SMS lead gen compliance: TCPA and CAN-SPAM best practices

Last updated 2026-07-10

What laws actually govern SMS lead generation compliance?

Two federal laws dominate the conversation, but only one directly hits text messages. That law is the TCPA.

The Telephone Consumer Protection Act, 47 U.S.C. § 227, is the statute you worry about for SMS. It restricts marketing texts sent with an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice to any number without prior express written consent. The FCC implements it through rules in 47 C.F.R. Part 64, and courts have produced thousands of decisions applying it to text campaigns. The TCPA is strict liability. Intent barely matters. Send a text without proper consent, and you owe the statutory damages. ^[1]

CAN-SPAM covers email. Not SMS. The FTC is clear on this point, and its business guide defines a "commercial electronic mail message" in email terms. You will see blog posts claiming CAN-SPAM reaches text messages. They are wrong. ^[2] One wrinkle: some SMS platforms fire an email receipt alongside the text, and that email leg can touch CAN-SPAM. Keep the two separate in your policy documents.

State laws stack on top. Florida, Oklahoma, and Washington have passed SMS-specific statutes that go past the federal floor in places. Florida's 2021 Mini-TCPA, the Florida Telephone Solicitation Act as amended by SB 1120, created a private right of action for unsolicited texts even without an ATDS. That matters, because federal TCPA cases often live or die on the ATDS question. ^[3] Run a lead gen program across multiple states and you need a state-by-state view. Our lead generation compliance news page tracks the changes as they land.

Here is the short version. Build your framework around the TCPA, layer state rules on top, and never confuse CAN-SPAM with your SMS obligations.

What kind of consent do you need before texting a lead?

The TCPA has two tiers of consent. For marketing texts, you need the stricter one, in writing, before the first message goes out.

"Prior express written consent" is the standard for autodialed or prerecorded marketing messages. The FCC's 2012 TCPA order defined it as an agreement, in writing (electronic form counts), that clearly authorizes the seller to send marketing messages to a specific number, signed after the consumer sees a clear disclosure that messages will come and that consent is not a condition of purchase. ^[4] That last piece trips up more teams than any other. If your form says "Provide your number to complete your order" and marketing texts follow, you have a problem.

Informational texts are different. Appointment reminders, delivery notices, one-time passwords: those need only prior express consent, a lower bar, no TCPA-specific written language. But the second a message picks up any marketing character, the written consent requirement snaps into place.

What does "written" mean in real life? A checked checkbox on a web form works, as long as the form spells out what the person agrees to. Verbal agreement on a recorded call is harder to defend, because while the FCC's rule counts electronic records, courts are skeptical of oral-only consent for marketing texts. ^[4] Text-to-join keywords ("Text JOIN to 12345") work if the call-to-action clearly discloses the marketing nature of the messages.

Consent has to be specific to the seller. A lead form reading "I agree to be contacted by our partners" fails under the FCC's 2024 one-to-one consent rule, which took effect for SMS on January 27, 2025. ^[5] That rule requires consent to name the specific company that will send messages, with a clear and conspicuous disclosure of which entities rely on it. Aggregated lead gen, where one opt-in feeds dozens of buyers, is now the riskiest practice in the business.

For a step-by-step build of a compliant opt-in flow, read our guides on sms opt in and SMS opt-in form: what it must say and how to build one.

How did the FCC's 2024 one-to-one consent rule change lead gen?

This is the biggest compliance shift for lead generation companies in a decade. One-to-one consent broke the aggregator model.

In December 2023, the FCC released a Report and Order amending its TCPA rules to require "one-to-one" consent for marketing calls and texts. ^[5] Effective January 27, 2025 for the SMS and voice rules, consent to receive marketing texts must be obtained separately for each seller, and each seller must be named in the disclosure. A single web form lumping consent for a whole network of buyers into one checkbox no longer qualifies.

For aggregators, the effect is severe. A mortgage lead site that used to collect one opt-in and sell the lead to 20 lenders now needs either 20 separate disclosed consents or a different business model entirely. Many aggregators built disclosure carousels naming specific partners, but the FCC's language demands the disclosure be clear and conspicuous, never buried in fine print. ^[5]

For outbound teams buying leads, the risk moved downstream and landed on you. Buy a lead, text it, and if the consent did not specifically name your company, you are the defendant in the class action. The vendor's indemnification clause is cold comfort when your name is on the caption. The fix: require lead vendors to hand over consent records tied to each lead, with the timestamp, the IP address, the exact form language shown, and the specific company named.

Nobody has clean data yet on how courts will read the one-to-one rule, because it is new. But the FCC's text is plain, and the plaintiffs' bar is already filing on it.

What should your SMS opt-in disclosure actually say?

Bad disclosure language causes a huge share of TCPA exposure. Fix the words on the form and you close most of your risk.

At minimum, your opt-in language has to: (1) name your company, (2) describe the messages that will be sent, (3) state message frequency or say "message frequency varies," (4) disclose that message and data rates may apply, (5) explain how to opt out, and (6) link to your privacy policy and terms. ^[4] The CTIA Messaging Principles and Best Practices, which carriers enforce, require the same elements, and carriers will shut down a shortcode or toll-free number that skips them. ^[6]

Here is language that works: "By checking this box, you agree to receive marketing text messages from [Company Name] at the number provided, including messages about [product/service]. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to cancel, HELP for help. See our [Privacy Policy] and [Terms]." Every element is present. The company is named. The marketing purpose is disclosed. The opt-out is stated.

What makes language fail? Consent buried in a wall of terms with no specific reference to texts. A pre-checked box, which most courts and the FCC treat as inadequate because it is not an affirmative act. Generic "contact" language that never mentions texts or names the company. Any phrasing that hints a number is required to finish a transaction.

Double opt-in is not required by the TCPA. It is the strongest evidence you have that the consumer meant to opt in. When someone texts JOIN and gets a confirmation asking them to reply YES, you have a two-step audit trail. Get sued, and that trail is your defense. Our sms double opt in guide shows how to do it without wrecking conversion.

How do you handle opt-outs and revocations correctly?

Opt-out handling is where otherwise clean programs fall apart. The failure is almost always operational, not legal.

The TCPA requires you to honor opt-outs promptly. The FTC's CAN-SPAM rule uses a 10-business-day standard for email, but the TCPA sets no explicit window, and courts expect reasonable promptness, which for SMS means honoring a STOP request before your next send cycle. The FCC's 2024 Report and Order confirmed that consumers can revoke consent through "any reasonable means," well beyond the standard STOP keyword. ^[5] So if someone replies "please remove me" or calls your sales line and says stop texting, you honor it.

Carriers require you to support at minimum STOP, UNSUBSCRIBE, CANCEL, END, and QUIT. Respond with one confirmation message saying you removed them and no further texts will come. Put no marketing content in that confirmation. Send no follow-up asking why they left.

On the operations side, opt-outs have to propagate across your entire CRM, not only the SMS tool. This is where small teams get burned. A contact opts out in your texting platform, but their Salesforce record still reads "OK to text: yes," and three weeks later a campaign hits them again. That second message, sent after a valid revocation, is a willful violation, and the damages jump from $500 to $1,500 per message. ^[1]

Build one suppression list that is the source of truth for opt-outs. Every send system checks it before anything ships. Audit the process quarterly.

What are the TCPA penalties and what does a real case cost?

The numbers are big enough that one bad campaign can end a small company. That is not hyperbole. Read the math.

The TCPA provides statutory damages of $500 per violation (per text message) and up to $1,500 per willful or knowing violation. ^[1] There is no aggregate cap in a class action, which is why these suits settle so large. A campaign that sent 100,000 texts without proper consent faces $50 million in potential statutory damages at the $500 rate. Courts rarely award the maximum in class actions, and many cases settle for cents on the dollar, but seven-figure settlements are routine for mid-size campaigns.

Real case data. In 2021, Papa John's settled a TCPA class action for $16.5 million over marketing texts sent without adequate consent. In 2019, Jiffy Lube's parent settled for $47 million. These are not outliers. The plaintiffs' bar runs specialized TCPA practices precisely because the fee structure, statutory damages with no need to prove actual harm, makes the cases pay. ^[7]

The FCC can also impose its own forfeitures under 47 U.S.C. § 503, separate from private suits. The FTC has enforcement authority over deceptive practices that often overlap with TCPA violations.

For small outbound teams, the real threat is not the mega-settlement. It is the single plaintiff. One person can sue in small claims or federal court over a handful of texts and demand $1,500 each. Serial TCPA plaintiffs, the "professional plaintiffs," file hundreds of cases a year. A purchased list of 5,000 numbers, one bad text apiece, is $7.5 million in exposure at the maximum rate. Let that number drive your consent practices.

Our full breakdown at tcpa sms compliance covers how courts have applied these rules.

Violation Type	Statutory Damages Per Text	Notes
Standard violation	$500	Per message, per recipient
Willful/knowing violation	$1,500	Court may treble
State Mini-TCPA (FL, WA, OK)	Varies, up to $500+ per text	Some states set separate floors
FCC forfeiture	Up to $23,727 per day of violation	Separate from private suits

How should you vet and use third-party lead lists for SMS?

Bought lists are the highest-risk input in any SMS lead gen program. Most compliance people will tell you not to text purchased lists at all. That is the conservative answer, and for most small teams it is the right one.

If you buy anyway, here is the vetting that actually cuts risk. Require the vendor to provide a consent record for every number: the timestamp of consent, the IP address of the device that submitted the form, the URL of the page where consent was given, and the exact verbatim disclosure the consumer saw. Missing any of the four? Do not text the number. Second, the disclosure must have named your company specifically. After the FCC's 2024 one-to-one rule, shared consent does not cut it. ^[5]

Scrub every list against the National Do Not Call Registry before you call or text. The FTC requires telemarketers to check the registry, and while the DNC list was built for voice, texting a registered number with marketing content adds another layer of exposure. Scrub against your own suppression list of prior opt-outs too. ^[8]

Age of consent matters. The FCC and courts have set no bright-line expiration for TCPA consent, but older consents carry more risk. A lead who opted in three years ago, on a form that never named your company, using pre-one-to-one language, is a bad bet. Some practitioners treat consent older than 18 months as functionally expired for marketing texts. That is not a legal standard. It reflects realistic litigation risk.

Real estate teams working lead lists should read our real estate text message marketing guide for sector-specific consent practices.

What does a compliant SMS lead gen workflow look like end to end?

Compliance is a process, not a checkbox. It runs from list acquisition through send through opt-out handling. Six steps.

Step 1: Consent acquisition. Audit your opt-in forms so they include every required disclosure element, name your company, use an unchecked checkbox requiring an affirmative click, and store a timestamped record of each consent. If you use an sms opt-in form, make sure the software logs the form version shown, not only the submission.

Step 2: List hygiene before every send. Run the list through a phone validation tool to strip landlines and disconnected numbers. Disconnected numbers get reassigned, and the TCPA protects the current subscriber, not the person who gave you consent. The Reassigned Numbers Database, run by the FCC, is the authoritative source for numbers that changed hands. ^[9] Scrub against your suppression list and the DNC registry.

Step 3: Message construction. Every marketing text identifies the sender (company or brand), includes an opt-out instruction ("Reply STOP to unsubscribe"), and carries no deceptive content. Keep the message consistent with what the disclosure promised. If someone opted in for mortgage rate updates, do not send insurance offers.

Step 4: Timing controls. The TCPA bans calls and texts before 8 a.m. or after 9 p.m. in the recipient's local time. ^[1] Recipient's time, not yours. A California team texting a Florida consumer at 6 p.m. Pacific is texting at 9 p.m. Eastern, right at the wall. Build timezone detection into your send logic.

Step 5: Opt-out processing. Treat every opt-out as immediate, update the suppression list within one send cycle, and propagate it across all systems.

Step 6: Record retention. Keep consent records, message logs, and opt-out records for at least four years. The TCPA carries a four-year federal statute of limitations. ^[10] Some state statutes run shorter, but four years is the safe floor.

LeadCompliant's free compliance kit includes a checklist mapped to these six steps, plus a sample opt-in disclosure template you can adapt.

For platform-level implementation, the text message marketing software guide covers what to look for in a compliant SMS platform.

Does the TCPA apply to B2B SMS lead generation?

Yes, with nuance. This is one of the most misunderstood corners of TCPA compliance, and the honest answer surprises people.

The TCPA protects phone numbers, not people by their job title. Text a salesperson's personal cell with a marketing message and the TCPA applies, no matter that you pulled the number off LinkedIn or a company website. Cell phones are protected. ^[1]

The one practical carve-out (not in the statute itself) comes from FCC interpretations and some court decisions treating texts to "established business relationships" more leniently for certain informational communications. For marketing texts, no established-business-relationship exception exists in the TCPA the way one exists in older telemarketing rules. Do not lean on it.

B2B texting gets more room on the ATDS question. A rep manually texting one prospect at a time from a phone is almost certainly not using an ATDS, so the TCPA's ATDS consent requirements do not reach that specific act. The risk returns when you use a platform that sends from a pool of numbers, runs a queue or campaign engine, or otherwise automates transmission. The Supreme Court's 2021 decision in Facebook v. Duguid narrowed the ATDS definition, but the fight over what qualifies continues. ^[11]

Teams doing B2B lead gen across borders should also read our b2b lead generation platforms gdpr compliance guide, because EU leads stack GDPR obligations on top of TCPA.

What records do you need to prove consent if you get sued?

If a TCPA suit hits your desk, your defense rests almost entirely on your consent documentation. Cases settle badly because the defendant cannot produce clean records.

At minimum, you need to produce: the exact disclosure the consumer saw at opt-in (not a current version of the form), the timestamp of consent (date, time, time zone), the IP address of the submission, the phone number submitted, and any confirmation message sent. Using double opt-in? Keep the consumer's confirmation reply too. ^[4]

Sounds simple. It breaks in a few common ways. Form software that overwrites language on update, with no versioning, means you cannot prove what the consumer actually saw. CRM migrations that drop the consent metadata. Email lists imported into an SMS platform with no separate text consent (email consent and SMS consent are distinct under the TCPA).

Run this audit. Pick 50 random contacts in your SMS send list and trace each back to its consent record. Can you produce all five data points for every one? If the answer is no for more than a handful, you have a documentation gap to close before your next campaign.

Store these records in a system that is backed up and not chained to a vendor relationship that might end. If your SMS platform folds or you switch providers, export and keep your consent logs.

For more on what tcpa sms compliance documentation looks like in practice, we have a deeper guide on the topic.

How do SMS frequency and content rules affect lead gen programs?

Frequency and content rules are part legal, part carrier-enforced, part plain survival for your deliverability. Ignore them and your throughput dies before any lawyer shows up.

The TCPA sets no explicit cap on how many texts you can send a consented contact. But the disclosure you gave them fences in the reasonable scope of your program. If it said "occasional promotional messages," seven texts a week is going to be tough to defend as consistent with the consent given. Courts look at whether the messages received matched what the consumer agreed to. ^[4]

Carriers and the CTIA Messaging Principles set frequency expectations by message type. For lead gen, the CTIA requires opt-in disclosures to state message frequency (or "message frequency varies"). Say frequency varies, then send twice daily, and you may have a carrier problem even if you are technically inside TCPA bounds. ^[6] Carriers can suspend your shortcode or toll-free number for abuse, and that kills a campaign faster than any suit.

Content rules: messages cannot be deceptive, must identify the sender, and must skip prohibited content, which carriers define broadly to cover adult content, gambling, firearms sales, and more. For lead gen, the message must match what the consumer opted in to receive. Do not cross-sell an unrelated product on a consent that covered one topic.

One practical note on content. Putting your company or brand name at the front of every message is both a legal best practice (the identification requirement) and a deliverability one. Messages that identify clearly draw fewer spam reports, and fewer spam reports means better throughput from carriers.

Which compliance tools and processes are actually worth the cost?

The range runs from free tools that do real work to enterprise platforms small teams never need. Spend where the exposure is, skip the rest.

Start with the tools you actually need.

Phone number validation (landline versus cell, disconnected number detection): services like Twilio Lookup, Telnyx, or Ekata run roughly $0.005 to $0.02 per lookup. For any real list, this is non-negotiable. Texting a landline is a TCPA violation. Texting a reassigned number is live liability. The cost is nothing against the exposure.

Reassigned Numbers Database (RND) access: the FCC runs the RND as a subscription service. Monthly cost scales with query volume, starting around $15/month for small users. ^[9] If you buy third-party leads, querying the RND on every number before sending is the closest thing to insurance you can buy.

DNC scrubbing: the FTC charges for access to the National Do Not Call Registry for commercial scrubbing, currently around $75 per area code per year, with a full national subscription available. ^[8] Free scrubbing tools handle small lists, but confirm they pull current registry data.

Consent management: most CRMs (HubSpot, Salesforce) carry consent fields, but they are rarely granular enough for TCPA compliance without customization. Dedicated consent tools exist (OneTrust, TrustArc) and run $10,000+ per year, which is overkill for small teams. For small and mid-size programs, a locked, versioned spreadsheet with timestamped consent fields is honestly fine if you stay disciplined.

SMS platforms with built-in compliance: platforms that auto-handle STOP processing, maintain platform-level opt-out lists, and enforce send-time windows earn the premium over raw API access. See our text message marketing software guide for what to evaluate.

The tools you probably do not need at small scale: full-stack consent orchestration platforms, AI-driven compliance monitoring, and dedicated TCPA audit firms, unless you run high volume (100,000+ contacts). Put that budget into a good compliance attorney reviewing your forms and policies once a year. The review runs $500 to $2,000 and beats any software subscription that hands you a green checkbox.

LeadCompliant offers free TCPA tools including a DNC checker and a consent language evaluator, worth running as a first audit before you pay for anything.

Frequently asked questions

Does CAN-SPAM apply to marketing text messages?

No. CAN-SPAM covers commercial email, not SMS. The FTC has confirmed this. Text marketing is governed by the TCPA (47 U.S.C. § 227) and FCC rules, plus state statutes like Florida's Telephone Solicitation Act. If your SMS campaign also triggers an email to the recipient, that email leg may fall under CAN-SPAM, but the text itself does not.

Can I text leads from a purchased list if I have a contract with the list seller?

A contract with the seller does not protect you from TCPA liability. The TCPA puts liability on the company that sends the text, not the one that collected consent. If the consent never named your company, or the seller cannot produce documented consent records with timestamps and form language, you carry real exposure texting those numbers.

What is the one-to-one consent rule and does it affect my lead gen program?

The FCC's 2024 Report and Order, effective January 27, 2025, requires TCPA consent for marketing texts to name the specific seller who will send them. Aggregated forms that grant blanket permission to a network of buyers no longer comply. If you buy leads where the consumer consented to contact from "partners," that consent is now inadequate for your texting program.

How quickly do I have to honor an opt-out request?

The TCPA sets no fixed number of days, but courts expect prompt action. For SMS, prompt means processing the opt-out before your next send cycle, ideally within 24 hours. The FCC's 2024 rules also confirmed consumers can revoke consent by any reasonable means, beyond replying STOP, so watch your inbound channels for revocation requests.

Are B2B text messages exempt from the TCPA?

No. The TCPA protects phone numbers, not people by employment status. Text a business contact's personal cell using an ATDS and TCPA consent requirements apply. The one practical distinction: individual manual texts from a rep's phone to a specific prospect may not use an ATDS, which changes the analysis. Platform-based B2B campaigns carry the same TCPA risk as consumer campaigns.

What time of day can I legally send marketing texts?

The TCPA bans marketing calls and texts before 8 a.m. or after 9 p.m. in the recipient's local time zone. The key phrase is the recipient's local time, not yours. If your office is in California and your prospect is in New York, apply Eastern time. Build time zone detection into your platform so sends are blocked outside legal hours.

How long should I retain consent records for TCPA compliance?

Keep consent records at least four years. The federal statute of limitations for TCPA claims is four years under 28 U.S.C. § 1658. Some state analog statutes have shorter windows, but four years is the safe floor. Retain the exact form language shown, the timestamp, the IP address, and any confirmation messages, in a versioned system that is not overwritten when you update your forms.

What happens if a phone number I texted was reassigned to a new owner?

If you text a reassigned number and the new subscriber never consented, you may have a TCPA violation even though the prior owner consented. The FCC created the Reassigned Numbers Database to help callers and texters spot reassigned numbers before sending. Querying the RND before each campaign is the most direct way to cut this risk.

Is double opt-in required by the TCPA for SMS?

No, double opt-in is not required. It is the strongest consent documentation you can have. A two-step process where the consumer initiates contact (texts a keyword) then confirms (replies YES) creates a two-record audit trail that is very hard for a plaintiff to challenge. It does trim opt-in conversion somewhat, so weigh the compliance benefit against your acquisition funnel.

What should my STOP confirmation message say?

Send one message confirming the opt-out. Something like: "You have been unsubscribed from [Company Name] texts. No further messages will be sent. Reply START to resubscribe." Include no promotional content. Send no follow-up asking for feedback. One clean confirmation is all you send, and carriers require you support at minimum STOP, UNSUBSCRIBE, CANCEL, END, and QUIT as opt-out keywords.

Do I need a written privacy policy to run an SMS lead gen program?

The TCPA does not mandate a privacy policy, but the CTIA Messaging Principles require opt-in disclosures to link to one, and carriers enforce it. In practice, every compliant SMS program includes a privacy policy link in the opt-in form. State privacy laws like the CCPA (California) and Virginia's CDPA may also require one independently of your SMS program.

Can I text someone who gave me their number verbally on a phone call?

Oral consent is legally weaker for TCPA marketing text purposes. The FCC's definition of prior express written consent requires the agreement to be in writing, which includes electronic records, but courts scrutinize verbal-only consent for marketing texts. You can document a verbal consent by following up with an email consent form, and that safer path beats texting directly after a verbal exchange.

What is the Reassigned Numbers Database and how do I access it?

The Reassigned Numbers Database (RND) is an FCC-managed registry of phone numbers reassigned from one subscriber to another. Telemarketers and SMS marketers query it to check whether a number changed hands before sending. Access runs through the FCC's RND administrator at reassignednumbers.com. Subscription pricing starts around $15/month for low-volume users and scales by query volume.

Sources

1. U.S. Congress, Telephone Consumer Protection Act, 47 U.S.C. § 227: TCPA statutory damages are $500 per violation, up to $1,500 for willful violations; prohibits autodialed marketing texts without prior express written consent; bans calls/texts before 8 a.m. or after 9 p.m. local time
2. FTC, CAN-SPAM Act: A Compliance Guide for Business: CAN-SPAM applies to commercial email messages; SMS text messages are not covered by CAN-SPAM
3. Florida Legislature, Florida Telephone Solicitation Act (SB 1120, 2021 amendment), Fla. Stat. § 501.059: Florida's 2021 Mini-TCPA created a private right of action for unsolicited marketing texts even without an ATDS requirement
4. FCC, TCPA rules on prior express written consent, 47 C.F.R. Part 64 Subpart L: FCC rules define prior express written consent to require a signed written agreement, clear disclosure of marketing texts, and a statement that consent is not a condition of purchase
5. Reuters, Legal news coverage of Papa John's TCPA settlement (2021): Papa John's settled a TCPA class action for $16.5 million in 2021 over marketing texts sent without adequate consent
6. FTC, National Do Not Call Registry for businesses (telemarketing.donotcall.gov): FTC requires telemarketers to scrub lists against the National Do Not Call Registry; commercial access fees apply by area code or national subscription
7. U.S. Congress, General Federal Statute of Limitations, 28 U.S.C. § 1658: Federal statute of limitations for TCPA claims is four years
8. U.S. Supreme Court, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): Supreme Court narrowed ATDS definition in 2021, holding that a device must use a random or sequential number generator to qualify as an ATDS under TCPA
9. FCC, 47 C.F.R. Part 64, Subpart L, Restrictions on Telemarketing: FCC implementing rules for TCPA including consent requirements, time-of-day restrictions, and identification requirements for marketing calls and texts