TCPA Compliance for Small Businesses: A Checklist
TCPA compliance for a small service business comes down to five habits: get the right level of consent for each kind of call or text, keep sales contacts between 8 a.m. and 9 p.m. in the customer’s time zone, honor every opt-out within 10 business days, check sales lists against the National Do Not Call Registry, and keep records that prove all of it. The checklist below turns those rules into tasks an office manager can tick off, with the paragraph of 47 CFR § 64.1200 each one comes from so you can read the wording yourself.
The stakes come from the statute. Under 47 U.S.C. § 227(b)(3), a person who gets an illegal autodialed or prerecorded call can sue for actual losses or $500 per violation, whichever is more, and a court can triple the award if the violation was willful or knowing. Texts count as calls here: the FCC has read the word that way since 2003, as the Eleventh Circuit noted in a January 2025 opinion.
Sort your calls and texts before you check anything
Almost every rule turns on two questions. Is the message selling something? And is it sent with an autodialer or with an artificial or prerecorded voice? Sort your own traffic first, because a confirmation text and a coupon text sent from the same app are treated very differently.
| What you send | What it is | What the federal rules ask |
|---|---|---|
| A customer texts “can someone come today?” and you reply by hand | A conversation the customer started | No extra permission for your reply under industry guidelines. Stop if they say stop. |
| Booking confirmation or “tech is 20 minutes out” text from scheduling software | Informational | Prior express consent if it goes out by autodialer to a cell, § 64.1200(a)(1). Ask for it when you book. |
| Review request after the job | Informational if it stays plain | Same consent as above. Add a discount or an offer and it starts to look like marketing. |
| “Spring tune-up, $89 this week” text to past customers | Telemarketing | Prior express written consent if automated, (a)(2). Sales hours and Do Not Call rules apply. |
| Prerecorded voicemail about a schedule change, to a home landline | Commercial, not selling | No consent needed for up to three calls in 30 days, with ID and an opt-out, (a)(3)(iii). To a cell, prior express consent. |
| Prerecorded sales message | Telemarketing | Prior express written consent, to cells and home lines alike, (a)(2) and (a)(3). |
| Cold calls to homeowners who never contacted you | Telephone solicitation | Registry check, calling hours, internal do-not-call list, caller identification. |
Know this, but do not lean on it: the federal autodialer definition in § 64.1200(f)(2) is narrow (equipment using a random or sequential number generator), so texts typed one at a time may fall outside it. The hours and Do Not Call rules apply to sales contacts whatever equipment you use, prerecorded voice is covered on its own, and states can go further. Florida’s § 501.059 counts text messages as telephonic sales calls and requires prior express written consent for those sent with an automated system.
The TCPA compliance checklist
Consent
- List the messages you send and mark each one informational (confirmations, arrival texts, invoices) or sales (promos, membership pitches, reminders that carry an offer).
- For informational texts, ask at booking and note the answer on the job: “Can we text this number about your appointment?”
- For automated marketing texts and prerecorded sales calls, get prior express written consent: a signed agreement naming your business and the phone number, saying the person agrees to marketing messages sent by automated means, § 64.1200(f)(9). An e-signature or checkbox counts where federal or state e-signature law recognizes it.
- State that agreeing is not a condition of buying anything, (f)(9)(i)(B). Never pre-check the box.
- Store the proof: date, time, source, the exact wording the customer saw, and the number.
Timing
- Sales calls and texts only between 8 a.m. and 9 p.m. at the called person’s location, (c)(1). Use the service address’s time zone, not your office’s.
- Check your state. Florida’s § 501.616(6) stops commercial solicitation calls at 8 p.m. and allows no more than three on the same subject in 24 hours.
Opt-outs
- Treat any reasonable request as a stop, (a)(10). A reply of stop, quit, end, revoke, opt out, cancel or unsubscribe is a stop by definition, and so is a plain “please quit texting me.”
- Honor it within 10 business days at the most. Same day is better.
- Send no more than one confirmation text, with nothing promotional in it, ideally within five minutes, (a)(12).
- Requests by voicemail or email count too, (a)(11). As of October 2026 you may not insist on one channel.
- If your texts cannot take replies, say so in every message and give another way to opt out.
Do Not Call
- Before sales calling or texting anyone who is not a current customer, check the National Do Not Call Registry using a copy no more than 31 days old, (c)(2)(i)(D).
- Registry access, per the FTC’s fee rule: the first five area codes are free, and from October 1, 2026 each extra area code costs $85 a year, capped at $23,425. A shop working two or three area codes pays nothing; check the current fee.
- Keep an internal do-not-call list, honor each request on it for 5 years, keep a written policy and train staff on it, (d)(1), (d)(2), (d)(6).
- Know the established business relationship window: a customer who bought from you in the last 18 months, or asked about your services in the last three, is outside the registry rule until they ask you to stop, (f)(5).
Identification
- Live sales calls: give your name, the business name and a number or address where you can be reached, (d)(4).
- Prerecorded messages: say the registered business name at the start and a callback number, (b)(1) and (b)(2). Sales messages also need a key-press opt-out, (b)(3).
Records and vendors
- Keep consent records for as long as you message the customer and several years after. Five years, matching the do-not-call rule, is an easy floor.
- Using a vendor does not move the liability. Under (d)(3), when someone else records do-not-call requests for you, the business the calls are made for is liable for any failure to honor them.
- Write it into the contract: the vendor passes opt-outs to you within a business day, keeps consent logs you can export, and sends only from registered numbers.
What one bad text blast costs
Run the numbers on a common mistake. A pest control company loads its old job list, 600 phone numbers, into a texting tool in March and sends a spring discount. Say 150 of those people never gave written permission, and a court treats the tool as an autodialer.
- 150 texts × $500 = $75,000 at the statutory minimum.
- If the court finds the violation willful: 150 × $1,500 = $225,000.
- A reminder text a week later doubles both figures.
There is a second, separate exposure. If some of those 150 numbers are on the national registry and get more than one sales text within 12 months, § 227(c)(5) gives each of them a claim of up to $500 per violation. The same subsection gives a defense to a business that shows it had reasonable practices and procedures in place to prevent the violation, which is why the written policy below is worth an hour of your time. Doing it right costs one checkbox on the booking form.
Rules that changed recently
Much of the guidance online predates these four changes.
- Revocation rules took effect April 11, 2025. That is when the FCC’s “any reasonable means” opt-out rule, the 10-business-day limit and the five-minute confirmation text became enforceable, according to the FCC’s own order DA 25-312.
- The “stop means stop for everything” piece is on hold. The same order delayed the part that makes a stop to one kind of message end unrelated messages too, and order DA 26-12 pushed it to January 31, 2027. As of October 2026, FCC 26-67 replaces it 30 days after Federal Register publication: a stop to an informational message may then cover only that category, and you may name exclusive opt-out methods if every call or text discloses them. The safe habit either way: when someone says stop, stop everything that needs consent.
- The one-to-one consent rule never arrived. On January 24, 2025 the Eleventh Circuit vacated the FCC’s 2023 rule that would have limited marketing consent to one company at a time and to closely related topics (Insurance Marketing Coalition v. FCC).
- Courts read the statute themselves now. In McLaughlin Chiropractic Associates v. McKesson (June 20, 2025), the Supreme Court held that district courts are not bound by the FCC’s reading of the statute. An old FCC ruling that seemed to protect a practice can be argued again, so build on the conservative reading.
A written do-not-call policy you can adapt
Paragraph (d)(1) requires a written policy, available on demand, from anyone making telemarketing calls. Edit the brackets, print it, and have everyone who calls or texts customers sign it.
[Company] calling and texting policy. 1. Anyone who asks us not to call or text, in any words and by any channel, goes on our internal do-not-call list the same day. 2. We stop sales calls and texts to that number within 10 business days at most and keep the request on file for five years. 3. We place sales calls and send sales texts only between 8 a.m. and 9 p.m. in the customer’s time zone. 4. Before sales calling or texting anyone who is not a current customer, we check the National Do Not Call Registry using a copy no more than 31 days old. 5. We send automated marketing texts only to people who gave written consent, and we keep a record of when and how they gave it. 6. Everyone who calls or texts customers reads this policy when hired and once a year. Policy owner: [Name]. Last reviewed: [date].
The TCPA glossary entry defines the law in brief, and the SMS compliance guide covers carrier registration. For depth, read what counts as TCPA consent, the rules for business texts and, if you cold call, the Do Not Call list rules.
This is general information, not legal advice. For a specific situation, ask a lawyer licensed in your state.
FAQ
Does the TCPA apply to small businesses?
Yes. Neither 47 U.S.C. § 227 nor the FCC’s rules exempt a business because it is small. A two-truck shop that sends automated marketing texts faces the same $500-per-message exposure as a national chain.
Do I need consent to send appointment reminder texts?
If the reminders go out automatically to cell phones, you need prior express consent, the lighter of the two levels. Ask “Can we text this number about your appointment?” when you book and note the answer. Keep offers out of reminders so they stay informational.
Can I text a customer whose number is on the Do Not Call list?
The registry rule covers telephone solicitations, so informational texts about a job are outside it. Sales texts are allowed if the customer bought from you in the last 18 months or asked about your services in the last three, unless they have asked you to stop. Written permission to contact them also works.
How fast do I have to honor a stop request?
Within a reasonable time, and never more than 10 business days. You may send one confirmation text with no marketing in it. Requests to your internal do-not-call list must be honored for five years.
Does the TCPA cover calls I dial by hand?
Partly. The autodialer and prerecorded-voice rules turn on equipment and recorded voices, so a live call you dial yourself to follow up on a quote is outside them. A sales call dialed by hand still has to respect the 8 a.m. to 9 p.m. window, the national registry and your internal do-not-call list.
New field guides by email
Guides for home-service businesses on answering calls, call triage and after-hours coverage: the title, a short summary and a link for up to six of the newest guides on this site. At most one email every 30 days.