The Short Answer: Not Illegal, But Expensive If You Get It Wrong

Texting your customers at scale isn't against the law. Getting consent wrong while you do it is where the real money gets lost.

In the US, SMS blasting is legal but regulated under the federal Telephone Consumer Protection Act (TCPA). The stakes are serious: $500 to $1,500 in statutory damages per message, with no cap on aggregate class-action exposure. A campaign of 100,000 messages sent without proper consent could mean exposure exceeding $150 million in a single lawsuit.

Big companies have already paid the price:

• Uber settled for $20 million in 2017 over unwanted driver-recruitment texts
• Wells Fargo paid $17.85 million for unsolicited texts and calls to non-customers
• Steve Madden settled for $10 million after 200,000+ unsolicited texts
• Pizza Hut franchisees paid $6 million for roughly 13,000 unsolicited texts

And the litigation trend is accelerating. According to compliance industry data, TCPA class actions filed through mid-2025 were up nearly 95% year over year. Mass text campaigns are, as Purdue Global Law School puts it, "perfectly suited for class action certification" because a single blast reaches thousands of numbers across multiple jurisdictions at once.

Here's the part that trips up most business owners: the TCPA was written in 1991, before SMS marketing existed. The FCC has long interpreted the statute to treat text messages as "calls," which means the same consent and quiet-hours rules that govern phone calls apply to texts. If you wouldn't robocall someone without written permission, you can't text them a promo without it either. Quiet hours run 8 a.m. to 9 p.m. in the recipient's local time zone, and about a dozen states layer their own stricter "mini-TCPA" rules on top.

That's why choosing who runs your messaging matters as much as choosing to message at all. When Worqd builds follow-up and database reactivation campaigns, compliance isn't a bolt-on: consent is captured explicitly, opt-outs are honored across channels, and sends respect quiet hours and state-level restrictions. The same discipline applies whether an AI SDR is qualifying an inbound lead in under 60 seconds or an old CRM contact is being revived into a booked call.

The short version: SMS blasting is a legal, high-performing channel. It just has a very expensive failure mode, and the businesses that treat consent as a marketing asset rather than a legal chore are the ones that keep it profitable.

The Five Rules That Decide Whether Your Campaign Is Legal

Whether a bulk SMS campaign is legal comes down to five requirements, and missing any one of them can turn a routine send into a lawsuit. Violations run $500 per message, or $1,500 if the violation was willful, and there's no cap on total damages in a class action.

Here's what the law actually requires of you before you hit send.

1. Prior express written consent, per recipient. Marketing texts require written consent under the TCPA, and that consent has to be captured specifically for SMS. An email opt-in doesn't cover text messages. You need a separate opt-in that names your business, describes the message content and frequency, and warns that message and data rates may apply. Purchased or shared lists don't count, because consent doesn't transfer when a list changes hands.

2. Quiet hours: 8 a.m. to 9 p.m., recipient's local time. The window applies based on where your recipient lives, not where you're sending from. Some states are stricter. Florida and Washington enforce a 9 a.m. to 8 p.m. window, and Florida and Oklahoma cap you at three texts on the same subject within any rolling 24-hour period. The safe move is to schedule by ZIP code or area code and apply the strictest standard that applies to any contact based on their state.

3. Scrub against the DNC Registry and Reassigned Numbers Database before every send. Texting a number on the National Do Not Call Registry is illegal, with penalties up to $43,792 per call or text. The Reassigned Numbers Database matters because phone numbers get recycled: if consent was collected more than 30 days ago, you need to check whether that number now belongs to someone else. These checks belong in every campaign workflow, starting from the moment you build the list.

4. Register for 10DLC. Every business sending application-to-person SMS through 10-digit long codes in the US must register its brand and campaigns with The Campaign Registry. Since February 2025, carriers have blocked unregistered traffic outright, so even a legally compliant message goes nowhere without registration. Brand registration takes 1 to 3 business days; campaign registration takes 2 to 7.

5. Keep transactional and promotional messages separate. Slip a discount offer into an order confirmation and you've reclassified the whole message as marketing, which triggers the higher consent standard. Run these as completely separate workflows.

One more layer worth knowing: about a dozen states have their own "mini-TCPA" laws, and where state law is stricter than federal law, state law wins. A single campaign reaching consumers across multiple states needs to meet the most stringent requirement in the batch.

This is the standard we hold ourselves to at Worqd. When we run SMS as part of fast follow-up and database reactivation for clients, every send starts from documented, per-recipient consent, and every list gets scrubbed before it goes out. Far from being the obstacle to a working SMS channel, compliance is what keeps the channel open.

If you want bulk SMS built into a growth plan that treats the rules as non-negotiable, book a growth call at worqd.com/book.

What Changed in 2025: Opt-Outs Got Harder to Ignore

If you run SMS campaigns, April 11, 2025 is a date worth circling. That's when the FCC's expanded opt-out rule took effect, and it changed what counts as a valid unsubscribe request. Under the new rule, you have to honor a revocation made through "any reasonable manner" rather than only the standard STOP keywords.

What does that mean in practice? A customer can opt out by leaving a voicemail, sending an email, or even telling your cashier. If you only monitor keyword replies, you're exposed. The rule also tightened the processing window from 30 days down to 10 business days, and it works across channels: a STOP sent by text also stops your automated voice calls, and vice versa.

There's one narrow allowance. You may send a single clarification message within 5 minutes of the revocation request, and it can't contain any marketing content. Anything beyond that one message puts you at risk of TCPA penalties, which run $500 per violation and up to $1,500 for willful violations.

Here's the other big 2025 development, and it actually loosened things: the FCC's One-to-One Consent Rule was vacated by the Eleventh Circuit Court of Appeals in January 2025, days before it was set to take effect. That rule would have required written consent for each individual seller. With it struck down, the pre-2023 consent standard remains the baseline for marketing texts.

Not everyone was happy about the opt-out changes. In March 2025, major banking and financial groups, including the American Bankers Association and America's Credit Unions, met with FCC staff to ask for a pause of the rule until April 2026. They cited the burden of processing revocations across multiple channels and coordinating with third-party vendors. The FCC moved ahead anyway, so the rule stands.

For anyone evaluating an SMS provider or a growth partner, this section of the rules is a good stress test. Ask how opt-outs get captured when they arrive outside the standard keywords, how quickly they're processed, and whether consent records are kept audit-ready. At Worqd, outreach is built to be permission-aware from the start, because fast follow-up only works when the follow-up is compliant. The rules aren't optional, and with TCPA class actions up nearly 95% year-over-year through mid-2025, the cost of getting opt-outs wrong keeps climbing.

How Compliant Messaging Actually Works in Practice

Knowing the rules is one thing. Seeing how a compliant campaign actually runs day to day is where most providers reveal whether they're serious or just checking boxes.

Start with consent records. A proper provider timestamps every opt-in and stores the exact disclosure language the recipient saw: your business name, message frequency, the "message and data rates may apply" warning, and opt-out instructions, per FCC guidance. If a dispute surfaces years later, that timestamped record is your defense, and an email opt-in doesn't count as SMS consent.

Opt-out handling is where the April 11, 2025 rules bite. Providers must honor revocation made through "any reasonable manner" instead of only the keyword STOP, and process it within 10 business days, with one clarification message allowed within 5 minutes and no marketing content, according to TCPA attorneys at BCLP. That means fuzzy opt-out recognition that catches "stoppp," "please stop texting," and non-English replies in addition to perfect keywords.

Scheduling is the other tell. Quiet hours run 8 a.m. to 9 p.m. in the recipient's local time, so sends must be scheduled by the recipient's area code or ZIP code, never the sender's location. Florida and Washington tighten the window to 9 a.m. to 8 p.m., and Florida and Oklahoma cap you at three texts on the same subject per rolling 24 hours, as Purdue Global Law School notes. A provider applying one blanket send time across all states is creating exposure you'll pay for.

Here's what to expect from anyone you hire:

• Timestamped consent records with the exact disclosure text, retained 4 years federally and up to 10 years for Virginia contacts
• Fuzzy opt-out recognition covering misspellings, phrases, and non-English replies, processed well inside 10 business days
• Time-zone-aware scheduling based on recipient area code, applying the strictest applicable state standard
• Branded short domains instead of public shorteners like Bitly, which trigger carrier spam filters

That last point surprises people. Public link shorteners are heavily used by spammers, so carriers filter them, and a legally compliant message can still get blocked, as compliance guides from Infobip explain. Branded short domains keep your messages deliverable.

When Worqd runs follow-up and database reactivation for clients, these are the practices we hold to, because a booked call that costs you a TCPA claim isn't a win. Ask any provider you're evaluating to show you their consent log format, their opt-out recognition logic, and their send-time rules. If they can't produce all three in a few minutes, you've found your answer.

How Worqd Handles It: Consent-First, Never a Blast

So where does all this regulation leave you if you just want more booked calls? The good news is that the rules leave