Text Message Laws Every Business Needs to Follow

What are the text message marketing laws?

Several governing bodies have created regulations regarding telemarketing communications. These laws are updated continually to reflect technological advancements and evolving business practices. Here are some of the laws you should be aware of:

Telephone Consumer Protection Act

The Telephone Consumer Protection Act (TCPA) is the primary telemarketing law in the United States. Passed by Congress in 1991 and governed by the Federal Communications Commission (FCC), the TCPA has been amended numerous times to target unsolicited text messages and phone calls. It emphasizes rights of privacy through the following measures:

• Autodialer restrictions: The TCPA places restrictions on robocalls, in which an automatic telephone dialing system (ATDS) calls or messages consumers without human intervention by selecting phone numbers from a digitally stored list.
• Identification: Commercial entities must identify themselves and clearly state their reason for contact.
• Hours of operation: Communication must occur between the hours of 8 a.m. and 9 p.m.
• Opt-out functions: Consumers can request that their phone number be placed on a do-not-contact list at any time. All text communications must allow consumers to opt out of the company’s subscriber list by directly replying to the text.
• Prior express written consent: Companies may not contact customers with commercial or marketing offers without obtaining prior express written consent. No previous contact, verbal confirmations or purchase history can substitute for that express consent.

CAN-SPAM Act

The Federal Trade Commission (FTC) published the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act) to combat unsolicited email messages containing explicit or offensive content. It supplements the TCPA by extending the laws governing autodialers to all commercial entities. Informational messages that do not promote new business, such as those regarding the status of an already completed purchase, are a permissible exception; they can be sent to customers without express written consent. 

The CAN-SPAM Act was created in 2003, before the widespread adoption of text messaging, so it does not fully govern SMS communication. The FTC is permitted to write new text message marketing regulations within these guidelines, but the FCC remains the chief arbiter of SMS communication laws, through the TCPA. 

Cellular Telecommunications Industry Association guidelines

The Cellular Telecommunications Industry Association (CTIA) is a national trade group that represents the wireless communications industry. The CTIA is not a governing body, but it can discontinue and block the texting services of businesses that refuse to comply with its guidelines.

The CTIA provides a Messaging Principles and Best Practices document to define and elaborate on many of the provisions set forth in the TCPA and CAN-SPAM Act. The document outlines exactly what a business must do to secure a legally binding offer of express written consent from consumers.

Express written consent

Express written consent, as required by the TCPA and defined by the CTIA, validates the contract between a business and its customers to communicate through text messaging. The offer for customer consent to telemarketing must meet, in a single written form, these five criteria:

• Disclose to each customer the nature of why the business requests their contact information.
• Outline a reasonable forecast of how often customers will receive messages and explain what content those messages will contain.
• Provide access to the full terms and conditions of their consent, typically through a hyperlink or direct-reply option.
• Allow customers to immediately terminate the agreement at any time and for any reason through a direct reply.
• Inform them that standard messaging and data rates will apply.

Brian Wilson, former chief revenue officer of SlickText, said obtaining full express written consent is critical.

“The most common mistake we see is not receiving prior consent,” Wilson told business.com. “If there’s one central rule around compliance with federal regulations, it’s to receive consent from the individuals you are going to be messaging.”

International laws

International consumer privacy laws govern all communication conducted within their territories, regardless of a business’s primary headquarters location. The strictest of these laws is the European Union’s General Data Protection Regulation (GDPR).

In addition to requiring express consent, the GDPR mandates any business that wishes to store European customer data to meet six additional data privacy requirements. Complying with these extensive regulations demands significant financial and legal investments.

Canada has its own set of laws – Canada’s Anti-Spam Legislation (CASL) – but differences between CASL and the TCPA mostly pertain to email. If your SMS campaigns meet the express written consent criteria as defined by the TCPA and the CTIA, they will likely be permissible under CASL guidelines. If you are unsure whether your campaigns meet U.S. or international criteria, seek legal counsel.

What are the penalties and fines for not adhering to the laws?

Even just one mistake with text messaging compliance can result in hefty fines, and a full understanding of prior express written consent does not shield businesses from all errors. Garrett Olexa, vice president of legal affairs at Sun Health, warns of several other mistakes businesses often make.

One common misstep, he said, is “mistakenly assuming that just hiring a third party to send out the texts shields their business from liability.”

Even when using a separate texting service, businesses remain responsible for the content of their messages. Each violation triggers a $500 fine, per occurrence. In other words, this is the penalty for each individual message in breach of TCPA compliance, not the fine for the entire campaign.

Therefore, an SMS campaign that illegally messaged 1,000 contacts would result in penalties of at least $500,000. The fines for any violations deemed intentional are then tripled to $1,500 each. In that same campaign to 1,000 contacts, the total penalty, if deemed premeditated, would be $1.5 million – and that assumes only one message was sent to each contact.

These damages are not capped, and businesses are held responsible for every violation. As subscriber lists grow, so do the potential damages, often outpacing insurance coverage.

Olexa warned companies against “assuming their business liability insurance coverage will apply to any statutory violation, which is often not the case.” [Read related article: A Crash Course in the Business Legal Terms You Need to Know]

How can businesses avoid violating text message marketing laws?

The potential for fines and regulations might discourage some businesses from using SMS marketing, but mass texting is too effective to ignore. Here are several ways to fulfill TCPA requirements while successfully marketing your business:

Include all of the information necessary for express written consent.

Use the express written consent guidelines above to ensure that your first message to a new subscriber includes all of the necessary information. It should contain the following information:

• Business name
• Reason for messaging
• Message frequency
• Rates disclaimer
• Privacy policy and terms
• Opt-out instructions

It sounds more obtrusive than it is. Here’s a simple template to get you started:

“Hi [Name], thanks for signing up for the [Company] Summer Sale! We’ll send you personalized deals every week. Up to 4 msgs/month. Msg & data rates may apply. Reply HELP to review terms, STOP to cancel.”

Use keyword short codes.

A keyword short code is a word or phrase that customers can text to a specified number to sign up for your text messages. Businesses can provide that keyword to the customer within a CTIA-compliant disclaimer that includes all components of express written consent. When a customer responds with the keyword, they have provided consent.

Consider a double opt-in.

A double opt-in is the safest way for a business to ensure the legality of its text messages. After a subscriber has provided their phone number, send a message asking them to confirm their subscription by replying “yes” or “no.” The double opt-in erases any doubt that a keyword message or email subscription did not acquire the consumer’s express written consent.

“Any time companies have a certain age level or verification they want to do with an individual … they may want to use a double opt-in to understand how old the person is before [they] agree to include them in [their] text marketing list,” Wilson said.

Maintain your commitments.

Text message campaigns offer the highest open rates of all marketing channels. This can tempt a business to inundate its subscribers with SMS notifications, but contacting customers too frequently can put you at risk of violations and damage your brand image. 

SMS laws ensure a business commits to its promised texting schedule. By adhering to these laws, your text messaging will remain an infrequent surprise, and customers will be less likely to grow annoyed and perceive these messages as spam.

Provide an incentive to sign up.

Offer value for customers who sign up for your text messages. For example, subscribers could receive discounts, limited-time offers or additional features to your core services, such as delivery tracking or real-time alerts. Consider how your favorite brands could convince you to provide your phone number, and then see how your business might use a similar approach. 

Some source interviews were conducted for a previous version of this article.