The Telephone Consumer Protection Act is the United States law that governs automated calls and text messages to individuals. What matters day to day is not the statute but the Federal Communications Commission rule under it, 47 CFR 64.1200, which is where the operative requirements live.
This page describes what that rule says. It is not legal advice, and whether any particular message is lawful depends on facts this page cannot see; ask a lawyer about your own programme.
What does the rule actually prohibit?
Automated marketing contact without the right kind of consent.
The core prohibition covers calls and texts placed with an automatic telephone dialing system or an artificial or prerecorded voice, to the numbers the rule lists, and it names the exception that makes normal business possible:
Initiate, or cause to be initiated, any telephone call that includes or introduces an advertisement or constitutes telemarketing, using an automatic telephone dialing system or an artificial or prerecorded voice, to any of the lines or telephone numbers described in paragraphs (a)(1)(i) through (iii) of this section, other than a call made with the prior express written consent of the called party
Two things follow from the wording. The requirement attaches to marketing content specifically, which is why a purely transactional notification is treated differently from a promotion. And it attaches to the person you are contacting, so consent gathered from someone else, or for a number that has since changed hands, is not consent.
What counts as prior express written consent is defined precisely, and it is stricter than a checkbox. What is express written consent covers the definition.
When may I send?
Between 8 a.m. and 9 p.m. where the recipient is:
No person or entity shall initiate any telephone solicitation to:
(1) Any residential telephone subscriber before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)
The parenthesis is the operative part and the part that gets engineered wrong. The window is in the recipient's local time, and a mobile number's area code is not reliable evidence of where its owner is. A campaign scheduled by the sender's clock will breach the window for part of any national list.
How does someone revoke consent?
However they reasonably choose, and the rule refuses to let you narrow it.
This is the part of the rule most worth reading in full, because it is more specific than most opt-out implementations assume:
A called party may revoke prior express consent, including prior express written consent, to receive calls or text messages ... by using any reasonable method to clearly express a desire not to receive further calls or text messages from the caller or sender. Any revocation request made using an automated, interactive voice or key press-activated opt-out mechanism on a call; using the words “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” sent in reply to an incoming text message; or pursuant to a website or telephone number designated by the caller to process opt-out requests constitutes a reasonable means per se to revoke consent.
Three consequences for anyone building this:
- Seven words are per se revocation. A keyword handler that recognises only
STOPdoes not meet the rule, becauseCANCELandREVOKEand the rest are equally effective. - Other words count too. The rule continues that where a reply uses different words, "the caller must treat that reply text as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent."
- You may not require one channel. "Callers or senders of text messages ... may not designate an exclusive means to request revocation of consent." A message that says opt-outs are only accepted through a web form is asserting something the rule denies.
There is also a provision for senders who cannot receive replies at all: where the protocol does not allow reply texts, the rule requires a clear and conspicuous disclosure of that on each message, along with an alternative way to revoke.
Bird handles the keyword side of this on inbound SMS. Opt-outs and keywords covers which keywords are recognised and what happens to the next send.
How quickly must I act on it?
Ten business days at the outside:
All requests to revoke prior express consent or prior express written consent made in any reasonable manner must be honored within a reasonable time not to exceed ten business days from receipt of such request.
"A reasonable time not to exceed" is a ceiling rather than an allowance. A system that suppresses immediately is doing the obviously safe thing, and one that batches opt-outs into a weekly job is relying on the ceiling to cover its latency.
Does the TCPA apply to my email?
No. The TCPA covers calls and texts to telephone numbers.
The equivalent rule for commercial email in the United States is CAN-SPAM, which works quite differently: it is opt-out rather than opt-in, and it requires specific content in the message itself. What is CAN-SPAM covers it.
Two other things the TCPA is not. It is not the whole US picture, because states have their own statutes and several are stricter. And it is not the same as the carrier and industry requirements you also have to meet to send at all, which are a separate layer covered in the CTIA messaging principles and in 10DLC registration.