Text marketing in the US: what the TCPA requires before you send

The rule draws a line between consent and written consent. A call or text made with an autodialer to a wireless number generally needs prior express consent, while a call or text that includes an advertisement or constitutes telemarketing needs prior express written consent. Health care messages from a covered entity or its business associate sit under a separate provision with their own conditions.

The regulation defines prior express written consent precisely, which is useful because it turns a vague approval into a checklist. There has to be an agreement in writing bearing the signature of the person called, it must clearly authorize the seller to deliver advertisements or telemarketing messages using an autodialer, and it must name the number to which those messages may be sent. Electronic and digital signatures count where the law recognises them.

Two disclosures have to appear clearly and conspicuously inside that agreement. The person signing has to be told that they are authorizing autodialed telemarketing messages, and they have to be told that signing is optional and cannot be required as a condition of buying anything.

Health care providers get a defined exemption for a specific list of purposes: appointment and exam confirmations and reminders, wellness checkups, hospital pre registration instructions, pre operative instructions, lab results, follow up after discharge intended to prevent readmission, prescription notifications and home health care instructions.

The conditions are as important as the purpose list. Messages go only to the wireless number the patient provided. Each one states the provider's name and contact information, and for a voice call that disclosure comes at the beginning. No message may contain telemarketing, solicitation or advertising, and none may carry billing or debt collection content. A provider may send one message per day to each patient, up to three combined per week. Every message has to offer an easy way out, and for a text that means telling the patient to reply stop. The messages also have to comply with the HIPAA privacy rules.

The practical consequence is that a reminder system and a marketing system have to stay separate. The moment a reminder carries an offer for a whitening package or a supplement, it has left the exemption and the marketing consent rule applies instead.

The rule allows a recipient to revoke consent by any reasonable method that clearly expresses a wish to stop receiving calls or texts. It then names several methods that count as reasonable by themselves: an automated opt out mechanism on a call, a reply containing stop, quit, end, revoke, opt out, cancel or unsubscribe, or a request through a website or telephone number the sender designated for that purpose.

Once consent is revoked, the sender may not send further messages on it. Practically, that means the opt out has to reach whatever system sends the messages rather than sitting in an inbox, and it needs to be recorded in a way that survives a change of supplier.

Separate from consent, the rules protect residential subscribers who register an objection. A person or entity making telemarketing calls needs a written do not call policy available on demand, has to train the people making calls on it, has to record a request at the time it is made, and has to honour it. The regulation sets a limit of ten business days for honouring a company specific request and requires the record to be kept for five years.

The caller identification requirements sit in the same place: the person or entity on whose behalf a call is made has to be identified, with a telephone number or address where they can be reached, and the number given may not be one that charges the recipient.

The statute provides a private right of action. A person may ask a court to stop the violation, or recover actual monetary loss or $500 for each violation, whichever is greater, or both. Where the court finds a willful or knowing violation it may increase the award to as much as three times that figure. The FCC can also impose a forfeiture penalty on its own track.

Two operational lessons follow. The first is that consent records matter more than consent intentions, because the sender carries the burden of showing what a customer agreed to and when. The second is that a single bad list can produce a large number of violations very quickly, since the measure is applied per message rather than per campaign.