Is Cold Texting Illegal? B2B SMS Rules and Risks in 2026

This article is general information, not legal advice. Telemarketing law changes fast and varies by state and country. Talk to counsel before you send anything at volume.

TL;DR#

• In the US, cold texting a mobile number for marketing without prior express written consent is illegal in most cases. The TCPA carries statutory damages of $500 to $1,500 per message, and plaintiffs' firms run text-message class actions as a business model.
• There is no meaningful "B2B exemption." The TCPA protects the number, not the person's job title. Almost every mobile number on a prospect list is a personal cell.
• Even where the law is ambiguous, carriers are not. US A2P messaging runs through 10DLC registration and campaign vetting. Unconsented cold blasts get filtered, throttled, or your brand gets blocked outright.
• Cold email is the legally looser channel. CAN-SPAM is opt-out based; the TCPA is opt-in based. That single difference is why cold email is a standard outbound motion and cold texting is not.
• The compliant play: find the business contact through legitimate B2B data, open on email or phone, earn consent, then move to SMS for the fast-moving parts of the deal.

Sales teams keep discovering SMS, seeing 90%+ open rates, and assuming the rules are the same as email. They are not. Email regulation in the US says "you may send until they tell you to stop." SMS regulation says "you may not send until they tell you it's okay." Everything else follows from that inversion.

Is cold texting illegal in the United States?#

Short answer: yes, in most realistic scenarios, if the text is a marketing message sent to a mobile number without prior express written consent.

The governing statute is the Telephone Consumer Protection Act of 1991. Courts have treated SMS as a "call" under the TCPA since at least 2009, so every restriction written for telemarketing calls lands on text messages too. The FCC's telemarketing rules set the operational detail on top.

What the statute requires, in plain terms:

• Marketing texts to a wireless number require prior express written consent when sent using an automatic telephone dialing system or a prerecorded/artificial voice equivalent. That consent must be a signed, written agreement that clearly discloses the recipient will receive marketing messages, names the sender, and is not a condition of purchase.
• Consent must be revocable by any reasonable means. Under the FCC's 2024 revocation order, "STOP," "unsubscribe," "quit," and similar plain-language replies count, and senders must honor the request within 10 business days.
• Damages are statutory and per message. $500 per violation, trebled to $1,500 for willful or knowing violations. A 5,000-contact blast is a $2.5 million exposure before anyone argues about intent.
• There is no "one message to ask permission" carve-out. The invitation to consent is itself a telemarketing message if it promotes your product.

The one genuinely gray area is manual, one-to-one texting typed by a human from a normal phone. After Facebook v. Duguid (2021) narrowed the definition of an autodialer, individually typed messages sent without any dialing equipment are much harder to attack under the autodialer provision. But the Do-Not-Call rules, the internal DNC-list requirement, and state statutes still apply, and "we typed them by hand" is a defense you get to argue after you have been sued.

What actually counts as a "cold text"?#

The word "cold" is doing a lot of work in this question. Five distinctions decide whether you have a problem:

1. Marketing vs. transactional. "Your order shipped" is transactional and largely outside telemarketing consent rules. "Saw you're hiring SDRs — want a demo?" is marketing. Wrapping a pitch in a fake service notification does not change the classification; regulators look at the purpose of the message, not its costume.
2. Automated vs. manually typed. Platform-sent, list-uploaded, templated sends look like automated equipment to a court. A message you personally typed and sent to one person from your own handset is a different risk profile — not zero, just different.
3. Mobile vs. landline. The strictest TCPA provisions attach to wireless numbers. Company switchboard landlines sit under different (still real) DNC rules. Almost everything on a prospecting list is mobile.
4. Existing relationship vs. genuinely cold. An established business relationship helps with some DNC exemptions. It does not substitute for prior express written consent for automated marketing texts.
5. Consent you collected vs. consent someone sold you. Purchased "TCPA-compliant leads" transfer almost none of the protection the seller implies. The consent record has to name your brand, and you have to be able to produce it years later.

If your message is marketing, automated, going to a mobile number, and the consent record does not name your company, you are in the zone where cases get filed.

/blog/generated/memes/2026-09-14/is-cold-texting-illegal-meme-1.png

Which laws apply to cold texting in 2026?#

Federal law is the floor, not the ceiling. A dozen states have passed "mini-TCPAs" with their own private rights of action, and they frequently reach conduct the federal statute misses.

That last row is the whole story in one line. Two channels, two opposite defaults. Cold email is legal by default with an honest opt-out; cold texting is illegal by default until consent exists.

One more wrinkle worth knowing: the FCC's "one-to-one consent" rule, which would have banned single opt-ins that pass a lead to dozens of sellers, was vacated by the Eleventh Circuit in early 2025. Lead-gen consent is still shaky as a legal foundation — several states now regulate it directly — but the federal version of that specific rule is not currently on the books. Do not let a data vendor tell you otherwise.

Do B2B numbers get an exemption?#

No, and this is the single most expensive misconception in outbound SMS.

The common belief goes: "TCPA is a consumer protection law, we sell to businesses, therefore we are outside it." The TCPA does contain a business-to-business carve-out for some DNC provisions, and the FCC has historically treated calls to business landlines differently. But the core restriction on automated marketing messages to wireless numbers is written around the number, not the recipient's role.

Here is why that kills the theory in practice:

• The "direct dial" mobile number on a B2B contact record is, in nearly every case, a personal cell phone the employee also uses for their kids' school and their doctor.
• Courts have repeatedly declined to read a blanket B2B exemption into the autodialer/wireless provisions.
• State mini-TCPAs like Florida's are drafted around "telephone solicitations" without a business-recipient escape hatch.
• Even a fully B2B campaign becomes a class action the moment a few hundred of those numbers belong to individuals who never consented.

If you are building phone-based outreach, the compliant path is to use the number for a manually dialed call — cold calling to a business contact is a much better-established practice than cold texting — and to reserve SMS for contacts who have opted in. Tools like a B2B phone finder are useful for exactly that: getting an accurate, current direct dial so a human can place a real call, not fuel for an SMS blast.

How do carriers enforce this even when the law doesn't?#

Even if you were willing to accept legal risk, the pipes will stop you. Since 2021, application-to-person messaging over US 10-digit long codes runs through 10DLC registration: you register your brand, register each campaign with its use case, sample messages, and opt-in description, and get assigned throughput based on a trust score.

What that means operationally:

• Your opt-in flow gets reviewed. The Campaign Registry and the carriers ask how consent is collected. "Purchased list" is not an accepted answer, and misrepresenting it is grounds for campaign rejection or removal.
• Filtering happens before delivery. Carriers score message content and complaint rates in real time. High opt-out rates, link shorteners, and unknown-sender patterns get silently blocked — you are billed for sends that never arrive.
• Penalties are contractual and fast. Carrier violation fees run into the hundreds or thousands of dollars per incident, and repeated violations get your brand blacklisted across all campaigns, not just the offending one.
• The industry codified this. CTIA, the US wireless trade body, publishes messaging principles that all major carriers enforce; consumer consent is the first pillar.

So the real-world answer to "is cold texting illegal" is layered: legally risky, contractually prohibited, and technically filtered. You would need all three to break your way.

/blog/generated/memes/2026-09-14/is-cold-texting-illegal-meme-2.png

Cold text vs. cold email vs. cold call: which channel is actually safer?#

Read that table as a routing decision, not a scoreboard. Cold email carries a compliance burden too — it is just a burden about identification, opt-out honoring, and email deliverability rather than pre-consent. You can start an email program legally on Monday. You cannot start a cold SMS program legally on Monday.

How do you run SMS outreach without breaking the law?#

The channel is not off-limits. It is sequenced differently. Run it this way:

1. Open on a permitted channel. Email or a manually dialed call to a verified business contact. This is where discovery and consent-earning happen.
2. Capture explicit written consent. An unchecked checkbox on your demo form, a signed order form clause, or a reply-to-confirm double opt-in. Log the timestamp, the IP or channel, the exact disclosure language shown, and the phone number. Keep it for at least four years — the TCPA's limitations period.
3. Register properly. Brand and campaign registration under 10DLC, with an opt-in description that matches what you actually do.
4. Use SMS for the mid-funnel. Meeting confirmations, reschedules, document nudges, renewal reminders. This is where SMS earns its open rate, and it is where consent naturally exists.
5. Honor opt-outs instantly and globally. Suppress across every campaign and every number you own, not just the one that received "STOP."
6. Validate before you send. Disconnected, reassigned, and landline numbers are both a delivery cost and a liability — the FCC's reassigned-numbers problem is a recurring source of TCPA claims. A phone validator check on your list is cheap insurance.

This is also the reason most well-run outbound teams treat SMS as a closing channel and email as the opening channel. If you want a sense of how the email side of that split is built, HubSpot's sales resources cover sequence design in depth.

What happens if you get it wrong?#

Three things, usually in this order.

Carrier filtering. The quiet one. Your delivery rate drops, replies vanish, and you spend six weeks blaming copy before someone checks the campaign status in TCR.

Demand letters. Plaintiffs' firms run automated intake on unconsented texts. The first signal is often a single letter demanding settlement over a handful of messages. It is designed to be cheaper to pay than to fight, which is precisely why it works.

Class certification. SMS cases certify well because the evidence is uniform: one list, one template, one send timestamp. Seven-figure settlements are routine. Your own send logs are the plaintiff's exhibit A.

The asymmetry is what should decide this for you. The upside of a cold SMS blast is a slightly better open rate than email. The downside is a per-message statutory penalty and a carrier ban. No conversion rate justifies that trade.

Where does that leave your outbound program?#

Build on the channel where the default is permission-to-send rather than permission-required, then graduate contacts to SMS once they have opted in. That means your data layer matters more than your dialer: accurate work emails, correct direct dials, and clean company records, so every first touch reaches a real person at the right company.

Start with the contact, not the channel. Tomba's Email Finder gets you verified business email addresses by name and domain — the compliant, class-action-free way to open a B2B conversation — with a free tier at 25 searches a month and paid plans from $49/mo. Pair it with the email verifier to keep bounce rates down, run domain search to map a whole account team at once, and check Tomba pricing when you are ready to scale. Earn the opt-in first. Then text.

Related guides#

• Cold Calling Compliance in 2026: Rules, Risks & Checklist
• Are Cold Emails Legal in 2026? CAN-SPAM, GDPR & CASL Rules
• Cold Email Compliance in 2026: Laws, Rules & Best Practices
• CAN-SPAM Act Guidelines: The 2026 Compliance Checklist