TCPA and CAN-SPAM for SMS: What Violations Cost and How to Avoid Them

TCPA and CAN-SPAM for SMS are grouped together, but only one causes the lawsuits that hit text marketers. If your team thinks email compliance applies to texting, or that a few stray messages after an opt-out won’t be a big deal, the math below deserves a careful look. 

The TCPA applies to marketing text messages sent to phone numbers in the US, and it allows consumers to sue for $500 per violation, up to $1,500 if the violation was willful. The CAN-SPAM Act governs commercial e-mail, but it applies only to text-style messages sent to a wireless e-mail address. For most SMS programs, the real financial risk is TCPA and state telemarketing laws.

Learn which law applies, what violations cost, the errors behind recent settlements and the controls that prevent them. It is general information and not legal advice. For the complete list of federal, carrier and state rules, see our guide to  SMS marketing laws.

TCPA vs CAN-SPAM: which law covers your texts?

The deciding factor is where the message goes. A text sent to a phone number is a TCPA matter. A message sent to an email address is a CAN-SPAM matter, including the rare case of an email address hosted by a wireless carrier.

	TCPA	CAN-SPAM
Year passed	1991	2003 (in effect Jan. 1, 2004)
Covers	Calls and texts to phone numbers	Commercial email, plus “mobile service commercial messages” sent to wireless email domains
Consent model	Opt-in: prior express written consent for automated marketing texts	Mostly opt-out for email; express prior authorization for messages to wireless email domains
Who enforces	Consumers (private lawsuits), the FCC, state attorneys general	The FTC, the FCC, state attorneys general, internet service providers
Private lawsuits by consumers	Yes, including class actions	No
Main penalty	$500 per violation, up to $1,500 if willful	FTC civil penalties up to $53,088 per violation

Two points follow from this. First, the opt-out-only model that works for email doesn’t work for SMS. A text program needs opt-in consent before the first marketing message. Second, CAN-SPAM’s FCC rule for wireless email domains (47 CFR 64.3100) is the only part of CAN-SPAM most SMS teams will ever touch, and only if they send to carrier email gateways instead of phone numbers.

What TCPA violations cost

The TCPA sets statutory damages per violation, and each text can count as a separate violation. That’s what turns an ordinary mistake into a large number.

Source of liability	Amount	Who can bring it
TCPA autodialer and consent rules, 47 U.S.C. 227(b)(3)	Actual damages or $500 per violation, whichever is greater; up to $1,500 if willful or knowing	Any recipient, including as a class
TCPA Do Not Call rules, 47 U.S.C. 227(c)(5)	Up to $500 per violation; up to $1,500 if willful or knowing	A recipient who got more than one call or text in 12 months
FTC Telemarketing Sales Rule and CAN-SPAM	Civil penalties up to $53,088 per violation (16 CFR 1.98)	The FTC and Department of Justice
State mini-TCPA laws	For example, $500 to $1,500 in Florida and Oklahoma, up to $5,000 in Virginia, fines up to $20,000 in Connecticut	Consumers or state attorneys general, depending on the state

Here’s the feds’ numbers by the numbers. One text to 5,000 people without valid consent costs $2.5 million in statutory exposure at $500 per text and $7.5 million if a court finds the violation willful. The same list is tripled by two follow-up texts. Class action lawyers do this math, too, which helps explain the trend: According to data reported by, TCPA class action filings rose 95.2% in the first half of 2025 to 1,052 cases compared with 539 a year earlier, according to WebRecon TCPAWorld.

Most cases settle before trial, so settlement amounts are a better guide to real cost than the theoretical maximums. They’re still large.

The mistakes behind recent SMS settlements

Recent settlements over marketing texts tend to trace back to a handful of operational failures, not exotic legal theories.

Texting people after they said STOP

Designer Brands, the parent company of DSW, agreed to pay more than $4.42 million to settle claims that it kept sending marketing texts after customers asked it to stop (Top Class Actions). Opt-out failures usually come from systems that don’t talk to each other: a customer replies STOP in one tool, and a different tool or a stale list keeps texting them.

Texting numbers on the Do Not Call Registry

Zales agreed to a settlement of up to $7,548,300 over promotional texts sent to numbers on the National Do Not Call Registry (TCPAWorld). In a separate case, Clover Network agreed to a settlement of up to $15 million over telemarketing texts sent without consent to numbers on the registry between 2018 and 2023 (CompliancePoint).

Weak or missing consent records

If you can’t prove when and how someone gave consent, you’ll have a hard time defending a claim that they never did. The same problem arises when consent is collected by a third party, hidden away in the terms of service, or tied to a pre-selected box. 

Texting reassigned numbers

Phone numbers change hands constantly. The FCC has estimated that about 35 million numbers are disconnected and made available for reassignment each year (FCC). Consent from the old owner doesn’t carry over to the new one. Checking the FCC’s Reassigned Numbers Database before you text dormant contacts gives you a safe harbor if the database gives you a wrong answer.

Referral and “invite a friend” texts

Cash App’s parent company agreed to a $12.5 million settlement over “Invite Friends” referral texts, a case brought under Washington’s Commercial Electronic Mail Act rather than the TCPA (Payments Dive). Texts your customers trigger to their contacts can still count as your marketing messages under state law.

Sending outside allowed hours

Federal rules bar telephone solicitations before 8 AM or after 9 PM in the recipient’s local time, and Florida, Oklahoma, and Maryland stop at 8 PM. A campaign scheduled in your own time zone can land at 7 AM on the other coast.

What changed in 2025 and 2026

The legal ground under the TCPA shifted more in the last two years than in the previous decade. Here’s what matters for SMS programs.

• Opt-out by any reasonable method (April 11, 2025). Consumers can revoke consent through a STOP reply, a call, an email, or any other reasonable means, and you must honor it within 10 business days. One confirmation text is allowed, with no marketing in it. The provision that would apply an opt-out to all your unrelated messages is delayed until January 31, 2027 (Burr & Forman).
• One-to-one consent rule removed (2025). The Eleventh Circuit vacated the FCC’s one-to-one consent rule on January 24, 2025, and the FCC deleted it from its rules effective August 29, 2025.
• Courts read the statute themselves (June 20, 2025). In *McLaughlin Chiropractic Associates v. McKesson Corp.*, the Supreme Court held that district courts aren’t bound by the FCC’s interpretations of the TCPA (Cornell LII).
• Oral consent in the Fifth Circuit (February 25, 2026). In *Bradford v. Sovereign Pest Control*, the Fifth Circuit held that the TCPA requires only prior express consent, which can be oral (Holland & Knight).
• Texts and Do Not Call in the Seventh Circuit (July 14, 2026). In *Steidinger v. Blackstone Medical Services*, the Seventh Circuit held that texts aren’t “telephone calls” under the TCPA’s Do Not Call private right of action. Other courts, and the FCC, take the opposite view.

These rulings narrow some claims in some courts. They don’t reduce your exposure under state laws, under other circuits’ case law, or under carrier rules, and plaintiffs’ lawyers file where the law favors them. Treat the strictest reading as your operating standard.

The B2B exemption that doesn’t exist

The TCPA has no general exemption for business-to-business texting. If you text a cell phone, the consent and opt-out rules apply whether the person is a consumer or a purchasing manager. Many B2B contacts give you a mobile number as their main line, so a sales team texting “business” contacts from a list can carry the same exposure as a consumer brand.

How to avoid TCPA and CAN-SPAM fines

These controls address the failure patterns above. They work best built into your systems, so they don’t depend on someone remembering to check.

1. Capture consent you can prove. Use opt-in language that names your business, describes the messages, states frequency, says consent isn’t required to buy, and explains STOP and HELP. Keep the date, source, and exact wording for each opt-in. Our TCPA consent language guide and SMS opt-in form examples show what this looks like.
2. Make opt-outs instant and universal. Suppress a number the moment a STOP reply arrives, and sync that status to every system that can send a text, including your CRM, your support tools, and any agency you work with. Log opt-outs that arrive by phone or email too.
3. Scrub before you send to anyone without consent. Check the National Do Not Call Registry and your internal do-not-contact list.
4. Check dormant numbers. Query the Reassigned Numbers Database before re-engaging contacts who haven’t heard from you in a long time.
5. Send by the recipient’s clock. Schedule marketing sends between 9 AM and 8 PM in the recipient’s time zone, which satisfies federal rules and the strictest state windows.
6. Register for 10DLC. Registration doesn’t protect you from lawsuits, but carriers filter unregistered traffic, and a registered campaign forces you to document your opt-in flow. See our 10DLC registration guide.
7. Keep email and SMS consent separate. An email subscriber hasn’t agreed to receive texts. Ask for SMS consent on its own.

If carriers have already flagged your traffic, our guide to what to do after a carrier suspension covers recovery.

Where CAN-SPAM still matters for SMS teams

Most SMS teams also email and the two programs share contacts. CAN-SPAM also requires accurate headers and subject lines, a physical mailing address, a simple way to unsubscribe, and honoring of email opt-outs within 10 business days. The practical takeaway here is to track consent by channel: an email unsubscribe doesn’t cancel out SMS consent unless the person explicitly does so, and an SMS opt-out doesn’t unsubscribe someone from your email list. But with the FCC’s 2025 rule, an email request can revoke text consent, so read what people actually ask for.

How Message IQ helps HubSpot teams stay compliant

Most of the above failures come down to data in the wrong place. An opt-out in one tool, a campaign in another. Message IQ offers two-way texting in HubSpot, so consent and opt-out status are stored on the same contact record that your workflows use. Unsubscribes, deliveries and bounces sync to HubSpot automatically. Message IQ 3.0 scans all outgoing messages for opt-out language and adds it if it’s missing. Our team also handles the registration of your 10DLC brand and campaigns. See how it works at our HubSpot SMS integration page.

Frequently asked questions

Does CAN-SPAM apply to SMS text messages?

In a very narrow case. CAN-SPAM governs commercial email, and its FCC rule applies to commercial messages sent to wireless email addresses, or “mobile service commercial messages.” Texts sent to a phone number are governed by the TCPA and state telemarketing laws instead. 

What are the TCPA fines for text messages?

The TCPA allows recipients to recover actual damages or $500 per violation, whichever is greater, and judges can increase that to $1,500 for willful or knowing violations. Every text can be a separate breach; The FTC also can seek civil penalties of up to $53,088 per violation for Do Not Call violations under its Telemarketing Sales Rule.

Is there a cap on TCPA damages?

The statute sets damages per violation, and does not set an overall cap. Which is why class actions on big text campaigns can be in the millions of dollars in exposure. Most cases settle, with recent settlements over marketing texts ranging from several million dollars to $15 million. 

Do I need consent to text business contacts?

Yes. There is no general business-to-business exception to the TCPA, so if you are texting a cell phone, you need to get the same consent and handle opt-outs whether the recipient is a consumer or a business buyer. Some state laws also apply depending on the area code of the recipient. 

How quickly must I honor an SMS opt-out?

FCC rules require you to honor an opt-out within 10 business days of receipt and consumers can opt out by any reasonable method. Virginia: Businesses must honor a STOP reply for at least 10 years. The safest course of action is to kill the number at once. 

Does 10DLC registration make my texts TCPA compliant?

No. 10DLC registration is a carrier requirement that impacts the delivery of your messages. Your TCPA compliance is based on your records of consent, opt-out processing, and send times. You need both. 

Are oral consents enough under the TCPA now?

A Fifth Circuit decision in 2026, which includes Texas, Louisiana and Mississippi, held that oral consent can satisfy the TCPA. Elsewhere, FCC rules still require written consent for automated marketing texts, and several states require it, and carriers expect documented opt-in. The safe standard is still to get written consent. 

Start with a clean program

If your team markets from HubSpot, Message IQ adds two-way texting with opt-out syncing, automatic compliance language, and registration support built in. Plans start at $49 a month, billed month-to-month with no contract, for businesses in the US and Canada. Compare plans to find the right message volume.

Book Your Free Demo