The Short Answer: Consent Is the Line Between Legal and Illegal

Bulk SMS itself isn't against the law. What puts you on the wrong side of it is sending marketing texts to people who never agreed to receive them.

The federal Telephone Consumer Protection Act of 1991 governs text messages, and the FCC treats SMS the same way it treats phone calls. That means the same consent rules apply. For marketing texts, you need prior express written consent before you hit send. For transactional texts like appointment reminders, delivery updates, or one-time passcodes, the bar is lower: prior express consent, which can be oral.

Here's where businesses get tripped up. Under the FCC's dual-purpose rule, a message that both informs and promotes counts as promotional. A shipping notification with a discount code tucked in? That's a marketing text in the eyes of the law, and it needs written consent. The TCPA also applies to any business texting US consumers, even one based outside the country.

The penalties make the stakes clear:

• $500 per message in statutory damages, rising to $1,500 for willful or knowing violations, with no cap on total liability
• Up to roughly $43,792 per text for DNC Registry violations
• A 100,000-message campaign sent without consent could expose you to more than $150 million in a class action

Recent settlements show where companies actually get hurt. DSW paid $4.43 million for texting after customers replied STOP. Cash App settled for $12.5 million over referral texts sent without consent under Washington state law. Zales paid $7.5 million for texting numbers on the DNC Registry that had never consented at all. The pattern across these cases is consistent: the biggest penalties come from either no consent or ignoring opt-outs, and both are preventable with the right infrastructure.

This is why consent practices matter when you're choosing who handles your outreach. At Worqd, we treat permission-aware messaging as a baseline, not an afterthought. Our booking funnel requires an explicit "I agree to be contacted about my request" before anyone hears from us, and our B2B outreach is personalized to relevant accounts rather than a template blast to a purchased list.

If you're evaluating any provider, ask two questions before signing: how do they capture and store written consent, and how do they handle opt-outs? Under the FCC's rules effective April 11, 2025, opt-outs must be honored in any reasonable manner and processed within 10 business days. A provider who can't answer those questions clearly is a liability you're paying for.

What Gets Companies Sued: The Penalty Math and Settlement Patterns

A single text message can cost your company $1,500, and there's no ceiling on the total. That's the math behind the TCPA's statutory damages, which run from $500 to $1,500 per message, per violation, with no cap on total liability. A campaign of 100,000 messages sent without proper consent could expose a business to more than $150 million in a class action.

The penalties stack across frameworks, too. Sending to numbers on the Do Not Call Registry carries its own fine of up to $43,792 per call or text. And the volume of litigation keeps climbing: TCPA class actions filed through mid-2025 were up nearly 95% year over year.

The 2025 settlements show exactly where the money goes:

• DSW/Designer Brands paid $4.43 million for continuing to text people after they replied STOP.
• Cash App paid $12.5 million for referral texts sent without consent under Washington state law.
• Zales Jewelers paid $7.5 million for texting DNC registrants who never opted in.

The pattern is hard to miss. As settlement analysis from Bloomreach puts it, the largest penalties involve either sending texts with no consent at all or continuing to text after an opt-out request. Both scenarios are preventable with real compliance infrastructure.

That's why provider selection matters more than most buyers realize. The right setup captures explicit consent at the point of contact, processes opt-outs within 10 business days, respects quiet hours, and scrubs against DNC and reassigned-number data before anything sends. At Worqd, permission-aware outreach is the default: our booking flow requires an explicit "I agree to be contacted" before a single message goes out, and we treat that consent record as the foundation of every campaign we run.

If you're evaluating a messaging provider, ask two questions first: are they registered for A2P 10DLC, and can they show you the consent trail? Unregistered traffic has been blocked by carriers since February 2025, and detailed consent records remain your strongest defense if a complaint ever lands.

2025–2026 Rule Changes Every Sender Needs to Know

If you're texting US consumers in 2025, the rulebook you learned two years ago is already out of date. The FCC tightened its opt-out requirements in April, carriers started blocking unregistered traffic in February, and one major consent rule is sitting in legal limbo.

Start with the opt-out changes, effective April 11, 2025. Businesses must now honor opt-outs made "in any reasonable manner," which covers email, voicemail, in person, or even a plain "Leave me alone." Per BCLP's analysis of the new rules, you have 10 business days to process the request (down from 30 days), you can send only one non-promotional confirmation within 5 minutes, and a "STOP" text stops both your robotexts and your robocalls. The burden is on you to prove an opt-out wasn't reasonable, so your team needs a process that catches revocations no matter where they arrive.

The second change is quieter but just as consequential. US carriers require A2P 10DLC registration for any application-to-person texting over 10-digit numbers, and since February 2025, unregistered traffic is being blocked outright. Registration means submitting a Brand (your sender identity) and a Campaign (your opt-in, opt-out, and message purpose), with approvals typically taking a few business days. If you're evaluating any provider or agency that sends SMS on your behalf, ask for proof of registration. Worqd treats this as part of the follow-up setup, since messages that never deliver can't book calls.

Then there's the one-to-one consent rule, which is where things get murky. Some sources point to a January 26, 2026 effective date requiring lead generators to obtain separate, clearly disclosed written consent for each individual marketer, with no sharing of consent across partner businesses. But BCLP reports the rule was vacated by the 11th Circuit in January 2025, while other industry coverage still cites the 2026 date. That's a genuine contradiction, and the practical takeaway is simple: don't assume either version. If your lead flow involves co-marketing or shared consent language, confirm the current status with counsel before relying on it.

A few other dates worth marking. The FCC delayed its "revoke-all" rule to January 31, 2027, which may eventually allow a clearly disclosed "Reply STOP" as your only opt-out method. And state laws keep tightening too: Texas extended telemarketing rules to texts via SB 140 in September 2025, and several states now cap solicitations at three per day on the same subject.

The pattern across all of it: regulators and carriers are converging on the same demands, clear consent, fast opt-out handling, and registered senders. The 2025 TCPA class-action filing rate was up nearly 95% year-over-year, so the cost of guessing wrong keeps climbing. Build your messaging around the strictest current interpretation and you won't have to rewrite your process every quarter.

How to Vet Any SMS Provider's Compliance Practices

The biggest settlements in recent SMS litigation, like DSW's $4.43 million and Cash App's $12.5 million, came from two preventable failures: texting without consent and continuing after opt-outs. That means your provider's compliance infrastructure matters more than its feature list. Here's what to verify before you sign anything.

1. Confirm A2P 10DLC registration. Since February 2025, US carriers block unregistered traffic entirely, according to Infobip's compliance analysis. Registration requires both a Brand (your sender identity) and a Campaign that documents opt-in, opt-out, help, and message purpose, per Twilio's official documentation. If a provider says registration is optional, walk away.

2. Ask how consent is captured and stored. Marketing texts require prior express written consent, and the burden of proof sits with you. ActiveProspect's legal analysis calls detailed consent records "your strongest defense" in a TCPA dispute. A provider should log when consent was given, how, and for what.

3. Test opt-out handling. The FCC's April 2025 rules require opt-outs processed within 10 business days, honored in any reasonable manner, with one confirmation allowed within 5 minutes. Ask the provider to show you the actual opt-out workflow.

4. Check scrubbing and timing. Your provider should scrub against federal and state DNC registries, consult the Reassigned Numbers Database when consent is older than 30 days, and respect quiet hours of 8 a.m. to 9 p.m. recipient local time.

A quick vetting checklist:

• Can they show you a registered Brand and Campaign ID for 10DLC?
• Do they timestamp and store consent records, and for how long?
• Do opt-outs process within 10 business days across all channels?
• Do they scrub DNC and Reassigned Numbers Database entries before every send?
• Do they respect recipient-local quiet hours, including state-specific 8 p.m. cutoffs?

Worqd's own approach follows this checklist rather than treating it as optional. B2B outreach is built as personalized, permission-aware contact with relevant accounts, which is the opposite of a template blast. The booking funnel itself requires an explicit "I agree to be contacted about my request" checkbox and states that details are used only to prepare for the call, so consent is captured in writing at the point of inquiry, not assumed afterward.

That last part is the pattern worth demanding from anyone you hire. Consent captured explicitly, opt-outs honored fast, and records kept on file. Providers who can't demonstrate all three are gambling with your liability, since TCPA damages run $500 to $1,500 per message with no cap on the total.