You Received a TCPA Demand Letter: The First 30 Days
TCPA exposure is measured per message, at $500 to $1,500 each. What you do in the first month usually determines whether the matter resolves quietly or becomes a class action.
Regulatory Defense
SMS Marketing Without a TCPA Claim: A Consent Compliance Checklist
By Ingrid Rainey · March 10, 2026 · 8 min read
Text messaging is the highest-converting channel most businesses have and the fastest route to statutory damages they will ever find. Damages run $500 per message, trebled to $1,500 for willful violations, with no cap and no requirement that the recipient prove harm. The Southern District of California is among the most active TCPA venues in the country. The difference between a profitable program and a class action is almost entirely documentation.
Key takeaways
- Marketing texts sent with an automated system require prior express written consent: a signed agreement, including electronic signature, that clearly authorizes the sender to send marketing messages to the specific nu…
- Capture the full opt-in screen: the exact disclosure text, timestamp, IP address, URL, and the number entered.
- The business whose goods or services are promoted is generally the party sued, regardless of which platform pressed send.
- The California Invasion of Privacy Act supports claims over call and session recording and, increasingly, website tracking and chat tools that share visitor data with third parties.
What counts as consent
Marketing texts sent with an automated system require prior express written consent: a signed agreement, including electronic signature, that clearly authorizes the sender to send marketing messages to the specific number, discloses that consent is not a condition of purchase, and identifies the sender.
Consent buried in a linked privacy policy, bundled across a list of partner brands, or inherited from a purchased list does not meet the standard. Consent must also be tied to the number actually messaged.
The checklist
- Capture the full opt-in screen: the exact disclosure text, timestamp, IP address, URL, and the number entered.
- Keep consent language visible next to the submit control, not behind a link.
- Say who is sending, what kind of messages, expected frequency, and that message and data rates apply.
- Honor STOP, END, QUIT, UNSUBSCRIBE, and any reasonable revocation — including replies in plain language — promptly, and suppress across every platform, not just the one that received it.
- Respect quiet hours and the national and internal do-not-call lists, including for informational campaigns that drift into marketing.
- Scrub for reassigned numbers before large sends.
- Retain consent and revocation records for at least four to five years; the record you cannot produce is the violation you cannot defend.
Vendors do not transfer the risk
The business whose goods or services are promoted is generally the party sued, regardless of which platform pressed send. Review platform and agency contracts for indemnity, consent representation, data ownership, and — critically — your ability to export consent records after the relationship ends.
If a vendor cannot produce a per-number consent artifact on request, you do not have a consent program. You have a spreadsheet.
Have a question about your situation?
Rainey Law P.C. advises San Diego businesses and employees on matters like this one.
Request a consultationCalifornia adds a second layer
The California Invasion of Privacy Act supports claims over call and session recording and, increasingly, website tracking and chat tools that share visitor data with third parties. Those claims frequently accompany a TCPA demand and carry their own statutory damages.
Any audit of a messaging program should cover the website analytics and chat stack at the same time, because the plaintiff-side firms filing these claims audit both.
If a demand letter arrives
Preserve everything immediately, do not contact the claimant directly, and pull the consent artifact for the specific number before responding. Rainey Law P.C. defends TCPA and CIPA claims in the Southern District of California and audits messaging programs before they generate them.
Frequently asked questions
Does a customer relationship imply consent to text marketing?
No. An existing business relationship may support certain informational contacts, but automated marketing texts require prior express written consent specific to that number.
How long should consent records be kept?
At least four to five years, covering the statute of limitations plus the time it takes for a claim to surface. Retention should survive changing messaging vendors.
Are transactional messages exempt?
Transactional and informational messages face a lower consent standard, but the exemption is narrow. A shipping notification that also promotes a sale is treated as marketing.
This article is general information, not legal advice, and does not create an attorney-client relationship. Outcomes depend on the facts of each matter.
More insights
ADA and Unruh Act Website Accessibility Claims Against California Businesses
A demand letter over your website is not really about the website. It is about $4,000 in statutory damages per violation and a fee claim on top.
CCPA and CPRA Compliance: What California Businesses Actually Have to Do
Most CCPA exposure is not about data policy. It is about a missing link, an unanswered request, and a vendor contract that lacks four required sentences.
We fight for you.
Schedule a confidential consultation to discuss your business or employment matter.