Is Missed-Call Text-Back Legal? The TCPA Rules That Actually Apply

The question that decides everything: is this a reply, or a solicitation?

Almost every hard question about missed-call text-back collapses into one distinction. The TCPA and its FCC rules treat marketing messages more strictly than non-marketing ones. A purely informational, responsive message (confirming you missed the call, asking what the caller needs, offering a time) is held to a lower consent standard than a message whose purpose is to advertise or promote something.

The trap is that the FCC reads "telemarketing" broadly, and it treats dual-purpose messages, ones that serve both an informational and a marketing purpose, as telemarketing. A message that answers the caller's question and then adds a line about this month's promotion is not a hybrid in the FCC's view. It is a marketing message, and it is judged by the stricter standard.

So the practical test is not "did they call us?" It is: if this text were read aloud in front of a judge, is it obviously answering the call that just happened, or is it obviously selling something? A well-built text-back sequence keeps the first message unambiguously in the first category, and treats anything that drifts toward the second as a separate program with its own consent record.

Why a missed call is a stronger starting position than a purchased list

FCC guidance has long held that a person who knowingly releases their phone number to a business has, in effect, given permission to be contacted at that number, absent instructions to the contrary, for communications closely related to the reason they gave it. Someone who deliberately dials your business line to ask about a service is doing something much closer to that than someone whose number you bought.

The important limit sits right next to it in the same guidance: a number that is captured by caller ID or automatic number identification equipment without notice to the subscriber is not treated as an invitation to receive autodialed or prerecorded calls. That distinction matters here more than most vendors admit, because a missed-call text-back system is, mechanically, reading the caller ID of a call nobody answered.

The honest reading is that an inbound call to your published number is a genuinely strong position for a responsive reply about that call, and a weak position for anything else. The caller chose to contact you; they did not choose to join a list. Treat the call as consent for the conversation it started, not as consent for every message you might later want to send.

This also explains why the risk profile differs by industry. Most HVAC and dental calls come from existing customers or people who found that specific business on purpose. Real estate sees far more first-contact callers dialing a number off a sign, which is a thinner relationship to lean on.

What changed in 2025 and 2026

Two appellate decisions have reshaped this area, and they cut in different directions.

In January 2025, the Eleventh Circuit vacated the FCC's "one-to-one consent" rule in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir., Jan. 24, 2025), one business day before it would have taken effect. The court held the FCC had stretched the ordinary meaning of prior express written consent beyond its statutory authority. The FCC subsequently removed the vacated language and reinstated the prior version of the rule. That decision removed a requirement that each consent be tied to a single identified seller; it did not remove consent requirements generally.

In February 2026, the Fifth Circuit went further in Bradford v. Sovereign Pest Control of TX, Inc. (5th Cir., Feb. 25, 2026), holding that the TCPA's text requires only "prior express consent" and does not distinguish between oral and written consent, which undercuts the FCC's long-standing prior-express-written-consent rule for telemarketing calls to mobile numbers. It is one of the first decisions to reassess an FCC TCPA interpretation in light of Loper Bright Enterprises v. Raimondo, which directs courts to read statutes independently rather than deferring to an agency's view.

Here is the part that matters operationally, and that a lot of coverage glosses over: Bradford binds the Fifth Circuit, which is Texas, Louisiana, and Mississippi. The FCC's written-consent rule remains in force everywhere else, and the FCC has not repealed it. A business serving customers in multiple states cannot safely design one consent flow around the most permissive circuit. The sensible posture is unchanged: collect and document consent as if written consent were required, and treat Bradford as a defense that may be available, not as a reason to loosen the process.

The opt-out rules that are in force right now

The FCC's Report and Order FCC 24-24 created a revocation regime that took effect on April 11, 2025, and this is the part of TCPA compliance most likely to be the thing that actually bites a small business, because it is about behavior after the first text rather than before it.

• A recipient can revoke consent in any reasonable manner. A business cannot designate one exclusive method and ignore the rest, so "reply STOP" being the only supported path is not sufficient if someone tells your receptionist to stop texting them.
• The FCC identified standardized keywords that must be honored as revocation on their face, including stop, quit, revoke, opt out, cancel, unsubscribe, and end.
• Revocation must be honored as soon as practicable and no more than ten business days after receipt, down from the previous thirty.
• Exactly one confirmation message may be sent after a revocation, and then messaging has to stop.

One piece of that rule is not yet live. The provision requiring that a revocation made in response to one type of message be treated as applying to all of that caller's messages, sometimes called the revoke-all or global revocation rule, has been delayed by successive FCC waiver orders and now takes effect January 31, 2027. Waiting for the deadline is a poor plan. Honoring a stop request across everything you send is the behavior a customer already expects, it is what most messaging platforms do by default, and building it in now costs nothing next January.

The reason to take this seriously is arithmetic. The TCPA carries statutory damages of $500 per violating message, rising to $1,500 for a willful or knowing violation, under 47 U.S.C. § 227(b)(3). Those are per message, and a misconfigured sequence sends a lot of messages before anyone notices.

Quiet hours, and the litigation wave built on them

The TCPA's call-time rules prohibit telephone solicitations before 8 a.m. or after 9 p.m. in the recipient's local time. Read strictly, that restriction applies to solicitations, which is why a genuinely responsive reply to a call the person placed themselves at 2 a.m. is a different thing from a 2 a.m. promotional blast.

That reading has not stopped a large volume of litigation. Plaintiff firms have filed class actions in significant numbers arguing that marketing texts outside the 8 a.m. to 9 p.m. window are unlawful regardless of consent, and TCPA class filings rose sharply through 2025. In March 2025 the Ecommerce Innovation Alliance petitioned the FCC for a declaratory ruling that the quiet-hours provision does not apply where prior consent exists, and asking for a workable presumption about which time zone a mobile number sits in. That petition is the live question, and until it is resolved the exposure is real even for defendants with good arguments.

The practical configuration follows from the distinction rather than from the litigation. The immediate responsive text should follow the caller, because it is an answer to something they just did. Anything scheduled afterward, a follow-up nudge, a reminder, a promotion, should be held to the 8 a.m. to 9 p.m. window in the recipient's local time, and a system that cannot determine local time should default to the narrowest safe window rather than guessing.

The state layer most guides skip

Federal law is a floor, not a ceiling. A growing number of states, at least a dozen by 2026, now run their own telemarketing statutes, commonly called mini-TCPAs, and they generally bind any business texting that state's residents regardless of where the business is located. That last point catches people: the relevant question is where your customer is, not where your office is.

Florida's Telephone Solicitation Act (2021, amended 2023) set the template the others copy. It treats texts as calls, requires prior express written consent for automated sales messages, narrows the window to 8 a.m. to 8 p.m. in the recipient's local time, caps messages on the same subject at three per twenty-four hours even with consent, provides $500 per violation with treble damages for willful violations, and gives consumers a private right of action.

Oklahoma's Telephone Solicitation Act (2022) tracks Florida's closely, including the three-per-day cap. Maryland's Stop the Spam Calls Act took effect January 1, 2024 and requires prior express written consent for automated calls and texts. Washington reaches marketing texts through its commercial electronic mail and robocall statutes, with its own private right of action.

The common thread is that these laws target sales and solicitation messages. A strictly responsive reply to an inbound call is not the target of any of them. A follow-up campaign built on top of the numbers those calls generated very much is, and a business operating across state lines should know which of these statutes its customer base actually touches before it turns that campaign on.

Carrier rules are separate from the law, and they are what actually blocks your texts

There is a second rulebook that has nothing to do with the TCPA and is enforced far more immediately. U.S. carriers require application-to-person registration, known as A2P 10DLC, for any business sending automated texts from a standard ten-digit local number. Registration runs through The Campaign Registry: the business registers a brand and a specific messaging campaign, and carriers review what is being sent and to whom.

Since carriers tightened enforcement in 2025, unregistered application-to-person traffic is blocked or heavily filtered rather than merely delayed. The failure mode is quiet and expensive: the software reports messages as sent, the business believes text-back is working, and the texts are not reaching phones. If you are evaluating a vendor, ask specifically who holds the 10DLC registration, whether your brand and campaign are registered under it, and how delivery failures surface in reporting.

Carrier campaign review also looks at message content and opt-out language, which means the compliance work above is not purely a legal exercise. A campaign whose sample messages lack clear opt-out instructions can be rejected at registration before a single customer is involved.

What a compliant setup actually looks like

Pulling the above together, this is the configuration that keeps a missed-call text-back deployment on the right side of all four rulebooks.

• The first message is strictly responsive to the call that triggered it. It references that call, asks what the caller needs, and sells nothing.
• Opt-out instructions appear in the first message, and the standardized revocation keywords are honored automatically.
• A stop request received through any channel, text, phone, email, or in person, is recorded against that number and honored everywhere, not just in the sequence that received it.
• Revocations are processed immediately in practice, well inside the ten-business-day requirement, with at most one confirmation message afterward.
• The immediate reply follows the caller; every scheduled message after it respects 8 a.m. to 9 p.m. local time, or 8 a.m. to 8 p.m. where a stricter state rule applies.
• Marketing follow-up is a separate program with its own consent record, not an extension of the text-back reply.
• A2P 10DLC brand and campaign registration is in place and documented before launch.
• Consent, revocation, and message history are logged in a form you could actually produce if challenged, because in TCPA disputes the business generally has to prove consent rather than the consumer having to disprove it.
• Every template a customer can receive has been read and approved by someone at the business before it goes live, which is the same standard AutomateLine applies to voice scripts.

Where this sits next to the other compliance questions

TCPA is the messaging rulebook, and it is not the only one a front-desk automation touches. If the business is a healthcare provider, the content of those messages and the vendor handling them fall under HIPAA as well, which is a separate analysis with its own contractual requirement; the HIPAA and AI voice agents guide covers what actually matters there. If calls are recorded or transcribed, state wiretap consent rules apply on top of both.

These stack rather than substitute. A vendor who can speak fluently about one and goes vague on the others is telling you something. The buyer's checklist has the specific questions worth asking before signing anything.

Sources

• Telephone Consumer Protection Act, 47 U.S.C. § 227; § 227(b)(3) supports the $500 and $1,500 statutory-damages figures. FCC rules at 47 C.F.R. § 64.1200 support the call-time (quiet hours) and consent provisions.
• Federal Communications Commission guidance on prior express consent, including the treatment of knowingly released numbers and of numbers captured by caller ID or ANI equipment without notice, and the FCC's broad construction of "telemarketing" including dual-purpose messages.
• Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir., Jan. 24, 2025), vacating the FCC's one-to-one consent rule, with the FCC subsequently removing the vacated rule language, as reported in 2025 legal alerts from firms including Wiley, Venable, and Womble Bond Dickinson.
• Bradford v. Sovereign Pest Control of TX, Inc. (5th Cir., Feb. 25, 2026), holding the TCPA requires only prior express consent, oral or written, as reported in 2026 legal alerts from firms including Nixon Peabody, Holland & Knight, Mayer Brown, and Hogan Lovells. Binding in the Fifth Circuit (Texas, Louisiana, Mississippi) only. Decided against the background of Loper Bright Enterprises v. Raimondo (2024).
• Federal Communications Commission, Report and Order, FCC 24-24 (adopted February 15, 2024), revocation provisions effective April 11, 2025; Consumer and Governmental Affairs Bureau waiver orders dated April 7, 2025 and January 6, 2026 (DA-26-12) delaying the 47 C.F.R. § 64.1200(a)(10) scope provision to January 31, 2027, as summarized in 2025 and 2026 alerts from firms including Bryan Cave Leighton Paisner, Nixon Peabody, Carlton Fields, and Hunton.
• Ecommerce Innovation Alliance petition for declaratory ruling on the TCPA quiet-hours provision, filed with the FCC March 3, 2025, and 2025 industry and legal coverage of the resulting quiet-hours class-action filings.
• Florida Telephone Solicitation Act (2021, amended 2023); Oklahoma Telephone Solicitation Act (2022); Maryland Stop the Spam Calls Act (effective January 1, 2024); Washington commercial electronic mail and robocall statutes.
• The Campaign Registry and carrier A2P 10DLC registration requirements; 2025 industry coverage of AT&T, T-Mobile, and Verizon filtering of unregistered application-to-person traffic.
• This guide is general information about how these rules are commonly understood as of September 2026. It is not legal advice, and a business should have its own message content, consent flow, and opt-out handling reviewed by counsel.