TCPA Compliance for B2B Text Outreach: The Operator’s Playbook

Somewhere between deciding to text business owners and pressing send, someone mentions the TCPA — usually attached to a horror story about per-message damages — and the room goes quiet. The advice you find next is almost uniformly bad in one of two directions: either texting businesses is basically illegal, or businesses can text anyone they like.

Neither is right, and the reason is that both skip the actual question. The TCPA does not ban business-to-business texting. It restricts particular methods and particular recipients. Whether your program is exposed depends on which of those you touch.

This is the operator’s version: what actually creates liability, what the rules require versus what the internet says they require, and the operating decisions that keep a program defensible. Every claim links to the statute, rule or opinion it comes from. If you want the full 35-year history instead, that is a separate article — see Is B2B Cold Texting Legal?

What actually creates exposure

The federal statute, 47 U.S.C. § 227, contains two separate regimes, and conflating them is the single most common mistake in this conversation.

• § 227(b) regulates technology. It restricts calls made using an automatic telephone dialing system or an artificial or prerecorded voice. Both are defined terms. Neither means “software.”
• § 227(c) regulates recipients. It directs the FCC to protect the privacy of residential telephone subscribers, which is what the national Do Not Call registry implements at 47 C.F.R. § 64.1200(c)(2).

A program that uses neither an autodialer nor a prerecorded voice removes the two things § 227(b) actually turns on. That is not a safe harbour: § 227(c) and the do-not-call rules are untouched by it, § 64.1200(d) imposes duties of its own, and state statutes and carrier rules sit outside the TCPA entirely. Most of what follows exists to address those other layers.

1. Where your numbers come from is the whole game

47 U.S.C. § 227(a)(1) defines an automatic telephone dialing system as equipment with the capacity to store or produce telephone numbers using a random or sequential number generator, and to dial them.

In Facebook, Inc. v. Duguid, 592 U.S. 395 (2021) the Supreme Court held — unanimously in the judgment, with Justice Alito concurring in the judgment only — that the random-or-sequential-generator requirement modifies both “store” and “produce.” Bulk sending is not autodialing. A CRM is not an autodialer. Scheduling is not autodialing.

Be precise about what that did and did not settle. Duguid did not hold that any list-based system is categorically outside the definition, and footnote 7 expressly left a door open, observing that an autodialer “might use a random number generator to determine the order in which to pick phone numbers from a preproduced list.” Courts have since narrowed that gap, but not uniformly, and district courts outside the circuits below have read the footnote both ways.

Appeals courts closed the workarounds plaintiffs tried next:

• Borden v. eFinancial (9th Cir. 2022) — using a generator to pick the order you message a stored list is not autodialing. The generator has to produce the numbers.
• Panzarella v. Navient (3d Cir. 2022) — the statute bans making a call using an ATDS, so having the capacity somewhere in the software is not enough.
• Soliman v. Subway (2d Cir. 2024) — and a text message is not a “prerecorded voice,” closing the other half of § 227(b).

What follows from this: every number in your database traces to a source you can name, and nothing in your stack ever generates a phone number — no random dialing, no sequential fills, no permuting digits, not even in a test script. Store the source and the collection date with the record. That provenance record is the defense.

2. Business lines and residential lines are decided by conduct

The do-not-call rules are written around the residential subscriber. The FCC was asked in 2005 to exempt business numbers outright and declined — but said in the same paragraph that the registry “applies to residential subscribers” and “does not preclude calls to businesses,” and that business numbers inadvertently registered are not violations (FCC 05-28, ¶ 14). That paragraph has never been reversed.

But the FCC also presumes, in its 2003 Order at ¶ 36, that a wireless subscriber who registers on the do-not-call list is a residential subscriber. That presumption is the starting point, and it runs against the sender.

Courts decide the question by how the number is actually used and presented. A line stays residential, one court held, only “as long as the subscriber does not hold out such numbers to the public as a business line” (Bank v. Independence Energy Group). Where that plaintiff had put the number on his business card, letterhead and court filings, the presumption was rebutted. Shelton v. Target Advance reached a similar result for a serial filer who advertised his cell as his collections-business line.

Do not over-read those. They are individual district court decisions on particular facts, and courts have gone the other way on similar ones — in Worsham v. Discount Power the defendant pressed the business-line argument hard and the court declined to reach it, resolving the case on other grounds after earlier allowing the do-not-call counts past the pleadings. Business-line status is a fact question that gets litigated, not a status you can assume.

Chennette v. Porch.com, 50 F.4th 1217 (9th Cir. 2022) is the case that matters most here, and it deserves to be read honestly rather than waved off. The defendants had scraped Yelp, YellowPages and BBB for over ten million contractors and texted their cell numbers — a fact pattern close to a lot of B2B programs. The Ninth Circuit held those contractors were within the TCPA’s zone of interests and their mixed-use numbers presumptively residential, and reversed the dismissal. It is binding circuit precedent.

What it also did was supply the rebuttal test, expressly, and expressly at the pleading stage: how the number is held out to the public, whether the carrier lists it as residential or business, extent of business use, who pays the bill, and how a reasonable observer would see it. Defendants “may overcome the presumption,” on a developed record.

Payne v. Sieva Networks (N.D. Cal. 2024) shows what that looks like in practice. Numbers came from federal USDOT registrations, a database only commercial operators appear in, and the court denied class certification because the plaintiff could not advance a workable theory of proving residential status across a class under Rule 23. Read it for what it is: a class certification ruling, not a merits holding that business-sourced numbers are never residential. The court acknowledged some of those numbers might qualify as residential. The practical effect is that these claims are hard to aggregate, not that they fail.

What follows from this: message numbers that businesses published themselves, publicly, so customers can contact them, and keep the record of where each one came from. That makes the first factor a documented fact rather than an argument. It does not make the question unlitigable.

3. Opt-outs, and what the rule actually says

Under FCC rules effective 11 April 2025, a person can revoke consent by any reasonable method. You may not require a specific keyword or a specific channel, and the request must be honoured within a reasonable time not exceeding ten business days.

Under 47 C.F.R. § 64.1200(d)(5) a do-not-call request applies to the particular entity making the call and does not automatically extend to affiliated entities. Agencies sometimes read that as licence to keep messaging someone for a different client. Do not. If one operator sends from shared infrastructure for many clients, the entity initiating the message is arguably that operator, and the 2025 rules contemplate revocation being honoured across the caller’s messages. Suppress globally — it is the cheap answer and it removes the single most common route from an annoyed recipient to a filed complaint.

There is more to § 64.1200(d) than the affiliate rule, and it is the part cold SMS programs most often skip. Subsections (d)(1) through (d)(4) require a written do-not-call policy available on demand, training for personnel engaged in telemarketing, recording the request when it is made, and identifying in the message the caller, the entity on whose behalf it is sent, and a way to reach that entity. Those duties attach with no autodialer, no prerecorded voice and no registry listing involved. If you have no written policy and no training records, that is the first thing produced in discovery, and it undercuts everything else you would want to say about how carefully you operate.

What follows from this: classify intent rather than matching keywords — “take me off your list” is a valid opt-out and STOP is not required. Suppress in the same session rather than using the ten-day window. Never re-add a suppressed number. Write the policy, train the people, keep the log.

4. Send windows and the states

47 C.F.R. § 64.1200(c)(1) sets the federal telemarketing window at 8am to 9pm local time at the called party’s location — their time zone, not yours and not your client’s.

State law is where the genuine remaining exposure sits, and none of the federal analysis above touches it. Florida, Oklahoma, Maryland and Washington have their own telephone solicitation statutes with independent private rights of action; several cap messages per day and stop at 8pm. Florida narrowed its own statute in 2023, adding a fifteen-day cure window that a working opt-out process defuses entirely.

What follows from this: run 8am–8pm in the recipient’s local time everywhere. It costs almost nothing — business replies cluster mid-day — and it keeps you inside the strictest state window without needing per-state routing logic.

5. The channel line: text only

§ 227(b) is violated by an autodialer or an artificial or prerecorded voice. Those are independent. The FCC ruled in November 2022 that a ringless voicemail delivered to a wireless number is a call using a prerecorded voice requiring prior consent.

This matters more than it looks. Everything in section 1 above — the entire no-autodialer position — does nothing for ringless voicemail, because the prerecorded-voice route to liability does not require an autodialer at all. Same list, same targeting, completely different exposure.

What follows from this: keep voice out of the text pipeline. If you want to run RVM, run it as a separate product with its own list and its own legal review.

6. What you say

Two content rules are worth treating as absolute, for reasons that are only partly about the TCPA.

Never claim a relationship that does not exist. “Following up on your inquiry” when there was no inquiry is deceptive-practice exposure under consumer protection law rather than texting law — and it is the fact pattern that converts an annoyed recipient into a motivated plaintiff. It also gets numbers blocked.

Keep the offer business-facing. The moment your content addresses someone as a consumer rather than as an operator of a business, the business-to-business framing that section 2 depends on gets weaker across your whole program, not just that campaign.

Also worth knowing: in Guthrie v. PHH Mortgage (4th Cir. 2023) a company representative casually saying “we use an auto dialer” was held not to be evidence of a statutory autodialer.

The carrier layer, which bites first

In day-to-day practice the carriers police business texting more immediately than any regulator. A2P traffic over 10-digit long codes runs through a registration framework: you register your brand and campaign use case, and the ecosystem assigns throughput and a trust profile. Unregistered traffic gets filtered or blocked, often silently. A lawful message that never arrives is worth nothing.

Register weeks before launch, not days. Write your sample messages exactly as you will send them, opt-out line included — a sample-to-traffic mismatch is a common reason campaigns get flagged later.

Where the law is heading

Two Supreme Court decisions removed the FCC’s ability to settle these questions by declaration. Loper Bright (2024) ended mandatory deference to agency readings of ambiguous statutes, and McLaughlin Chiropractic v. McKesson (2025) held that district courts are not bound by the FCC’s interpretation of the TCPA at all.

The consequence arrived in 2026. The private right of action for do-not-call violations, § 227(c)(5), covers someone who “received more than one telephone call.” In Steidinger v. Blackstone Medical Services (7th Cir., July 2026) the Seventh Circuit held a text message is not a telephone call under that provision — the first federal appeals court to decide it, binding in Illinois, Indiana and Wisconsin. District courts in Georgia, Ohio and Florida have reached the same result.

Be straight about the other side: courts in the Ninth Circuit have gone the other way, and the Ninth Circuit itself held in Howard v. RNC (January 2026) that a text is a call, though under a different subsection. The question is genuinely unsettled and an appeal raising it is pending in the Eleventh Circuit. Do not build a program that only works if this resolves in your favour.

What a defensible program tends to look like

Not a compliance program and not advice for yours — a description of the choices that show up in outreach operations that have held up. Your counsel decides what applies to you.

1. Every number traces to a public business listing, with the source and date stored.
2. Nothing in the stack generates phone numbers, ever.
3. You message numbers businesses published themselves as their business line.
4. Opt-outs are classified by intent, not keyword, and honoured in the same session.
5. Suppressed numbers are never re-added, by re-upload or by request.
6. Sending runs 8am–8pm in the recipient’s local time.
7. No calls, no voicemails, no ringless voicemail, no recorded or synthetic voice.
8. Every message identifies who is texting and on whose behalf.
9. No invented prior relationship. No consumer-facing offers.
10. A2P 10DLC brand and campaign registered before launch.
11. Anyone raising the law or a lawyer is suppressed and escalated, not argued with.
12. A TCPA attorney has reviewed the program.

Why this is not theoretical for us

In 2026 I was personally sued under the TCPA by a web designer, who claimed six violations and asked the court to find nineteen. The court entered judgment for the defendant, finding that targeted listing data “uses specific, purposeful criteria rather than pure chance or simple counting,” and that the messages “were not violations of the TCPA and did not constitute abusive telemarketing practices.” Costs were assessed against the plaintiff. Cause No. 41C01-2602-SC-000383, Johnson County, Indiana.

It is a small claims judgment and it binds no other court. What it is: a motivated opponent testing this exact set of operating rules in front of a judge, and losing. The full history, with all 46 sources and a video walkthrough, is in Is B2B Cold Texting Legal? Every Law and Court Case, 1991–2026.

Frequently asked questions