The month honouring every STOP was not TCPA compliance, at $62K MRR

Nobody saw that reply for nine days. It arrived as an answer to a product-update text, our messaging platform did not file it as an opt-out because it did not contain the word STOP, and the next broadcast went out to that number as though nothing had happened. We were at 62K MRR, and I had spent the previous quarter telling anyone who asked that our messaging stack was fully compliant because our vendor handled STOP automatically. It does handle STOP. That turned out not to be the question.

Quick answer (2026). This diary is a composite. The numbers, the timeline and the customer are assembled from several small SaaS businesses rather than one, and no single company is being described. The legal analysis is not composite: every rule below is quoted from the statute or the regulation, and you can check each one. The short version is that TCPA compliance is not a consent problem with an opt-out footnote attached. For an ordinary SaaS texting its own customer list, most of the frightening parts of the statute do not apply at all, and the part that does apply is the part a keyword handler is structurally unable to satisfy.

The number I could not stop calculating

The arithmetic that kept me awake was simple. We had sent that broadcast to about 4,000 numbers. The figure everyone quotes is 500 dollars per message, trebled to 1,500 for willful violations. Four thousand times 1,500 is six million dollars, against a business doing 62,000 a month.

I spent a full day on that number before I read the actual text, and the actual text dismantled almost all of it.

Layer one: most of my messages were never solicitations

The statute defines its own scope, and the definition is narrower than the summaries suggest. Under 47 U.S.C. 227, a telephone solicitation is "the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services". Then it carves out, in the same sentence, calls "to any person with that person's prior express invitation or permission" and calls "to any person with whom the caller has an established business relationship".

Our password resets, our billing failures, our trial-expiry notices: none of those encourages a purchase, and all of them go to people we already have a relationship with. They are not solicitations. They never were. Those same password resets had already taught me a separate lesson about channels whose rules I did not write.

The broadcast that caused the trouble was different, and I knew it while I was writing it, because it ended with a discount code.

Layer two: I did not own an autodialer

The heaviest prohibitions in the statute are not about texting. They are about equipment. Section 227(b) attaches to calls made "using any automatic telephone dialing system or an artificial or prerecorded voice", and the regulation at 47 CFR 64.1200 defines that system as "equipment which has the capacity to store or produce telephone numbers to be called using a random or sequential number generator and to dial such numbers".

The Supreme Court read that clause strictly in Facebook v. Duguid, holding that "a device must have the capacity either to store a telephone number using a random or sequential number generator, or to produce a telephone number using a random or sequential number generator". The necessary feature, the Court said, is "the capacity to use a random or sequential number generator to either store or produce phone numbers to be called".

Our system pulls a list of customer records out of Postgres and posts them to an API. There is no number generator anywhere in it. Neither is there a prerecorded voice. So the subsection carrying the mandatory 500 dollar floor was not engaged by what we did, and neither was the written-consent rule, which the regulation scopes to advertisements or telemarketing sent "using an automatic telephone dialing system or an artificial or prerecorded voice".

That is the part nobody tells you, and it removed roughly nine tenths of my six million dollars.

Layer three: the subsection I landed in is the forgiving one

What was left was the do-not-call side of the statute, section 227(c). I had assumed the two halves were symmetrical. They are not, and the difference is two words.

Section 227(b)(3) gives a plaintiff "an action to recover for actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater". Section 227(c)(5) gives the same plaintiff "an action to recover for actual monetary loss from such a violation, or to receive up to $500 in damages for each such violation, whichever is greater".

Up to. In (c), the 500 is a ceiling a court may award. In (b), it is a floor a court must.

And (c) carries something (b) does not have at all. It states that "It shall be an affirmative defense in any action brought under this paragraph that the defendant has established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations in violation of the regulations prescribed under this subsection".

There is a written safe harbour for a company that has genuinely tried. It sits in the subsection I was actually exposed under, and I had never read it because every guide I had read was written for call centres worried about (b).

One caution before anyone relaxes too far. Section 227(c)(6) says flatly that "The provisions of this subsection shall not be construed to permit a communication prohibited by subsection (b)". Landing in the gentler subsection does not license anything the harsher one forbids.

The obligation that does not care about any of that

Here is where I stopped feeling clever. Every exit above depends on equipment, or on whether a message was a solicitation. The internal do-not-call rules depend on neither.

Paragraph (d) of the regulation requires any entity making calls for telemarketing purposes to keep a list of people who asked not to be contacted, and sets minimum standards for it. You must have "a written policy, available upon demand, for maintaining a do-not-call list". You must train personnel. You must record each request and honour it within a period that "may not exceed ten (10) business days from the receipt of such request". And under paragraph (d)(6), the request "must be honored for 5 years from the time the request is made".

Paragraph (e) then pulls all of it onto text messages: those rules are "applicable to any person or entity making telephone solicitations or telemarketing calls or text messages to wireless telephone numbers". I should state a limit here rather than overreach. That extension is written by reference to a Commission order, CG Docket No. 02-278, that I did not read. I am quoting the reach the regulation claims, not an independent reading of the order behind it.

The sentence that actually changed how we work is a different one. Paragraph (d)(3) provides that "If such requests are recorded or maintained by a party other than the person or entity on whose behalf the call is made, the person or entity on whose behalf the call is made will be liable for any failures to honor the do-not-call request".

We had outsourced the list. We had not outsourced the liability. The regulation says so in terms.

Why honouring STOP is not compliance

The rule on revoking consent is paragraph (a)(10), and it is the one I would print out and pin up. A recipient may revoke "by using any reasonable method to clearly express a desire not to receive further calls or text messages from the caller or sender". Seven words are per se reasonable in a reply: stop, quit, end, revoke, opt out, cancel, unsubscribe.

Then comes the sentence that undid us. If a reply uses other words, "the caller must treat that reply text as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent".

A keyword matcher cannot do that. It is not a configuration gap, it is a category difference. Please take me off this list is not on the list of seven words, and a reasonable person understands it perfectly. The regulation also forbids senders from designating an "exclusive means" of revoking, so reply STOP as your only channel is itself a defect rather than a defence. The deadline is the same ten business days.

There is exactly one place in that regulation where STOP is allowed to be the only route out, and it is not available to us. It sits in a narrow exemption for financial institutions sending fraud and breach alerts, where text messages must inform recipients of the ability to opt out by replying STOP, "which will be the exclusive means by which consumers may opt out of such messages". That permission arrives bundled with six other conditions, including a cap of three messages per event, a 160 character limit, a ban on any marketing content, and an obligation to honour opt-outs immediately rather than within ten days. You do not get the convenient clause on its own.

The consent form I would have failed anyway

While I was in the regulation I read the definition of written consent, which I had assumed we met with a checkbox. It requires an agreement that "clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages", and it requires the form to disclose that "The person is not required to sign the agreement (directly or indirectly), or agree to enter into such an agreement as a condition of purchasing any property, goods, or services".

Ours was a single checkbox in the signup flow, pre-ticked, bundled into the terms you had to accept to create an account. If we had ever needed that consent to be valid, it would not have been, because we had made it a condition of purchase. Electronic signatures are fine. Bundled ones are not.

What actually happened

Time to read both instruments end to end: about three hours. Time spent panicking first: one day.

What I got wrong

Three things, and the first two are the useful ones.

I expected a business-to-business exemption. Small SaaS companies text other companies, and I was certain the rules were written for consumer telemarketers. I searched the regulation before building anything on that assumption, which is the right order, and the phrases business-to-business and de minimis appear zero times in it. There is no categorical carve-out. What remains genuinely open, and I am not going to pretend otherwise, is how a work mobile is treated where paragraph (d) speaks of a residential subscriber while paragraph (e) extends the rules to wireless numbers. I did not resolve that and I am not going to invent an answer.

I expected the penalties to be uniform. They are not, and one word separates them. I would never have found that by reading a summary, because every summary I read collapsed both subsections into 500 dollars per violation.

The third is smaller and it still cost me a day. I assumed the scariest number I could compute was the number I was exposed to. It almost never is. The exposure sits in the obligation with no equipment test attached, which was the cheapest one to fix and the only one nobody had written a checklist about.

Nothing here rests on what any vendor charges or what tier a feature sits in, so none of it goes stale when a price list changes. It rests on a statute and a regulation, both of which you can read for yourself in an afternoon.

The one thing I would tell you

Go and reply to your own marketing text with a sentence that does not contain any of the seven magic words. Then look at whether anything in your system noticed. That single test tells you more about your position than any compliance checklist will, and it takes about four minutes.

We failed it. Then we built a rule that routes every inbound reply a human has not classified into a queue, and we default to suppressing the number while it waits. Suppressing someone who did not ask to be suppressed costs us one message. The other direction costs considerably more, and unlike the six million dollars I invented on day one, that one is real.