A Dozen States Now Have Their Own TCPA Laws. Most CMOs Don't Know About Them.

For most of the TCPA's existence, the compliance model was mercifully simple. It was one federal law. A brand's legal team read it, marketing built consent capture and opt-out handling to match, and a national campaign that cleared the federal bar cleared it everywhere. Comply once, send everywhere.

That model has stopped being true, and it broke in a direction most marketing teams never saw, because they were watching the wrong level of government. While marketers had their eyes on Washington, some states redrew the map.

The federal rule got easier, but it was a distraction

At the federal level, the last two years have run in the brand's favor. In early 2025, a federal appeals court vacated the FCC's one-to-one consent rule, which is the requirement that a consumer consent to each seller individually, finding the agency had overstepped the statute. The FCC, under new leadership, declined to appeal, and by that August had reinstated the older, looser consent standard. Months later, a Supreme Court decision stripped the FCC's interpretations of much of their binding force in court.

Read in isolation, that's a clear loosening. The single most burdensome federal consent rule disappeared before it took effect, and the agency's grip on interpretation slipped. A marketing leader tracking only federal developments would reasonably conclude the pressure was easing, but that conclusion is only half the picture. The missing half is where the exposure moved.

While Washington eased off, the states moved in

As the federal rule retreated, state legislatures moved into the space it left, and they didn't move gently. More than a dozen states now have their own mini-TCPA laws, and the list is growing by the legislative session.

Four passed or took effect in roughly the last year alone. Texas now treats marketing texts as regulated solicitations, requires senders to register with the state and, most consequentially, lets consumers sue directly, with damages that can reach several thousand dollars per message and no cap on repeat claims. Oregon restricts contact to daytime hours and caps senders at three messages per person per day. Virginia rewrote its opt-out and do-not-call rules and made both the brand and its vendor liable for a violation. Utah added its own restrictions this spring.

Those sit on top of an established roster that already had mini-TCPAs on the books, including Florida, Oklahoma, Washington, Maryland, New York, Arizona, Tennessee, Georgia, and Connecticut. Here's the part that turns a list into a problem: none of these laws is a copy of another. They set different consent standards, permitted hours, registration requirements, and penalties. There is no single state TCPA to comply with. There are many, and they often disagree.

One send, fifty rulebooks

For a national direct-to-consumer brand, no single one of these laws is the threat. The threat is that they stack. A text campaign goes out to a list that spans every state at once, but the rules riding on each message are set by where the recipient happens to live.

The same send that's clean in one state can trip three laws in others. Federal rules allow contact from 8 a.m. Texas pushes the start to 9 a.m. on most days and noon on Sundays. Oregon and Virginia close the evening window earlier than the federal cutoff. Oregon treats the fourth message in a day as a violation. A campaign calendar built to a single national standard is, by definition, non-compliant somewhere the instant it treats the country as one market.

The shift marketers keep missing is that compliance stopped being a bar to clear and became a map to navigate.

Why this stays off the radar

There's a structural reason most CMOs don't know this is happening. The TCPA has always lived under legal, filed mentally as one federal statute that someone else owns. State mini-TCPAs don't send marketing a memo when they pass. They surface later as a demand letter or a class complaint.

They're also triggered by something marketing rarely segments on for compliance: the recipient's physical location. A brand can hold genuinely valid federal consent, run a textbook federal-compliant program, and still be violating four state laws in a single blast, not through negligence, but because the mental model it's operating on describes a segment that no longer exists.

Build to the highest line on the map

The brands ahead of this stopped trying to memorize a dozen rulebooks, because that's a losing race against a growing list. They're doing the opposite, finding the strictest requirement on each dimension (the earliest permitted hour, the tightest frequency cap, etc.) and building one program to that line. Clear the toughest state, and every looser one is covered by default.

That approach converts the fragmentation from dozens of separate problems into a single standard, and it carries an added benefit. A program built to the strictest state is also the one least attractive to the plaintiff's bar.

The federal map got simpler over the last two years, but the country got more complicated. The brands that noticed are building to the toughest line on it. The ones that didn't are still comfortably compliant with rules that no longer match the territory, right up until a state they weren't thinking about reminds them it has its own.