Email, Text, and Phone Marketing Rules for Small Business

Two different federal laws govern how you can market to people, and they are not equally strict. Email marketing under CAN-SPAM does not require the recipient's permission first — you can email people who never opted in, as long as you follow the rules about honesty and opt-out. Texting and calling customers under the Telephone Consumer Protection Act (TCPA) is far stricter — for most marketing texts and any autodialed or prerecorded marketing call, you generally need signed, written consent before you ever contact them. Small businesses get in trouble by assuming the two work the same way, or that because email is loose, texting must be too.

Email: what CAN-SPAM actually requires

The CAN-SPAM Act, enforced by the FTC, does not require opt-in consent for commercial email. What it requires is honesty and an easy way out. It also covers all commercial email, not just bulk sends, and it makes no exception for business-to-business email. For every commercial message you send, or that a vendor sends for you, you must:

• Use accurate "From," "To," "Reply-To," and routing information. The email cannot appear to come from someone or somewhere it didn't.
• Use a subject line that reflects the content. No misleading "Re:" tricks or bait-and-switch subject lines.
• Identify the message as an advertisement. The law gives you a lot of leeway in how you do this, but the disclosure has to be clear and conspicuous.
• Include a valid physical postal address. A current street address, a post office box you have registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail-receiving agency all qualify.
• Give a working opt-out mechanism and honor it. The opt-out has to stay functional for at least 30 days after you send, and you must honor a request within 10 business days. You cannot charge a fee, demand any personal information beyond an email address, or make someone take any step beyond a reply email or a single web page.

Three things trip up honest small businesses. First, you stay legally responsible even if you hire an outside marketer or agency to send the emails — CAN-SPAM allows both the business whose product is promoted and the company that pressed send to be held liable, so "my email vendor did it" is not a defense. Vet who you hire and put compliance expectations in the contract. Second, a subscription or membership is not a waiver: members and subscribers can still opt out of your marketing email. Only a genuinely transactional or relationship message — one that fits the narrow categories the Act sets out, like fulfilling an order the person already placed — can go without an unsubscribe link. Dressing up a promotion as a receipt does not work. Third, penalties run per email, not per campaign or per complaint. The FTC's civil penalty amount is set by statute and adjusted for inflation, so a single sloppy send to a large list can turn one mistake into thousands of separate violations. Confirm the current penalty amount on ftc.gov before you assume the risk is small.

Texting and calling: the TCPA is a different animal

The TCPA, enforced by the FCC (with private lawsuits doing much of the real-world enforcement), covers marketing texts and marketing calls that use an autodialer or an artificial or prerecorded voice. The baseline rules:

• You generally need prior express written consent before you send a marketing text or make an autodialed or prerecorded marketing call. This is a higher bar than email's opt-out model — it is opt-in, in writing, before contact.
• "Prior express written consent" is a defined term, not a vibe. Under the FCC's rule it means a written agreement that bears the person's signature (an electronic or digital signature counts), clearly authorizes you to send autodialed or prerecorded marketing to the specific number given, and includes a clear and conspicuous disclosure of what they are agreeing to. Critically, you cannot make that consent a condition of buying anything — the rule says so explicitly, and "check this box to place your order" is exactly the design that fails.
• The consent cannot be buried. A disclosure hidden in dense terms and conditions, or a pre-checked box the customer has to notice and uncheck, is the kind of "consent" that regularly loses in court.
• Honor opt-out requests, and do not police how they arrive. A person can revoke consent by any reasonable method. The FCC's rule treats "stop," "quit," "end," "revoke," "opt out," "cancel," and "unsubscribe" in a reply text as automatically reasonable — but that list is a floor, not a magic-words requirement, and you may not designate an exclusive way to opt out. Someone who replies "please stop texting me," emails you, or tells your front desk has revoked consent just as effectively. Once revoked, you must stop within a reasonable time, and in no event more than 10 business days from receipt. Build it into your texting platform so it happens immediately rather than riding on someone remembering.
• Respect calling hours. The federal telemarketing rules generally bar solicitation calls before 8 a.m. or after 9 p.m. — measured in the called party's local time, not yours. Several states set narrower windows, discussed below.
• Scrub against the National Do Not Call Registry before making unsolicited sales calls to consumers. Consumers register their own numbers for free; sellers and telemarketers access the registry through the FTC's separate business portal at telemarketing.donotcall.gov, where access fees can apply depending on how many area codes you need. The version of the list you use generally must be no more than 31 days old, so this is a recurring chore, not a one-time download.
• Keep your own internal do-not-call list. Anyone who asks you directly to stop calling or texting goes on it, regardless of what the national registry says, and stays on it.

The reason this matters more than email compliance is enforcement. The TCPA gives individuals a private right of action — a consumer doesn't need the FCC to act; they can sue you directly, and the law sets statutory damages per violating call or text, with a higher amount available if the violation was willful or knowing. Because damages are set per message and don't require the recipient to prove any actual financial loss, a single text blast to a list of a few thousand numbers lacking proper consent can generate enough small individual claims to support a class action. Texting a purchased or scraped contact list — rather than a list of people who affirmatively opted in to your texts specifically — is one of the fastest ways a small business ends up as a defendant. A phone number sitting in your customer database from a sale, an invoice, or a sign-in sheet does not by itself mean that number consented to marketing texts.

"Existing business relationship" is not a blank check

Many business owners have heard that an existing customer relationship lets them market more freely. That's only partly true, and the part that's true is narrower than most people think. Under the federal rules, an established business relationship is mainly a Do Not Call Registry concept: it can let you make a live solicitation call to a number on the registry for a limited period — measured from the customer's purchase or transaction, with a much shorter window running from a mere inquiry or application — and it evaporates the moment that person asks you to stop.

What it does not do is substitute for the prior express written consent that autodialed or prerecorded marketing calls and marketing texts require. There is no established-business-relationship exception to that requirement. Treat every marketing channel — email, text, calls — as needing its own documented consent, rather than assuming that because someone bought from you once, every kind of outreach is fair game. Because the exact windows are set by regulation and can be amended, confirm the current periods on fcc.gov or ftc.gov rather than relying on a number you half-remember.

The rules keep moving — verify before you launch a campaign

The FCC's consent requirements for texts and calls have been actively rewritten and fought over in court. One example: a rule that would have required consent to be given separately to each individual seller, rather than to a lead-generation site collecting consent for many sellers at once, was vacated by a federal appeals court before it took effect and does not appear in the FCC's current rules. The FCC has also adjusted compliance dates on parts of its revocation-of-consent rules. But the underlying requirement for clear, specific, signed prior express written consent to autodialed and prerecorded marketing contact remains fully in effect, and so does the right to revoke by any reasonable means. Do not rely on a vendor's or platform's assurance that a list or a consent method is "compliant" without checking current FCC and FTC guidance yourself, especially before a campaign involving a purchased list, a lead-generation partner, or automated dialing/texting software.

State law can be stricter — "mini-TCPA" statutes

Several states have their own telemarketing and text-marketing statutes that go beyond federal law, often with their own private right of action and their own damages, separate from the TCPA's. You don't get to pick the friendlier rule — if you call or text into a state with a stricter mini-TCPA, that state's rules apply on top of federal law, and several of these statutes presume that a call to an in-state area code reached someone in that state. These are examples of the kinds of extra duties states impose, not a complete list and not a substitute for reading the current statute:

• Florida — its telephone solicitation statute creates its own private right of action and requires prior express written consent for sales calls, texts, or voicemails made using an automated system for the selection and dialing of numbers, a recorded message, or a prerecorded voicemail. (It is not a consent requirement for every unsolicited sales call — the automation is what triggers it.) For text solicitations, the statute builds in a safe harbor: the recipient must first reply "STOP," and the sender then has 15 days to stop, after which it may not text again except to confirm the opt-out.
• Oklahoma — its Telephone Solicitation Act of 2022 reaches an automated system for the selection or dialing of numbers, a deliberately broader trigger than the federal definition; bars commercial solicitation calls before 8 a.m. or after 8 p.m. in the called person's time zone; limits you to no more than three solicitation calls to a person in a 24-hour period on the same subject, regardless of which number you call from; and lets consumers sue directly.
• Washington — its telephone solicitation statute requires the caller to identify themselves, their company, and the purpose of the call within the first 30 seconds; bars calls received before 8 a.m. or after 8 p.m. in the recipient's local time; and, once a person says they want the call to end or their number removed, requires you to end the call within 10 seconds and keep them off your lists for at least a year. It reaches live calls, not just automated ones — though it excludes business-to-business contacts.

Other states have similar statutes on the books or moving through their legislatures, and the details vary, are frequently amended, and are heavily litigated. Before any calling or texting campaign, check the current telemarketing and consumer-protection statutes in every state where your recipients are located — not just where your business is based — through that state's official legislature or attorney general site.

What to do

1. Separate your consent records by channel. Consent to email you is not consent to text you, and consent to text is not consent for autodialed sales calls. Track each separately, with a timestamp and the exact language the person agreed to. In a dispute, your records are the whole ballgame.
2. Never pre-check a marketing consent box, never bundle it into terms the customer has to hunt for, and never make it a condition of purchase. Make it a clear, standalone checkbox the customer actively selects.
3. Don't buy or rent contact lists for texting or autodialed calling. A purchased list is, by definition, people who did not consent to hear from you.
4. Build opt-out handling into your systems so it's automatic — and make sure it catches more than the word "STOP," since a person can revoke by any reasonable method and you cannot require one specific channel.
5. Scrub against the National Do Not Call Registry on a recurring schedule and maintain your own internal do-not-call list before any consumer telemarketing campaign, and keep a valid physical mailing address in every marketing email.
6. Check current FCC and FTC guidance, and the telemarketing statute of every state you're contacting people in, before a mass campaign — guidance from even a year or two ago may no longer be current.
7. Talk to a qualified attorney before launching automated texting or calling at any real scale. The downside of getting this wrong — per-message statutory damages multiplied across a whole list — is large enough that a short compliance review upfront is cheap by comparison.

Free official starting points: the FTC's CAN-SPAM compliance guide and telemarketing guidance at ftc.gov, the National Do Not Call Registry at donotcall.gov (with the seller/telemarketer portal at telemarketing.donotcall.gov), and the FCC's guidance on robocalls, texts, and telemarketing rules at fcc.gov. Your state's legislature and attorney general publish the state statute for free. If you want free help thinking through your marketing compliance alongside the rest of your business, SCORE and your state's Small Business Development Center offer no-cost mentoring through sba.gov.

This article is general business information, not legal, tax, or financial advice, and does not create an attorney-client relationship.