TCPA Opt-Out Rules 2026: What Changed for Your Texts

On September 30, the FCC voted to let businesses choose how a customer is allowed to say stop. That sounds like a small thing. It changes what a text-message opt-out flow has to look like, and most small businesses are running one that was

On September 30, the FCC voted to let businesses choose how a customer is allowed to say stop.

That sounds like a small thing. It changes what a text-message opt-out flow has to look like, and most small businesses are running one that was never designed on purpose.

If your business sends appointment reminders, quote follow-ups, review requests, or any text from a CRM, the TCPA opt-out rules in FCC 26-67 are now your problem. Here is what the order actually says, what it does not say, and how to build around it.

The FCC now lets you pick the one way customers can opt out

Until now, a customer could revoke consent "in any reasonable manner." A STOP reply counted. So did "pls stop texting me," a voicemail, or an email to the front desk. You had to catch all of it.

The new order, adopted September 30 and released October 1 in CG Docket No. 02-278, changes that. You can now designate one or more of three methods as the exclusive way to opt out:

1. An automated voice or key-press opt-out in response to a call.
2. A reply to a text using one of the standardized words.
3. A website or phone number you provide for processing opt-outs.

There is a catch, and it is the whole point. You have to disclose the method "clearly and conspicuously" on the call or in the text. If you designate nothing, nothing changes: you still honor any reasonable request.

The FCC says it directly in paragraph 26: "We impose no new compliance obligation." It is a permission, not a mandate. But it only helps if you use it.

Disclosing one word in each text is enough, honoring all seven is not optional

Text senders had a practical worry. The FCC's standardized list is long: stop, quit, end, revoke, opt out, cancel, unsubscribe. Printing all seven in a 160-character message is silly.

The order fixes that. Disclosing even one word per text satisfies the rule, and the FCC's own example is telling people they can respond "stop."

The other half matters more. Per paragraph 17 of the order, text senders "still must honor revocation requests made using any of the standardized words." Tell people to reply STOP, and a customer who replies CANCEL has still opted out.

So the setup is: one disclosed word in the text, all seven recognized on the inbound side. If you have not designated an exclusive method, add "please stop" and its cousins too, because any reasonable request still counts.

Reminders and promotions now get treated differently

The second change is quieter and probably more useful.

Under the old "revoke all" idea, a customer who stopped one kind of message was treated as stopping everything you send. The FCC has now reversed that for informational messages, meaning anything that is not an advertisement or telemarketing. Its example: someone who opts out of payment reminders can still receive appointment reminders, and you may read the request that narrowly.

For a clinic, a garage, or a salon, that is a real win. A patient who texts STOP to a review request does not have to disappear from your appointment reminders by accident.

Marketing is the opposite. Per paragraph 14, one revocation in response to an advertising or telemarketing robocall "revoke[s] consent to all future robocalls containing an advertisement or that constitute telemarketing from that caller." Do-not-call requests also reach affiliated entities if the customer would reasonably expect that.

Marketing calls and texts keep their own opt-out rules, which this order explicitly leaves alone. And the new rule replaces the earlier delay on the revoke-all provision, which had been pushed to January 31, 2027.

When does it all start? Thirty days after Federal Register publication. The version the FCC released has that date blank, so treat late 2026 as the planning window, not a fixed day.

We impose no new compliance obligation.

— FCC 26-67, paragraph 26

The AI robocall headline you saw does not apply to your business

A separate FCC item has been circulating, and it is easy to misread.

In DA 26-940, released September 4, the Consumer and Governmental Affairs Bureau asked for comment on a petition from Club for Growth. The request is narrow: a limited waiver so "noncommercial, political calls" could use an artificial or prerecorded voice, "including an AI-generated voice," without the call recipient's prior express consent. Comments were due October 5. Replies are due October 19.

Read that again. Noncommercial. Political. Nothing about a dentist, a plumber, or a Shopify store.

If a headline made you think the consent rule for AI voices is loosening for ordinary businesses, it is not. The same notice also puts a second petition on the table, from Joe Shields, asking the FCC to rule that peer-to-peer texting where a person merely clicks send on thousands of messages an hour counts as an autodialer. If the FCC agrees, tools that "just need a human click" get riskier, not safer.

Your AI voice agent is inside the rule the moment it dials out

We covered the inbound side in our piece on whether your AI receptionist has to say it's AI. Short version: a customer who calls you and reaches an AI assistant is not a robocall.

Outbound is a different animal. In FCC 24-17, the Commission confirmed that AI technologies generating human voices fall under the TCPA's "artificial or prerecorded voice" rule. Calls that use them need the prior express consent of the person called, unless there is an emergency or an exemption. Statutory damages run $500 per violation, and up to three times that when a court finds the violation willful, under 47 U.S.C. § 227.

That is where the new opt-out order lands for AI builds:

• A voice agent that calls back leads, chases no-shows, or runs a reactivation list needs an automated opt-out it can actually execute mid-call.
• A key press or a spoken "take me off the list" has to write to the same suppression list as the SMS side.
• An opt-out on a call has to stop the follow-up text, and the other way round.

The lead who says "stop calling me" to your voice agent on Tuesday and gets a text from your CRM on Thursday is the case plaintiffs' lawyers look for.

The FCC is still deciding four things that could tighten this

The order also opened a further rulemaking. Comments are due 30 days after Federal Register publication, replies at 60. Four questions matter for small businesses:

• Speed. The current ceiling is ten business days to honor an opt-out. The FCC asks whether seven is right, citing a joint proposal from the American Bankers Association, the National Consumer Law Center, and ACA International.
• Two-way texting. Whether to require that text senders can receive replies, so STOP works everywhere.
• A "revoke all" method. Whether callers who scope an opt-out to one category must also offer a one-step way to stop everything.
• Affiliates and separate lines of business. How far an opt-out travels if you run several brands or locations.

The FCC says it wants to minimize burdens on small entities. That is a comment period, not a promise. If you run multiple locations, the last question is the one that bites.

One suppression list and one webhook cover most of the risk

Here is the take from the people who build these flows for a living: the legal change is small, and the build change is big.

Most small-business texting is a pile. The CRM sends reminders. A review tool sends requests. A missed-call text-back app, like the ones in our text-back versus AI receptionist comparison, fires on its own. Each keeps its own unsubscribe list. None talks to the others.

That is fine until a customer says stop to one of them. The fix is boring, which is why it works:

1. One suppression list. Every tool checks it before any send, and every opt-out writes to it. Not a nightly sync. A check at send time.
2. STOP handling at the number, not the app. The inbound webhook catches all seven standardized words plus the obvious human ones ("please stop," "don't text me"), flags the contact, and replies once with a confirmation.
3. One disclosed method. Pick reply-STOP for texts, a key press for voice, and print it in every message or say it in every call. That is the exclusive-method option the FCC just opened.
4. Category tags. Appointment reminders, review requests, and promotions get separate tags, so a customer who drops reviews keeps their bookings.
5. A timestamped log. Time received, method, who processed it. If anyone ever asks, you answer in one query.

Our opinion, not the FCC's: do not use the ten days. Honor the opt-out immediately. The only reason to wait is a manual process, and a manual process is the reason people get sued. If you are sorting out which leads deserve a call at all, start the same way: decide the rules once, then let the system enforce them.

Building this is usually one workflow, not a six-week project. It is exactly the kind of fiddly, unglamorous automation that is worth paying someone to wire once. Our automation service does that: we set up the list, the webhooks, the call and text disclosures, and the log, then hand you a diagram you can show a lawyer.