screen out known serial plaintiffs with a litigator scrub.
What changed in 2025 and 2026
The rules moved several times in 2025 and 2026, and older guides still describe some that no longer stand. Here is the log, with where each change sits on 2026-10-22.
| Date | What changed | Source | Status today |
|---|---|---|---|
| 2021-04-01 | Facebook v. Duguid: an autodialer must store or produce numbers with a random or sequential number generator. | Supreme Court | Settled law |
| 2025-01-24 | The 11th Circuit vacates the FCC's one-to-one consent rule. | IMC v. FCC | Vacated |
| 2025-04-07 | An FCC bureau order delays the revoke-all part of the revocation rule to 2026-04-11. | DA 25-312 | Replaced by the 2026 delay |
| 2025-04-11 | The revocation rules take effect: any reasonable method, seven reply words, ten business days. | § 64.1200(a)(10) | In force |
| 2025-06-20 | McLaughlin v. McKesson: district courts read the statute themselves instead of deferring to the FCC. | Supreme Court | Settled law |
| 2025-08-29 | The FCC removes the one-to-one wording from the written-consent definition. | 90 FR 42137 | Removed |
| 2026-01-06 | The revoke-all requirement is delayed again, to 2027-01-31. | DA 26-12 | Delayed |
| 2026-09-30 | FCC 26-67 adopted: callers may name an exclusive revocation method; an informational opt-out can be limited to its category. | FCC 26-67 | Adopted, not yet in effect |
Carrier rules sit on top of the law
A business text in the US also travels under the wireless carriers' rules, written up by CTIA and enforced through 10DLC registration. They are not the TCPA, but a campaign that breaks them can be filtered or suspended by the carriers, whatever a court would say.
Carriers expect the first message after an opt-in to confirm five things:
“(1) the program name or product description; (2) customer care contact information (e.g., a toll-free number, 10-digit telephone number, or HELP command instructions); (3) how to opt-out; (4) a disclosure that the messages are recurring and the frequency of the messaging; and (5) clear and conspicuous language about any associated fees or charges and how those charges will be billed.”
They also expect plain-language opt-outs to be read and acted on, one final confirmation per opt-out, opt-in records that keep the timestamp, the medium, the wording shown, the campaign, the IP address, the number and who the person is, and no opt-in lists that were rented, sold or shared. That is why a well-run program answers HELP and honours STOP from its first message. The texting-specific federal rules are in TCPA rules for text messages.
A compliance program in seven steps
Compliance is a set of records you can produce on the day a demand letter arrives. Build it in this order; each step maps to a rule above.
The FTC's Telemarketing Sales Rule runs alongside the TCPA for sales calls and adds its own requirements; the TSR vs TCPA guide sets the two side by side. This page explains the federal rules; it is not legal advice.
Questions owners ask
Does the TCPA apply to text messages?
Yes. The Supreme Court noted in Facebook v. Duguid that neither side disputed the ban extends to unsolicited text messages, the FCC's revocation rule speaks of calls and text messages throughout, and 47 CFR § 64.1200(e) applies the Do Not Call rules to calls and texts to wireless numbers. Plan every texting program as if each message were a call.
What is the difference between prior express consent and prior express written consent?
Prior express consent is the person's agreement to receive the call or text, spoken or written; it covers informational messages sent by an autodialer or a prerecorded voice. Prior express written consent is a signed agreement (an electronic signature counts where the law recognises it) that names the phone number and tells the person they need not agree to buy anything. Marketing by an autodialer or prerecorded voice needs the written kind.
How fast do we have to stop after someone opts out?
The rule in force says within a reasonable time, not more than ten business days from the request. One confirmation text with no marketing in it is allowed, and if it goes out within five minutes it is presumed to fall within the consent the person gave. Carriers expect one final opt-out confirmation per campaign.
Is the FCC's one-to-one consent rule in effect?
No. The 11th Circuit vacated it on 2025-01-24, and the FCC removed the wording from its rules with effect from 2025-08-29. A consent still has to name the seller clearly enough to authorise that seller's calls under the written-consent definition.
Are we liable for texts a vendor or agency sends for us?
The rules put the seller in the frame: for Do Not Call requests kept by another party, the business on whose behalf the call is made is liable for any failure to honour them. Contracts can shift costs, not the rule, so keep your own copy of every consent and opt-out your vendors record.
Does the TCPA cover business-to-business calls?
Partly. The Do Not Call registry rules are written for residential subscribers, but the autodialer and prerecorded-voice rules for cell phones carry no business exception, and many business contacts give a personal cell number. Treat a B2B texting or dialer program like a consumer one unless counsel tells you otherwise.
Sources
- 47 U.S.C. § 227, Restrictions on use of telephone equipment (govinfo, 2023 edition)fetched 2026-10-22
- 47 CFR § 64.1200, Delivery restrictions (eCFR, current as of 2026-10-20)fetched 2026-10-22
- Facebook, Inc. v. Duguid, No. 19-511 (U.S. Apr. 1, 2021)fetched 2026-10-22
- Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025)fetched 2026-10-22
- FCC, conforming rule after the one-to-one vacatur, 90 FR 42137 (Aug. 29, 2025)fetched 2026-10-22
- FCC, Order DA 25-312 (Apr. 7, 2025), revoke-all delayfetched 2026-10-22
- FCC, Order DA 26-12 (Jan. 6, 2026), revoke-all delay to Jan. 31, 2027fetched 2026-10-22
- FCC, Order and FNPRM FCC 26-67 (adopted Sept. 30, 2026)fetched 2026-10-22
- FCC, news release on the consent revocation votefetched 2026-10-22
- Federal Register, FCC documents (checked for FCC 26-67 publication)fetched 2026-10-22
- McLaughlin Chiropractic Associates v. McKesson Corp., No. 23-1226 (U.S. June 20, 2025)fetched 2026-10-22
- FCC, Reassigned Numbers Databasefetched 2026-10-22
- CTIA, Messaging Principles and Best Practices (May 2023)fetched 2026-10-22