TCPA Compliance for Business Texting: What You Must Know in 2026

TCPA violations cost $500 to $1,500 per unsolicited message — and class action lawsuits in this space routinely reach seven and eight figures. This is not a hypothetical risk. Major brands have paid tens of millions of dollars to settle TCPA claims, and plaintiffs' attorneys actively hunt for businesses that are texting without proper compliance infrastructure.

If you're sending business text messages in the U.S., you need to understand the Telephone Consumer Protection Act. This guide covers the 2026 landscape — what the rules actually require, where most businesses get it wrong, and how to build a program that holds up.

What the TCPA Actually Requires

The Telephone Consumer Protection Act, passed in 1991 and substantially updated since, establishes federal rules for how businesses can communicate with consumers via phone and text. For SMS/MMS marketing in 2026, the core requirements are straightforward in principle but frequently misapplied in practice.

Prior Express Written Consent

Before sending any marketing or promotional text message to a consumer, you need their prior express written consent. The word "written" is significant — this doesn't mean a verbal agreement or an implied consent from a business relationship. You need a clear, affirmative action by the consumer that acknowledges they're agreeing to receive text messages from your business.

"Written" in this context includes digital records. A checkbox on a web form, a keyword opt-in by text, or a signed paper form all qualify — as long as the consent clearly describes what the consumer is agreeing to receive, from whom, and that they understand message and data rates may apply.

What doesn't qualify: pre-checked consent boxes, consent buried in terms of service, purchase confirmation opt-ins that don't specifically mention marketing texts, or email opt-ins that don't explicitly include SMS/MMS.

The FCC's 2024 One-to-One Consent Rule

A significant FCC ruling that took effect in January 2025 changed the consent landscape for many businesses. The new rule requires that TCPA consent be specific to a single seller — meaning consent obtained through a lead generation form that lists dozens of companies does not satisfy TCPA requirements for marketing texts from any of those companies.

If you've been buying leads or using shared consent forms, your consent infrastructure likely needs to be rebuilt. Each consumer must give consent specifically to your business, not to a generic "marketing partners" category.

Opt-Out Requirements

Every SMS/MMS marketing message must include a clear and simple way for recipients to opt out. "Reply STOP to unsubscribe" is the standard mechanism, and it must be honored immediately. Once someone opts out, you may not send them further marketing messages. Continuing to text after an opt-out is a separate TCPA violation for each message sent.

Your opt-out process needs to be automatic and immediate. Manual processes that depend on a staff member updating a list are insufficient — any delay creates liability.

Where Most Businesses Get TCPA Wrong

Consent Documentation Gaps

The most common TCPA problem is consent that was obtained but not documented in a way that can be proved years later when a lawsuit arrives. Courts require businesses to show exactly when consent was given, what the consumer agreed to, and how the consent was recorded.

A screenshot of a form isn't enough if you can't tie that form to the specific consumer who consented. Your consent records need to include: the consumer's phone number, the date and time of consent, the exact language they agreed to, and the method (web form, keyword opt-in, etc.).

Purchased and Third-Party Lists

Buying contact lists and texting them is one of the highest-risk activities in SMS/MMS marketing. Unless you can verify that each person on the list explicitly consented to receive texts from your business specifically — not from a lead aggregator, not from a related company — you're sending without proper consent.

Even lists from reputable data providers typically don't meet 2026 TCPA consent standards. The one-to-one consent rule means historical blanket consents are no longer sufficient.

Re-engagement Campaigns to Dormant Contacts

Texting customers who haven't engaged in two or three years carries real risk. Consent obtained years ago may not cover your current texting program if that program has changed materially. And if any of those numbers have been reassigned to new owners since the original opt-in, you're texting someone who never consented.

The FCC's reassigned numbers database exists specifically to address this problem. Checking against it before any re-engagement campaign is a practical risk management step.

Transactional Message Overreach

Transactional messages — order confirmations, appointment reminders, account alerts — generally don't require marketing consent. But businesses frequently include promotional content in messages they classify as transactional, which converts them into marketing messages subject to prior express written consent requirements.

"Your appointment is confirmed for tomorrow at 2pm — and check out our spring sale!" is a marketing message with a transactional element, not a transactional message. The promotional content changes the consent requirement.

Building a Compliant SMS/MMS Program

Consent Collection at the Source

The cleanest consent collection happens at your own properties: your website, your app, or in person at the point of sale. A dedicated SMS/MMS opt-in on your website or a keyword opt-in (text JOIN to 12345) gives you direct, documentable consent with clear records.

Your opt-in language needs to be explicit. Telling consumers they'll receive "marketing messages from [Business Name] about promotions and updates" is not enough if you also plan to send appointment reminders or service notifications — list all the message types. Being specific at opt-in prevents disputes later about what consumers agreed to.

Suppression Lists

Every number that has opted out needs to go on a suppression list that is applied to every outbound campaign before sending. This list needs to be maintained in real time and cross-referenced with any external lists you use. A suppression failure — sending to someone who has opted out — is a clean TCPA violation.

Consent Audit

If you've been running an SMS/MMS program for several years without reviewing your consent practices, an audit is worth the effort. Walk through every source of phone numbers in your database and verify that each has documentable, one-to-one consent that meets current standards. Numbers that can't be verified should be suppressed.

How Textmunication Approaches Compliance

We've built 10DLC registration, opt-out automation, consent documentation, and suppression list management into the platform infrastructure — so the mechanics of compliance don't depend on your team remembering to do the right thing every time.

When a client comes to us with an existing list, we review the consent documentation before any sends. When we set up new programs, we configure the opt-in flows to capture and store consent records that would hold up in court.

TCPA compliance isn't complicated once the infrastructure is built correctly. The risk is mostly concentrated in programs that were built before compliance became a priority, or in businesses that are scaling SMS/MMS without realizing the legal framework around it.

If you want a compliance review of your current program, reach out. We'll look at your consent practices, your suppression lists, and your message content and tell you exactly where the gaps are.