TCPA Basics for Small Business: Consent, Hours, Mistakes

The short answer

The Telephone Consumer Protection Act (TCPA) is the US federal law that decides when a business may call or text people, which calls need consent, and what happens if it gets that wrong. For most small businesses, three things carry nearly all the risk:

1. Marketing calls or texts sent with automated tools or a prerecorded or artificial voice need the person's prior express written consent.
2. Telephone solicitations to residential numbers are limited to 8 a.m. to 9 p.m. in the called person's local time, and may not go to numbers on the National Do Not Call Registry unless an exemption applies.
3. Opt-outs ("stop", "unsubscribe", "don't call me again") must be honoured quickly, within ten business days at most.

A person who receives an unlawful call or text can sue for actual losses or $500 per violation, whichever is greater, and a court can raise that to three times the amount if the violation was willful or knowing ^[1]. Because each call or text is a separate violation, a modest campaign can add up quickly.

This guide explains the rules as of October 2026 in plain language, for owners and office managers of small businesses. It is educational information, not legal advice. If you run a real outbound campaign, have a lawyer review it.

What the TCPA is and who enforces it

Congress enacted the TCPA in 1991 to address a growing number of telemarketing calls. It restricts telemarketing and the use of automatic telephone dialing systems and artificial or prerecorded voice messages. The FCC adopted its first rules under it in 1992, including the duty to keep a company-specific do-not-call list; in 2003, in coordination with the FTC, it created the national Do Not Call Registry; and in 2012 it required prior express written consent before telemarketing robocalls ^[2].

The working rules are in 47 CFR 64.1200. A separate FTC rule, the Telemarketing Sales Rule (TSR), overlaps with it for sales calls ^[3]. In practice a small business should assume both apply to its sales calls and follow the stricter reading.

Two court decisions changed how these rules are read:

• In Facebook v. Duguid (decided 1 April 2021), the Supreme Court held that an "automatic telephone dialing system" means equipment that can store or produce numbers using a random or sequential number generator ^[4]. A staff member dialling from a mobile is generally outside that definition, but whether a given software tool qualifies is a fact question. The rules on prerecorded and artificial voices were not affected by the decision.
• In McLaughlin Chiropractic Associates v. McKesson Corp. (decided 20 June 2025), the Supreme Court held that district courts in enforcement cases are not bound by an agency's interpretation of a statute; they must decide the law's meaning themselves while giving the agency's view "appropriate respect" ^[5]. FCC guidance still matters, but a court may read the TCPA differently.

Calls versus texts: what counts as a call

For TCPA purposes a text message is generally treated as a call. The FCC's rule says so directly in its exemption provisions: "the term 'call' includes a text message, including a short message service (SMS) call" ^[6]. If you would need consent to call someone with a prerecorded message, plan on needing consent to text them too.

Texting also has a separate, non-legal gate: US carriers require business texts from ordinary local numbers to be registered (A2P 10DLC). That is a carrier requirement, not a TCPA rule, and registration does not replace consent. Our research page on business texting and 10DLC covers it.

Consent: which kind, for which message

The TCPA uses two consent levels. Matching the level to the message is most of the job.

The rule defines prior express written consent as a written agreement, signed by the person, that clearly authorizes the seller to deliver advertisements or telemarketing using an autodialer or an artificial or prerecorded voice, and names the phone number. The agreement must clearly tell the signer that they are authorizing those calls and that signing is not a condition of buying anything. Electronic signatures count where federal or state law recognizes them ^[6].

A rule the FCC adopted in 2023, which would have limited marketing consent to "one seller at a time" and to logically related content, never took effect. The Eleventh Circuit vacated that part of the order on 24 January 2025, holding that the extra restrictions conflicted with the ordinary meaning of "prior express consent" ^[7]. Consent still has to be clear and specific to your business; it just does not have to meet that extra test.

Example consent wording for a web or paper form

Adapt this with your lawyer; it is a starting point, not a safe harbour.

By checking this box and entering my mobile number, I agree that [Business Name] may send me marketing calls and text messages, including messages sent using automated technology or a prerecorded voice, at the number I provided. Consent is not a condition of any purchase. Message frequency varies. Message and data rates may apply. Reply STOP to opt out.

Practical points that matter more than the exact words:

• The box must be unticked by default and separate from your terms acceptance.
• Store the evidence: the wording shown, the date and time, the number entered, and how the person signed (checkbox, signature, form ID).
• Keep informational consent ("text me when my repair is ready") separate from marketing consent. A customer who gave a number for reminders has not agreed to promotions.

Calling hours and Do Not Call

For telephone solicitations to residential subscribers, the FCC rule bars calls before 8 a.m. or after 9 p.m., local time at the called party's location ^[6]. The FTC's TSR uses the same window for outbound telemarketing calls to a person's home ^[3]. When your customer list spans time zones, use the customer's zone, not yours: 8:30 a.m. in Toronto is 5:30 a.m. in Vancouver.

The same FCC rule bars solicitations to residential numbers on the national Do Not Call Registry, and registrations "must be honored indefinitely" until the consumer cancels or the number is removed ^[6]. The FTC adds that sellers and telemarketers must remove registered numbers from their lists at least every 31 days ^[3].

"Telephone solicitation" has a specific meaning. It excludes calls made with the person's prior express invitation or permission, calls to someone with whom you have an established business relationship, and calls by tax-exempt nonprofits ^[6]. An established business relationship exists for 18 months after the customer's last purchase or transaction, or three months after an inquiry or application, and it ends as soon as the customer asks you not to call ^[6].

You also need your own company-specific do-not-call list. Businesses that make telemarketing calls must have a written policy, train staff, record each request at the time it is made, honour it within a reasonable time of no more than ten business days, and keep honouring it for five years ^[6]. People who receive more than one violating call within 12 months from the same business can sue for up to $500 per violation, though a business that shows it had reasonable procedures in place has an affirmative defence ^[1].

On business-to-business calls: most calls to businesses are exempt from the FTC's TSR, except calls selling nondurable office or cleaning supplies ^[3]. That exemption is FTC-only. The FCC's consent rules for autodialled and prerecorded calls to mobiles still apply, and many owners use their mobile as their business line. Treat a mobile number as protected unless you know otherwise.

Prerecorded and artificial-voice calls: what the message must say

If you place any call with a prerecorded or artificial voice, the message must state the business's name (the name it is registered under) at the start, and a callback number during or after the message. Marketing messages of this kind must also offer an automated, key-press or voice opt-out within two seconds of the identification ^[6].

A compliant opening might be: "This is a message from [Business Name] about your appointment on Tuesday. To reach us, call [number]." For a marketing message, add: "To stop receiving these calls, press 9 now."

Opting out: the rules change on 25 November 2026

Revocation is where small businesses most often get caught, and the rule is in flux.

Until 24 November 2026, the current text of 47 CFR 64.1200(a)(10) applies. A person may revoke consent "by using any reasonable method". Replying "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" to a text, using a key-press opt-out on a call, or using a website or phone number you designate all count automatically. Requests must be honoured within ten business days, and you may not insist on one exclusive method. You may send one confirmation text, which is presumed fine if sent within five minutes and must contain no marketing.

From 25 November 2026, FCC 26-67 (adopted 30 September 2026, published at 91 FR 67214 on 26 October 2026) changes three things ^[8]:

• Exclusive method allowed. A business may designate one of the three standard methods (key-press or voice opt-out on the call, a reply text using a standard word, or a designated website or phone number) as the only way to revoke, provided it discloses that method clearly on each call or text. A texter can meet the disclosure duty by including at least one standard word such as "Reply STOP to opt out", but must still honour all seven words.
• Category-specific revocation for informational messages. A "stop" in reply to, say, payment reminders may be treated as stopping that category only, not fraud alerts or appointment reminders. A revocation in reply to a marketing message still stops all future marketing calls and texts from that business.
• No exclusive method designated? Then you must still accept revocation by any reasonable means. Either way, the ten-business-day deadline stays.

This supersedes the "revoke all" requirement, whose effective date had been postponed to 31 January 2027. The FCC's companion proposal, published the same day at 91 FR 67239, asks whether to shorten the ten-business-day window, require two-way texting, require a "revoke all" option and extend revocations to affiliates; comments are due 25 November 2026 and replies 28 December 2026 ^[9]. Expect further change in 2027.

For a small business, the simplest safe practice is the same under both versions: treat any clear "stop" as a stop, from any channel, within a day or two, and log it.

Five common small-business mistakes

Checklist before you call or text customers

• List every outbound message type (reminders, follow-ups, promotions) and label each informational or marketing.
• For marketing by text or automated or prerecorded call: written consent collected, with the required disclosures, and stored.
• Do Not Call: registry access set up if you make solicitations, list refreshed at least every 31 days, internal do-not-call list kept for five years.
• Calling windows set to 8 a.m. to 9 p.m. in the recipient's time zone.
• Every text carries an opt-out word ("Reply STOP to opt out"); every prerecorded call identifies you and gives a callback number.
• One person owns the opt-out list and checks it weekly.
• After 25 November 2026: decide whether to designate an exclusive revocation method, and if so, disclose it on every message.
• Check your state's own telemarketing law; several states add rules this guide does not cover.

Where an inbound-only business number fits

This section is our reading, not a legal rule. The TCPA regulates calls and texts a business makes. A number that only receives calls, with a menu that routes callers to staff, does not by itself place calls or send texts, so it does not create the consent and calling-hour obligations above. The exposure begins when someone calls or texts customers back, from whatever phone. A staff member returning a voicemail by hand is not using an autodialer under Duguid, but a promotional pitch on that callback is still a solicitation for Do Not Call purposes unless the person asked to be called or you have an established business relationship. If callers mention spam labels on your outbound calls, that is a separate issue covered in why a business number shows up as spam and our STIR/SHAKEN research page.

FAQ

Do calls to other businesses count? The FTC's TSR exempts most business-to-business calls ^[3], but the FCC's consent rules for autodialled and prerecorded calls apply to mobile numbers whoever owns them. Many small-business contacts are mobiles.

Does an existing customer need written consent? For informational messages about their account or appointment, ordinary prior express consent is usually enough. For marketing texts or prerecorded marketing calls, yes, written consent is required. An established business relationship helps only with the Do Not Call rule for solicitations, not with autodialled or prerecorded marketing.

Is a text from my own mobile covered? The opt-out, calling-hour and Do Not Call rules for solicitations do not depend on the equipment. Whether the autodialer rules apply depends on the software used, after Duguid. Consent is the safe default for marketing either way.

How long do I have to honour a "stop"? No more than ten business days from receipt under both the current rule and FCC 26-67 ^[8]. Faster is better.

Is this legal advice? No. This is a plain-language summary as of October 2026. State laws, pending FCC proceedings and your specific messages can change the answer; ask a lawyer before a campaign.

Auto Attendant answers and routes inbound calls only; it places no outbound calls and sends no texts.