Texting Leads With AI? The TCPA Consent Rules You Need

Key Takeaways

• Under the Telephone Consumer Protection Act (TCPA), text messages count as "calls," so an AI texting agent needs the same consent a business would need for automated calls.
• Informational texts (replying to an inquiry, confirming an appointment, sending a quote) generally need prior express consent, which a customer can give orally or by sharing their number for that purpose. Marketing texts (promotions, lead nurture sequences, cold lead reactivation) need prior express written consent.
• A missed call text back that answers the caller's own inquiry is usually treated as informational. Adding offers, upsells, or a multi-week sequence moves it into marketing territory.
• Capture consent at every entry point (calls, web forms, texts) and store the exact wording, the timestamp, the phone number, and the source for at least four years.
• Honor opt-outs sent by any reasonable means, including plain-language replies like "stop texting me," and confirm them once without marketing.

This article is general information for small business owners, not legal advice. TCPA rules vary by message type and state, so confirm your specific setup with a lawyer who handles telecom compliance.

What is TCPA consent, and does it apply to AI text messages?

TCPA consent is the permission a business must obtain before it sends automated calls or text messages to a consumer's phone, as required by the federal Telephone Consumer Protection Act. TCPA consent applies fully to AI texting agents, because courts and the FCC treat a text message as a "call" under the law.

The Supreme Court confirmed in Campbell-Ewald v. Gomez (2016) (opinion text via Cornell Law's Legal Information Institute) that a text message qualifies as a call under the TCPA. That means every automated follow-up text, whether written by a person, a template, or an AI model, falls under the same consent rules.

The FCC has also made clear that AI does not get a pass. In its February 2024 Declaratory Ruling (document published by the FCC), the agency stated that AI-generated voices count as "artificial or prerecorded voice" under the TCPA. For a service business running an AI voice agent and AI SMS follow up together, the safe assumption is simple: treat every automated touch as covered.

The 2021 Facebook v. Duguid decision (Supreme Court opinion at supremecourt.gov) narrowed the definition of an "automatic telephone dialing system." Some vendors cite that ruling to argue their texting tools fall outside the TCPA. Do not build a business on that argument. State "mini-TCPA" laws often use broader definitions, carriers enforce their own consent rules, and the artificial voice rules apply regardless of dialing equipment.

What kind of consent do I need before my AI agent texts a lead?

The consent a business needs depends on what the AI text message says. Informational messages, like replying to an inquiry or confirming booked appointments, generally require prior express consent. Marketing messages, like promotions or lead nurture sequences, require prior express written consent, a stricter standard with specific disclosure requirements.

The definitions sit in the FCC's TCPA regulations at 47 CFR 64.1200. Here is how common follow-up messages tend to fall:

What makes consent "written"?

Prior express written consent is a signed agreement, and an electronic signature counts under the federal E-SIGN Act (statute text via Cornell Law's Legal Information Institute). The agreement must clearly authorize your business to send marketing messages using automated technology to a specific number, and it must state that consent is not a condition of purchase. A checked box on a web form or a "YES" reply by text can satisfy the signature element when the wording is right.

What happened to the "one-to-one consent" rule?

The FCC adopted a rule in late 2023 that would have required consent to name one specific seller at a time. The Eleventh Circuit vacated that rule in January 2025 in Insurance Marketing Coalition v. FCC (opinion published at uscourts.gov). For a business collecting consent for its own messages, naming your own company in the consent language is still the right practice.

Is a missed call text back legal without written consent?

A missed call text back is generally treated as an informational reply when the message only responds to the caller's own inquiry, such as "Sorry we missed you, how can we help?" The caller initiated contact, so many attorneys view a direct reply as covered by prior express consent. Promotional content in that first text changes the analysis.

The line to watch is scope. A caller who rang about a broken furnace has invited a reply about the broken furnace. That same caller has not agreed to a monthly newsletter, a maintenance plan pitch, or a six-week lead nurture sequence.

A safer missed call text back flow looks like this:

1. First text: answer the inquiry only. Identify your business and offer to help or book.
2. Two way texting: keep the conversation focused on the service they asked about. AI appointment booking, scheduling, and quote follow up fit here.
3. Consent ask: if you want to send marketing later, ask directly, for example: "Want occasional texts about seasonal offers from Riverside HVAC? Reply YES. Msg & data rates may apply. Reply STOP to opt out. Consent not required to buy."
4. Record the answer with a timestamp.

An AI texting agent such as InstantReply.ai can run that missed call text back sequence automatically, so after hours cover does not come at the cost of crossing from an inquiry reply into unconsented marketing.

How do I capture consent on a phone call handled by an AI voice agent?

An AI voice agent can capture prior express consent orally by asking the caller a clear question, such as "Is it okay if we text this number about your appointment?" and logging the answer. Oral consent works for informational texts. Marketing texts need written consent, which the agent can trigger by sending a follow-up text that asks the caller to reply YES.

Oral agreement on a call does not meet the written standard for marketing. The practical fix is a two-step flow:

• On the call: the AI receptionist confirms the mobile number and asks permission to text about the specific request (booking, quote, reminders). The call recording or transcript stores the answer.
• By text afterward: a transactional text confirms the booking and, separately, asks whether the customer wants promotional texts. A YES reply becomes the written record.

Make sure the question is unambiguous. "We'll text you" is a statement, not a request. "Can we text you?" followed by a recorded "yes" is consent. If your AI answering service also discloses that it is an automated assistant, keep that disclosure in the transcript too; several states have their own AI or bot disclosure laws.

How should my web forms ask for texting consent?

Web forms should collect texting consent with a separate, unchecked checkbox next to clear language naming your business, the type of messages, the use of automated technology, and the fact that consent is not required to buy. Pre-checked boxes and consent hidden in terms of service are weak evidence and invite disputes.

Sample checkbox language you can adapt with your lawyer:

☐ I agree to receive text messages from [Business Name] at the number provided, including appointment reminders, quote updates, and promotional offers, sent using automated technology. Consent is not a condition of purchase. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. [Link to privacy policy and SMS terms]

A few practical rules:

• Keep the checkbox optional so the form still submits without it. Your team can still reply to the inquiry itself.
• Split consent if needed: one box for service updates, one for marketing.
• Save a screenshot or version of the form each time you change the wording, so you can prove what a lead saw on a given date.

Carriers enforce similar standards. US business texting from standard numbers runs through 10DLC registration, and carriers follow the CTIA Messaging Principles and Best Practices, which expect clear opt-in language. Weak consent flows can get a campaign rejected or filtered before any lawyer gets involved.

What records prove I had consent?

Proof of TCPA consent is a stored record showing who agreed, to what wording, on which number, when, and through which channel. Without that record, a business may be unable to defend a claim even if the customer genuinely agreed. Keep consent records for at least four years.

The four-year figure comes from the federal catch-all limitations period in 28 U.S.C. 1658, which courts generally apply to TCPA claims. Store these fields for every contact:

Whichever platform you use, whether InstantReply.ai, Podium, or a CRM add-on, the legal responsibility stays with your business. Check that your tool exports these records, rather than assuming the vendor keeps them for you.

How do people opt out, and how fast must I stop texting?

Consumers can revoke TCPA consent by any reasonable means, including texting STOP, QUIT, CANCEL, UNSUBSCRIBE, or a plain sentence like "please stop texting me." Under the FCC's revocation rules, which took effect in April 2025, businesses must honor the request within 10 business days, and an AI agent should stop immediately.

The rules come from the FCC's 2024 Report and Order on consent revocation (Federal Register public inspection copy). Key points for an AI texting setup:

• Understand natural language. An AI model should recognize "not interested, don't text me again" as an opt-out, not as an objection to overcome.
• Send one confirmation, if any. A single text confirming the opt-out is allowed when it contains no marketing.
• Sync across channels. If a lead opts out by text, remove them from texting everywhere, including other campaigns and other tools.

What other rules apply beyond consent?

Beyond consent, AI SMS follow up must respect quiet hours, state telemarketing laws, carrier registration rules, and the National Do Not Call Registry for marketing. The federal rule limits telephone solicitations to between 8am and 9pm in the recipient's local time, and some states set tighter windows and frequency caps.

• Quiet hours: the 8am to 9pm federal window appears in 47 CFR 64.1200(c)(1). Schedule AI messages by the lead's time zone, not yours.
• State mini-TCPAs: Florida's Telephone Solicitation Act restricts solicitation timing and frequency more tightly than federal law, and other states have followed.
• Healthcare: dental and medical clinics also have HIPAA duties. Keep appointment reminders minimal and avoid treatment details in texts.
• Do Not Call: marketing texts to numbers on the national registry need written consent or an established business relationship that meets the rules.

What does a TCPA mistake actually cost?

A TCPA violation carries statutory damages of $500 per message, which a court can triple to $1,500 per message for willful or knowing violations. The penalty multiplies by every text sent, so an automated sequence sent to hundreds of leads without valid consent can produce a very large class action exposure.

Those amounts are set in the statute itself at 47 U.S.C. 227(b)(3). For example, imagine a five-text reactivation campaign sent to 200 old leads with no written consent: that is 1,000 messages, or $500,000 in potential statutory damages before any willfulness finding. Insurance, real estate, and home services businesses are frequent TCPA targets, so the risk is not theoretical.

The upside is that compliance and fast inbound lead response work together. A tight lead response time keeps the conversation inside the customer's own inquiry, which is the safest place to be.

What should a compliant AI follow-up setup include?

A compliant AI follow-up setup separates informational from marketing messages, captures consent at every entry point, stores proof for four years, honors opt-outs instantly, and sends only within allowed hours. Each of those pieces can be automated, so compliance does not have to slow down how quickly you answer leads.

• Map every automated message to "informational" or "marketing."
• Add optional, unchecked SMS consent boxes to every form.
• Script your AI voice agent to ask permission to text and log the answer.
• Keep first replies to missed calls focused on the caller's inquiry.
• Use a YES keyword reply to collect written consent for marketing.
• Store consent records with wording, timestamp, number, and source.
• Configure natural-language opt-out detection and cross-channel suppression.
• Schedule messages by recipient time zone and check state rules.
• Register your texting campaign under 10DLC.
• Have a lawyer review your consent language once, then reuse it.