Text message consent rules for a small business.

The short answer

Three questions decide what a text needs. Did the customer contact you first? Is the text about something they booked or bought? Does it try to sell them something? The answers put each text into one of three cases, and each case has its own rule.

• A reply to someone who just called or wrote to you: closest to what they asked for. Keep it about their call.
• A text about their booking or job, such as a confirmation or a reminder: covered by giving you their number for it, as long as it stays about the booking.
• An offer, a newsletter or a "we miss you" text: marketing, which needs written consent before the first one.

Two sets of rules apply in the US: the law, and the carriers' own rules, which decide whether your texts are delivered at all. This guide is general information, not legal advice. For your own case, ask a lawyer who knows the TCPA.

Which rules apply

The Telephone Consumer Protection Act, the TCPA, is the federal law. The FCC writes the rules under it and treats a text as a call. People can sue under it for each unlawful text, which is why a small mistake repeated across a customer list becomes expensive.

• The FCC's rules set the consent each kind of call or text needs, the hours for sales messages and how opt-outs work.
• The National Do Not Call Registry covers sales texts to mobile numbers as well as calls.
• Several states have their own laws on top, often called mini-TCPAs, with tighter hours and limits. Florida and Oklahoma are two.
• The carriers have rules of their own, set out by their trade body, the CTIA, and enforced through texting registration. They expect consent for every business text, sales or not, and they can block your number.

Whether the TCPA's consent rules reach a particular text can turn on how it was sent, and courts have argued about that for years. Do not build your texting on the argument. The carriers ask for consent anyway, and it costs little to get.

Case one: a reply to someone who contacted you

When someone calls and you miss them, or sends an enquiry from your website, a text back about that contact is the closest any business text gets to what the customer asked for. Keep it that way:

• One text, about their call or enquiry.
• Your business name at the start, because they may not have your number saved.
• No offer, no link to a sale, no newsletter sign-up.
• A way to stop: "Reply STOP to opt out."

"Harbour Dental: sorry we missed your call. Reply here and we will call you back today, or book online: [link]. Reply STOP to opt out."

If they do not reply, leave it there. A second and third nudge about a call they made last week has stopped being a reply. Say it on the call as well: a greeting that says "If we miss your call, we will text you back from this number" tells the caller what is coming. When you register your number, the carriers ask how people come to get your texts, so describe this flow there, as A2P 10DLC registration explains. Chasing enquiries nobody answered is a different job, done by your team, as in enquiry follow-up.

Case two: texts about a booking or a job

The FCC has long said that a person who knowingly gives you their number has, in general, agreed to be contacted on it, and it reads that permission narrowly: it covers messages about the reason they gave the number. A confirmation, a reminder, an "on the way" text and a note that the car is ready are all about the booking. The FCC has said much the same about patients who give a clinic their mobile number.

Make it explicit anyway. One line on the booking form, in the confirmation or at the desk removes the doubt, and the carriers expect it:

"We will text you a confirmation and a reminder before your appointment. Reply STOP at any time to stop texts."

Keep the texts about the booking. "See you Thursday at 3pm. Book your next visit now and get a free treatment" is a marketing text, and it needs the consent in case three. A dental clinic reminder should also leave out the treatment: the time and place are enough.

If the reminders are automated, as in booking automation, put the same line in every confirmation, so nobody gets a reminder they were not told about.

Case three: offers, newsletters and win-back texts

Any text that promotes something is marketing: an offer, a new service, a seasonal push to book, a "we miss you" message to a customer who has not been back. Sent by software, these need what the FCC calls prior express written consent. That means an agreement the customer signs, which can be done electronically on a form, and which:

• Names your business.
• Gives the phone number the texts will go to.
• Says marketing texts may be sent to that number by automated means.
• Says agreeing is not a condition of buying anything.

The carriers add their own points: how often you will text, that message and data rates may apply, how to stop and get help, and links to your terms and privacy policy. A box for a salon booking form:

"Text me offers and news from Harbour Hair Studio at the number above. Up to four texts a month, sent by automated means. Agreeing is not a condition of any purchase. Msg and data rates may apply. Reply STOP to opt out, HELP for help."

Keep this box separate from any booking consent, unticked and optional. A customer who wants reminders but not offers must be able to say so. Never text offers to a number you bought, borrowed or copied from another business, and check the Do Not Call rules with your adviser before texting anyone who has not given you this consent.

One patient, four texts

Sam rings a physiotherapy clinic at 12.40pm and nobody answers. Here is how each text the clinic might send falls into the three cases:

• A minute later: "Riverside Physio: sorry we missed your call. Reply here or book online: [link]. Reply STOP to opt out." Case one, a reply to his call.
• Sam books online. The booking page says the clinic texts confirmations and reminders, so the confirmation and the day-before reminder are case two. Neither names the treatment.
• Six weeks later the clinic starts Pilates classes and wants to tell past patients. Sam did not tick the offers box at booking, so he gets no text about it. The physio mentions the classes at his last appointment instead.
• Sam replies STOP to a reminder because he would rather have email. Every text stops. The clinic emails him the time of his next appointment and notes the change on his record.

Each step is easy to get right when the booking form said what would be texted, and kept the offers box separate.

The one-to-one consent rule that never started

In late 2023 the FCC adopted a rule that would have required written consent to name one seller at a time. It was aimed at comparison sites, where one tick box covered a long list of "marketing partners". On 24 January 2025, days before it was due to start, the Eleventh Circuit Court of Appeals vacated it, holding that the FCC had gone beyond what the TCPA allows.

For a small business that collects its own consent, little changes. Your consent should name you anyway, and the carriers do not accept consent handed on from someone else: Twilio's guidance says consent cannot be treated as transferable to affiliates. If you buy leads, ask exactly what each person agreed to, and in whose name, before anyone texts them.

Treat STOP, and every other no, as final

Since April 2025 the FCC's rules let a customer withdraw consent in any reasonable way, and a reply of stop, quit, end, revoke, opt out, cancel or unsubscribe always counts. You must honour it within a reasonable time, and within ten business days at most. You may send one confirmation with no marketing in it. After that, nothing.

Your texting tool should block the number the moment someone replies STOP. Plain words need a person: "please don't text me again", "wrong number", or a request made on the phone. Whoever reads the replies should mark the number as opted out the same day, in every tool that texts.

An FCC order that takes effect on 25 November 2026 changes parts of these rules. Among other things, it lets senders of informational texts treat an opt-out as covering only that kind of message, and name the opt-out methods they accept if they show them on every text and on their website. For a small business the safe habit is the same as before: when someone says stop, stop everything, and use email or a call for anything they still need about a booking.

Never ask why, never send an "Are you sure?" text, and never text the number again from a different number.

Send at sensible hours

The FCC's rules ban sales calls and texts before 8am or after 9pm, in the recipient's local time. Some states go further. Florida's law, for example, bars sales solicitations before 8am or after 8pm, and more than three on the same subject in 24 hours, and Oklahoma's is similar.

Go by where the customer is, not where you are or what their area code suggests. People keep their numbers when they move, so a number from your area can belong to someone three time zones away.

Reminders and replies are not sales messages, but keep them inside the same hours. A 6am reminder annoys the customer it was meant to help. Set each texting tool to hold anything outside these hours until the morning.

Keep a record of every yes and no

If a customer or a carrier asks how someone agreed, you need to show it. For each number, keep:

• The date and time they agreed.
• The exact wording they saw, with every old version of your form kept as well.
• Where it happened: the page, the paper form or the call, and who took it.
• What they agreed to: replies, reminders, offers, or a mix.
• Every opt-out, with the date and the words they used.

Keep these records where the texting happens, in the texting tool or your CRM, not on a member of staff's phone. Ask your adviser how long to keep them. Claims can arrive years after the text.

If you also text customers in Europe

The rules differ, and they are about marketing more than reminders. In the UK, the regulator, the ICO, says marketing texts need the person's consent. Its "soft opt-in" lets you text existing customers who bought something similar from you, if you gave them a simple way to opt out when you took their number and in every message since. EU countries apply similar rules through their own laws, with local differences.

Booking confirmations and reminders are not marketing. The GDPR still covers how you store the numbers, who can see them and for how long, and your privacy notice should say that you text customers and why. The GDPR checklist for small business websites covers the rest.

Mistakes that cause trouble

• A pre-ticked box, or consent buried in the terms and conditions.
• Making the offers box a condition of booking.
• A reminder with an offer tacked on the end.
• Loading an old customer spreadsheet into a texting tool and sending an offer to everyone in it.
• Staff texting customers from their own mobiles, where nobody can see consent or opt-outs.
• Ignoring "wrong number" replies. Numbers change hands, and the new owner never agreed to anything.
• Two tools with two opt-out lists, so a STOP in one does not stop the other.

Check your own setup this week

• Text your business number from your own mobile, reply STOP, then trigger a reminder. Nothing should arrive.
• Read your booking form and your website form. Does each say what you will text? Is any marketing box unticked and optional?
• Look at your last ten sent texts. Does any reminder contain an offer?
• Find where consent and opt-outs are stored, and who can see them.
• Check the send times in every tool against the hours above, in the customer's time zone.

If you are setting up missed-call texts or reminders, decide the consent wording and the opt-out handling before anything is built. The first automations guide covers what to automate first, and our automation work starts with the same questions.