What Is the TCPA? A Plain Language Guide for Organizations

The TCPA, or Telephone Consumer Protection Act, is a federal law passed in 1991 that restricts how organizations can call and text people without their permission. It requires consent before you send automated texts or calls, sets quiet hours for outreach, and gives individuals the right to sue for $500 to $1,500 per violating message. If your organization texts supporters, patients, students, or residents, the TCPA applies to you.

This article is general information, not legal advice. Consult an attorney for guidance on your specific situation.

Key takeaways:

The TCPA is a 1991 federal law, enforced by the FCC and through private lawsuits, that governs automated calls and text messages.
Consent is the core requirement: informational messages need prior express consent, while marketing messages need prior express written consent.
Nonprofits get some exemptions for voice calls, but those exemptions are narrower than most teams assume, especially for texting.
Statutory damages run $500 per violation and up to $1,500 per willful violation, and they multiply across every message on your list.
Practical compliance comes down to documented opt-ins, honored opt-outs, quiet hours, and a texting platform that supports all three.

What the TCPA actually says

Congress passed the Telephone Consumer Protection Act in 1991 in response to a flood of telemarketing calls and junk faxes. The law, codified at 47 U.S.C. 227, restricts calls and texts made with automatic telephone dialing systems (often called autodialers or ATDS), artificial or prerecorded voice messages, and unsolicited fax advertisements.

Courts and the FCC have long treated text messages as "calls" under the statute. That single interpretation is why a law written before SMS existed now governs nearly every mass texting program in the country.

In plain language, the TCPA says three things:

You need the right kind of consent before sending automated calls or texts to someone's phone.
You must stop contacting people when they ask you to stop.
You must respect time-of-day restrictions and do-not-call rules.

The FCC writes the implementing regulations and updates them regularly, so TCPA compliance is a moving target. The most recent significant change, a rule making opt-out revocation easier for consumers, took effect in 2025. You can read the FCC's own consumer guidance at https://www.fcc.gov/consumers.

Who the TCPA applies to

The short answer: almost everyone who texts at scale. The law covers businesses, healthcare providers, schools, government contractors, political campaigns, and yes, nonprofits.

The nonprofit question

Many mission-driven organizations assume they are exempt. That assumption causes real damage. The TCPA's telemarketing rules include carve-outs for tax-exempt nonprofit organizations, but those carve-outs are narrower than people think:

The nonprofit exemption primarily applies to certain telemarketing rules for live voice calls, not to the core autodialer and prerecorded-message restrictions.
Texts sent through a mass texting platform to mobile phones still generally require prior express consent, regardless of your tax status.
Fundraising appeals sent by text can be treated as solicitations, which pushes them toward the stricter written-consent standard.
Courts have allowed TCPA suits to proceed against charities, churches, and advocacy groups.

The safest operating posture for a nonprofit is to behave as if no exemption applies: collect documented consent, honor every opt-out, and keep records. Platforms built for mission-driven organizations, including FRANSiS, structure their opt-in and opt-out workflows around this assumption.

The two tiers of consent

Consent is the center of the TCPA, and there are two distinct tiers. Knowing which one your messages require is the single most important compliance decision you will make.

Consent tier	What it covers	What it requires
Prior express consent	Informational messages: appointment reminders, service updates, alerts	The person knowingly gave you their number for that purpose, such as on an intake form
Prior express written consent	Marketing and fundraising messages: promotions, appeals, campaigns	A signed written or electronic agreement with clear disclosure that automated texts will be sent

Two practical notes. First, giving you a phone number on a form is generally treated as consent for informational messages related to why the number was provided, not blanket permission for everything. Second, written consent for marketing must be unambiguous: the disclosure has to say the person agrees to receive automated marketing texts, that consent is not a condition of purchase or service, and it must be affirmatively signed or checked, not pre-checked.

If your program mixes message types, as most nonprofit and healthcare programs do, collect prior express written consent up front. It covers both tiers and removes guesswork later. Our TCPA compliance checklist for 2026 walks through exact consent language element by element.

Autodialers after Facebook v. Duguid

For years, the biggest TCPA fight was over what counts as an automatic telephone dialing system. In 2021, the Supreme Court decided Facebook v. Duguid and narrowed the definition: a system is only an ATDS if it uses a random or sequential number generator to produce or store the numbers it dials.

Most modern texting platforms send to curated contact lists, not randomly generated numbers, so many no longer meet the narrow ATDS definition. Some organizations read that decision as a green light to text freely. That reading is wrong for four reasons:

Prerecorded and artificial voice restrictions were untouched by the decision and still require consent.
State laws, including so-called mini-TCPAs in states like Florida, Oklahoma, and Washington, define autodialers more broadly and carry their own penalties.
FCC rules on revocation, quiet hours, and do-not-call obligations apply regardless of ATDS status.
Carrier and 10DLC registration requirements demand documented consent even where the statute might not.

Treat Duguid as a narrowing of one legal theory, not a repeal of the law. Consent-first texting remains the standard.

Quiet hours, opt-outs, and the do-not-call rules

Beyond consent, the TCPA and FCC rules impose day-to-day operating requirements:

Quiet hours. Telemarketing calls and texts may only be sent between 8 a.m. and 9 p.m. in the recipient's local time zone. Schedule sends by recipient time, not your office time.
Opt-out honoring. When someone replies STOP or otherwise revokes consent, you must stop messaging them. Under the FCC rule effective in 2025, consumers can revoke by any reasonable means and revocations must be honored within 10 business days, though good platforms process them instantly.
Do-not-call registry. Telemarketing to numbers on the National Do Not Call Registry is restricted unless an exception, such as established consent, applies.
Identification. Messages should clearly identify your organization so recipients know who is texting them.

These are the requirements organizations trip over most often, because they depend on operational discipline rather than a one-time legal review.

What violations cost

The TCPA has teeth. The statute sets damages at $500 per violation and up to $1,500 per willful or knowing violation, and each individual message can count as a separate violation. There is no cap, and plaintiffs do not need to show they were harmed. A private right of action means any recipient can sue directly, and class action attorneys actively recruit TCPA plaintiffs because damages multiply across entire contact lists. The federal statute of limitations reaches back four years.

The FCC can also pursue enforcement actions and forfeitures on its own. For most organizations, though, the realistic risk is a private suit or class action, and defense costs alone can be painful even when you win.

Practical compliance steps

You do not need a legal department to run a compliant texting program. You need a handful of habits and a platform that enforces them:

Collect prior express written consent with complete disclosure language: program name, message frequency, "message and data rates may apply," and HELP/STOP instructions.
Keep consent records showing who opted in, when, how, and what disclosure they saw. Retain them at least four years.
Honor STOP and every reasonable revocation immediately, and suppress opted-out numbers across all campaigns.
Send only between 8 a.m. and 9 p.m. recipient local time.
Audit your list regularly and remove stale numbers, since mobile numbers get reassigned to new owners.
Register your messaging campaigns through 10DLC so carriers know your traffic is legitimate.
Reassess annually, because FCC rules change.

If you operate in healthcare, consent obligations stack with privacy obligations; see our guide to HIPAA compliant text messaging for how the two frameworks interact. FRANSiS supports TCPA compliance with built-in opt-out handling, consent recordkeeping, and quiet-hour scheduling, and you can review FRANSiS pricing to see which plan fits your organization's size.

Frequently asked questions

What does TCPA stand for?

TCPA stands for the Telephone Consumer Protection Act. It is a federal law passed in 1991 and codified at 47 U.S.C. 227. It restricts automated calls, prerecorded voice messages, unsolicited faxes, and, under long-standing interpretation, text messages.

Does the TCPA apply to text messages?

Yes. The FCC and the courts treat text messages as calls under the TCPA. That means consent requirements, opt-out obligations, and quiet hours all apply to SMS campaigns the same way they apply to automated phone calls.

Are nonprofits exempt from the TCPA?

Not in the way most people assume. Nonprofits get limited carve-outs from certain telemarketing rules for voice calls, but automated texts to mobile phones still generally require consent. Courts have permitted TCPA lawsuits against charities and churches, so nonprofits should run consent-first programs like everyone else.

What is the penalty for violating the TCPA?

Statutory damages are $500 per violation and up to $1,500 per willful or knowing violation, with each message potentially counting separately. Because damages multiply across a contact list, class actions can produce substantial settlements. Recipients can sue directly without proving any actual harm.

What are TCPA quiet hours?

FCC rules restrict telemarketing calls and texts to between 8 a.m. and 9 p.m. in the recipient's local time zone. Organizations texting across time zones should schedule sends based on each recipient's local time rather than the sender's.

Conclusion

The TCPA is not a trap; it is a rulebook, and organizations that follow it actually build stronger programs, because consented audiences engage more and complain less. Get written consent with proper disclosures, honor every opt-out, respect quiet hours, keep records, and choose tools that make those habits automatic rather than optional.

Ready to put compliant texting to work? Contact the FRANSiS team to see how the platform's built-in consent capture, opt-out handling, and scheduling controls help your organization meet TCPA requirements from day one.