SMS Messaging Rules Every Small Business Should Know

Thinking of texting your customers? Whether you’re sending appointment reminders, flash sale alerts, or friendly follow-ups, SMS marketing can be incredibly effective. But here's the catch: it's highly regulated. If you’re not following federal and state-specific rules, you could face serious legal trouble.

Let’s break down the must-know legal rules around SMS messaging so you can market confidently and compliantly.

1. Federal Rules: Start With the TCPA

The Telephone Consumer Protection Act (TCPA) is the federal law that governs all SMS marketing in the U.S. It’s enforced by the Federal Communications Commission (FCC) and sets the baseline for what’s legal.

Here’s what the TCPA requires:
- Prior express written consent: You must get clear, written permission from a customer before sending them promotional texts. And you must send a welcome (or Opt-In) message that has all the elements below: 

1. Your business name

2. Purpose of messaging

3. Frequency of texts per day, week or month

4. Text message and data rate notices

5. Explicit access to terms and conditions

6. Instructions for requesting help

7. Instructions for opting out

Here is an example you can use for your Opt-In message: 

There are also a few other important legal requirements you have to follow. First, you can't use any kind of auto-dialing or automated texting system without getting proper consent from the recipient. Doing so without permission is a clear TCPA violation. Second, every marketing text must give people an easy way to opt out—usually something simple like “Reply STOP to unsubscribe.” And finally, there are strict time-of-day rules: you’re only allowed to send messages between 8 a.m. and 9 p.m. local time for the recipient. Anything earlier or later could land you in hot water.

Penalties for non-compliance to these rules? Up to $1,500 per unauthorized message. Ouch.

2. States with Their Own Rules

Most of us using SMS messaging are running national online businesses, which means we need to pay attention to SMS laws in every state—not just our own. Staying compliant isn’t just a best practice, it’s a legal must. And yes, there are people out there who are more than willing to file lawsuits if your messaging doesn’t follow the rules. Here is a breakdown of some of the states who have enacted these laws: 

Arizona: In 2023, Governor Hobbs signed House Bill 2498, which prohibits businesses from sending unsolicited text messages to anyone listed on the National Do Not Call Registry. Violators may face fines of up to $1,000 per text message. 

California: Under the California Consumer Privacy Act (CCPA):
- Consumers have the right to request a report of what personal data businesses have. 
- Businesses must disclose how they use and share personal information.
- If a consumer opts out of text marketing, businesses have 15 days to stop texting.

Connecticut: Public Act No. 14-53 requires express written consent before sending commercial texts. Businesses also may not send messages to anyone on the Connecticut Do Not Call Registry. Fines can be up to $20,000 for violations.

Florida: Florida enacted its own version of the TCPA in 2021, commonly known as the Florida Telephone Solicitation Act (FTSA). The FTSA was amended by House Bill 761 in 2023. And spoiler alert: it's stricter than the federal version.

What Florida small businesses need to know:

- Applies to more than just robocalls: The FTSA now covers text messages too.
- Consent must be specific: General consent isn’t enough. You need documented proof of prior express written consent, and it must be clearly tied to the type of messages you’re sending.
- Must have a way to reach an actual person: Although there has been a push to have the SMS phone number be callable, that is not the law yet. However, you need to have a way for SMS subscribers to reach you!
- Message caps: You can’t send more than three commercial messages per 24-hour period to a single recipient.
- Longer Quiet Hours: You can’t send message before 8am EST or after 8pm EST.
- Fines and lawsuits: Florida consumers can sue for $500–$1,500 per text. This has led to a wave of class action lawsuits, so compliance is critical.

Pro tip: If you do business in or send texts to Florida residents, assume FTSA applies to you.

Indiana: House Enrolled Act 1273 updated Indiana law to treat text messages as sales calls. Texting consumers on the Indiana Do Not Call Registry is prohibited, and enforcement applies even if the message isn't technically a phone call.

New Jersey: Under Assembly No. 617:

- Unsolicited commercial text messages are banned.
- Businesses must get explicit consent.
- An opt-out mechanism is required in every message.
- Violators may be fined $500 to $1,000 per infraction.

Oklahoma: Oklahoma’s Telephone Solicitation Act (OTSA) went into effect in 2022. It includes:

- Consent requirements before sending commercial texts.
- Restrictions on texting before 8 a.m. or after 8 p.m. (recipient’s local time).
- No more than three messages per day on the same topic.

Virginia: Virginia’s Telephone Privacy Protection Act, amended in 2020, applies to both local and non-local area codes. Key rules:

- Businesses must identify themselves in any commercial message.
- Consumers on the Do Not Call Registry may not be texted.
- Fines escalate: $500 (first offense), $1,000 (second), $5,000 (subsequent).

Washington: Under the Consumer Electronic Mail Act (CEMA), businesses may not send commercial text messages without prior permission. The law focuses on unwanted digital marketing, and texts fall under its scope.

Wisconsin: ATCP 127 prohibits unsolicited text messages to numbers on the Wisconsin Do Not Call Registry. This includes both calls and texts. If you’re texting Wisconsin residents, always check your list against the registry.

3. Best Practices for Compliant Texting

Compliance isn’t just about avoiding lawsuits, it’s also about building trust with your customers. Here are a my best up-to-date tips to stay on the safe side with SMS messaging as a business owner:

- Use written opt-in forms that clearly explain what customers are signing up for.
- Keep detailed records of when and how a customer gave consent.
- Work with a reputable SMS platform that supports compliance features.
- Segment your contacts to avoid over-texting.
- Get a system in place for a consumer to contact you directly from the messages you send. This might mean setting up a number consumers can actually call! 
- Review your website terms and privacy policy for transparency.

4. What About Transactional Messages?

Not all texts are treated equally. Transactional messages—like order confirmations or appointment reminders—aren’t subject to the same consent rules as marketing messages. But be careful: once you slip in a promo (e.g., “Use code SAVE10”), it’s no longer just transactional. That’s a marketing message that then needs to be compliant with the TCPA.

5. How to Protect Your Business

If you’re unsure about your current texting practices, now is the time to get them reviewed. Text message lawsuits are on the rise, and ignorance of the law won’t protect you. BUT a solid Website Terms and Conditions & Privacy Policy will and we here at The Legal Paige have created a template just for you which includes legally compliant SMS privacy language! 

Texting is a powerful way to connect, but it comes with serious legal strings. Whether you’re marketing in Miami, Minneapolis, or anywhere in between, make sure your SMS strategy is legally sound.

THIS BLOG POST IS NOT A SUBSTITUTE FOR LEGAL ADVICE. EVERY SITUATION IS DIFFERENT & IS FACT-SPECIFIC. A proper legal analysis is necessary based on your location and contract. Consult an attorney in your home state for advice regarding your contract or specific legal situation.

See our full disclaimer here.