Text Message Marketing Laws by State: What Changes the Rules

Text message marketing in the United States is governed by a federal baseline, the TCPA, plus a growing patchwork of state laws that add stricter consent standards, tighter time windows, and new penalties. If you text people in Florida, Oklahoma, Washington, Maryland, or several other states, you are subject to rules that go beyond federal law. The practical strategy for most organizations is simple to state and important to execute: comply with the strictest standard that applies to anyone on your list.

This article is general information, not legal advice.

Key takeaways:

• The TCPA is the federal foundation: consent before automated texts, honoring opt-outs, and quiet hours of 8 a.m. to 9 p.m. recipient local time.
• CAN-SPAM mostly governs email, not SMS; do not assume email-style compliance covers your texting program.
• Florida, Oklahoma, and Washington have led the "mini-TCPA" wave, with other states following, and Florida's FTSA window is 8 a.m. to 8 p.m.
• Texas requires registration for certain telephone solicitors, an obligation many texting programs overlook.
• The safest national strategy is written consent everywhere, the tightest quiet hours window, and platform-enforced opt-out handling.

The federal baseline: TCPA, CTIA, and the CAN-SPAM myth

Every state law sits on top of the federal Telephone Consumer Protection Act. The TCPA requires prior express consent before sending automated texts, requires prior express written consent for marketing messages sent with automated technology, obligates you to honor opt-outs, and restricts solicitations to 8 a.m. to 9 p.m. in the recipient's local time. Violations carry statutory damages of $500 per message, rising to $1,500 for willful or knowing violations, and the law includes a private right of action that fuels class litigation. Our plain-language guide to the TCPA walks through the federal rules in detail.

A common misconception is that CAN-SPAM, the federal email marketing law, is the relevant statute for texting. It is not, at least not the way people think. CAN-SPAM primarily governs commercial email, and while it touches some messages sent to mobile devices, the TCPA is the statute with teeth for SMS. An email-style "opt out any time" footer does not substitute for the TCPA's consent-first model.

Alongside the law, the CTIA, the wireless industry association, publishes messaging principles and best practices that carriers effectively enforce through filtering and program registration. CTIA guidance is not statute, but ignoring it gets your messages blocked, which is its own kind of penalty. You can find the industry's published guidelines at ctia.org.

The mini-TCPA states: where the rules get stricter

Since 2021, a series of states have passed their own telemarketing and texting statutes, often called mini-TCPA laws. They matter because they add requirements beyond federal law and, in several cases, create their own private rights of action with per-message damages.

• Florida (FTSA). The Florida Telephone Solicitation Act kicked off the trend. It covers telephonic sales calls including texts, requires prior express written consent for solicitation messages sent with automated systems, and restricts sending to 8 a.m. to 8 p.m. local time, an hour tighter in the evening than federal law. It includes a private right of action, which made Florida a center of texting litigation.
• Oklahoma. Oklahoma's Telephone Solicitation Act closely follows the Florida model, extending similar consent requirements and restrictions to solicitations directed at Oklahoma residents.
• Washington (CEMA). Washington's Commercial Electronic Mail Act reaches commercial text messages sent to Washington residents, prohibiting unsolicited commercial texts, and it has been the basis for significant litigation. Washington also has separate telephone solicitation rules.
• Maryland. Maryland has adopted its own telephone solicitation legislation in the mini-TCPA mold, applying stricter standards to calls and texts directed at Maryland residents.
• New Jersey and the broader trend. More legislatures introduce similar bills every session, and New Jersey is among the states that have moved in this direction. The trend line is clear: assume the list of stricter states will grow, not shrink.
• Texas. Texas takes a different angle: certain telephone solicitors are required to register with the state and post security before soliciting Texas residents. Whether registration applies depends on what you send and which exemptions fit your organization, but texting programs that never checked are taking on avoidable risk.

The details of each statute differ, and legislatures amend them regularly, so treat the summaries above as orientation rather than the final word. When a campaign targets a specific state, have counsel confirm the current requirements.

State-by-state summary table

State	Key law	What it adds beyond federal law
Florida	FTSA	Written consent for automated solicitations, 8 a.m. to 8 p.m. window, private right of action
Oklahoma	Telephone Solicitation Act	Florida-style consent and solicitation restrictions for Oklahoma residents
Washington	CEMA and telephone solicitation rules	Prohibits unsolicited commercial texts, active litigation history
Maryland	State telephone solicitation law	Mini-TCPA consent standards for Maryland residents
New Jersey	Emerging mini-TCPA activity	Part of the broader trend toward stricter state rules
Texas	Solicitor registration requirement	Registration and bonding for certain solicitors before contacting residents

If your audience is national, this table is really one row: the strictest combination of all of them.

Why area codes cannot segment your compliance

A tempting shortcut is to apply Florida rules only to numbers with Florida area codes. It does not work. Number portability means people carry their mobile numbers across state lines, so a 305 number may belong to someone in Ohio and a 206 number to someone in Tampa. State statutes generally protect residents of the state, not holders of the state's area codes.

That leaves you with three workable approaches:

1. Collect and use real location data. If you have a mailing address or self-reported state for each contact, segment on that and apply each state's rules.
2. Adopt the strictest standard for everyone. Written consent, an 8 a.m. to 8 p.m. sending window, and prompt opt-out handling satisfy every state on the list simultaneously.
3. A hybrid. Use the strict default nationally and relax only where you have verified location data and a reason to.

Most nonprofits, healthcare organizations, schools, and agencies land on option two. The marginal value of texting at 8:30 p.m. rarely justifies maintaining fifty separate rule sets.

A practical compliance strategy for national senders

Here is the playbook that keeps a national texting program inside every state's lines:

• Get prior express written consent everywhere. A clear disclosure at signup that names your organization, says recipients will get automated texts, notes that consent is not a condition of purchase or donation, and mentions message and data rates. Written consent is the federal standard for automated marketing and satisfies the mini-TCPA states too.
• Keep consent records. Store the timestamp, source, and exact disclosure language for every opt-in. In a dispute, your records are the difference between a strong defense and a settlement.
• Honor the tightest quiet hours. Send between 8 a.m. and 8 p.m. recipient local time, which satisfies both the federal window and Florida's. Our guide to texting quiet hours and state time rules covers how to operationalize this, including the area code problem.
• Make opt-out instant and forgiving. Process STOP, and also common variants like CANCEL, END, and QUIT, immediately and automatically. State laws differ on grace periods; instant compliance satisfies all of them.
• Identify yourself in every campaign message. Recipients should never wonder who is texting them. Clear identification is required by industry guidelines and expected by several statutes.
• Watch frequency. Some state laws restrict how often you may solicit the same person in a given period. Reasonable cadence is both a legal safeguard and good audience stewardship.
• Put enforcement in the platform. Consent capture, opt-out processing, and sending windows should be enforced by your texting platform, not by staff diligence. FRANSiS builds these controls into the sending workflow so a scheduling mistake cannot become a statutory violation, and its compliance-supported approach extends to regulated audiences, with HIPAA compliance supported through a signed BAA for healthcare use.

Frequently asked questions

Do I need different consent language for different states?

Generally no. A single well-drafted written consent disclosure that meets the federal prior express written consent standard will satisfy the mini-TCPA states as well. The variation between states shows up more in time windows, frequency limits, and penalties than in what a compliant opt-in looks like.

Does the TCPA apply if my organization is a nonprofit?

Nonprofits benefit from certain exemptions, particularly around telemarketing rules, but the exemptions are narrower than most teams assume, and state laws draw their own lines. Fundraising texts sent with automated systems still create real risk. The safe posture is to run consent-based, quiet-hours-respecting programs regardless of tax status.

Which state texting law is the strictest?

Florida's FTSA is the usual benchmark because it combines written consent requirements, an 8 a.m. to 8 p.m. window, and a private right of action. Washington's CEMA has also produced major litigation over unsolicited commercial texts. Building your program to satisfy Florida and Washington gets you most of the way to satisfying everyone.

What happens if I text someone in a state I didn't know they lived in?

State statutes generally protect their residents wherever the sender is located, and courts have not been sympathetic to "we didn't know" defenses built on area codes. This is precisely why national senders adopt the strictest standard across their whole list rather than guessing at geography.

Is texting without consent ever allowed?

Narrow categories exist, such as certain purely informational or emergency messages, and manually sent individual messages sit differently than automated campaigns. But for anything resembling marketing or fundraising at scale, consent first is the rule. When a message's category is unclear, treat it as marketing and get written consent.

Conclusion

State texting laws are a moving target, but the direction of movement is consistent: more states, stricter consent, tighter windows, bigger penalties. Chasing fifty rule sets individually is a losing game for a lean team. Instead, set your program to the strictest common denominator: written consent captured with good records, an 8 a.m. to 8 p.m. sending window anchored to recipient local time, instant opt-out processing, clear sender identification, and platform-level enforcement so none of it depends on memory. Do that once, and new state laws become news items rather than emergencies.

Ready to build a texting program that clears every state's bar? Contact the FRANSiS team to see how consent management, enforced sending windows, and automatic opt-out handling keep mission-driven organizations compliant nationwide.