TCPA Consent for Text Messages: What a Small Business Must Collect and Keep

TCPA consent for text messages is the permission a business must hold before sending an automated text to a mobile number, and the Federal Communications Commission's rules sort it into two grades: prior express consent for informational messages, and prior express written consent for anything that advertises or sells.

Every rule below comes from 47 CFR 64.1200, the regulation implementing the statute, and from the FCC's own consumer guidance, and is current as of October 2026. Educational, not legal advice: whether your particular platform and your particular message are covered is a question for a telecoms lawyer.

What a written consent record has to contain

A written consent record has to do four things under the regulation's definition: be an agreement in writing, bear the signature of the person called, clearly authorize the seller to send advertising or telemarketing messages by automated system, and name the telephone number the signer is authorizing. A bare checkbox does none of them.

The regulation defines prior express written consent as "an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages" by automated or prerecorded means. The same definition requires the agreement to identify the number the signatory is authorizing, the clause most web forms miss: a form that captures a number without saying what will be sent to it has collected a number, not a consent.

Signature includes an electronic one: the FCC's guidance describes written consent as obtainable on paper or through electronic means, including website forms or a telephone keypress. The requirement is a record the business can produce later, not ink.

Where consent is captured, and what does not count

Consent is captured at the moment the number is collected, in whatever form can be retrieved a year later: a web form with a visible consent line beside the field, a signed service agreement, or a keypress the phone system logs. The consent and the number have to be stored together, because the agreement authorizes that number specifically.

What does not count is the larger half of the problem. A completed job, a paid invoice and a number on a work order are records of a transaction, not agreements to receive advertising. Neither is a purchased list, nor a number a customer gave a different company. The FCC also states its rules apply to a mobile number whether or not it is on the National Do Not Call Registry, so absence from the registry is not permission.

The one-to-one consent rule is not in force

The FCC's one-to-one consent rule, which would have required a separate consent naming each individual seller, never took effect. The Eleventh Circuit vacated it on January 24, 2025 in Insurance Marketing Coalition v. FCC, holding that the restriction exceeded the agency's authority because it conflicted with the ordinary meaning of prior express consent in the statute.

The cleanup is on the record too. The court issued its mandate on April 30, 2025; the FCC's Consumer and Governmental Affairs Bureau released a conforming order in July 2025 amending the written-consent definition to match, and the amendment was published in the Federal Register on August 29, 2025, reinstating the previous text. The FCC titled that document as removing the one-to-one consent rule nullified by the court decision.

This matters because a great deal of advice still treats named-seller consent as a live requirement. Anyone can check: the operative definition in 47 CFR 64.1200 carries no named-seller clause as of October 2026. Nothing prevents a narrower rule later, which is why this section carries a date rather than a verdict. Naming the business that sends the texts on your own form is good practice regardless.

A reply of stop starts a ten-business-day clock

A customer may revoke consent by any reasonable method, and the regulation lists words that count automatically: stop, quit, end, revoke, opt out, cancel and unsubscribe, sent in reply to an incoming text. Once received, a revocation has to be honored within a reasonable time not exceeding ten business days.

The phrase doing the work is "any reasonable method", which is wider than the keyword list. A voicemail, an email, a reply with a sentence in it rather than a keyword, or a word said to a technician at the door can all revoke consent, and the FCC's guidance says a consumer may opt out at any time and in any reasonable manner even after previously giving consent. A platform that only recognises the word stop will miss most of them.

Quiet hours, the registry, and what each one covers

Telephone solicitations to a residential subscriber are barred before 8 a.m. and after 9 p.m., local time at the called party's location, and barred entirely to numbers listed on the national do-not-call registry. Those paragraphs of the regulation are written about telephone solicitations rather than texts specifically.

Two honest caveats belong here, because the regulation does not resolve either. The rule text treats text messages as calls through FCC interpretation and case law rather than by naming them in the consent paragraphs, and it does not settle whether a given platform counts as an automatic telephone dialing system, a question courts have worked through since Facebook v. Duguid in 2021. Neither uncertainty is a reason to send at 10 p.m.

The local-time clause catches a growing business: the window is measured where the recipient is, not where the business is, so a list spread past one time zone needs the send schedule to follow the number, not the office clock.

What this looks like when it runs as a built system

Consent stops being paperwork when it is a field on the same customer record the booking and the messaging run from. Mirastart builds the capture, the stored consent grade, the timestamp and one shared suppression list into the system itself, so whether a number may be texted is answered by the record instead of by memory.

The pieces that make that useful already run in production for Charlotte businesses: the live-availability booking system, the missed-call follow-up, the review request that goes to every customer at the same milestone, and the dashboard they report into. A uniform ask at a fixed milestone is both the legitimate way to ask and the version a consent record can describe.