TCPA Text Message Rules for Consent, Quiet Hours and STOP Handling

The TCPA text message rules come down to four things: get the right consent before you text, send only within allowed hours in the recipient's time zone, identify yourself, and stop texting as soon as someone opts out. Marketing texts generally need prior express written consent, and Do Not Call rules apply to texts.

This guide covers each rule in practical terms for sales teams, agencies and anyone running business SMS in the United States. It reflects the Telephone Consumer Protection Act (47 U.S.C. § 227), the FCC rules at 47 C.F.R. § 64.1200, common state laws and carrier expectations. It is general information, not legal advice, and the rules change, so check current requirements with counsel before you launch a program.

TCPA consent rules for text messages

The FCC treats a text message as a call under the TCPA. Which consent you need depends on what the message says and how it is sent.

Prior express consent for informational texts

Informational messages, such as a confirmation of an appointment the person booked or a status update they asked for, need prior express consent. Providing a phone number for a specific purpose generally counts as consent to texts about that purpose. It does not extend to unrelated marketing.

Prior express written consent for marketing texts

Marketing and telemarketing texts sent with regulated technology need prior express written consent. Under the FCC rules, that means a written agreement, which can be signed electronically under the E-SIGN Act, that:

• clearly authorizes the named seller to send marketing messages,
• identifies the phone number the messages will go to,
• states that consent is not a condition of buying anything.

A checkbox on a web form, unchecked by default, with clear language next to it is the most common way to collect this consent. A keyword opt-in, where the person texts a word like QUOTE to your number and then confirms, also works when the call to action explains what they are signing up for.

Consent must be given to you

Consent attaches to the seller named in the agreement. Consent a lead generator collected "on behalf of partners" is a frequent source of litigation, and a list vendor's consent does not cover your marketing texts. In 2023 the FCC adopted a rule requiring one-to-one consent for lead generation, but the Eleventh Circuit vacated that rule in January 2025 before it took effect. The safest practice is still to collect consent that names your company directly.

What to store as proof

When a consent claim is challenged, the sender has to prove consent. Keep, for every contact:

• the exact consent language shown at the time,
• the form or keyword source and page URL,
• timestamp, IP address and phone number,
• any later opt-out and when it was processed.

TCPA claims can be brought up to four years after a message, so plan retention accordingly.

Do Not Call rules for texts

Telephone solicitations to numbers on the National Do Not Call Registry are restricted unless you have the person's permission or an established business relationship as defined in the rules. In December 2023 the FCC codified that these protections apply to text messages. Federal rules also require you to keep an internal do not call list and honor it.

Combine both lists in practice. A contact who opted out of your texts goes on your internal list immediately, and numbers on the national registry should be texted only with documented consent.

Quiet hours for text messages

Federal rules bar telephone solicitations before 8 a.m. or after 9 p.m. at the recipient's location. Several states set tighter windows and frequency limits:

Other states have their own rules, and holidays or Sundays can be restricted in some places. Two practical rules keep you out of trouble. Schedule by the recipient's local time, based on area code and any address you have, and use 8 a.m. to 8 p.m. as a default window for marketing texts. ColdTexting applies quiet hours by recipient time zone and state on every campaign and sequence step, so a rep in New York cannot accidentally text a Florida lead at 8:30 p.m.

STOP handling and opt-out rules

Opting out has to be easy, and honoring it has to be reliable. Three layers apply.

Revocation by any reasonable means

Consumers can revoke consent in any reasonable way. FCC rules adopted in 2024 make clear that replies such as STOP, QUIT, END, CANCEL, UNSUBSCRIBE, REVOKE and OPT OUT are treated as revocation, and other wording such as "please stop texting me" can count too. The rules set a maximum of 10 business days to process a revocation. Systems can do it immediately, so there is no reason to wait.

One confirmation message

Sending a single message that confirms the opt-out is acceptable, as long as it contains no marketing. Keep it short: "You are unsubscribed from Northwind Solar texts. No more messages will be sent."

Opt-out across every number and sequence

The opt-out belongs to the contact, not to one rep or one number. If your team uses several numbers, a STOP sent to one of them has to suppress the contact everywhere, including sequences that were already scheduled. Missed opt-outs in multi-number setups are one of the most common causes of TCPA claims against sales teams.

Message content rules from carriers and CTIA

The CTIA Messaging Principles and Best Practices, which carriers use to enforce business messaging standards, add expectations on top of the law:

• Identify the sender. Put the brand name in the message, ideally at the start.
• Disclose program details at opt-in. Message frequency, "Msg and data rates may apply", and how to get help and opt out.
• Include opt-out language. At least in the first message and periodically after that.
• Respond to HELP. Return the brand name and a way to reach support.
• Avoid restricted content. Sex, hate, alcohol, firearms and tobacco (SHAFT) and some other categories need special handling or are not allowed.
• Avoid public link shorteners. Shared shortener domains are filtered. Use your own domain.

A message can be legal and still get filtered if it breaks these norms. The SMS compliance checker scores a draft against both legal and carrier rules, including the recipient's state, in a few seconds.

Reassigned numbers and consent that goes stale

Phone numbers change hands. When a mobile number is disconnected and later assigned to someone new, the consent you collected belongs to the previous owner, not the new one. Texting the new owner is texting someone without consent. The FCC created the Reassigned Numbers Database so businesses can check whether a number has been permanently disconnected since a given date. Querying it, and relying on the result in good faith, gives a safe harbor for a message that still reaches a reassigned number because of a database error.

Consent also goes stale in practice. A lead who opted in two years ago and never replied is a weak contact, and texting them out of nowhere invites complaints even if the consent is technically still valid. Re-confirm consent for old contacts before adding them to a campaign, and remove numbers that bounce or come back as landlines.

A practical TCPA text message checklist

1. Every contact has a consent record that names your company and shows source, time and IP.
2. Marketing messages go only to contacts with prior express written consent.
3. Numbers are registered through A2P 10DLC registration with a campaign that matches your traffic.
4. Sending windows follow the recipient's local time and state, defaulting to 8 a.m. to 8 p.m.
5. Frequency caps are set per contact per day.
6. The first message names the brand and includes Reply STOP to opt out.
7. STOP and similar replies suppress the contact across all numbers and sequences immediately.
8. Reassigned numbers are checked against the FCC Reassigned Numbers Database where available.
9. Consent, opt-out and message logs are kept for at least four years.

Doing this by hand across a team is where things break. ColdTexting was built to enforce this list on every send. See how the guardrails work on the TCPA compliance software page, read about cold texting done the compliant way, or compare plans on SMS marketing pricing.

Frequently asked questions about TCPA text messages

Do TCPA rules apply to text messages?

Yes. The FCC treats text messages as calls under the TCPA, and in 2023 it codified that Do Not Call protections cover texts. Marketing texts generally require prior express written consent.

What time can businesses send marketing texts?

Federal rules allow telephone solicitations between 8 a.m. and 9 p.m. in the recipient's local time. Some states, including Florida, Oklahoma, Maryland and Washington, limit solicitations to 8 a.m. to 8 p.m., so many businesses use that window everywhere.

How fast do I have to honor a STOP request?

FCC rules adopted in 2024 set a maximum of 10 business days, but best practice is to stop immediately. A single confirmation message without marketing content is allowed.

What are the penalties for violating the TCPA?

The statute provides 500 dollars per violation, and courts can increase that to 1,500 dollars per violation for willful or knowing violations. Each text can count separately, and class actions add up across recipients.

Does an existing customer relationship replace consent?

An established business relationship can matter for Do Not Call rules, but it does not replace prior express written consent for marketing texts sent with regulated technology. Collect clear text consent from customers you plan to market to.