TCPA Text Message Rules: What Applies in 2026
TCPA text message rules for small businesses in 2026: what binds you today, what the FCC's Sept. 30 vote could change, and where courts and Texas differ.
Is it right for you?
Your checks are saved on this device only — they reset if you clear browser data or switch devices.
The short answer: one layer is settled, two are moving
As of September 26, 2026, a small business texting customers in the US works under three layers of TCPA rules. The first, consent and opt-out obligations already in force, is settled. The second, an FCC rewrite of the consent revocation rules, is a draft that commissioners are scheduled to vote on September 30. The third, whether a private lawsuit over a marketing text can even be brought, depends on which federal circuit and which state you are in. Marketing texts still need written consent, and STOP still has to work.
This guide separates what binds you today from what might change, with dates and sources for each piece. It is general information, not legal advice, and a lawyer who knows your states should review any texting program before it scales.
What already binds you: consent, opt-outs and damages
Two kinds of consent matter. Informational texts, such as a delivery update or an appointment reminder, need prior express consent, which generally means the customer gave you the number in a context where they would expect that kind of contact. Marketing texts need the stricter prior express written consent: an agreement in writing, bearing the person's signature (an electronic one counts), that clearly authorizes promotional texts [America's Credit Unions, TCPA consent basics, checked 2026-09-26]. A text that mixes a reminder with a sales pitch will generally be treated as a marketing text for consent purposes.
On the way out, the FCC's 2024 consent order lets people revoke consent by any reasonable means and treats replies using the words stop, quit, end, revoke, opt out, cancel and unsubscribe as reasonable per se. It also generally requires senders to process a revocation as soon as practicable and no later than 10 business days after receiving it [The CommLaw Group, FCC recasts TCPA consent revocation rules, checked 2026-09-26]. So a customer who writes "please stop messaging me" has revoked consent even though they skipped the keyword, and a texting platform that only recognizes STOP does not protect you from that claim.
The cost of getting it wrong is set by statute. The TCPA carries statutory damages of $500 to $1,500 per violation, so a modest class action can reach seven figures quickly [Cooley, Seventh Circuit holds texts not telephone calls, July 22, 2026]. One rule you may have heard about is gone: the FCC's one-to-one consent requirement was vacated by the Eleventh Circuit on January 24, 2025, one business day before it would have taken effect [Wiley, 11th Circuit vacates one-to-one consent rule, 2025-01]. That does not make lead-form bundling safe. Consent still has to be clear and specific to your business.
Status board: what is in force, what is draft, what is contested
The table lists each moving piece with its status as of this guide's update date. Rows marked draft or contested are the ones to recheck after September 30.
| Rule or ruling | Status on 2026-09-26 | What a small sender does |
|---|---|---|
| Written consent for marketing texts | In force | Capture a signed or e-signed opt-in that names your business and says the texts are marketing. Keep the timestamp. |
| Opt-out by any reasonable means; STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE are reasonable per se | In force | Honor those keywords instantly and treat clear plain-English requests the same way. Process within 10 business days at the outside. |
| "Revoke-all" for informational texts | Delayed to Jan. 31, 2027; the FCC draft would replace it | Nothing new yet. Keep marketing and service texts on separate lists so a later split is easy. |
| FCC draft order on exclusive opt-out methods | Draft only; vote scheduled for Sept. 30, 2026 | Consider waiting for the final order before rewriting your opt-out flow. Prepare wording that names your opt-out method in every message. |
| One-to-one consent rule | Vacated by the Eleventh Circuit on Jan. 24, 2025 | No action. Bundled lead-form consent still fails on ordinary consent grounds, so name your own business. |
| Steidinger v. Blackstone Medical Services (7th Cir., July 14, 2026) | Binding only in Illinois, Indiana and Wisconsin, and only for one do-not-call claim | Do not treat it as permission to text without consent. Other TCPA claims and state laws still apply. |
| Texas SB 140 (in effect since Sept. 1, 2025) | In force for texts to Texas residents | Consent-based senders do not register with the state, per Texas guidance, but the private right of action remains. |
Two of the rows cut in opposite directions. The FCC draft would ease the burden on senders, while the circuit split makes lawsuit risk harder to predict, so build to what is in force today and adjust when a rule is final.
The FCC draft that could change opt-outs after September 30
On September 9, 2026, the FCC released a draft Report and Order and Further Notice of Proposed Rulemaking on consent revocation. It is scheduled for a vote at the commission's September 30 open meeting, and it is not final until adopted [Ecommerce Innovation Alliance, September 11, 2026; Greenberg Traurig via National Law Review, September 24, 2026]. If adopted as circulated, the rules would take effect 30 days after publication in the Federal Register, which replaces the previously delayed January 31, 2027 date for the revoke-all provision.
The draft makes three moves that matter to a small sender. First, a sender could designate an exclusive opt-out method, choosing one or more of an automated call opt-out, a reply text using the standard keywords, or a website or phone number that handles opt-outs. The method has to be disclosed clearly and conspicuously in the text, and a sender who does that would not have to honor revocations arriving by other means. Second, a revocation aimed at one category of informational messages, such as payment reminders, could be limited to that category, so fraud alerts or appointment reminders could continue. Third, an opt-out from a marketing text would still end all marketing texts from that sender [The CommLaw Group, FCC recasts TCPA consent revocation rules, checked 2026-09-26].
We could not open the FCC's draft itself for this guide, so the details above rest on three law-firm and trade-group summaries that agree with each other. Read the order before you change a workflow. The accompanying further notice is the part to watch. It asks whether the FCC should require faster opt-out processing, end one-way texting for covered messages, and force an automated revoke-all method. None of that is proposed as a rule yet, but a business whose platform cannot receive replies could face a real constraint if it becomes one.
For a small team the actionable step is cheap. Put your opt-out instruction in the text itself (a footer such as "Reply STOP to opt out" already fits the keyword method), and choose a platform that logs every inbound reply. If the draft passes, the sender who has already named a method can use the exclusive-method protection without rebuilding anything.
What the Seventh Circuit decided in Steidinger
On July 14, 2026, the Seventh Circuit decided Steidinger v. Blackstone Medical Services and held that a text message is not a "telephone call" under section 227(c)(5) of the TCPA, the private right of action for do-not-call violations. The plaintiffs said they kept receiving marketing texts after replying STOP or registering on the National Do-Not-Call Registry, and the court affirmed dismissal [Cooley, July 22, 2026; Holland & Knight and Skadden published matching summaries in July 2026]. In Illinois, Indiana and Wisconsin, that particular text-message lawsuit is no longer viable.
Four limits keep this from being a safe harbor. It binds only the Seventh Circuit, and other appeals courts have read the statute the other way: the Ninth Circuit held in Howard v. Republican National Committee (January 2026) that texts are calls under the TCPA. It addressed only section 227(c)(5), not the separate autodialer provisions that the FCC and many courts apply to texts. Indiana and Wisconsin define their own telemarketing rules to include text messages, so state-law claims are untouched. And law-firm commentary already flags the circuit split as a candidate for Supreme Court review, which means the answer can change [Cooley, July 22, 2026].
A small business that texts nationally should therefore keep the same consent and STOP practices in every state. The ruling changes the litigation risk for one claim in three states, and it does not change what the FCC's own rules require of you.
Texas SB 140 adds a state layer
Texas Senate Bill 140 took effect September 1, 2025 and extended the state's telemarketing law to cover certain marketing text messages, including a registration statement and a $10,000 security bond for senders who fall under it. After a lawsuit over the bill settled, the Texas Secretary of State confirmed that a business sending texts with the consumer's prior consent does not need to file the registration statement [Nixon Peabody, Texas telemarketing update, December 10, 2025; Consumer Financial Services Law Monitor, November 2025, reports the Attorney General's position that opt-in SMS falls outside registration].
The same source cautions that the state law carries a private right of action and that the Attorney General's reading, while persuasive, does not bind Texas courts. Keeping proof of consent is what keeps you out of the registration question, and that proof matters most in Texas. Calling-hour limits are a separate topic, covered state by state in our telemarketing calling hours guide.
Which text needs which consent
Most small-business compliance mistakes come from putting a text in the wrong bucket. This table maps common messages to the consent bar and to what a STOP reply should do under the rules described above.
| Text you want to send | Consent bar | If they text STOP |
|---|---|---|
| Sale, coupon, new-product blast | Prior express written consent | All marketing texts from you should stop; the draft FCC order keeps this rule. |
| Appointment reminder or delivery update the customer asked for | Prior express consent (giving you the number for that purpose is usually enough) | Under the delayed revoke-all rule it would end every message; the FCC draft, not yet adopted, would let you limit it to that category. |
| Payment reminder or account notice | Prior express consent | Same split: revoke-all would end everything, the draft would allow category-only handling. Do not mix promotions into these texts. |
| A reminder that also pitches an upsell | Treated as marketing, so written consent | Treat STOP as ending all marketing texts. |
Keep the two kinds of messages on separate lists inside your texting platform. If the FCC draft is adopted, a customer opting out of payment reminders may still want appointment reminders, and separate lists let you honor that without guessing.
A practical setup for a small team
Start with the opt-in. The sign-up form or keyword flow should name your business, say that messages are marketing, state the message frequency and that consent is not a condition of purchase, and store the exact wording the person saw along with the date, time and source. That record is what you produce when a claim arrives, and it is also what lets you answer a Texas registration question. Sender registration for carriers is a different obligation, described in our guide to A2P 10DLC fees and registration.
Next, wire up the opt-out. Every marketing text should carry a plain instruction to reply STOP. Your platform should catch the seven keywords the FCC lists, and someone on the team should read inbound replies that do not match a keyword, because "take me off this list" counts. Our business text messaging software guide includes a test for STOP and reply handling, and the SlickText review walks through testing opt-in evidence and STOP suppression before you send.
Then split your content. Promotions go to consented marketing lists only. Delivery and appointment texts go through a separate flow, and you can see workable wording in our customer update text examples and auto-reply templates. Avoid tacking an offer onto a reminder, since that turns it into a marketing text.
Finally, set a review date. After September 30, check whether the FCC adopted the draft, whether it was published in the Federal Register (which starts the 30-day clock), and whether any court outside the Seventh Circuit has followed Steidinger. The rules above are accurate as of the update date and may change after September 30.
Frequently asked questions
What are the new TCPA rules for 2026?
Three things changed the picture. A draft FCC order released September 9 would let senders pick a single required way to opt out and confine some opt-outs to one category, and commissioners vote on it September 30 (EIA). A July 14 appeals court decision removed one kind of do-not-call lawsuit over texts in three Midwest states (Cooley). The revoke-all rule now waits until January 31, 2027 unless the draft replaces it (Greenberg Traurig).
Is it illegal to text someone without their permission?
Often, yes. Federal rules call for a signed opt-in before automated promotional messages, and each violation can cost $500 to $1,500 (credit union consent primer; Cooley). Some states, Texas among them, add their own text-message rules.
Does the Midwest appeals decision let me skip consent?
No. Steidinger closed off one kind of private suit over unwanted texts. It left the separate auto-dialing rules alone, other circuits, the Ninth among them, take a different view, and two of the three states in that circuit regulate text solicitation under their own statutes (Cooley).
Do I have to honor an opt-out that does not say STOP?
Generally yes under the current rule, when the message clearly says the person wants no more texts. The FCC accepts any reasonable method, and the draft would let a sender name exclusive methods once it is adopted and disclosed in the message (CommLaw Group).
How fast must I process an opt-out?
Promptly, and never later than ten business days under the FCC's 2024 order. The further notice asks whether that outer limit should shrink, so same-day handling is the safer design (CommLaw Group).
Do I need to register with Texas before texting Texas customers?
Generally not when each text goes to someone who agreed to receive it, according to state guidance (an official reading, not a court ruling) summarized by Nixon Peabody. A sender without documented agreement may face the registration filing and the $10,000 bond.