TCPA vs. CAN-SPAM: Which Law Covers Texts?
Marketers routinely mix up the two big federal anti-spam laws. Some assume CAN-SPAM, the email law, covers their text campaigns and that an unsubscribe link is all they need. Others assume the TCPA covers every electronic message they send, email included. Both assumptions are wrong, and the difference matters because the two laws have completely different consent models and penalty structures.
Here is the distinction in one sentence: the TCPA (47 U.S.C. 227), enforced primarily by the FCC, governs calls and text messages sent to telephone numbers, while the CAN-SPAM Act (15 U.S.C. 7701 and following), enforced primarily by the FTC, governs commercial email, including messages that reach a phone as email through a mail-to-SMS gateway.
For ordinary SMS marketing, the TCPA is the law that applies. But the gateway edge case is real, and understanding both frameworks keeps your whole messaging program clean.
The Two Laws in Plain Language
The TCPA: permission first
The Telephone Consumer Protection Act of 1991 is an opt-in law. Before you send marketing messages to a cell phone using automated technology, you need the recipient's prior express written consent under the FCC's rules at 47 CFR 64.1200. The law also imposes quiet hours for solicitations (8 am to 9 pm recipient local time), do-not-call protections, and immediate opt-out honoring. Its teeth are famous: a private right of action with statutory damages of $500 per violation, up to $1,500 for willful or knowing violations, with no cap on class action exposure.
CAN-SPAM: permission not required, honesty required
The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 is an opt-out law. You may send commercial email without prior consent, but every message must follow rules of honesty and control: no false or misleading header information, no deceptive subject lines, identification of the message as an ad where required, a valid physical postal address, a clear unsubscribe mechanism, and opt-out processing within ten business days. The FTC enforces it with civil penalties that are adjusted over time and can reach tens of thousands of dollars per violating email. There is no general private right of action for consumers.
Where Text Messages Fit
A standard SMS or MMS campaign sent through a texting platform to phone numbers is a "call" under the TCPA as interpreted by the FCC and the courts. CAN-SPAM does not govern it, and following CAN-SPAM's opt-out model for SMS (sending first, offering unsubscribe later) is precisely the mistake that generates TCPA liability.
The overlap case is the mail-to-SMS gateway. Every major US carrier historically offered email domains that convert email into text messages delivered to a subscriber's phone. A message sent to that kind of address is legally a commercial email to a wireless device. The FCC's CAN-SPAM implementing rules at 47 CFR 64.3100 go further than ordinary email rules here: they prohibit sending commercial messages to addresses at wireless carrier domains unless the subscriber has given express prior authorization. In other words, the gateway loophole is not a loophole at all. It converts an opt-out regime back into an opt-in regime, and senders who blast marketing email to carrier SMS gateways violate the wireless spam rules directly.
Side-by-Side Comparison
| Feature | TCPA | CAN-SPAM |
|---|---|---|
| Statute | 47 U.S.C. 227 (1991) | 15 U.S.C. 7701-7713 (2003) |
| Primary regulators | FCC (with FTC on telemarketing generally) | FTC, with FCC rules for wireless email |
| What it covers | Calls and texts to telephone numbers | Commercial email, including mail-to-SMS gateway messages |
| Consent model | Opt-in: prior express written consent for marketing to cell phones | Opt-out: consent not required, except express prior authorization for wireless carrier domains under 47 CFR 64.3100 |
| Timing rules | Solicitation quiet hours, 8 am to 9 pm recipient local time | None |
| Opt-out handling | Honor immediately; STOP keyword standard | Honor within 10 business days; working unsubscribe required |
| Content rules | Sender identification; telemarketing disclosures | No deceptive headers or subject lines; ad identification; physical postal address |
| Private lawsuits | Yes, $500 to $1,500 statutory damages per violation | No general private right of action |
| Class action risk | High | Low (enforcement led by FTC and states) |
The consent column is the one to internalize. Under CAN-SPAM you can email a stranger once, honestly, with an unsubscribe link. Under the TCPA you cannot text that same stranger a marketing message at all without written permission naming your organization. Teams that port email habits into SMS are the ones that end up in demand letters.
What This Means for Your Messaging Program
- Run SMS as opt-in, always. Collect prior express written consent before any promotional text, disclose message frequency and data rates, and never make consent a condition of purchase.
- Never use email-to-SMS gateways for outreach. They combine the worst of both regimes: CAN-SPAM's content rules plus the express-authorization requirement of the FCC wireless rules, and carriers filter them aggressively anyway.
- Keep the frameworks straight per channel. Email follows CAN-SPAM: honest headers, postal address, working unsubscribe. SMS follows the TCPA and, in many states, mini-TCPA laws with their own damages.
- Respect the clock on SMS. Marketing texts belong inside quiet hours, which several states have tightened beyond the federal window. Our guide to TCPA quiet hours for texting covers the time zone mechanics.
- Honor opt-outs across both channels immediately. Ten business days is CAN-SPAM's ceiling for email, not a target, and SMS opt-outs should suppress the number the moment STOP arrives.
- Follow carrier standards too. The CTIA Messaging Principles and Best Practices function as a de facto third rulebook for SMS. Violating them gets your traffic filtered even when no law is broken.
- Audit against a checklist. Consent records, quiet-hour scheduling, opt-out logs, and sender identification should all be verifiable. Our SMS compliance checklist walks through each control.
The pattern across every row of the comparison: SMS is the more strictly regulated channel, which is exactly why it remains the higher-attention channel. Permission-based texting reaches an audience that chose to hear from you, and the legal framework enforces that exchange of value.
A useful mental model is to think of the two laws as answering different questions. CAN-SPAM asks, "Is this message honest and escapable?" The TCPA asks, "Did this person agree to receive this message at all?" Email programs are judged on their behavior after the send: truthful headers, accurate subject lines, a working unsubscribe path, and prompt suppression. Texting programs are judged before the send: whether documented consent existed for that number, from that subscriber, for that category of message, at that hour. Building your workflows around those two questions, rather than around a single generic "spam policy," keeps each channel measured against the standard a regulator or plaintiff would actually apply.
One last edge case worth flagging: rich messaging channels that ride on data rather than the carrier SMS network do not remove these obligations. Regulators evaluate the substance of the communication and the consent behind it, and carrier and industry standards, including the CTIA guidelines, extend permission-based expectations across messaging formats. Treat every message to a phone number as TCPA territory and you will rarely be wrong.
This article is general information, not legal advice. Requirements vary by jurisdiction and change over time, so confirm your own obligations with qualified counsel or the relevant regulator.
Frequently Asked Questions
Does the CAN-SPAM Act apply to text messages?
Generally no. Standard SMS and MMS marketing to phone numbers is governed by the TCPA, not CAN-SPAM. CAN-SPAM reaches a phone only when the message is actually an email delivered through a carrier's mail-to-SMS gateway, and in that case the FCC's wireless rules at 47 CFR 64.3100 require the subscriber's express prior authorization before any commercial message is sent.
Which law is stricter, TCPA or CAN-SPAM?
For the sender, the TCPA. It requires consent before the first marketing message, imposes quiet hours, and gives every recipient a private right of action worth $500 to $1,500 per violation. CAN-SPAM allows unsolicited commercial email so long as it is honest, identified, and carries a working opt-out, with enforcement resting mainly with the FTC rather than private plaintiffs.
Can I text someone marketing messages if they only signed up for my email list?
No. Email consent is not texting consent. The TCPA requires prior express written consent specifically covering text messages to that number from your organization. Add a distinct SMS opt-in to your forms rather than inferring permission from an email subscription.
Who enforces these laws?
The FCC writes and enforces the TCPA's implementing rules, and private individuals and classes sue under the TCPA's private right of action; state attorneys general also bring actions. CAN-SPAM is enforced primarily by the FTC, along with state attorneys general and internet service providers, and the FCC enforces the wireless email provisions.
What are the penalties under each law?
TCPA: statutory damages of $500 per violation and up to $1,500 per willful or knowing violation, available in private suits and class actions, plus FCC forfeitures. CAN-SPAM: civil penalties per violating email that the FTC adjusts for inflation and that can reach tens of thousands of dollars per message, plus enhanced penalties for aggravated conduct such as address harvesting.
Keep Every Channel on the Right Side of the Law
FRANSiS is built for the opt-in world of SMS: consent capture, automatic STOP handling, quiet-hour scheduling, and full message logs, with an AI Powered Helper that keeps two-way conversations responsive and compliant. Talk to our team about running text messaging the permission-first way.
