Texting, AI answering and call recording rules for small businesses

This playbook is for owners and office managers switching on missed-call texts, reminders, follow-up sequences or an AI receptionist, in the order you meet each rule.

Everything here states the law as of October 3, 2026, as the cited source states it, and leans conservative. This is not legal advice; confirm with counsel. Several answers turn on facts only a lawyer can weigh: which state’s law applies, whether your texting tool is an autodialer, and whether your practice is a HIPAA covered entity.

What the TCPA covers, and what counts as an autodialer

Calling a cell phone with an autodialer or an artificial or prerecorded voice needs the called party’s prior express consent unless it is an emergency (47 U.S.C. 227). A person can sue for actual loss or $500 per violation, whichever is greater, and up to three times that for willful or knowing violations. Texts count as calls: the FCC said so in FCC 15-72 in 2015.

In Facebook v. Duguid (April 1, 2021), the Supreme Court limited an autodialer to equipment that stores or produces numbers “using a random or sequential number generator”. Most CRM texting from a stored list of leads is therefore probably not autodialed under federal law. That does not make it risk-free. The Do Not Call rules apply regardless of the equipment; Florida, Oklahoma and Maryland write their own definitions; and an AI voice is caught by the artificial-voice rule.

Since McLaughlin Chiropractic v. McKesson (Supreme Court, June 20, 2025), district courts are not bound by the FCC’s readings of the TCPA and give them “appropriate respect”. FCC positions persuade in a private lawsuit; they do not bind.

Which consent each kind of text needs

Informational messages need prior express consent rather than written consent. Autodialed or artificial-voice calls and texts to a cell phone that include an advertisement or are telemarketing need prior express written consent (47 CFR 64.1200(a)). That means a signed written agreement naming the phone number, clearly authorizing autodialed or prerecorded telemarketing, and saying signing is not a condition of purchase. An electronic signature counts where valid, and in Florida checking a box can count as a signature.

CTIA’s messaging guidelines (May 2023) are industry guidance, not law, but carriers enforce them:

CTIA category	Example	Permission expected
Conversational	The customer texts first and you reply	None beyond their message
Informational	Confirmations, “the tech is on the way”	Agreement for the purpose the number was given
Promotional	Offers, tune-up pushes, reactivation deals	Written agreement

CTIA warns that a call to action such as a coupon code may make an informational text promotional. The 2023 one-to-one consent rule is gone. The Eleventh Circuit vacated it on January 24, 2025 (IMC v. FCC), and the FCC reinstated the earlier definition effective August 29, 2025 (90 FR 42137). Naming your one business on the form is good practice and CTIA guidance, not an FCC requirement.

Build a consent box that holds up

What we put on every form that collects a mobile number:

• A separate checkbox, unchecked by default, not required to submit.
• Separate boxes for service texts and marketing texts.
• Your business name in the wording, what the texts are for, that they may be automated, that consent is not a condition of purchase, frequency, “Msg & data rates may apply”, “Reply STOP to opt out, HELP for help”, and a privacy policy link stating mobile numbers and opt-in data are not sold or shared.

A service box, with your business name in place of “us”:

Text me about this request and my appointments, including reminders and arrival updates. Texts from us may be automated. Up to 6 messages a month. Msg & data rates may apply. Reply STOP to opt out, HELP for help. Consent is not required to buy anything.

The marketing box says plainly that it covers offers and promotions, with the same lines.

Keep the proof: timestamp, page URL, IP address, the exact wording shown, phone number and name. When the wording changes, keep the old version with its dates.

Missed-call text-back: reduced risk, not exempt

No FCC ruling addresses a business missed-call text-back. The on-demand ruling in FCC 15-72 covers a one-time text sent immediately because the consumer expressly asked for it, and a missed call is not that request. Under Duguid, a single reply to the number that called is unlikely to be autodialed under federal law, and Maryland exempts “a single telephone solicitation made to a customer or client in response to an inquiry or request” from its written-consent rule, though not from its quiet hours. Treat it as reduced risk, and have counsel review it for Florida, Oklahoma and Maryland numbers.

How we set it up: one text, sent right away, only to the number that called, from a 10DLC number registered for customer care. Business name first, an apology, an invitation to reply, STOP wording. No coupon, offer, review request or drip unless the caller replies or has consented.

Hi, it’s Dana at Jamie Plumbing. Sorry we missed your call. Reply here with what you need and we’ll get right back to you. Reply STOP to opt out.

Jamie Plumbing stands in for your own name, which goes first because the caller may not know the number.

Opt-outs: the rules in force today

As of October 3, 2026 (47 CFR 64.1200(a)(10) to (12)):

• Consent may be revoked by any reasonable method, and you may not name one exclusive method.
• Stop, quit, end, revoke, opt out, cancel or unsubscribe is a valid revocation on its own; other words count if a reasonable person would read them as a request to stop.
• Revocations must be honored within a reasonable time not to exceed ten business days.
• One confirmation text is allowed if it only confirms, has no marketing and is the only further message; it is presumed compliant within five minutes.

The “revoke all” requirement, applying one opt-out to unrelated informational messages, is delayed to January 31, 2027 (DA 26-12). Do-not-call requests share the ten-business-day ceiling, in effect since April 11, 2025, so sources saying 30 days are out of date. Calls to numbers on the national registry also need an exemption, such as an established business relationship: a purchase within the prior 18 months or an inquiry within the prior 3 months.

How we run it: the seven words set as automatic keywords in any capitalization; replies like “please stop texting me” routed to a person the same day; every opt-out processed immediately and pushed to every number, tool and AI agent; opt-outs by phone, email or voicemail honored too, as CTIA also advises.

You’re opted out and won’t get more texts from us. Text START if you change your mind.

FCC 26-67: what changes once it takes effect

The FCC adopted FCC 26-67 on September 30, 2026 and released it October 1. It takes effect 30 days after Federal Register publication, on a date the FCC will announce. As of October 3, 2026 it had not been published, so it is not in force. Do not change your handling yet.

Once effective:

• A caller may designate an exclusive opt-out method (a key press, a standard reply word, or a designated website or phone number) if clearly disclosed on each call or text; STOP in each text satisfies that, and all seven words must still be honored.
• An opt-out in reply to an informational message may be limited to that category; one in reply to marketing ends all of that caller’s marketing.
• The confirmation rule drops “one-time” but keeps the no-marketing condition and five-minute presumption.
• It replaces the January 31, 2027 revoke-all date. The ten-business-day ceiling stays, and the FCC asks whether to cut it to seven.

Even after it takes effect, keep honoring clear plain-language opt-outs, because courts need not defer to the exclusive-method rule.

Sending hours and attempt caps: Florida, Oklahoma and Maryland

Federal rules bar telephone solicitations before 8 a.m. or after 9 p.m. local time, applied to telemarketing texts to cell phones (47 CFR 64.1200(c)), with exceptions for prior permission and established business relationships. The FTC’s Telemarketing Sales Rule (16 CFR 310.4(c)) separately limits outbound telemarketing calls to 8 a.m. to 9 p.m. Three verified states go further, and each presumes an in-state area code reaches a resident.

Florida. Section 501.059 bars unsolicited sales calls, texts or voicemails made with an automated system for selecting and dialing numbers, or a recorded message, without prior express written consent. Calls answering the consumer’s express request, about an existing debt or uncompleted contract, or to someone with a prior or existing business relationship are not “unsolicited”. A consumer must reply STOP and allow 15 days before suing over texts: a pre-suit cure period, not permission to continue. Section 501.616 bars commercial telephone solicitation before 8 a.m. or after 8 p.m. and more than three calls in 24 hours on one subject; whether it reaches texts is untested.

Oklahoma. The Telephone Solicitation Act of 2022 requires prior express written consent for automated commercial sales calls and bars solicitation before 8 a.m. or after 8 p.m. and more than three in 24 hours on one subject. Section 5 exempts many callers from the whole act, including existing business relationships or prior purchasers, retail establishments open at least a year where most buyers are served on site, repair or maintenance of goods previously sold, and real estate licensees. It also lists “a commercial telephone seller” among the exemptions, a drafting oddity for counsel. Later amendments were not verified.

Maryland. The Stop the Spam Calls Act (effective January 1, 2024) bars telephone solicitations between 8 p.m. and 8 a.m. and more than three in 24 hours on one subject, and requires prior express written consent for automated solicitations. Its exemptions apply only to consent, not to hours and the cap. Whether the hours rule covers texts was not verified.

Our policy: automated sales follow-ups only between 8 a.m. and 8 p.m. recipient time, judged by area code, and no more than three per person per 24 hours on one subject. That meets these three states. It is not a national safe window; other states were not verified, so have counsel check each state you text into.

Register for 10DLC before the first text

The Campaign Registry runs 10DLC, which verifies brands and providers before they send business texts from local numbers. A business cannot register directly; it goes through a registered messaging provider, usually its texting platform. Twilio has blocked texts from unregistered 10DLC numbers since September 1, 2023 and still bills them (Twilio traffic only), so reminders can quietly stop arriving.

Register the brand and every campaign before the first text, choose the use case that matches what each sends, and submit sample messages carrying the business name and STOP wording.

Clinic reminders: the healthcare exemption is narrow

Healthcare providers may send certain exempt texts without prior consent only under strict conditions (47 CFR 64.1200(a)(9)): free to the patient, sent only to the number the patient gave, naming the provider with contact details, limited to purposes such as appointment confirmations and reminders, no marketing or billing, HIPAA compliant, generally 160 characters or less, at most one a day and three a week, with a STOP opt-out honored immediately. Ordinary 10DLC texts are not free to the patient, so many clinics cannot use it. The sounder basis is usually the patient’s prior express consent from giving the number, which FCC 15-72 treats as consent to HIPAA-covered healthcare calls within that scope; confirm with counsel. Med spas are not named among covered providers.

Hi Maria, this is Priya from the clinic. Your visit is Thursday at 2:30. Reply C to confirm or call to reschedule. Reply STOP to opt out.

Promotions, reactivation offers and review requests need consent, written for marketing.

AI receptionists and AI callbacks

Outbound. FCC 24-17 (February 8, 2024) confirms AI voices and cloned voices are an “artificial or prerecorded voice”, so an AI calling a lead needs prior express consent, written for telemarketing. Every such message must state the business’s registered name at the start and give a callback number, and telemarketing to residential or cell lines needs an automated opt-out within two seconds of that identification (47 CFR 64.1200(b)).

Inbound. The ruling is silent on calls an AI answers; the fair inference is that the TCPA regulates making calls. State disclosure laws reach the answering side:

• Maine. P.L. 2025 ch. 294 bars using an AI chatbot, voice included, in a way that may lead a reasonable consumer to think they are talking to a human, unless told clearly and conspicuously otherwise. Confirm with counsel that it is in force before you rely on it.
• California health care. Since January 1, 2025, AB 3030 requires clinics and physician offices using generative AI for patient communications about clinical information to include a disclaimer (for audio, at the start and end) and how to reach a human. Scheduling and billing are excluded, so a booking receptionist falls outside it.
• Texas health care. Since January 1, 2026, HB 149 requires a provider using AI in relation to a health care service or treatment to disclose it clearly and conspicuously, even if obvious, no later than when the service is first provided. Whether scheduling-only AI qualifies is open. Texas businesses outside health care have no such duty.

No FCC rule requires AI disclosure. The FCC’s August 2024 proposal (FCC 24-84) had not been finalized as of October 3, 2026; the binding federal rules remain FCC 24-17 and the identification rules above.

What we set up for every agent, in every state:

• Open with the business name and a plain statement that the caller is speaking with an automated assistant, and answer truthfully when asked.
• Offer a person early, transfer live with a summary in staffed hours, give a callback window after hours, and hand off after two failed attempts to understand.
• Limit it to approved hours, area, services, booking rules and owner-approved price ranges. No diagnosis, legal advice or custom quotes; emergencies to 911 or the on-call line.
• Before any AI callback: form wording naming automated calls, a timestamped consent record and an opt-out on telemarketing.

Thanks for calling Jamie Plumbing. You’ve reached the automated assistant. I can book a visit or take a message, and I can get you to a person anytime. This call is recorded.

If you run Local Services Ads, Google counts a caller giving job details to an automated system as a charged lead (Google LSA Help), so route only service calls through it.

Recording calls: announce it every time

Federal law is one-party: you may record a call you are on, unless the purpose is criminal or tortious (18 U.S.C. 2511(2)(d)). States verified against statute text:

• California. Penal Code 632 makes recording a confidential communication without all parties’ consent a crime, businesses included; Penal Code 637.2 allows suits for the greater of $5,000 per violation or three times damages. Kearney v. Salomon Smith Barney (2006) applied it, going forward, to an out-of-state business recording calls with California clients, and said a business that adequately advises all parties at the outset would not violate section 632.
• Florida. All parties’ prior consent; a violation of Florida Statutes 934.03(1) is generally a third-degree felony.
• Pennsylvania. All-party, with a customer-service exception (18 Pa.C.S. 5704(15)) for training, quality control or monitoring and destruction within one year. Whether a small booking line qualifies is a legal question.
• Washington. All-party, but consent is obtained when one party announces the recording, and the announcement must be on the recording (RCW 9.73.030).
• Massachusetts. Secret recording without all parties’ authority is barred (M.G.L. c. 272, s. 99); an announced recording is arguably outside it.
• Maryland. All parties’ prior consent; a willful violation is a felony (CJP 10-402).
• Illinois. 720 ILCS 5/14-2 bars recording a private conversation “in a surreptitious manner” without all other parties’ consent. Surreptitious means by stealth, deception, secrecy or concealment, so an announced recording is outside the offense (Reporters Committee, Illinois page).

The Reporters Committee for Freedom of the Press (2021) also lists Delaware, Michigan, Montana and New Hampshire, plus Connecticut and Nevada for phone calls; those rest on that guide alone.

Announce recording at the start of every inbound and outbound call, keep it on the recording, and limit who can play recordings. An AI vendor that records or transcribes for you raises a third-party question none of these sources answers; ask counsel.

Thanks for calling, this is Marcus. Calls are recorded for quality. How can I help?

HIPAA: sign a business associate agreement first

A business associate is anyone outside your workforce who creates, receives, maintains or transmits protected health information for a covered entity, including subcontractors (45 CFR 160.103). HHS’s 2013 Omnibus Rule limits the conduit exception to mere transmission, while an entity that stores health information is a business associate even if it never views it. Our inference, not HHS wording: an AI phone vendor storing recordings or transcripts with patient information is a business associate. A covered entity may share that information only under a written business associate agreement (45 CFR 164.502).

• Sign the agreement before the agent answers a patient call.
• Confirm the vendor’s own subcontractor agreements for speech-to-text, the model and storage.
• If an agency resells the platform, it signs with the clinic and with the vendor.
• Turn on access logs.

HIPAA reaches a clinic or med spa only if it is a covered entity, in practice a provider that conducts standard electronic transactions such as insurance billing. Many cash-pay med spas and salons are not; ask counsel.

Where it differs by business type

• Clinics carry the most layers: the narrow reminder exemption, business associate agreements, and California and Texas AI rules.
• Med spas are not named in the FCC healthcare exemption and often are not covered entities; treat reminders as ordinary informational texts.
• Home services in Oklahoma may fit the exemptions for repair of goods previously sold or existing customers. New leads do not, and federal rules still apply.
• Retail shops and real estate licensees have their own Oklahoma exemptions.

Myths to drop

• “Texts have a 98% open rate.” No study behind it could be traced, and texts have no open tracking anyway.
• “Missed-call text-back is exempt.” No FCC rule or order says so.
• “Opt-outs must be honored within 24 hours by federal law.” Not found; the ceiling is ten business days.
• “You can choose one opt-out method.” Not until FCC 26-67 takes effect.
• “79% of Americans strongly prefer a human.” The survey it is pinned on reports 70% and 60% for its subgroups, figures that cannot produce 79%.
• “The FCC requires AI call disclosure.” FCC 24-84 is a proposal only.

A monthly compliance review

Sit down with whoever owns the texting tool and go through:

• Read the opt-out log: plain-language requests caught, and each pushed to every tool.
• Pull five consent records and confirm all six details are stored.
• Check the send log for sales texts outside 8 a.m. to 8 p.m. recipient time or more than three in 24 hours.
• Confirm 10DLC campaigns are approved and match what is sent.
• Listen to five AI calls for disclosure, recording notice and handoff, and note hang-ups after the opening.
• Confirm every recorded line plays its announcement and the business associate agreement is on file.
• Check whether FCC 26-67 has an effective date.

FAQ

Do appointment reminders need written consent?

Usually not: reminders are informational, and the federal standard for informational texts is prior express consent, not written consent. Keep coupon codes out, since CTIA says a call to action can make a reminder promotional.

Is my CRM an autodialer?

Probably not under federal law after Facebook v. Duguid. Florida, Oklahoma and Maryland use their own definitions around automated selection or dialing, so ask counsel about your tool.

Has FCC 26-67 changed how I handle opt-outs?

Not yet: as of October 3, 2026 it was adopted but not published, so it is not in force. Keep honoring any reasonable method within ten business days at most.

Can I text leads in the evening?

Not sales follow-ups to Florida, Oklahoma or Maryland numbers after 8 p.m., and federal telemarketing hours end at 9 p.m. Maryland’s hours apply even where its consent exemption does.

Does my AI receptionist have to say it is AI?

In Maine, a 2025 law requires it whenever a reasonable consumer could think it is human; confirm with counsel that it is in force. California and Texas add healthcare duties. We disclose on every call everywhere.

Does an AI answering service need a business associate agreement?

Yes, if you are a covered entity and the vendor stores recordings or transcripts with patient information. Sign it before the first patient call.

Sources

Checked on October 3, 2026. Rules and fees change, and many are set state by state or city by city: confirm the current requirements with the agency that issues them before you apply.

• 47 U.S.C. 227, the Telephone Consumer Protection Act (Cornell LII)
• FCC 15-72, TCPA Declaratory Ruling and Order, July 10, 2015
• 47 CFR 64.1200, FCC telemarketing and robocall rules (Cornell LII)
• Insurance Marketing Coalition v. FCC, Eleventh Circuit, January 24, 2025
• FCC rule reinstating the prior consent definition, 90 FR 42137, August 29, 2025
• FCC DA 26-12, revoke-all waiver extended to January 31, 2027
• FCC 26-67, revocation of consent order, adopted September 30, 2026
• Florida Statutes 501.059, telephone solicitation
• Florida Statutes 501.616, commercial telephone solicitation hours and limits
• Oklahoma HB 3168, Telephone Solicitation Act of 2022 (enrolled)
• Maryland Commercial Law 14-4502, Stop the Spam Calls Act
• CTIA Messaging Principles and Best Practices, May 2023
• The Campaign Registry, 10DLC
• Twilio changelog, full blocking of unregistered 10DLC traffic, September 1, 2023
• FCC 24-17, AI voices under the TCPA, February 8, 2024
• Maine P.L. 2025 ch. 294 (HP 1154), AI chatbot disclosure
• California Health and Safety Code 1339.75 (AB 3030)
• Texas HB 149 (89th Legislature), enrolled text
• Google Local Services Ads Help, How leads work
• 18 U.S.C. 2511, federal wiretap law (Cornell LII)
• Kearney v. Salomon Smith Barney, 39 Cal.4th 95 (2006)
• Cal. Penal Code section 632, confidential communications
• Fla. Stat. 934.03, interception of communications
• 18 Pa.C.S. 5704, exceptions to the Pennsylvania wiretap act
• Wash. RCW 9.73.030, consent of all parties
• Mass. G.L. chapter 272, section 99, interception of wire communications
• Md. Code, Cts. and Jud. Proc. 10-402
• Reporters Committee recording guide, Illinois page
• Reporters Committee for Freedom of the Press, recording guide, 2021
• 45 CFR 160.103, HIPAA definitions (Cornell LII)
• HHS HIPAA Omnibus Rule, 78 FR 5566, January 25, 2013
• 45 CFR 164.502, uses and disclosures of PHI (Cornell LII)