SMS Blasting Is Not Banned. It's Regulated.

If you've been told texting your contact list is flat-out illegal, you've been misinformed. SMS blasting is legal in both Canada and the United States. What regulators actually ban is sending commercial texts without consent, identification, or a working way to opt out.

Canada's regulator makes this explicit. When asked whether CASL prohibits commercial messages, the CRTC answered no, explaining that the law instead "sets out some requirements for sending commercial electronic messages." Those requirements are three: get consent, identify yourself, and provide a functioning unsubscribe mechanism. Text messages sent to mobile devices fall squarely under these rules.

The United States takes a similar approach through the Telephone Consumer Protection Act. The TCPA requires express written consent for marketing texts, along with clear sender identification, opt-out options, and respect for sending hours (8 a.m. to 9 p.m. in the recipient's local time). The law treats commercial texts much like phone calls, which is why the stakes are high: violations run $500 per message, and $1,500 per message when a court finds the violation willful.

Why does the regulated-versus-banned distinction matter so much? Because it changes what you should ask of any provider or partner handling your outreach.

• A banned channel would mean no compliant path exists. A regulated one means the path is clear: consent, identification, opt-out.
• The burden of proof sits with you. The CRTC puts the onus on the sender to prove consent was obtained before sending.
• B2B is not a loophole. Business-to-business texts follow the same consent and opt-out rules as consumer texts.
• Enforcement is real. Uber paid $20 million in 2017 over unsolicited calls and texts, and DSW settled for more than $4.4 million after texting consumers who had opted out.

There's a practical enforcement layer too. Carriers watch for the same behaviors regulators do, and unregistered traffic gets filtered before it ever reaches an inbox. So even setting fines aside, sloppy blasting quietly kills your deliverability.

This is why we treat compliance as a process rather than a checkbox. At Worqd, outreach is built as personalized, permission-aware messaging to relevant accounts, the opposite of a template blast, with explicit consent captured before anyone gets contacted. As one industry analysis puts it, "software alone cannot make a program legal. You still get to choose who you text and what you say."

The channel is open. The rules are the price of admission.

What Canada and the U.S. Actually Require

So what does "compliant" actually mean when you're sending texts at scale? It comes down to three things, and both countries agree on them.

The CRTC puts it plainly: every commercial text needs consent, sender identification, and a working unsubscribe mechanism. The U.S. TCPA mirrors this, requiring express written consent for marketing messages, clear sender ID, and an opt-out like "Reply STOP." And the burden of proof sits with you: if you can't document that someone consented, regulators assume they didn't.

Once those three basics are covered, the practical rules layer on top:

• Quiet hours. Texts are only allowed 8 AM to 9 PM local time in the U.S., and 9 AM to 9 PM in Canada. Several states tighten this further, with Florida, Oklahoma, and Maryland cutting off at 8 PM.
• Bilingual opt-outs. Canadian programs need to honor "STOP" and the French "ARRÊT" immediately when a recipient replies.
• SHAFT restrictions. Content related to Sex, Hate, Alcohol, Firearms, and Tobacco requires prior approvals or gating before carriers will carry it at all.
• Faster opt-out windows. A 2025 FCC rule requires opt-outs to be honored within 10 business days, with confirmation within 5 minutes considered the acceptable standard.

The stakes are real. TCPA violations run $500 to $1,500 per message, and consumers can sue directly, which is what makes it expensive. In Canada, CASL penalties reach CAD $10M for businesses. DSW paid over $4.4M for texting people who had already opted out.

Here's the part most businesses miss: software alone cannot make a program legal. You still choose who you text and what you say, and no tool can make that decision for you. Compliance is a checklist someone has to actively run, which is why it matters who's operating your follow-up, not just which tool they use. This is why Worqd treats outreach as permission-aware by design, capturing explicit consent at every entry point and building opt-out handling into the follow-up process rather than bolting it on afterward.

When you're evaluating a provider, ask how consent gets recorded, how opt-outs get honored, and who's accountable when the rules change. A good partner runs that checklist for you. A tool just hands you the send button.

The Three Layers of U.S. Compliance Most People Miss

Most businesses that get fined for texting didn't ignore the rules on purpose. They just didn't realize they were answering to three sets of rules at the same time. As one legal analysis puts it, every U.S. text marketing program answers to federal law, carrier rules, and state laws at once, and passing one layer doesn't excuse you from the others.

Layer one is federal: the TCPA. It requires express written consent for marketing texts, clear sender identification, working opt-out handling, and an 8 AM to 9 PM sending window in the recipient's local time. Violations run $500 to $1,500 per message, and because the TCPA lets consumers sue directly, one sloppy campaign can multiply fast. Uber paid $20 million in 2017 over unsolicited texts and calls, and DSW settled for more than $4.4 million after texting people who had opted out.

Layer two is the carriers themselves. Even if your list is perfectly clean, unregistered 10DLC traffic gets filtered before it reaches anyone. Brand approval takes about a day, campaign approval about two weeks, and carriers watch for the same behaviors the TCPA regulates when deciding what to block. Toll-free number verification has been mandatory since 2023. This layer is enforced by filtering, not fines, which means non-compliance can quietly kill your deliverability.

Layer three is the states, and this is where it gets messy. A few examples of how the rules diverge:

• Florida's FTSA adds a 15-day cure period, an 8 PM cutoff, and a cap of 3 marketing texts per day.
• Washington's HB 2274 lowered statutory damages from $500 to $100 per text, but kept the private right to sue.
• Connecticut requires quiet hours of 9 AM to 8 PM, tighter than the federal window.
• Virginia requires STOP replies to be honored for at least 10 years.

Here's the part that trips up even careful marketers: the legal ground is shifting under your feet. After the Supreme Court's 2025 McLaughlin decision, courts have split on whether texts even count as "calls" under the TCPA. On October 7, 2025, a California district court held in Wilson v. Medvidi that texts qualify as calls. Two and a half months earlier, a federal court in Illinois ruled the opposite in Jones v. Blackstone, finding the private right of action applies only to telephone calls. Legal commentators are blunt about what this means: don't treat the issue as settled nationwide.

The practical takeaway is simple. Treat every marketing text as if it were a regulated call, with documented consent, clean opt-out handling, and conservative sending windows. Assume TCPA risk unless you can prove compliant consent, because the burden of proof sits with the sender, not the recipient.

This is also why software alone can't save you. You still choose who you text and what you say, and no tool makes that choice compliant for you. It's the reason Worqd builds outreach as permission-aware and personalized to relevant accounts rather than template blasts, and why any partner you hire should be able to show you exactly how consent, identification, and opt-outs are handled before a single message goes out.

B2B Is Not a Loophole, and Software Is Not a Shield

Most teams that get burned by SMS rules didn't set out to break the law. They believed one of two things: that texting other businesses doesn't count, or that buying "compliant" software makes them safe. Both are wrong, and the fines don't care about good intentions.

B2B texts follow the same rules. The recipient being a company, or the number being a work line, doesn't create an exemption. As one compliance guide puts it, business-to-business messaging is not automatically exempt just because the recipient is a company. Another resource on SMS marketing laws is blunter: whether someone owns a company or not, the same consent and opt-out rules apply.

The same goes for the "we've done business before" assumption. Many senders believe an existing business relationship gives them all the permission they need. It doesn't. The TCPA eliminated that exemption back in 2013, so a past customer or long-time vendor contact still needs to have consented to your texts.

Software doesn't shield you either. A tool can handle opt-out keywords and quiet hours, but "software alone cannot make a program legal," as legal analyses of SMS programs note. You still choose who you text and what you say. That decision, and the consent records behind it, sit with you.

The stakes are concrete:

• TCPA violations run $500 to $1,500 per message, and consumers can sue directly, which is what makes it expensive.
• CASL penalties reach CAD $10M for businesses.
• In Canada, the CRTC places the onus on the sender to prove consent existed in the first place.

That last point matters most. If a regulator or a plaintiff's lawyer asks, you need timestamped records showing the exact language someone agreed to. A checkbox at checkout, without logs, won't hold up.

This is why process beats features. Worqd's outreach is built as personalized, permission-aware contact with relevant accounts, the opposite of a template blast, and even our own booking funnel requires an explicit "I agree to be contacted" step before anything is sent. Consent gets captured up front, in plain language, and used only for the stated purpose.

When you're evaluating any provider, ask two questions: how do you capture and document consent, and who is liable if a message goes to someone who never opted in? If the answer is "our software handles that," keep looking.

What Real Penalties Look Like and What to Ask a Provider

The fines sound abstract until you see what regulators actually collected. DSW Shoe Warehouse paid over $4.4 million for sending marketing texts to people who had already opted out, and Uber paid $20 million in 2017 over unsolicited robocalls and texts, according to legal analysis of TCPA enforcement.

The math gets ugly fast because penalties attach per message. Under the TCPA, each unauthorized text can cost $500, or up to $1,500 if the violation is deemed willful. In Canada, CASL exposure runs even higher: penalties reach CAD $1 million for individuals and CAD $10 million for businesses per violation, as current SMS marketing law summaries confirm. A "quick blast" to 10,000 contacts can turn into a seven-figure liability before lunch.

Here's the part most businesses miss: the person whose name is on the messages is you, not the vendor who pushed send. As one compliance resource puts it bluntly, "Software alone cannot make a program legal. You still get to choose who you text and what you say." And since the TCPA lets consumers sue directly, that's what makes it expensive.

Before any growth partner sends a single text on your behalf, ask them:

• How do you capture and store consent? You want exact checkbox language and timestamped logs, since the sender carries the burden of proving consent.
• How do you handle opt-outs, and how fast? Federal rules now require honoring them within 10 business days, and once someone opts out, they never go back on a list.
• What are your sending windows? The federal safe zone is 8 AM to 9 PM recipient local time, with tighter cutoffs in states like Florida and Oklahoma.
• Are you registered for 10DLC and toll-free verification, or will carriers filter your traffic before it ever lands?

The answers separate partners from blast vendors. A partner like Worqd treats outreach as personalized, permission-aware contact with relevant accounts, the opposite of a template blast, and builds consent capture into the process itself rather than bolting it on. That distinction matters because compliance is a practice, not a software feature.

One more question worth asking: does the provider distinguish promotional from informational campaigns, and does it recognize every opt-out keyword from "stop" to "cancel"? If they can't answer without checking with someone else, you're carrying their risk. Get the answers before the first text goes out, not after the first complaint arrives.