What You Need to Know About SMS Text Messaging Compliance

Organizations have more to worry about than just outbound calling when it comes to remaining compliant. Under the Telephone Consumer Protection Act (TCPA), all marketing calls including SMS or text messages are subject to government regulation.

The TCPA requires express written consent before contacting someone via SMS or text message. In other words, consumers do not have to opt-out or be on a Do Not Call list to avoid being contacted by text message. A business is not permitted to text a consumer unless the consumer provides express written consent to be contacted via text message.

To protect your organization from costly TCPA fines and safeguard your brand, here is everything you need to know about SMS marketing regulations.

Expressed Written Permission/Consent to communicate via SMS or Text Messaging

To legally text message wireless phone numbers from an automated telephone dialing system (ATDS) or leave an artificial pre-recorded voice message, organizations must capture and manage Express Written Permission (consent) from consumers.

This carveout is specific to each organization and must be maintained to provide proof of consumer consent. The ways to get consent in “writing” in the digital age include website forms, text messages, telephone key presses, and voice recordings.

When communicating with consumers via text message, it’s important that organizations always do the following when obtaining consent:

• Provide accurate information about the nature and content of text messaging when requesting permission
• Keep a record of all “written consent” received regardless of format
• Always provide an easy way to opt out of future communications and honor those opt outs in a timely manner

In most instances, expressed written permission (consent) does not expire. Generally, once a consumer opts-in to receive text messages, organizations are permitted to contact them until the organization receives an opt-out notice or consent is revoked. However, this rule can vary by state. For example, consent in the state of Florida expires after 18 months, making it so consumers have to opt-in again after that time to continue to receive messages.

Telephone Consumer Protection Act (TCPA) and SMS/Text Messaging

The TCPA was established to regulate telemarketing calls and text messages in the U.S. and protect consumers from being bombarded with unsolicited messages. If your organization violates the TCPA guidelines, you are at risk of being fined $500 for each violation and $1,500 per phone call or text message if it is proven that your business knowingly and willfully violated the rules.

In addition to obtaining express written consent to contact consumers via text message, there are some other SMS marketing best practices to implement when texting consumers:

• Provide disclosure with a comprehensive opt-in message including your business name, purpose of messaging, data rate notices, frequency of texts per day, week or month and instructions for both requesting help and opting out
• Clearly communicate terms and conditions
• Only communicate during business hours
• Include your business names in all messages
• Offer consumers an easy way to opt-out
• Respect the FTC (Federal Trade Commission) National Do Not Call Registry and honor opt-outs (not currently a requirement, but part of the FCC (Federal Communication Commission) Notice of Proposed Rulemaking that could become a requirement soon)
• Observe applicable state Do Not Calls lists that explicitly reference text marketing such as Arizona, Indiana, and Tennessee

Robocalls and Automatic Telephone Dialing System (ATDS) Restrictions on Text Messaging

If your company is using an ATDS to communicate with consumers, the TCPA requires that you obtain prior express written consent for both telemarketing and informational calls and text messages to mobile telephone numbers, whether for residential or business purposes. 

It is important to keep in mind that the TCPA’s definition of ATDS has changed over time and many states have adopted the mini-TCPA rule that, among other things, defines what constitutes an ATDS. The federal law currently defines an ATDS as “equipment which has the capacity – (A) to store or produce telephone numbers to be called, using a random or sequential number generator, and (B) to dial such numbers.” On a state level, the definitions of ATDS vary greatly and can either be less restrictive or more restrictive than the federal law.

Mini TCPAs

State-specific mini-TCPAs are increasing across the country and adding new rules and SMS marketing regulations to outbound telephone and SMS/text marketing. This is happening in states such as Florida, Oklahoma, Maryland, and others.

Not only are they redefining what constitutes an ATDS and consent, they are reducing legal calling hours and capping the number of attempts in a 24-hour period to an individual. Companies conducting text marketing should observe these updated outreach standards.

Wireless Restrictions

As more people are choosing remote or hybrid work and using their personal wireless numbers to conduct business, organizations must be more cognizant than ever of wireless restrictions. The TCPA prohibits telemarketers from calling or texting wireless phone numbers using an ATDS unless the caller has obtained prior express consent.

Disconnected/Reassigned Phone Number Database

Businesses face lawsuits every year due to accidentally calling or texting reassigned phone numbers. According to the Federal Communications Commission (FCC), approximately 37 million telephone numbers in the United States are reassigned to new subscribers each year. This means that about 100,000 phone numbers are reassigned every day. The reassignment of phone numbers can happen for a variety of reasons, such as when a customer cancels their service or when a carrier merges with another carrier.

Under the TCPA, consent is associated with the consumer being messaged, not the phone number.

Therefore, callers will be held liable for soliciting phone numbers for which they previously obtained consent to contact if the number has since been reassigned. To avoid text messaging reassigned numbers, organizations must scrub their contact databases to identify these numbers.

Legal Calling Hours and Other Call Curfew Requirements

Regarding call curfew, the TCPA prohibits businesses from text messaging consumers before 8 am or after 9 pm. Organizations must also be aware that text messages to phone numbers in nearly 20 states vary from the federal standard and could result in violations of their legal calling hour regulations.

To be safe, state-specific call curfew hours should be observed for text marketing. 6 different states have prohibitions on various observed holidays, making it critical that your organization stays in-the-know with these incremental restrictions.

State of Emergencies

In some states, it is prohibited from contacting consumers during a state of emergency. For example, in the state of New York, the New York Disaster Emergency Restrictions under the Nuisance Call Act mandates that it is unlawful for telemarketers doing business in the state to knowingly place an unsolicited telemarketing call to any person during a declared state of emergency.

In Louisiana, “during a state of emergency as declared by the governor, while the Office of Homeland Security and Emergency Preparedness requires the Louisiana Public Service Commission to report to the Emergency Operations Center (EOC), no telephonic solicitor shall engage in any form of telephonic solicitation (except as specifically allowed by R. S. 45:844.31).”

What does this mean for your business? It is important to keep up with both federal and state emergency purposes exemptions that may impact your outbound telemarketing efforts.

Known Litigators

There is an established group of known serial litigators that specifically target telemarketing, text messaging, and collections organizations by calling or texting them to initiate a class action lawsuit.

Organizations can protect their exposure to additional risk by identifying and blocking telephone numbers of known TCPA litigators and professional plaintiffs associated with consumer protection-related matters found in state and federal court filings to minimize their exposure.

Postal Code vs. Area Code to Determine Residency

With more than 10 million phone numbers that have different billing postal codes than the area code of their phone number, many organizations want to have control over how they determine residency.

It’s important for organizations to understand where a consumer lives, as area code alone, may not determine residency when looking at regulations such as legal calling/texting hours and frequency.

B2B: Business vs. Residential Phone Numbers

Contacting a business number does not necessarily enact TCPA or DNC restrictions. However, even if a wireless number is being used for business purposes, you must obtain prior consent to contact or text the number utilizing an ATDS.

Your organization can look up a number to identify whether it is a business or consumer line. However, how much time and resources are you willing and able to expend double-checking every number? And how will this slow down your sales and marketing processes?

State Do Not Call Lists

States such as Arizona and Tennessee recently joined the ranks of Indiana by adding “text marketing” to their state telemarketing program. This means that all texts must be screened against their state Do Not Call list as well as the National Do Not Call List.

To ensure your organization is up to date with evolving marketing compliance regulations, take a look at our new and pending State-by-State TCPA and Do-Not-Call Restrictions for 2023 guide to help you avoid costly penalties and protect your brand reputation.

FCC and Notices of Proposed Rulemaking (NPRM)

Early in 2023, the FCC issued a notice of proposed rulemaking (NPRM) entitled “Targeting and Eliminating Unlawful Text Messages” that, among other things, require mobile providers to block texts from invalid, unallocated, unused, or “Do-Not-Originate” numbers, block spoofed texts, apply caller ID authentication standards to the text channel, and mandate the use of the FTC National Do Not Call Registry when texting.

More recently, in another NPRM, the FCC tackled “Revocation of Consent,” which will have direct impact on text marketing. This latest NPRM calls for the consumers ability to revoke consent through “any reasonable method,” “near real-time” honoring of opt-out requests not to exceed 24-hours, and texting to confirm consent revocation or a one-time text message to confirm a consumer’s request that cannot include any marketing or promotional information.

Common Carrier Exemption Guardrails

For years, wireless providers have enjoyed legal carveouts that allowed them to engage their subscribers, including via the SMS/Text channel, if they did not charge the subscriber for the call/text. Recently, the FCC proposed the following:

• Wireless providers must honor customer requests to cease autodialed calls and texts and prerecorded or artificial voice calls with an exemption for informational robocalls and robotexts to their existing subscribers
• The wireless provider must identify name and contact information at the onset of the call
• The voice calls and text messages cannot include any telemarketing, solicitation, or advertising
• The voice call must not exceed 60 seconds and no more than 160 characters for text messages
• There is maximum of 3 voice calls and/or text messages during any 30-day period
• Providers must give subscribers the ability to opt-out by replying “STOP,” and those opt-out requests must be honored immediately

Can your organization keep up with all the regulations surrounding text messaging/SMS marketing compliance?

If all these rules and regulations sound difficult to manage, it is because they are. The ever-changing regulatory landscape makes it challenging for businesses to keep up with the latest requirements and ensure full adherence to complex compliance standards. 

Don’t attempt to navigate the federal and state regulations, express written consent, texting hour time frames and frequency restrictions all on your own. Protect your organization against costly TCPA and other potential violations and see how Gryphon can help today.