Why the Question Matters: The Real Cost of Getting SMS Wrong

Text messages get read. Industry data shows a 97% read rate within 15 minutes of delivery, which is why so many businesses want to add SMS to their marketing mix.

The same speed that makes SMS effective also makes it dangerous. A single compliance mistake can trigger statutory damages of $500 to $1,500 per text, per recipient, with no requirement to prove anyone was actually harmed (BCLP Law). Multiply that by a few thousand contacts and the math gets ugly fast.

So is SMS blasting illegal? No. Bulk SMS marketing is legal in the US when you follow the rules. The problem is that "the rules" have grown into a layered stack:

• Federal TCPA consent requirements
• State "mini-TCPA" laws (Florida, Texas, Oklahoma, Washington, and others)
• Carrier registration through 10DLC
• Quiet hours and content restrictions
• Cross-channel opt-out handling under the FCC's April 2025 rule

Most compliance failures come down to three things: missing prior express written consent, ignoring opt-out requests, and skipping carrier registration. Get those right and you've handled the bulk of your legal exposure.

That's where provider choice matters. When you're vetting an SMS partner, the right question isn't "what features do you offer?" It's "how do you handle consent capture, opt-out processing, and carrier compliance?" A provider that treats compliance as a feature, not a foundation, will leave you holding the bag when something goes wrong.

At Worqd, compliance isn't a bolt-on. It's built into how we run SMS campaigns for clients, from the consent forms to the opt-out keywords to the 10DLC registration. The goal is simple: let you use the highest-converting channel available without waking up to a class-action notice.

The stakes are real, but so are the rewards. Businesses that get SMS compliance right tap into the channel with the fastest read rates in marketing. Those that skip the homework pay for it, per text, for years.

The Rules That Decide Whether Your Texts Are Legal

The rules that decide whether your texts are legal come down to a handful of requirements, and each one carries real financial weight. Under the TCPA, marketing texts require prior express written consent from the recipient. Transactional texts like order confirmations and shipping updates only need the lower bar of prior express consent, so mixing promotional content into those threads without written consent creates legal exposure.

The stakes are steep. Statutory damages run $500 to $1,500 per violation, per class member, and you don't have to prove actual injury for a claim to land. That's per text, and class actions can turn a single campaign into a very expensive mistake.

Newer FCC rules tighten things further. The Opt-Out Rule, effective April 11, 2025, requires you to honor a revocation request within 10 business days, and the consumer can revoke "in any reasonable manner." If someone texts STOP, that ends both texts and automated voice calls to them. You get one clarification message within five minutes of the request, and nothing after that. Programs that only listen for the exact keyword STOP are building a gap a complaint or lawsuit can exploit.

Timing matters too. Marketing texts are restricted to roughly 8 a.m. to 9 p.m. in the recipient's local time zone, which means national lists need time-zone-adjusted sending logic, not a single broadcast clock.

Federal law is the floor, not the ceiling. State mini-TCPA laws keep adding layers:

• Texas SB 140 (effective Sept 1, 2025) extends telemarketing rules to promotional texts, even for out-of-state businesses texting Texas residents, with quiet hours of 9 p.m. to 9 a.m. and no promotional texts after noon on Sunday.
• Oklahoma limits messaging to 8 a.m. to 8 p.m. and caps texts on the same topic at 3 within 24 hours.
• Florida generally requires businesses to stop sending within 15 days of an opt-out request.
• Connecticut allows fines up to $20,000 per violation and requires prior express written consent.

Two recent developments sound like good news but aren't a free pass. The FCC's one-to-one consent rule was vacated by the Eleventh Circuit days before its January 2025 effective date, which restored the pre-2023 consent baseline rather than loosening it. And the Seventh Circuit ruled in Steidinger v. Blackstone Medical Services that texts aren't "telephone calls" under one specific TCPA provision, but legal analysts warn that robust TCPA compliance remains essential, since state laws and regulatory enforcement still apply.

This is why provider choice matters. When you're vetting a partner, ask how they handle consent capture, revocation across channels, quiet-hours logic, and state-level rules. At Worqd, outreach is built as permission-aware and personalized from the start, because the cheapest compliance problem to fix is the one you never create. A recent legal analysis recommends retaining opt-out documentation for at least four years, the length of the TCPA statute of limitations.

Legal Is Not Enough: Carrier Rules and Consent Records

You can follow every TCPA rule to the letter and still have your messages quietly disappear. That's because there's a second layer of enforcement most businesses never think about until it bites them: the carriers themselves.

Before you can send high-volume texts in the US, you have to register through 10DLC, which means identifying your business and describing your use case to the carriers. Skip that step, or misclassify your traffic, and your messages get throttled or blocked outright. According to carrier guidance, this happens "regardless of legal compliance." You can have perfect consent records and still fail to deliver a single message.

Carriers also filter content. The CTIA restricts what it calls SHAFT content: sex, hate, alcohol, firearms, and tobacco. Messages touching those topics get filtered even when they're sent to a fully consented list. And carriers have real teeth beyond filtering. They can suspend short codes, reject campaigns, or block violating senders entirely, as Business.com notes. When you're choosing an SMS provider, ask how they handle 10DLC registration and carrier monitoring, including whether they watch for "Spam Likely" flags. A provider that treats carrier compliance as an afterthought puts your whole messaging program at risk.

The second layer businesses miss is documentation. Winning a TCPA dispute often comes down to one question: can you prove the person consented, and can you prove exactly what they agreed to? Consent records are described as your strongest defense in a complaint or legal dispute, and a defensible record needs four specific elements:

• A timestamp showing when consent was given
• The exact disclosure language the person saw at opt-in
• The channel or source where consent was collected
• The phone number, tied to the specific campaign or brand identifier

Keep those records for at least four years, which matches the TCPA statute of limitations. If someone claims they never agreed to hear from you, a complete record ends the argument before it starts. An incomplete one invites it.

This is also where provider choice matters more than most people realize. Consent capture, opt-out handling, and carrier monitoring are operational details, and if your provider handles them sloppily, the exposure lands on you. It's part of why we at Worqd build outreach around permission-aware, personalized contact rather than template blasts, and why we tell clients to verify a vendor's compliance practices before signing anything.

Legal compliance gets you past the courtroom. Carrier registration and solid consent records get your messages delivered and keep you defensible when someone challenges you anyway. You need both layers, working together, or the whole program is fragile.

How to Run Compliant SMS: A Practical Checklist

Consent is the whole ballgame. Get it wrong and every text you send carries statutory damages of $500 to $1,500 per violation, per class member, with no proof of actual harm required. Get it right and SMS becomes one of the highest-performing channels you own.

Here's what compliance actually requires in practice:

• Capture clear, conspicuous written consent. It can't hide behind a link or sit buried in your terms. State plainly that the person agrees to receive automated marketing texts from your company, that consent isn't a condition of purchase, and that they can revoke anytime.
• Honor opt-outs beyond the STOP keyword. Under the FCC's Opt-Out Rule, effective April 11, 2025, people can revoke consent "in any reasonable manner," and you must honor it within 10 business days. Programs listening only for exact keywords leave a gap a complaint can exploit.
• Apply time-zone-adjusted quiet hours. Marketing texts belong between 8 a.m. and 9 p.m. in the recipient's local time. Some states run stricter: Oklahoma enforces 8 a.m. to 8 p.m., and Texas SB 140 bars promotional texts after noon on Sundays.
• Scrub against DNC registries and the Reassigned Number Database before sending, and register your sending numbers through 10DLC. Unregistered traffic gets throttled or blocked outright, regardless of legal compliance.
• Never rent, buy, or share opt-in lists. Every contact should come through your own opt-in campaigns, with records kept for at least four years.

This is where most bulk SMS operations fall apart. A purchased list plus a template blast isn't outreach. It's a lawsuit with a send button.

Worqd builds the opposite: personalized, permission-aware outreach to relevant accounts, with explicit consent captured inside every booking funnel. Every inquiry gets qualified in under 60 seconds, including after hours and weekends, so speed never comes at compliance's expense. You get more demand, faster follow-up, and better creative without gambling on your phone number.