Why Being TCPA-Compliant No Longer Means Your SMS Program Is Compliant

For years, a marketing team building an SMS program checked its compliance against one standard: the federal Telephone Consumer Protection Act. Get consent, honor STOP requests, register your sending number, and the program was legally sound regardless of where a given text message landed. That single-standard world is gone. More than fifteen states now enforce their own SMS marketing laws, commonly called mini-TCPAs, and several of them are meaningfully stricter than federal law, with penalties per violation that make a federal TCPA fine look manageable by comparison. A program that's fully compliant with federal law can still be actively breaking the law in specific states, and the exposure follows the recipient's location, not the sender's.

Two States Worth Understanding Specifically

Florida's Telephone Solicitation Act, in effect since 2021, uses one of the broadest definitions of an autodialer in the country, caps commercial messages on the same subject at three per 24-hour period, and restricts sending to between 8am and 8pm local time for the recipient. Violations carry statutory damages of $500 per message, tripled to $1,500 for willful violations, and Florida's broad autodialer definition means a standard SMS marketing platform's sending method can qualify even when a business assumes it wouldn't.

Texas's SB 140, effective more recently, went further: violating texts now carry statutory damages up to $5,000 each, and the law ties violations to the state's Deceptive Trade Practices Act, which opens the door to treble damages, damages for mental anguish, and attorney's fees stacked on top of the statutory penalty. A pattern of sends that would be a minor federal compliance gap in most states becomes a potentially five-figure exposure per affected recipient in Texas, calculated per message rather than per campaign.

Why an Automated Flow Is a Different Risk Than a One-Off Campaign

The abandoned-cart, welcome-series, and win-back flows most SMS programs run aren't one-off decisions reviewed each time they fire, they're configured once and then run continuously, unattended, against every customer who meets the trigger condition. That's exactly the pattern that turns a single misconfigured setting into a large, repeated exposure rather than an isolated mistake: a flow sending a fourth message on the same topic within Florida's 24-hour window doesn't do it once, it does it to every Florida customer who enters that flow, indefinitely, until someone notices and fixes the configuration. A one-off campaign send with a compliance gap is a single mistake. An automated flow with the same gap is that mistake repeating at whatever volume the flow processes, which is precisely why the automated flows deserve more compliance scrutiny up front, not less, than a manually reviewed campaign blast.

Why This Catches Programs Off Guard

The core structural problem is that these laws bind a business based on where the recipient is located, not where the business is headquartered or where its SMS platform is hosted. A Shopify brand selling nationwide, with customers in every state, is potentially exposed to whichever state's law is strictest for any given send, regardless of the brand's own home state or its general TCPA compliance posture. Most SMS programs were built once, against a single federal checklist, at a time when that federal checklist was genuinely sufficient. The state laws arrived later, apply based on customer geography rather than business geography, and don't announce themselves the way a platform's own terms of service might, which means a program can drift out of compliance with a new state law without anyone on the marketing team ever being told the rules changed.

Why More States Are Likely to Follow

Florida and Texas aren't outliers acting alone, they're the two most consequential examples in a pattern that's been building for several years and shows no sign of slowing. More than fifteen states now have some version of a mini-TCPA on the books, and the trend line points toward more states adopting similar statutes rather than fewer, often modeled closely on whichever earlier state law has already generated enforcement activity and case law to build from. A compliance posture built around "the states that currently have stricter laws" is a moving target that needs periodic review, not a fixed list to check once and file away. A brand that audits its program against today's landscape and never revisits it is likely auditing against an incomplete list within a year or two.

What Doesn't Change: The Underlying Discipline

The good news, to the extent there is any, is that the practices genuinely resilient state SMS laws are converging around aren't exotic: clear, affirmative opt-in with specific disclosure about message type and frequency, respecting a defined quiet-hours window for the recipient's actual time zone rather than the sender's, capping message frequency on a given topic rather than sending as often as engagement data might justify, and honoring opt-out requests immediately and completely. A program built around genuinely conservative versions of these practices, rather than the minimum federal floor, tends to clear most state-specific bars without needing a separate compliance configuration for every state.

What Does Change: Where the Minimum Bar Actually Sits

The federal TCPA is no longer the ceiling to design against, it's closer to the floor. A message cadence that's federally compliant but sends more than three times a day on the same topic is a live violation in Florida regardless of federal status. A send that goes out at 9pm recipient time, technically fine under a looser federal read, is outside Florida's window entirely. Designing a national SMS program around the loosest applicable standard, rather than the strictest state a brand actually ships to, is exactly the gap that turns into real financial exposure once volume is high enough for a plaintiff's attorney to find a pattern worth pursuing.

What This Means for an SMS Program in Practice

Auditing an existing program against this landscape doesn't require a different compliance system for all fifty states individually. It requires identifying the handful of states with meaningfully stricter rules than the federal baseline, Florida and Texas being the two most consequential examples currently, checking send frequency, timing windows, and consent language against the strictest of those states rather than the federal minimum, and treating that stricter standard as the actual design target for the whole program rather than a state-specific exception layered on top. A platform's built-in compliance tooling, quiet-hours enforcement, opt-in disclosure templates, keyword handling, is a meaningful head start, but it's a starting point to configure against the strictest applicable standard, not a guarantee that the default configuration already clears every state a brand's customers happen to live in.

The size of the exposure also scales with the exact thing SMS marketing is meant to grow: list size and send frequency. A small list sending occasional messages carries limited practical risk even with an imperfect compliance setup, simply because the pool of potential violations is small. That same imperfect setup running against a large, actively growing list, sending frequently enough to matter for revenue, is running that same gap at a scale where a plaintiff's attorney reviewing message logs has a genuinely large pattern to work with. Compliance rigor that felt optional at a smaller scale becomes the thing standing between a growing SMS program and a genuinely expensive legal exposure once volume catches up to it.

That's the uncomfortable part of this shift for a channel marketed heavily on its list-growth and revenue-per-subscriber numbers: the same growth that makes SMS worth investing in is also what turns a previously tolerable compliance gap into a real liability, on a timeline set by list size rather than by whenever the team gets around to a compliance review.