Automated Text Messages for Small Business: The Consent Rules

The automation nobody calls automation

When an owner tells me they want to automate something, they usually mean boxes and arrows. Lead comes in, record gets created, somebody gets notified. Almost nobody points at the appointment reminder text and calls it automation.

It is, and it is usually the first one a business turns on. A confirmation at booking, a nudge the day before, a note the morning of. Nobody writes those. Software does, on a trigger, without a human reading them first. That is the whole definition.

It is also the only automation in a typical small business that carries per message statutory exposure. That makes it worth twenty minutes before you turn it on.

A scope note. This post covers outbound automated text messages. If your question is whether your email lands in inboxes at all, that is a different rulebook, covered in email deliverability for small business. None of this is legal advice. It is the checklist we run before shipping a messaging feature.

Texts are treated as calls

The Telephone Consumer Protection Act was written in 1991 and does not mention text messages. The FCC interpreted the word "call" to include texts by regulation in 2003, and the Eleventh Circuit restated the point in a 2025 opinion, noting that the statute on its face says nothing about texts but that the FCC reads "call" to cover them.

So when you read a rule about robocalls, read it as covering your reminder texts too. That single substitution resolves most of the confusion owners have here.

What is actually in force right now

The operative rule is 47 CFR 64.1200(a)(10), which took effect on April 11, 2025. Three things in it change how you build a messaging system.

A customer can opt out any way a reasonable person would recognize as opting out. You do not get to define the magic word. The rule names "stop," "quit," "end," "revoke," "opt out," "cancel," and "unsubscribe" as per se reasonable, and then says other words count if a reasonable person would understand them as a request to stop. Someone replying "please take me off this" has opted out.

Second, you have a deadline.

Third, you get exactly one confirmation message. It may confirm the opt-out and nothing else, carry no marketing, and be the only additional message sent. Send it within five minutes and it is presumed reasonable. Send it later and you are the one explaining why.

The rule that got pushed to 2027

There is a fourth piece, and its status is the thing most articles get wrong.

The same rulemaking said that when someone opts out of one kind of message, you must treat it as an opt-out for all your other messages to them on unrelated matters. Banks, credit unions, and later electric utilities argued this was expensive to build across separate business units, and the FCC has delayed it twice.

The current order is DA 26-12, released January 6, 2026, which pushed the date from April 11, 2026 out to January 31, 2027 while the Commission decides whether to modify the requirement at all. The order also says the waiver extends only to that portion of the rule and does not alter the status quo for anything else about revoking consent. The narrow thing is delayed. The rest is live.

Here is my opinion, clearly labeled as opinion: build the cross channel behavior anyway, not for compliance but for cost. A single opt-out table keyed to the phone number, checked by every sender before it fires, is about an afternoon of work while you are building the system the first time. Retrofitting one across three tools that each keep their own list is a project. The delay to 2027 does not change that arithmetic.

The rule that no longer exists

In December 2023 the FCC adopted a "one to one consent" rule aimed at lead generators, requiring consent to name a single seller. Businesses spent a year preparing for it.

It never took effect. On January 24, 2025 the Eleventh Circuit vacated it in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277, holding that the FCC had exceeded its statutory authority by reading requirements into "prior express consent" that the statute does not contain. The FCC subsequently removed the language.

I am spending a paragraph on a dead rule for a specific reason. While researching this post I read a compliance guide, published in 2026, that told small businesses to prepare for one to one consent enforcement beginning January 27, 2026. That rule had been vacated a year earlier. The guide was confidently, checkably wrong, and it ranks well.

Take one operational habit from this post: when somebody tells you a messaging rule applies to you, ask for the citation and read it. The primary sources here are free, public, and short.

What Utah adds on top

Federal law is the floor. Utah has its own Telephone and Facsimile Solicitation Act, and one provision routinely surprises people who set up campaigns from a national tool's default settings.

Federal quiet hours run 8 a.m. to 9 p.m. local time. Utah Code 13-25a-103 prohibits a telephone solicitation to a residential or cellular number without prior express consent during three windows: between 9 p.m. and 8 a.m. local time, on a Sunday, and on a legal holiday.

Sunday. A promotional blast scheduled for Sunday morning, an ordinary thing for a marketing calendar to do, is a state law problem in Utah that it is not in most states.

Scope matters here, so be precise. Utah defines a "telephone solicitation" in 13-25a-102 as initiating a call or message for a commercial purpose or to seek a donation. A reminder that your grooming appointment is at ten tomorrow is not a solicitation. A message announcing twenty percent off packages this week is. Same phone number, same system, different rules, and the only thing that separates them is how your software classifies the message.

The same chapter contains a second detail worth knowing: an established business relationship, which is one of the exceptions that lets you contact someone without separate consent, terminates after 18 months with no inquiry, purchase, transaction, or voluntary two way communication. Your quiet list ages out.

What this looks like in a system

The design consequence of everything above is a single idea: your messages need a class, and consent needs to be recorded per class.

That means a reminder about an existing appointment and a promotion about a new service are different objects in your data model, not two templates in one folder. Each message carries its class. Each contact carries what they consented to, when, and how you captured it. Every send checks the opt-out table first, and the scheduler checks local time and the calendar before it fires.

We are building for a Salt Lake City private practice therapist right now, and consent capture at intake is exactly the kind of question that has to be answered before the first automated message goes out, not after. Get it right at the form and the rest of the system inherits it. Get it wrong and you are reconstructing consent records from memory. The same discipline shows up in client onboarding automation and, for regulated intake, in patient intake automation.

It helps to remember what your messages arrive next to. The FTC's Do Not Call Registry Data Book for fiscal year 2025 reports about 258.5 million active registrations as of September 30, 2025. Your customer has already opted out of everything they could. The reminder they asked for is welcome. Anything else is competing with that backdrop.

A short build checklist

1. Store consent per message class, with a timestamp and the capture source.
2. Match opt-outs on intent, not on one exact keyword.
3. Honor an opt-out within ten business days, and design for minutes rather than days.
4. Send one confirmation, with no marketing in it, ideally inside five minutes.
5. Check the recipient's local time, Sundays, and holidays before a promotional send.
6. Expire an established business relationship at 18 months rather than assuming it lasts.
7. Keep the opt-out list in one place that every sending tool reads.

Steps one and seven are cheap now and expensive later. The rest follow from them.

Where we land

Automated texting is the highest return automation most local service businesses will ever turn on, and it is worth doing. Reminders reduce empty chairs. Confirmations reduce phone tag. None of that is in question.

What is in question is whether the system was built by somebody who read the rules or by somebody who accepted a tool's defaults. Those two systems look identical on launch day. They stop looking identical the first time a customer replies "no more texts please" and the automation does not recognize it as an opt-out.

If you have reminders running and are not sure which system you have, that is a short thing to check. Our workflow automation team can look at how consent is recorded, how opt-outs are matched, and whether promotional sends respect Utah's calendar. Utah businesses should also read our note on state privacy obligations, because the same intake form usually triggers both.

Frequently asked questions

Do appointment reminders need consent if the customer booked the appointment? Booking generally supplies consent for messages about that booking, and Utah's definitions exclude communications tied to an existing transaction. The failure mode is drift: the reminder system quietly starts carrying promotions, and the consent you have no longer matches the message you are sending.

Does replying STOP to my reminders also stop my marketing texts? Under the delayed portion of the federal rule it eventually would, but that requirement is now waived until January 31, 2027. Today the answer depends on how your system is built. My recommendation is to make it stop everything regardless, because it is what the customer meant.

Can I text customers on Sunday in Utah? For a solicitation, not without prior express consent. Utah's statute names Sundays and legal holidays alongside the nightly quiet hours. A service message about an appointment they already have is a different category.

We use a third party scheduling tool. Is this their problem or mine? Yours. The tool sends on your behalf and under your business identity. Ask the vendor two questions: which inbound replies do you treat as opt-outs, and can I export the opt-out list. If either answer is unclear, that is your answer about the tool.

Have your messaging setup reviewed