The U.S. Telephone Consumer Protection Act (TCPA) is a consumer protection statute that has historically regulated informational and marketing communications via the telephone. U.S. Federal Communications Commission (FCC) orders have interpreted and expanded on the statute so that contacting consumers via text (also “SMS”) message was also impacted. Various U.S. states have also enacted their own, sometimes stricter, regulations (mini-TCPA acts).
Recent cases, including the U.S. Supreme Court’s 6-3 decision in McLaughlin Chiropractic Assocs., Inc. v. McKesson Corp., 606 U.S. 146, 146, 145 S. Ct. 2006, 222 L. Ed. 2d 405 (2025), two decisions in the Northern District and Middle District of Florida in late 2025 (Davis v. CVS Pharmacy, Inc., 797 F. Supp. 3d 1270, 1272 (N.D. Fla. 2025) and Sayed v. Naturopathica Holistic Health, Inc., No. 8:25-CV-00847-SDM-CPT, 2025 WL 2997759, at *1 (M.D. Fla. Oct. 24, 2025)), and the February 25, 2026 opinion of the U.S. Court of Appeals for the Fifth Circuit in Bradford v. Sovereign Pest Control of TX, Inc., 167 F.4th 809, 810 (5th Cir. 2026) have all introduced uncertainty with respect to some of the more established recommendations and practices regarding phone and text message communications and consents.
While companies should continue to monitor further TCPA activity by the FCC, the courts and various state mini-TCPA acts, the following practices may help companies continue to meet customer expectations and the more conservative reading of the rules (and thus help to minimize exposure or risk) while TCPA law and practice continue to evolve.
1. Obtain Proper Consent
Both informational communications and marketing messages require consent:
-
- Express Consent has been required for informational or transactional calls and texts tied to a specific purpose, which is commonly satisfied when a consumer (or employee, in the workplace context) knowingly provides a mobile number for communications reasonably related to that purpose.
- Prior Express Written Consent has generally been required for marketing or promotional calls or texts. In some jurisdictions based on recent judicial decisions, either oral or written consent may be considered sufficient to establish consent.
The FCC and courts continue to treat telemarketing texts to National Do-Not-Call (DNC) Registry numbers as prohibited unless the consumer has provided written permission or has a qualifying relationship. These approaches are consistent with respect to consumers generally, a company’s employees or company-owned or provided devices. Messaging employees about schedules, safety or operations typically fits the informational category and can rely on prior express consent inferred from onboarding or HR processes, so long as content stays within that scope. Marketing to employees, however, including urging them to purchase products or services, including partner offers, can trigger the higher consent standard.
2. Document Your Consent Records
For informational texts, tie the purpose to how and why the mobile number was provided.
For telemarketing texts, retain a signed, standalone prior express written consent record that identifies the sender and the number to receive texts, states that autodialed or prerecorded/AI-assisted telemarketing messages are authorized, and makes clear that consent is not a condition of purchase.
If you need to clarify or update the scope of consent because recipients may have opted into several categories, send one non-marketing confirmatory text and interpret any non-response as a global revocation for further robocalls and robotexts from your organization.
Organizations should ensure that disclosures are clear, and preserve relevant records for the required and recommended timeframes.
3. Respect Opt-Out Requests
Generally, recipients may revoke consent by any reasonable means, with the following reply keywords deemed per se reasonable in the texting context: STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE. Organizations should ensure their systems can interpret enumerated keywords automatically, yet also capture and route other “reasonable” revocation expressions. Revocations should be honored within a reasonable time (10 business days), and a STOP sent to one campaign or vendor should be honored across a company’s platforms or campaigns within the same 10-day window.
Companies should continue to scrub and monitor communication lists against the National DNC Registry and the FCC’s Reassigned Numbers Database (RND) in a timely manner, honor do-not-call requests for the required timeframe, and maintain internal evidence and documentation of such queries, updates and practices. In addition to complying with do-not-call documentation requirements, it is best practice to retain documentation demonstrating how you received consent to send text messages.
4. Manage Your Service Providers
When a company uses a third-party service provider, such as a workforce communication platform, texting vendor, or mass-notification system, to send texts, the company faces potential vicarious liability under the TCPA for the vendor’s actions. The FCC has made clear that companies cannot avoid TCPA liability by outsourcing communications to third parties. Contractual indemnification provisions requiring parties to comply with the TCPA do not insulate either the company or the vendor from statutory liability.
To mitigate risk, require vendors to maintain TCPA programs, promptly process revocations across all campaigns for your organization, support enumerated keywords, disclose alternative revocation paths where two-way replies are unavailable, and assist with RND checks. Include audit rights, incident notice obligations, data-sharing for opt-out synchronization, and indemnities proportionate to risk.
5. Consider State-Specific Rules
Although the TCPA is a federal law, many states have enacted their own, sometimes stricter, regulations. For example, California has more stringent consent requirements for certain types of messages. Florida has its own telemarketing regulations that restrict calls to between 8 am and 8 pm local time and limit calls on the same topic to three times within 24 hours. Companies operating across multiple states must comply with the most restrictive applicable standard for each employee’s location. States like Florida, California and Washington are particularly aggressive in enforcing their own mini-TCPA acts, which may impose additional or stricter requirements on employer texting, including narrower calling windows, separate consent requirements or private rights of action. Companies engaging in text messaging campaigns should consult with experienced legal counsel to ensure full compliance with both federal and state regulations.
Possible Penalties & Enforcement Actions
Marketing decisions can have consequences on both the federal and state levels. The FCC has the authority to impose significant fines for non-compliance, and statutory damages for federal violations range from $500 to $1,500 per offense (which can add up quickly in cases involving text message campaigns). State attorneys general may also pursue enforcement actions, adding another layer of potential liability. Given the recent judicial decisions questioning historical FCC interpretations, companies should be aware of the risk of class action lawsuits, which have become increasingly common in the last several years.
Next Steps
TCPA standards across U.S. jurisdictions are likely to further evolve. This interim update regarding TCPA provisions and decisions underscores that companies should continue to monitor developments. Businesses are encouraged to consult with experienced legal counsel to navigate these emerging challenges and to ensure that text messaging policies and agreements are up to date. If you have any questions about these considerations, please reach out to legal counsel.
