TCPA Compliance for SMS Marketing in Regulated Industries: Consent, Records and Real Penalties

Cannabis, nicotine, and alcohol brands face more than ordinary SMS marketing requirements. A business may obtain customer permission and follow federal telemarketing rules, yet still be unable to send messages because its provider prohibits the product category. Legal consent and carrier approval are separate questions.

Understanding the Telephone Consumer Protection Act (TCPA) helps regulated brands evaluate consent, opt-outs, records, and potential liability before launching campaigns. It also helps identify when marketing strategies for regulated industries, such as eligible email, SEO, and direct mail, provide a more practical path to customer retention.

Key Takeaways

• TCPA requirements depend on message purpose and technology: Marketing texts sent with covered automated dialing technology generally require prior express written consent, while other communications have different rules
• Opt-outs must be handled promptly: Covered revocation requests must be honored within a reasonable period, no longer than 10 business days, and a narrow FCC revoke-all provision is delayed until January 31, 2027
• Consent does not override carrier restrictions: A legally obtained opt-in cannot make cannabis, CBD, or vaping messages permissible on a provider that bans those categories
• Herb Agency helps brands build first-party audiences: Herb Mail and related retention services support permission-based engagement through eligible channels beyond carrier-delivered SMS
• Herb Agency emphasizes measurable regulated-market growth: Its cannabis and hemp campaign results demonstrate the role of email acquisition, retention, and attribution without implying guaranteed SMS eligibility

Understanding TCPA Rules for SMS Marketing

The TCPA is a federal law governing certain calls and texts, including restrictions on automated communications and telephone solicitation. The Federal Communications Commission (FCC) implements many of its requirements through 47 CFR § 64.1200.

Consent requirements depend on the sending technology, message purpose, do-not-call rules, and state laws.

What SMS Marketers Need to Review

• Message purpose: Promotional texts differ from genuine informational or transactional communications
• Sending technology: Rules covering automatic telephone dialing systems depend on the statutory definition and applicable court decisions
• Recipient permission: A purchase history or email subscription does not automatically grant consent for marketing texts
• Timing and suppression: Telephone solicitation rules, recipient opt-outs, and applicable do-not-call protections still matter
• Provider eligibility: Campaign registration and carrier policies impose requirements separate from the TCPA

The Supreme Court's 2021 Facebook v. Duguid decision narrowed the federal autodialer definition without eliminating state laws or other messaging requirements.

The Additional SMS Challenge for Regulated Industries

Cannabis, hemp-derived CBD, tobacco, vaping, and alcohol products do not face identical messaging policies. Some providers restrict particular campaigns, while others prohibit the underlying business category.

For example, Twilio's forbidden message categories prohibit cannabis and CBD businesses from using its U.S. and Canadian SMS/MMS services regardless of message content. Twilio also prohibits vaping and e-cigarette messaging on the listed U.S. routes, while allowing qualifying U.S. alcohol messaging with appropriate age verification.

Why TCPA Consent Is Not Enough

Regulated SMS programs must be assessed across three separate areas:

• Legal requirements: Federal and state consent, consumer-protection, and product-marketing laws
• Provider and carrier policies: Rules governing the business, campaign category, phone-number type, and content
• Operational controls: Age verification where required, subscriber records, opt-out processing, and delivery monitoring

Neither 10DLC registration nor customer consent overrides a prohibited business category. Confirm eligibility in writing before investing.

TCPA Consent: Express Consent vs. Express Written Consent

The FCC generally requires prior express written consent for telemarketing calls or texts using covered automatic dialing technology. Informational communications may involve a different federal consent standard. Other legal and provider requirements can still apply even when the technology does not meet the federal autodialer definition.

Under the FCC's written-consent definition, agreements must authorize the seller's covered marketing messages to an identified number. Consent cannot be a purchase condition, and electronic signatures may qualify.

Elements of a Clear SMS Opt-In

A defensible marketing signup typically includes:

• Identified sender: The business authorized to send messages
• Explicit purpose: Clear language specifying marketing SMS rather than vague permission for "updates"
• Phone number: The number to which the consumer agrees to receive messages
• Required disclosure: Notice of covered automated marketing and confirmation that consent is not a purchase condition
• Program details: Expected frequency, possible message and data rates, and an accessible opt-out method when required by the provider
• Affirmative action: An unchecked checkbox, signed form, or another clearly documented opt-in mechanism

Double opt-in strengthens consent evidence but cannot authorize a prohibited messaging use case.

What Happened to the FCC's One-to-One Consent Rule?

The FCC's proposed one-to-one and related-topic restrictions were vacated in January 2025. Businesses must still secure valid consent covering the actual campaign.

Opt-Out Requests and Do-Not-Call Rules

Recipients may revoke permission by reasonable methods, including STOP or other clear requests.

The FCC's rule generally requires applicable revocation requests to be honored within a reasonable time, no longer than 10 business days. Processing should be faster whenever possible, and suppression should take effect across the relevant messaging workflow.

The 2026 Rule Update

On January 6, 2026, the FCC extended a limited waiver until January 31, 2027. The delay concerns the requirement to apply an opt-out from one type of informational message to unrelated future calls or texts from the same sender. It does not suspend existing opt-out obligations or grant permission to continue sending messages after a valid revocation.

Businesses should also review national and applicable state do-not-call requirements, along with the federal telemarketing window generally running from 8 a.m. to 9 p.m. at the recipient's location. More restrictive state or provider rules may apply.

Consent Records and SMS Compliance Documentation

An opt-in is difficult to substantiate when the business cannot show what the customer agreed to. Reliable records help resolve customer complaints, provider reviews, and legal disputes.

What to Record for Each Subscriber

• The phone number and sending business or program
• The exact disclosure and version shown when consent was obtained
• The date, time, time zone, and signup method
• Relevant form, webpage, point-of-sale, or keyword enrollment details
• Confirmation activity, when a double opt-in process is used
• Subsequent opt-outs, suppression status, and any renewed consent

Record retention is not governed by a universal four- or five-year TCPA consent rule. Businesses should establish a documented retention period based on applicable requirements, potential claims, and privacy obligations. Separately, the FCC's company-specific do-not-call rules require certain opt-out requests to be honored for five years.

Keeping Records Usable

Maintain exportable records, restrict data access, and update procedures when forms or providers change. Email permission is not SMS consent.

TCPA Penalties: What the Financial Exposure Means

For covered violations under 47 U.S.C. § 227, private plaintiffs may seek actual monetary loss or statutory damages of $500 per violation, whichever is greater. A court may increase the statutory award to as much as $1,500 for a willful or knowing violation.

These figures are potential damages, not automatic fines per text. Actual liability depends on the violation, defenses, and court findings.

Other risks include litigation expenses, complaints, and provider suspension.

State SMS Laws Add Separate Requirements

Federal TCPA compliance does not replace state telemarketing, privacy, or product-advertising obligations. Three states illustrate why national campaigns need jurisdiction-specific review.

Texas

Texas SB 140 expanded telephone-solicitation rules to cover texts in September 2025. However, Texas Secretary of State guidance says prior-consent texters do not need Chapter 302 registration under the state agencies' current litigation position. Other Texas requirements may apply. No blanket $5,000-per-text penalty should be assumed.

Florida

Florida Statutes § 501.059 expressly covers certain sales-related text messages and establishes its own consent and opt-out rules. Businesses messaging Florida consumers should assess that statute rather than assume federal autodialer standards control every state-law obligation.

California

California's Consumer Privacy Act governs aspects of personal-information handling. The state's published penalty thresholds are privacy-law penalties, not an automatic 2,500-to-7,500 surcharge on every TCPA text. Applicable marketing, privacy, and cannabis-specific rules should be evaluated separately.

Implementing a Practical TCPA Compliance Process

SMS eligibility and consent controls should be established before importing contacts or activating campaigns.

Five Steps Before Launch

1. Confirm the channel is permitted: Review the product category, provider, carrier route, and applicable state restrictions
2. Design consent capture: Use clear marketing disclosures and a documented affirmative opt-in
3. Build suppression controls: Recognize opt-outs promptly, synchronize lists, and review do-not-call requirements
4. Verify data quality: Keep consent records, check for changes in phone-number ownership when appropriate, and monitor delivery
5. Review ongoing activity: Audit sample messages, landing pages, consent forms, and policy changes before expanding campaigns

The FCC's Reassigned Numbers Database may help identify numbers disconnected since consent was obtained. Using it is optional, not a universal requirement to check every 45 days.

Choosing an SMS Provider

Evaluate providers on actual permission to serve the business category, documented registration support, opt-out handling, usable record exports, and reporting. Avoid claims that changing numbers, disguising product language, or linking to age-gated pages automatically makes prohibited messages acceptable.

Marketing Options When SMS Is Restricted

When the business or messaging use case is prohibited, the appropriate response is to select another eligible channel. Email, SEO, editorial content, and direct mail offer different ways to acquire and retain customers, subject to their own laws and provider policies.

For example, cannabis email retention marketing allows consent-based customer education and segmented campaigns. Email remains subject to provider policies and the CAN-SPAM Act.

First-party data is especially valuable because it can support eligible channels without assuming access to every advertising or messaging platform.

How Herb Agency Helps Regulated Brands Build Compliant Growth Channels

Herb Agency approaches restricted-category marketing through channel eligibility, audience development, and measurable performance. Its experience is strongest in cannabis and hemp, with capabilities relevant to other regulated markets when adapted to their specific requirements.

The agency's marketing services include:

• Herb Mail: Consent-based email audience development and integration with customer email platforms
• Herb Postal: Trackable direct-mail outreach for qualifying customer segments
• Herb Reactivate: Contact-information recovery for existing email audiences, subject to prior opt-outs and applicable permission requirements
• Herb Dashboard: Reporting that connects campaign activity with engagement and attributed revenue

Herb Agency's DynaVap campaign collected 52,714 email contacts in 2024, achieving a 51.71% open rate and 22.32% click rate. These results highlight the potential of first-party email marketing for regulated brands.

For regulated brands, the objective is to use channels that are both available and commercially useful. Businesses can book a strategy call with Herb Agency to discuss acquisition and retention approaches suited to their product categories.

Frequently Asked Questions

Does every marketing text require prior express written consent under the TCPA?

Not under the same federal rule. Prior express written consent generally applies to marketing texts using covered autodialing technology. Do-not-call rules, state laws, and provider policies may impose separate duties. Documented SMS permission remains advisable.

Can a business use a pre-checked SMS consent box?

Pre-checked boxes provide weak evidence of affirmative consent and may violate applicable requirements. Use an unchecked box or equivalent opt-in with clear disclosures. Purchasing a product or subscribing to email does not automatically authorize marketing texts.

How long must SMS consent and opt-out records be kept?

There is no universal TCPA four- or five-year minimum for all consent records. Set retention policies according to applicable laws and potential claims. Federal company-specific do-not-call rules separately require certain opt-outs to be honored for five years.

What happens when a customer texts STOP?

STOP generally revokes consent for the relevant messaging program. Honor applicable requests within a reasonable time, no longer than 10 business days. The FCC's limited 2027 delay affects certain unrelated communications, not the obligation to stop unwanted texts.

Can cannabis, CBD, and vape brands send SMS if customers consent?

Not necessarily. Some providers prohibit cannabis, CBD, or vaping messages despite customer consent and lawful retail activity. Confirm specific routes and use cases before sending; otherwise evaluate eligible email, SEO, content, and direct mail.

Schedule a call with us to learn more about our services.

Learn more