Is Cold Texting Legal? TCPA Rules for Sales Texts in Plain English

Cold texting is legal only in narrow cases. Under the Telephone Consumer Protection Act, most sales and marketing texts sent with texting software need the recipient's prior express written consent, and texts to numbers on the National Do Not Call Registry need permission. Truly cold texts to strangers rarely qualify.

That short answer surprises a lot of sales leaders, because cold email is common and broadly legal in the United States under CAN-SPAM. Text messages sit under a different and much stricter set of rules. This guide explains those rules in plain English, shows where the real risk sits, and walks through what a compliant version of cold texting actually looks like for a sales team. It is general information, not legal advice. If you run SMS at scale, have counsel review your consent language and your process.

What cold texting means for a sales team

People use the phrase in two very different ways, and the legal answer depends on which one you mean.

• Texting strangers. You bought a list, scraped numbers from a directory, or pulled mobile numbers from a data enrichment tool, and you text people who have never heard of you. This is what regulators, carriers and plaintiffs' lawyers think of when they hear "cold texting".
• Texting leads who have not talked to a rep yet. Someone filled in a form on your website, downloaded a guide, registered for a webinar or texted a keyword, and in doing so agreed to receive texts. The relationship is cold from a sales point of view, but the contact gave consent. This is the version that can work.

The rest of this article explains why the first version is a legal and deliverability problem, and how to run the second version properly.

TCPA basics for text messages

The Telephone Consumer Protection Act of 1991 (47 U.S.C. § 227) and the Federal Communications Commission rules that implement it (47 C.F.R. § 64.1200) restrict calls made with an automatic telephone dialing system, calls with artificial or prerecorded voices, and telephone solicitations to people who have registered on the National Do Not Call Registry. The FCC has treated text messages as "calls" under the TCPA for over two decades, and the Supreme Court accepted that reading in Campbell-Ewald Co. v. Gomez (2016).

Consent levels under the TCPA

The rules recognize two levels of consent that matter for texting.

• Prior express consent covers informational, non-marketing messages, such as an appointment confirmation the person asked for. Giving your number for a specific purpose can count as consent for messages related to that purpose.
• Prior express written consent is required for telemarketing and advertising messages sent with regulated technology. It is a written agreement, which can be signed electronically, that clearly authorizes the named seller to send marketing messages to a specific number, and it must state that consent is not a condition of purchase.

A sales follow-up that promotes your product is marketing. If you send it from a platform rather than typing it by hand on a personal phone, plan on needing prior express written consent.

The autodialer question after Facebook v. Duguid

In Facebook, Inc. v. Duguid (2021), the Supreme Court narrowed the federal definition of an automatic telephone dialing system to equipment that uses a random or sequential number generator. Some vendors took this to mean texting platforms are now outside the TCPA. That is a risky reading for three reasons. First, the Do Not Call rules apply regardless of how a message is sent. Second, several states passed or expanded their own laws with broader definitions of automated systems. Third, carriers enforce their own consent requirements on business messaging no matter what a court says about autodialers.

Do Not Call rules apply to texts

The Do Not Call provisions in 47 U.S.C. § 227(c) let a person sue if they receive more than one telephone solicitation within a 12-month period while their number is on the National Do Not Call Registry. In December 2023 the FCC adopted rules that expressly codify that these protections cover text messages. A cold text that pitches a product to a registered number, with no consent and no established business relationship, is squarely the kind of message the rule targets.

B2B teams often assume business contacts are exempt. The registry is meant for residential subscribers, but a large share of business people give out a personal cell phone, and courts look at how a number is actually used. Treat every mobile number as if the Do Not Call rules apply unless you can show otherwise.

What a violation costs

The TCPA sets statutory damages of 500 dollars per violation, which a court can increase up to 1,500 dollars per violation if it finds the violation willful or knowing. Each text can count as a separate violation, and class actions multiply the exposure across every recipient. The math is why one list import can turn into a serious liability.

State mini-TCPA laws that tighten the rules

Several states have their own telemarketing statutes that apply to texts, often with stricter hours and frequency limits than federal law.

• Florida. The Florida Telephone Solicitation Act limits solicitation messages to between 8 a.m. and 8 p.m. local time, caps them at three per 24 hours on the same subject, and uses its own definition of automated systems. A 2023 amendment added a notice and cure step for text claims, where the recipient first replies STOP and the sender has 15 days to comply.
• Oklahoma. The Oklahoma Telephone Solicitation Act follows a similar model with time of day and frequency limits.
• Maryland. The Stop the Spam Calls Act sets comparable limits on hours and the number of solicitations.
• Washington. State law restricts telephone solicitation to between 8 a.m. and 8 p.m. and adds its own commercial messaging rules.

The practical takeaway is that the recipient's state, not your office's state, decides which rules apply. A tool that schedules by your time zone can put a message into a lawsuit window without anyone noticing.

Carrier rules matter as much as the law

Even if a message were legal, it still has to be delivered. US wireless carriers require businesses that text from standard local numbers to register through A2P 10DLC, describe how contacts opt in, and submit sample messages. Our guide to A2P 10DLC registration covers the steps. Carriers follow the CTIA Messaging Principles and Best Practices, which expect consent, clear opt-out instructions and honest content.

Carriers also watch complaint and opt-out rates. Purchased lists produce exactly the signals filters look for: high opt-out rates, spam reports and replies like "who is this". The result is filtered messages and, in serious cases, blocked numbers or a suspended campaign registration that affects every rep on the account.

How to run compliant cold texting

The version of cold texting that works is a fast, relevant first text to a lead who agreed to receive texts. Here is the process sales teams use.

Capture consent where the lead comes from

Add a consent checkbox, unchecked by default, to the forms that feed sales: demo requests, quote forms, webinar registrations, content downloads. The text should name your company, say the person agrees to receive marketing texts at the number provided, mention that consent is not a condition of purchase, note that message and data rates may apply, and explain how to opt out. Keep the form version, timestamp, IP address and page URL as the consent record.

Send the first text quickly and identify yourself

The first message should name the brand, reference what the person did, and include opt-out language. For example: "Hi Dana, this is Sam at Northwind Solar. You asked for a roof quote on our site. Is now a good time to text two quick questions? Reply STOP to opt out." It is short, it explains why the person is getting the text, and it makes leaving easy.

Respect quiet hours and frequency

Schedule by the recipient's local time, use the strictest window that applies to their state, and cap how many messages one contact gets in a day. If you are not sure which rules apply, the 8 a.m. to 8 p.m. local window is the safer default for marketing texts.

Honor STOP everywhere, immediately

When someone replies STOP, or any reasonable variation such as "unsubscribe" or "please stop texting me", stop all marketing texts from every number and every sequence. A single confirmation reply is fine. Further sales texts are not.

Keep the records for years

TCPA claims can be filed years after a message was sent. Keep the consent record, the opt-out history and the message log long enough to defend a claim. Searching a rep's personal phone for a screenshot is not a defense strategy.

Where an SMS compliance platform fits

Most of these steps break down when they rely on reps remembering rules. ColdTexting builds them into the sending flow: every contact carries a consent record, every message gets a compliance score before it can be scheduled, quiet hours follow the recipient's time zone and state, and STOP applies across every number and sequence at once. If you want to see how a draft holds up, paste it into the SMS compliance checker. For the full list of guardrails, see our TCPA compliance software page, and for plan limits see SMS marketing pricing.

The short version for your team is simple. Do not text people who never asked to hear from you. Make it easy for interested leads to opt in, text them quickly and clearly, and let them leave with one word.

Frequently asked questions about cold texting

Is it legal to text someone who never gave me their number?

Generally no, for sales and marketing purposes. Marketing texts sent with texting software usually need prior express written consent under the TCPA, and Do Not Call rules apply to texts. Carriers also expect documented opt-in for business messaging.

Does the TCPA apply to B2B texting?

Often yes. Many business contacts use personal cell phones, and the autodialer and Do Not Call rules focus on the number and how it is used, not on whether you sell to businesses. Treat mobile numbers as covered unless you can show otherwise.

Can I text a lead who filled out a form on my website?

Yes, if the form included clear consent language for texts that names your company and the person agreed. Keep the form text, timestamp, IP address and page as proof, and include opt-out instructions in the first message.

What happens if a recipient replies STOP?

Stop all marketing texts to that number from every sender number and sequence. One confirmation message is acceptable. Record the opt-out so the contact cannot be re-imported and texted again.

Is a purchased phone list ever safe to text?

No. Consent has to be given to you as the seller, so consent collected by a list vendor for someone else does not cover your marketing texts. Purchased lists also drive opt-outs and complaints that lead carriers to filter or block your numbers.