Home blog newsText Messages: Effective Business Tool, Potential Legal Quagmire

Text Messages: Effective Business Tool, Potential Legal Quagmire

PUBLISHED

September 21, 2026

AUTHOR

Purdue Global Law School

Businesses send billions of SMS text messages every day to their customers and prospects. Many consumers appreciate the convenience, but businesses are facing a surge in class action lawsuits and steep fines for noncompliant text messaging.

Text messages are covered by the Telephone Consumer Protection Act (TCPA) and a growing number of aggressive state-level mini-TCPA laws. Both the federal and state laws provide for a private right of action as well as attorney general enforcement. The number of federal and state lawsuits continues to skyrocket, exposing businesses to staggering legal liabilities.

Organizations should follow best practices to ensure compliance and limit legal risk. Because a single text messaging campaign can reach thousands of consumers across multiple jurisdictions, marketers need a comprehensive strategy that meets the most stringent legal requirements.

How the TCPA Restricts Text Messaging

The TCPA provides for a $500 penalty per individual text message sent in violation, with penalties of up to $1,500 for willful violations. A violation doesn’t refer to the text message as a whole but to any noncompliant element of that message. A single text message can trigger multiple violations, and a consumer can stack the penalties.

A consumer does not have to prove that they suffered actual damages. Simply proving that they received a noncompliant text message is enough to establish standing and win a judgment. Because a text campaign may be sent to thousands of numbers, text messaging cases are perfectly suited for class action certification.

Additionally, federal agencies target large-scale, systemic, and flagrant violations with regulatory enforcement. The federal maximum civil penalty was recently increased to $53,088 per violation with no aggregate cap on regulatory fines.

Prior Express Consent

The TCPA strictly prohibits businesses from sending promotional texts without prior express written consent. There must be a clear agreement that cannot be a condition of making a purchase. Non-promotional texts, such as shipping alerts, only require prior express consent, which can be met when a user provides their number for transactional updates.

Required Disclosures

Failing to tell users what they are signing up for invalidates consent. At the point of opt-in, businesses must clearly disclose the program name, message frequency, and a warning that “message and data rates may apply.” There must also be direct links to the sender’s Terms of Service and Privacy Policy.

Call Time Restrictions

Under the TCPA and Federal Communications Commission (FCC) rules, marketing text messages may only be sent between 8:00 a.m. and 9:00 p.m. local time. Local time refers to the recipient’s physical location at the time the text is received, not the recipient’s area code.

Opt-Out Mechanisms

The law demands that consumers have an easy way to stop receiving messages. Businesses must honor opt-out keywords such as STOP, END, CANCEL, UNSUBSCRIBE, or QUIT. Automated systems should process these requests immediately and send one final confirmation text. Continued texting after a STOP request is viewed as a willful violation.

State-Level Mini-TCPA Laws

Several states have passed stricter regulations, the so-called mini-TCPA laws. Most of these laws also include a private right of action, although there are major differences across state lines. Some states mirror the federal model, while others route violations through their existing consumer protection or deceptive trade practices laws.

Because the TCPA does not supersede state laws, plaintiffs can sue under the federal TCPA and the state’s mini-TCPA simultaneously. Unlike the TCPA, many mini-TCPA laws shift attorney’s fees onto the losing business. Multiple federal and state regulatory penalties may also apply to one text message.

The Redefinition of Texting Autodialers

Mass text blasting is the primary target of state statutes. Because of the Supreme Court’s ruling in Facebook, Inc. v. Duguid, platforms that pull numbers from a preset list rather than generating numbers randomly are not classified as autodialers under federal law. Some mini-TCPAs destroy this defense.

Statutes in Florida, Maryland, and Oklahoma ban any automated system used to select or dial numbers, although Florida added a 15-day safe harbor. Without a specific, signed opt-in form, each text carries immediate statutory liability.

State-Specific Text Restrictions

In Florida and Oklahoma, commercial texts cannot land on a resident’s phone before 8:00 a.m. or after 8:00 p.m. local time. Marketers may not send more than three texts regarding the same subject matter within any rolling 24-hour period. They must also obtain prior express consent before sending automated texts.

Connecticut prohibits the sending of unsolicited text messages before 9:00 a.m. and after 8:00 p.m. local time. Violations can carry penalties of up to $20,000 per infraction.

Texas law categorizes marketing texts as telephone solicitations. Unless a business only texts consumers who have provided clear, documented consent, it must pay the state’s $200 telemarketer registration fee and post a $10,000 bond. Unsolicited texting triggers full enforcement. Violating Texas text restrictions exposes businesses to penalties of up to $5,000 per noncompliant text message under the Texas Deceptive Trade Practices Act.

In California, all commercial text messages sent to residents must include the name of the business and clearly indicate that the message is an advertisement. If a consumer opts out of text messages in Virginia, the business must retain that number on its do-not-text list for 10 years.

The Jurisdictional Nightmare: Rebuttable Presumption

Mini-TCPA laws in Florida, Maryland, and Oklahoma include a rebuttable presumption that a consumer with an area code within that state is physically located in the state. Because proving the text recipient’s location requires a costly investigation, companies are economically forced to comply with that state’s regulations.

Text Messaging Risk Mitigation Considerations

The financial consequences of text messaging class actions have reached unprecedented heights. Because there is no total cap on damages under the TCPA, one noncompliant marketing blast could expose a business to a multimillion-dollar legal liability. Any state-level mini-TCPA damages would add to that amount. To protect against costly fines and litigation, businesses should include fundamental safeguards in their text messaging programs, which may include the following:

Meeting Express Consent Requirements

Businesses should implement a process in which customers text a keyword or reply YES to confirm their consent. Detailed, time-stamped logs of how and when each customer consented to receive texts should be maintained for at least 5 years. However, business requirements, legal obligations, and industry-specific regulations may require longer retention times.

Additionally, businesses should cross-reference contact lists against the Federal Trade Commission’s National Do Not Call Registry before every text blast. Because carriers recycle phone numbers, businesses should use software that also checks their contact lists against the FCC’s Reassigned Numbers Database. If the number changed hands since consent was given, the system should auto-delete the record.

Meeting Opt-Out Requirements

Businesses can use an SMS gateway that automatically handles numbers that reply STOP and common variants of opt-out intent. To comply with Virginia’s mandates, the business should place these unsubscribed numbers into a suppression file that is legally preserved for at least 10 years.

Complying With Call Time Restrictions

SMS marketing platforms should reference both the consumer’s billing ZIP code and area code. Morning messages should be sent based on the latest time zone and evening messages based on the earliest time zone. Text transmission should be automatically locked outside that window.

A Wide Range of Laws and Regulations Apply to Marketing

In addition to the TCPA, marketing campaigns may trigger privacy laws, truth-in-advertising laws, and laws that restrict marketing to children, among many others. Businesses need robust compliance processes to minimize legal risk.

Purdue Global Law School’s online Juris Doctor (JD) program prepares aspiring attorneys to counsel their business clients in these and other areas. Graduates of the JD program are academically eligible upon graduation to sit for the California, Connecticut, or Washington bar or, with an approved petition, the Indiana bar.

Purdue Global Law School’s online Executive Juris Doctor (EJD) program helps business leaders and professionals understand the state and federal regulations that may apply to their organizations. Individual law courses are also available for those not interested in pursuing a degree.

Request more information today to find the path that works for you.

About the Author

Purdue Global Law School

Established in 1998, Purdue Global Law School (formerly Concord Law School) is Purdue University's fully online law school for working adults.

News and Commentary

NOTES AND CONDITIONS

For Informational Purposes Only: The contents of this blog are presented for informational purposes only and are not to be relied upon for legal advice. Always check with a legal professional regarding any questions you may have.

JD Program Bar Exam Eligibility: Purdue Global Law School JD graduates who meet state regulatory requirements may apply for admission to the State Bar of California, Connecticut Bar Examining Committee, Washington State Bar Association, or — with an approved petition — the State Bar of Indiana.

Study at, or graduation from, this law school may qualify graduates to take the bar examination or satisfy the requirements for admission to practice in California, Connecticut, Washington, or — with an approved petition — Indiana. After receiving a law license in one U.S. state (or transferring a qualifying Uniform Bar Exam or NextGen Bar Exam score, as applicable), graduates may also apply to sit for the bar exam in North Carolina and Wisconsin. Graduates who earned their JD degree in 2024 or later are eligible upon graduation to sit for the Connecticut Bar Exam through 2027, at which time Purdue Global Law School will seek renewal. Purdue Global Law School cannot guarantee that any individual’s waiver petition in Indiana will be granted. There may be additional eligibility requirements to be admitted in California or any other state. Unless otherwise specified, graduation from this law school will not qualify graduates to take the bar examination or satisfy requirements for admission to practice in any other state. Requirements to sit for a state’s bar examination may change in the future. Refer to Purdue Global’s State Licensure and Certifications page for state-specific requirements.

EJD Program: Except as provided in rule 4.30 of the Admissions Rules (Legal education in a foreign state or country), completion of a professional law degree program at this law school other than for the Juris Doctor degree does not qualify a student to take the California Bar Examination or satisfy the requirements for admission to practice law in California. It may not qualify a student to take the bar examination or to satisfy requirements for admission to the practice of law in any other jurisdiction. A student who intends to seek admission to practice law should visit Purdue Global’s State Licensure and Certifications page for state-specific requirements. Students are highly encouraged to confirm state requirements from the appropriate bar admissions office for their state of residence.

Students who start in the EJD program may not transfer to the JD program and must withdraw and reapply for JD admission. None of the coursework completed in the EJD program can satisfy JD program requirements, so you may be required to retake previously passed courses.