SMS follow-up compliance basics for a small business
Lead follow-upUpdated
A US small business can text its leads legally if it follows four rules: only text people who contacted you first or otherwise gave consent, include opt-out instructions and honour STOP immediately, avoid quiet hours, and register your business number for application-to-person (10DLC) messaging with your carrier or texting provider. The governing law is the TCPA, enforced privately through lawsuits as well as by regulators, so the cost of getting it wrong is real. This is a plain-language overview, not legal advice — check with a lawyer for your situation.
Who can I text?
People who have given you consent. For a small business the clean cases are: someone who filled out your contact form and gave a phone number, someone who booked through your scheduling tool, and someone on a list you built with explicit permission. Purchased lists and numbers scraped from directories are not consent. If the message is promotional rather than a direct reply to an inquiry, the consent standard is higher (prior express written consent), and the safest path is to keep automated texts to replies and confirmations.
What must every message include?
- Who it is from. The business name, in the first message at minimum.
- How to stop. "Reply STOP to opt out" or equivalent, at least in the first message and periodically after.
- Nothing misleading. The message should be what it says it is — a reply from the business to the inquiry.
What happens when someone replies STOP?
You stop. Immediately, for every automated message, and you keep a record of the opt-out. One confirmation message acknowledging the opt-out is generally allowed; anything after that is not. A good follow-up tool handles this automatically — STOP flips the lead to opted-out and nothing else sends — but the responsibility is the business's regardless of the tool.
Are there hours I cannot text?
Federal rules restrict telemarketing calls and texts to between 8am and 9pm in the recipient's local time, and some states are stricter. A direct reply to an inquiry the person just submitted is a different category from a marketing blast, and many businesses reasonably reply at the time the inquiry arrives. If you want a conservative policy, hold automated messages outside those hours and send them at 8am local.
What is 10DLC and do I need to register?
US carriers require businesses that send automated texts from a standard 10-digit number to register the business and the use case ("application-to-person" or A2P 10DLC). Unregistered traffic is filtered or blocked. Your texting provider (OpenPhone and similar services) walks you through it: business details, a description of what you send, and sample messages. It takes a few days and is a one-time step per business.
What should I keep records of?
- How and when each lead gave consent — the form submission, the booking, the import with its source.
- Every message sent and received, with timestamps.
- Every opt-out and when it was honoured.
A follow-up tool that stores the conversation and the lead's source gives you most of this by default. A spreadsheet and a personal phone do not.
Common questions
Is replying to a contact-form inquiry by text considered marketing?
A direct, one-to-one reply to a question the person just asked is generally treated differently from a promotional blast, but the line is not always bright and the safest practice is to behave as though every automated text needs consent, an opt-out, and a STOP mechanism. When in doubt, ask a lawyer who works with small businesses in your state.
Does this apply outside the US?
Every country has its own rules — CASL in Canada, PECR and GDPR in the UK and EU, the Spam Act in Australia — and most are at least as strict on consent. The principles (consent, identification, opt-out, records) carry over; the details do not.
What does Upbeat do about this?
Upbeat only texts leads who submitted a form, booked through a connected tool, or were imported with consent. Every automated message carries opt-out language, STOP unsubscribes the lead immediately, and the full conversation and lead source are stored. 10DLC registration happens with your texting provider.