Marketing automation in the US: texting is where lawsuits start

Short answer: In the US, email and text messages sit under different laws. CAN-SPAM lets you send marketing email without prior permission as long as you identify yourself, include a physical address and honor unsubscribes quickly. The TCPA is far stricter: automated marketing texts need prior express written consent, and statutory damages of US$500 to US$1,500 per message can be claimed by the recipient directly. Automate email first, and add texting only once consent capture, quiet hours and carrier registration are in place.

Picture a plumber in Columbus who finally sets up a follow-up sequence. It emails every past customer a reminder, and it texts them too, because texts get read. Two weeks later a former customer, annoyed by the third text, calls a lawyer whose practice is built on exactly this situation. The emails were fine. The texts were the problem, and the plumber never knew they fall under two different laws.

The software is easy to buy. The rules about who you can message, by which channel, and on what proof of permission decide whether it is an asset or a liability. This guide is general information, not legal advice, and a large list is worth a quick check with a marketing-compliance lawyer.

The follow-up your business already owes people, done on a schedule

Marketing automation is software that sends the follow-up you would otherwise forget, triggered by something a customer does or stops doing. A quote request gets a reply within a minute. A booking gets a reminder the day before. A finished job gets a review request. A lapsed maintenance plan gets a renewal note before the customer forgets you exist.

That is not advertising. Advertising finds strangers. Automation looks after people who already know you, so you recover revenue that was one nudge away. If the missing piece is the first reply to a new enquiry, our guide to AI lead generation covers speed-to-lead, the front half of the same system.

The useful question is which job is leaking money today, and which channel the law lets you use for it. The second half is where the US differs from most countries.

Email and text run on different laws, and only one of them can bankrupt you

Two federal statutes cover almost everything here, and they work in opposite ways.

CAN-SPAM, the federal law on commercial email, is an opt-out law. You do not need permission before the first marketing email. You need to follow its rules from that first message and stop when told. Regulators enforce it, and the penalty is steep in theory (over US$50,000 per email, an amount the FTC adjusts each year).

The TCPA, the Telephone Consumer Protection Act, is an opt-in law for automated calls and marketing texts, and ordinary people can enforce it. It gives a recipient a private right of action, with statutory damages that do not depend on proving harm. That is why it produces so many class actions, and why a texting mistake scales in a way an email mistake usually does not.

	Email (CAN-SPAM)	Text (TCPA)
Permission first	Not required	Prior express written consent
Enforced by	Regulators	Regulators and consumers directly
Money at stake	Over US$50,000 per email	US$500 per message, up to US$1,500 if willful
Opt-out	Within 10 business days	Any reasonable manner

Start on email. Add texting only after the consent side is built and tested.

CAN-SPAM: the opt-out rules that trip up careful senders

CAN-SPAM covers all commercial email, including messages to your own customers, and each message in a sequence counts separately. The rules are short and the failures sit in the details.

• Honest headers and subject lines. The from name and reply address must identify the real sender, and the subject must reflect what is inside.
• A valid physical postal address in every message. New senders skip this constantly.
• A working opt-out. It must keep working for at least 30 days after sending, cannot require more than a reply or one web page visit, and cannot cost anything.
• Opt-outs honored within 10 business days. Automations fail here across tools: the person unsubscribes in the email platform while a separate texting or CRM sequence keeps firing.

The rule careful senders miss is responsibility. If an agency, freelancer or platform sends for you, you are still responsible for what goes out under your name, and so are they. The fix is dull: one suppression list every tool checks.

TCPA: what prior express written consent looks like in practice

For automated marketing texts and calls placed with an autodialer or prerecorded voice, the standard is prior express written consent. The person agreed in writing (a web form or electronic signature counts) to receive marketing messages from you at that number by automated means. On a real form that means:

• Consent language beside the phone field, saying they agree to automated marketing texts from your business and that agreeing is not a condition of buying.
• A box that is not pre-ticked. Consent buried in a terms link is the pattern lawsuits are built around.
• One purpose per consent. Agreeing to reminders is not agreeing to promotions.
• A record you can produce: date, time, number, page and exact wording shown. Forms get redesigned, so keep a dated copy of each version.

Revocation is the other half. Under the FCC’s rules a person can revoke consent in any reasonable manner, and words like stop, cancel, unsubscribe, quit and end are treated as reasonable. These rules have been revised and delayed several times, and the details of which opt-out methods a sender may require are still moving. Do not build around fine print that keeps moving: honor any plain request to stop, right away, in every tool.

The money is the reason to care. The statute allows US$500 per message, and up to US$1,500 if the violation was willful or knowing. A sequence sent to a few thousand numbers without valid consent creates exposure no small business can absorb, and because consumers can sue directly, it does not depend on a regulator noticing you.

Federal telemarketing rules also set calling hours of 8am to 9pm in the recipient’s local time, and marketing texts are generally treated the same way, so a sequence must know each contact’s time zone, not yours.

Then come the states. Several have passed their own telemarketing and text laws, often called mini-TCPAs, and they tend to be stricter. Florida, Oklahoma and Maryland are the ones most often cited. Depending on the state they can add tighter quiet hours, daily message caps and their own private right of action. Details change, so check the current rules before you text into a state. Our guide to state texting laws sets four of them side by side.

A transactional text, such as a confirmation for a booking someone just made, has a lower bar than a promotion. A text that also tries to sell is a marketing text.

10DLC registration: the carrier gate nobody mentions before you buy a texting tool

This is about whether messages arrive at all. Business texting from ordinary 10-digit local numbers runs through A2P 10DLC (application-to-person, 10-digit long code). Carriers use it to separate legitimate businesses from spammers, and texts from unregistered numbers are increasingly filtered or blocked, with no warning.

Registration has two parts. You register your brand (legal name, tax ID, address, website), then each campaign: what you will text about, the consent language customers agree to, and sample messages.

All of this is subject to change. Most texting platforms guide you through it and submit it for you. Approval takes from days to a few weeks, so start early. Fees are usually small one-time and monthly amounts that vary by provider, so ask for current figures. Toll-free numbers have their own verification process and timeline. And carrier approval is not an opinion that your consent process satisfies the TCPA.

If a tool promises you can text customers tomorrow with no registration step, treat that as a warning about the tool.

Fifty states, a patchwork of privacy statutes

A second layer covers the personal data automation collects. The US has no single national consumer privacy law, so what applies depends on where your customers live, not where your business is registered.

California’s CCPA, as amended by the CPRA, is the broadest. It covers many businesses that collect personal information from California residents and gives them rights to know, delete, correct and opt out of the sale or sharing of their data. Texas has the TDPSA, Virginia has the VCDPA, and a growing list of states have their own versions, each with different thresholds for who is covered.

The working rule: find out which states your contacts live in, and where rules differ, meet the strictest one you reach. That usually means a clear privacy notice and an easy way to request deletion or opt out, honored in every tool that holds the data. Fine amounts differ by state and change, so build the request process once rather than quoting figures.

Gmail and Yahoo’s sender rules apply to you too

Since early 2024, Gmail and Yahoo have enforced sender requirements, and other providers have moved the same way. They decide whether a legally compliant email reaches the inbox.

• Authentication. Set up SPF, DKIM and DMARC for your sending domain. Your platform shows the records to add.
• One-click unsubscribe, processed promptly.
• Low spam complaints. The commonly cited target is under 0.3 percent, ideally under 0.1 percent. Google Postmaster Tools shows your rate.
• A domain you own, not a free webmail address.

The formal bulk-sender threshold is about 5,000 messages a day to one provider. That does not exempt a 400-person list, because authentication is expected of everyone. This is also where a bought list catches up with you: cold contacts produce complaints and bounces, and once the rate climbs your real customers stop seeing your email too.

Five automations to switch on, in order

Switch these on one at a time and let each run before adding the next.

1. Welcome and lead follow-up. Reply the moment a form or quote request arrives. Email is the default. Text only where the form captured written consent, and keep the first text useful, not promotional.
2. Quote and estimate chase. Two or three short follow-ups over a week, by email first. For many service businesses this is the highest-return automation.
3. Appointment reminders and no-show recovery. Text fits best because it is read within minutes, and reminders about a booking someone just made carry less risk than promotions. After a missed appointment, one rebooking offer is reasonable.
4. Review requests. One message a day or two after the job. Ask everyone, and never pay for a review.
5. Win-back and renewal reminders. Email carries this, because older contacts may have no text consent. It has the strongest payback for recurring services, and the example below uses it.

A worked example: an Indianapolis HVAC company and its lapsed maintenance plans

This is a hypothetical, built to show a method and its arithmetic. It is not a client, and none of the numbers are measured results.

Imagine an HVAC company in Indianapolis with four technicians. Its records show 150 customers whose annual maintenance plans lapsed in the past two years, with no follow-up. Nobody decided to let them go. Nobody had time to chase.

The method. Clean the list first: remove opt-outs, merge duplicates, confirm addresses. Build one win-back email sequence of three messages over three weeks, offering the seasonal tune-up and plan renewal, each with the postal address, an honest subject line and a working unsubscribe. Then check the records for written text consent. Only contacts who agreed to texts on a form, with a saved copy of the wording, get one optional text from a registered number after the second email. Everyone else stays on email, which also invites them to opt in to reminder texts.

Most of Indiana is on Eastern time, but a handful of counties are on Central, so sends are scheduled by each contact’s time zone, not the office clock.

The arithmetic, as an illustration. Suppose a plan sells for US$180 a year. If 20 percent of the 150 lapsed customers renew, that is 30 renewals and US$5,400, before any repair work the tune-ups uncover. Suppose the tool costs US$100 a month and a professional builds the sequence for US$2,500: first-year cost US$3,700. At a 10 percent renewal rate the plan revenue is US$2,700, short of that cost, which is why repair work and the second year matter. Run the numbers on your own business before you buy.

Choosing a platform: HubSpot, Klaviyo, Mailchimp or a text-first all-in-one

No platform removes the legal work. They differ in what they are built for.

HubSpot combines a CRM, pipeline and automation, and suits a business that wants records, quotes and follow-up in one place. Free tools exist and paid plans commonly start in the tens of US dollars per month, but advanced automation tiers cost substantially more and scale with contacts.

Klaviyo is built around purchase and browsing behavior, so it suits online stores, especially on Shopify. It handles email and text.

Mailchimp is the familiar email tool for newsletters and simple automations. Check which features sit on the free plan today, because that has shifted over time.

A text-first all-in-one such as GoHighLevel bundles CRM, missed-call text-back, texting, email and booking, so a local service business can run its whole speed-to-lead loop in one place. Some tools of this type handle carrier registration inside the platform. The trade-off is a bigger setup job.

Check current US-dollar pricing directly, because plans change. Before committing, ask whether the platform stores consent records, honors one suppression list across channels and schedules sends by time zone. If not, that work falls on you. Our comparison of marketing automation software for US small business puts those questions to seven platforms and prices them at the list size you will have in two years.

What it costs in US dollars

Ranges, not quotes.

• Tools: US$40 to US$150 a month per tool. Most small businesses need one or two.
• Texting: billed per message, commonly a cent or a few cents plus carrier fees, with registration fees on top. It varies by provider.
• Done-for-you build: US$2,500 to US$6,000 for a single automation, more for a system that connects several tools.

Our guide to what marketing automation costs in the US prices each of these lines from the vendors’ and carriers’ own pages.

For the wider budget, US digital marketing costs breaks down agency fees and ad spend. Automation is usually the cheaper half of a growth plan because it works on people you already have. Our AI automation service covers having it built for you.

How to tell it is working

Measure each automation separately, in a monthly review.

• Revenue attributed to each automation: renewals, booked quotes, reviews collected. If you cannot tie one to money, consider cutting it.
• Unsubscribe and opt-out rate. It should stay low and steady. A rising rate means the messages have drifted from what people agreed to.
• Spam complaint rate, under 0.3 percent and ideally under 0.1 percent.
• Reply rate on texts. Many STOP replies and few real ones means consent or timing is wrong.
• Time to first reply on new enquiries. Automation should make it seconds.

Also text STOP to your own number to confirm every tool goes quiet. For benchmarks, see AI marketing statistics for the US, and for where the tools are heading, the future of marketing automation.

Where US setups quietly go wrong

• Buying a list. Texting one invites a TCPA claim, because nobody on it gave written consent, and emailing one wrecks your sender reputation.
• One shared consent checkbox for everything. A single tick covering newsletters, promotions and texts is the pattern plaintiffs look for.
• No quiet-hours logic across time zones. A sequence timed to your office clock sends at the wrong hour two zones away.
• Texting from an unregistered number. Messages get filtered silently, so the automation appears to work while nothing arrives.
• Forgetting the vendor. Confirm in writing who keeps consent records and handles opt-outs.
• No record of consent. If you cannot show when and how someone agreed, you cannot defend a claim, even when consent was real.
• Automating the sensitive conversation. A complaint or cancellation deserves a human reply.

Who should start now, and who should stay manual

Start now if you have a few hundred contacts or more, customers who should return and do not, and quotes that go quiet. Home services, clinics, salons and repeat-purchase shops fit. Begin with email and one automation, then add texting once consent capture and carrier registration are done.

Stay manual if your list is under about 100 contacts. A personal message from you will outperform a sequence. Wait too if you cannot say where your contacts came from or have no consent records. Fix that first, because automation on an unclear consent position multiplies risk instead of revenue. Leave emotional or high-stakes conversations manual too.

Leads you pay for through digital advertising are only worth what your follow-up does with them. Our US digital advertising guide covers the buying side. For getting found in the first place, see SEO, AEO and GEO in the US. For the wider question of what AI can and cannot draft on your behalf, and the FTC and disclosure rules that come with it, see our AI marketing guide for US small business. To see where your own follow-up leaks, start with a free audit.

Frequently asked questions

What is the difference between CAN-SPAM and the TCPA for a small business? CAN-SPAM governs commercial email and lets you send without prior permission as long as you identify yourself, include a postal address and honor opt-outs. The TCPA governs autodialed and prerecorded calls and marketing texts, and it requires prior express written consent first. CAN-SPAM is enforced by regulators. The TCPA also lets individual consumers sue, which is why texting carries the bigger legal risk.

Do I need consent to send automated marketing emails in the US? Not under CAN-SPAM, which is an opt-out law: you may email without prior permission if you follow its rules. But every message needs a working unsubscribe, a valid physical address and honest headers and subject lines. Gmail and Yahoo also expect authentication and low complaint rates, so in practice permission-based lists perform better and are safer than any list you did not build yourself.

What does TCPA consent for marketing texts actually require? Prior express written consent means the person agreed in writing, including by a form or electronic signature, to receive marketing texts from your business using automated technology. The wording should be clear, sit next to an unticked box, and not be a condition of buying anything. Keep a dated record of exactly what they saw and when they agreed, because you may have to prove it.

What is 10DLC registration and do I need it? 10DLC is the system US carriers use to vet businesses that text from ordinary 10-digit local numbers. You register your brand and each texting campaign, usually through your texting platform, and unregistered traffic is increasingly filtered or blocked. Toll-free numbers have a separate verification process. Fees and approval times change, so check your provider before you plan a launch date.

How much can a TCPA violation cost? The statute allows US$500 per violating message, and up to US$1,500 per message if a court finds the violation willful or knowing. Because the law gives consumers a private right of action, a single bad automated sequence sent to a large list can turn into a class action. Some state laws add their own penalties on top, so treat consent as a cost of doing business, not a formality.

Do Gmail and Yahoo’s sender rules apply to a small business? Formally the strictest requirements apply to bulk senders, meaning roughly 5,000 or more messages a day to one provider. In practice both providers expect every sender to authenticate with SPF, DKIM and DMARC, offer easy unsubscribing and keep spam complaints low. The commonly cited target is under 0.3 percent, ideally under 0.1 percent. A small sender who ignores this still lands in spam.

How much does marketing automation cost in the US? Tools commonly run US$40 to US$150 a month each, and a single done-for-you automation typically costs US$2,500 to US$6,000 to build. Texting adds a per-message cost, usually cents per message plus carrier fees, and registration fees vary by provider. Check current pricing before you commit, because plans and contact-based tiers change often.

Which platform should a US small business choose? It depends on the business. HubSpot suits a company that wants CRM and automation together. Klaviyo suits online stores. Mailchimp suits a business that mainly needs simple email. A text-first all-in-one such as GoHighLevel suits a local service business that lives on missed calls and quotes, and it can handle carrier registration inside the platform.

---

Want to know whether your current follow-up would survive a TCPA complaint, and which automation to switch on first? Get a free marketing audit. No jargon, no pressure.