Texting customers: TCPA rules for health brands

Current as of October 21, 2026.

The short version

Texting customers brings TCPA risk from four directions: consent, opt-outs, calling hours, and state laws stricter than the federal rules. Florida, Oklahoma and Maryland have such laws.
The FCC’s September 30 order will let senders choose exclusive opt-out methods, but it is not yet in effect.
Since 2025, district courts decide what the TCPA means for themselves. Following an FCC interpretation does not ensure a court will agree with it.

Paul’s take

I’ve litigated TCPA cases. They usually turn on a consent record nobody can produce, and an opt-out that never reached every system. The fix is operational, and it costs far less than the lawsuit.

— Paul Albarrán

Why does the TCPA matter for health brands?

Direct-to-consumer health companies reach customers by phone, and most of all by text. Offers, refill prompts and abandoned-cart messages all go to mobile phones. The Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, is a federal law restricting autodialed, prerecorded-voice and telemarketing calls. The FCC’s rules under it appear at 47 C.F.R. § 64.1200. Under those rules, an autodialed marketing text generally needs the recipient’s prior express written consent.

The TCPA lets consumers sue. For autodialed and prerecorded calls, the statute sets damages at $500 per violation, or actual loss if greater. A court may increase the award to as much as three times that amount for willful or knowing violations. The FCC treats text messages as calls under these rules. Each message can be its own violation, so exposure grows with the size of a campaign.

In McLaughlin Chiropractic Associates v. McKesson Corp. (2025), the Supreme Court addressed how much weight the FCC’s readings carry. It held that district courts are not bound by the FCC’s interpretation of the statute. Courts decide what the TCPA means for themselves, while giving the FCC’s view appropriate respect.

What consent do marketing calls and texts need?

The TCPA restricts calls to mobile numbers made with an automatic telephone dialing system or an artificial or prerecorded voice. Outside emergencies and limited exemptions, those calls need the called party’s prior express consent. When such a call or text is marketing, the FCC’s rules generally require prior express written consent.

Prior express written consent has a defined meaning. It is a written agreement, signed by the person called, that clearly authorizes the seller to send marketing using those technologies. It names the phone number to be used. It must also clearly disclose two things. Signing authorizes those marketing calls or texts, and signing is not required to buy anything. An electronic signature recognized under federal or state law can satisfy the signature requirement. In its 2012 order, FCC 12-21, the FCC said that if consent is questioned, the seller bears the burden of proving it.

Consent usually comes from a checkbox or form at signup or checkout. The wording, the placement and the record of what the consumer saw all matter. A company should be able to show who agreed, when, to what language and for which number.

In Facebook, Inc. v. Duguid (2021), the Supreme Court read the autodialer definition narrowly. Equipment qualifies only if it has the capacity to store or produce telephone numbers using a random or sequential number generator. The separate prerecorded voice prong of 47 U.S.C. § 227(b)(1)(A) does not depend on the autodialer definition.

How do the do-not-call rules apply?

The do-not-call rules appear in 47 U.S.C. § 227(c) and 47 C.F.R. § 64.1200(c) and (d). These rules apply to telephone solicitations, which 47 C.F.R. § 64.1200(f)(15) defines by their purpose of encouraging a purchase, not by equipment. A company generally may not send them to a residential number on the National Do-Not-Call Registry. The FCC’s rules extend these protections to wireless numbers and text messages, within limits set by an FCC order.

There are exceptions. One is the consumer’s permission, shown by a signed, written agreement with the seller. Another is an established business relationship. Under the federal rules, that relationship generally runs 18 months from a purchase or three months from an inquiry. A consumer’s request to the seller to stop ends that relationship for marketing purposes.

Companies must also keep their own internal do-not-call list. The rules require a written policy, staff training and a record of each request. Requests must be honored within a reasonable time, which may not exceed ten business days. A request must then be honored for five years.

The FCC’s rules also bar telephone solicitations to residential subscribers before 8 a.m. or after 9 p.m. That window runs on the recipient’s local time. Automated sending should account for each recipient’s time zone.

The do-not-call rules carry their own right to sue. It applies after more than one call within 12 months, made by or on behalf of the same entity. Damages can reach $500 per violation, with the same trebling for willful or knowing violations.

Whether texts count as calls for this right to sue is now contested. In Steidinger v. Blackstone Medical Services (2026), the Seventh Circuit held that it does not cover texts. The court noted that other circuits treat texts as calls under a different provision. The Seventh Circuit issued its mandate on August 5, 2026, and no Supreme Court petition was docketed as of October 21, 2026. Some state laws, such as Florida’s, expressly reach text messages.

How can a consumer revoke consent?

A consumer may revoke consent. Under the rule in force on October 20, 2026, a consumer may revoke by any reasonable means. A reply such as “stop” counts. A revocation must be honored within a reasonable time, not more than ten business days.

The FCC changed this rule in an order adopted on September 30, 2026, FCC 26-67. Once in effect, it lets a sender designate the only revocation methods it must honor. One choice is an automated voice or key-press opt-out on a call. Another is a reply to a text using a listed word, such as “stop”. A website or phone number the sender designates also qualifies. The sender must clearly and conspicuously disclose the chosen method on the call or in the text. Under the order, a valid revocation in reply to a marketing text ends consent to all that sender’s automated marketing.

The order takes effect 30 days after it is published in the Federal Register. It had not been published there as of October 21, 2026. The FCC also asked for comment on shortening the ten-business-day deadline.

Every channel should feed one suppression list. A stop request by text, email or support ticket should reach every vendor that sends messages for the brand.

Is a brand liable for texts its vendors send?

Many health brands use agencies, affiliates and lead sellers. A brand can be liable for calls and texts made on its behalf. The do-not-call right to sue reaches calls made by or on behalf of the same entity.

Purchased leads deserve particular care. The consent must cover the brand that sends the message. Consent gathered on a comparison site may not name the brand clearly enough. In 2023, the FCC adopted a one-to-one consent rule for consent collected this way. In Insurance Marketing Coalition v. FCC (2025), the Eleventh Circuit vacated it. The FCC ordered the rule removed in July 2025, effective August 29, 2025. The general rule still applies: written consent must authorize the seller that sends the message.

Vendor contracts can help. Useful terms require the vendor to follow the TCPA and state law, keep consent records and honor opt-outs across lists. An indemnity can cover violations the vendor causes. It is only as good as the vendor’s ability to pay, so insurance terms matter too. Audit rights let the brand confirm that the vendor does what the contract says.

Which state laws and health rules also apply?

Several states have their own telemarketing and texting laws. Florida, Oklahoma and Maryland each require prior express written consent for automated sales calls. Each state’s definition of that consent expressly covers text messages. Florida, Oklahoma and Maryland each bar sales calls before 8 a.m. or after 8 p.m. Each also bars more than three calls in 24 hours on the same subject. Florida’s limits are in Florida Statutes section 501.616(6) and apply to commercial telephone sellers and salespersons. All three states give consumers a private right to sue. Florida and Oklahoma allow actual damages or $500, whichever is greater. Maryland’s action runs through section 13-408 of its Commercial Law Article, for up to $500 or actual damages, whichever is greater. Florida requires a consumer to reply “stop” and wait 15 days before suing over texts. These summaries reflect the statutes as read on October 20 and 21, 2026. A national texting program should be checked against the current law of each state it reaches.

Health messages raise their own questions. The FCC’s rules treat certain “health care” messages from HIPAA covered entities and their business associates differently. A separate exemption covers free messages from healthcare providers for listed purposes, such as appointment reminders and prescription notifications. That exemption excludes any telemarketing, solicitation or advertising. Neither provision should be read as covering a marketing campaign.

Message content matters too. A text that names a medication or condition can reveal health information to anyone who sees the phone.

What practical steps do health brands commonly take?

Write consent language that meets the definition, and keep a copy of each version.
Store each consent record with the number, the date, the source and the language shown.
Check marketing lists against the national registry and the internal do-not-call list.
Send only within permitted hours in the recipient’s local time.
Route every opt-out, from every channel, to one suppression list.
Put TCPA terms in every vendor and lead source contract.
Review the law of each state the program reaches.

The information on this site is general information, not legal advice.