Text Message Fundraising and TCPA: Consent Rules AI Will Not Remember for You

What the TCPA Reaches, and Which of Your Texts Are Actually Marketing

The Telephone Consumer Protection Act and the FCC rules implementing it at 47 CFR 64.1200 restrict calls and texts made to wireless numbers using an automatic telephone dialing system or an artificial or prerecorded voice. Text messages sent through a mass messaging platform are treated as within that scope for practical purposes, and every credible nonprofit messaging vendor operates on that assumption. The important distinction for a fundraising team is not whether the TCPA applies at all. It is which consent standard applies to each message you send.

The rules draw a line between messages that advertise or promote, which sit in the telemarketing bucket and require the higher standard of prior express written consent, and informational or transactional messages, which sit in a lower bucket requiring prior express consent that can be established more simply. A donation receipt, an event reminder for an event the person registered for, a volunteer shift confirmation, and a delivery notice for something the person requested are the clear informational cases. A solicitation for a gift, a year-end appeal, a matching gift push, and a membership renewal ask are the clear marketing cases.

The problem is that real nonprofit messages do not respect the line. Consider the message most development teams would consider harmless: "Thanks for volunteering on Saturday. We served 240 meals. Chip in 25 dollars to keep the kitchen stocked." That is a transactional opener with a solicitation attached, and the attachment is what governs. Once a message contains an ask, the whole message is treated as marketing, and the consent you needed was the higher standard, not the lower one. Teams get into trouble here constantly because the dual-purpose message feels like good stewardship rather than a legal event.

The practical response is to classify message types in writing before the program scales, and to enforce the classification at the template level rather than in a sender's head. Build a template library where every template is tagged with the consent standard it requires, and where the sending system refuses to release a marketing-tagged template to a segment that only has informational consent on file. This is a systems control, and it is far more reliable than training people to remember a distinction they will encounter twice a month under deadline. If your organization is already building automated donor communications, this classification belongs in that architecture from the start rather than being retrofitted later.

One more category deserves attention because it hides in plain sight. Advocacy messages asking a supporter to contact a legislator are not fundraising, but they are also frequently not purely informational, and organizations that run both fundraising and advocacy programs often maintain them in separate systems with separate lists and separate vendors. That structural split is where consent records and opt-out signals go to die, and we return to it below.

The Consent Record Is the Deliverable

Here is the operational heart of the whole topic. In a TCPA dispute, the burden of establishing consent sits with the sender. The person who received the text does not have to prove they never agreed. Your organization has to produce evidence that they did, for that specific number, at a specific moment, under a disclosure whose exact wording you can reproduce. A screenshot of your current donation page is not that evidence, because your current page is not necessarily the page that existed eighteen months ago when the number came in.

A usable consent record captures, at minimum, the phone number in a normalized format, a timestamp with a time zone, the source of the consent identified specifically enough to reconstruct it, the exact disclosure text that was displayed at that moment stored as a snapshot rather than as a pointer to a live page, the IP address and user agent for a web opt-in, the method by which consent was given, and a version identifier for the disclosure language. If consent arrived by the person texting a keyword to your short code, the record should hold the inbound message content and the timestamp of that message. If consent arrived on paper at an event, the record should reference a scanned image of the signed card.

The disclosure snapshot is the field organizations skip and the one that matters most. Storing "consented via donation form" tells you nothing defensible, because nobody can say what the form said at the time. Versioning the disclosure language and stamping each consent record with the version identifier solves this cleanly and costs almost nothing to implement. When you change the wording, you mint a new version, and every record carries the version that was live when it was created. That single design decision converts an unprovable assertion into a reproducible fact.

Retention needs deliberate thought too. The federal TCPA carries a four year statute of limitations, and several state statutes have their own periods, so a retention schedule that purges contact history after two years can leave you unable to defend a claim that is still live. At the same time, consent records contain personal data you are obliged to protect, so the answer is a defined retention period with restricted access rather than either indefinite accumulation or premature deletion. Fold this into your organization's broader records retention schedule rather than letting the messaging vendor's defaults decide it for you.

Finally, ask a question most nonprofits have never asked their SMS vendor: can we export the full consent record, including disclosure snapshots, in a format we can read without your platform? Many organizations discover at the worst possible moment that their evidence lives inside a system they no longer subscribe to, or that the export contains a timestamp and nothing else. Make the exportable consent record a contractual requirement during procurement, alongside the other questions you would ask during vendor onboarding for any system holding sensitive supporter data. The evidence has to be yours.

STOP Has to Work Immediately, and It Has to Work Everywhere

Revocation is the area where the FCC has been most active and where nonprofit programs most reliably fail, because failure here is structural rather than intentional. The FCC's consent revocation rules, most of which took effect on April 11, 2025, establish that a person may revoke consent through any reasonable means, that senders must honor the request within a defined window, and that senders may not impose a specific method as the only acceptable one. The Commission has indicated that replying with words including STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE constitutes a reasonable revocation.

Read that list carefully, because it is where automated opt-out handling breaks. Many messaging platforms process the literal keyword STOP automatically at the carrier level and pass everything else through as an ordinary inbound reply. A supporter who texts back "please stop texting me" or "take me off this list" or "unsubscribe me" has revoked consent, and in most systems that message lands in an inbox nobody reads, while the next appeal goes out on schedule. That is the single most common real-world TCPA exposure in nonprofit texting, and it is entirely a workflow problem rather than a legal one.

The second structural failure is propagation across systems. A supporter texts STOP to the fundraising platform, the fundraising platform suppresses them correctly, and six weeks later the advocacy team sends an action alert from a different vendor with a different list, to the same person, who has now revoked consent twice and been texted anyway. Add a peer-to-peer texting tool a volunteer team uses during a campaign, and a third list exists that nobody reconciles. The FCC has separately been working toward a requirement that a revocation sent to one part of an organization applies across that organization's messaging, and the effective date for that revoke-all obligation has been extended more than once, most recently into 2027. Waiting for the deadline is the wrong posture. Design the propagation now, because the supporter already expects it to work that way and a plaintiff's attorney will frame it as one organization regardless of your vendor map.

Build a single authoritative suppression list that every sending system reads before a send, rather than each platform keeping its own. Make writing to that list the only way an opt-out is recorded, so there is no path by which one system knows something the others do not. Instrument it: log every suppression with its source, its timestamp, and the message that triggered it, so you can demonstrate the request was honored and when. And test it on a real cadence by sending a test opt-out through each channel you accept and confirming the suppression appears everywhere within minutes. This is the same discipline that makes a clean, reconciled CRM possible, and the two projects are usually worth doing together.

A note on the confirmation message. Sending one message confirming that the opt-out was processed is standard practice and generally accepted, provided it does nothing but confirm. Organizations sometimes use that final message to make one more ask, or to offer a reduced frequency option in a way that reads as a retention attempt. Do not. A person who has just revoked consent and receives an appeal in response has received exactly the message the rule exists to prevent, and it is the kind of detail that turns an ordinary complaint into a willfulness argument.

State Mini-TCPA Laws, Quiet Hours, and Why Federal Compliance Is Not Enough

A growing number of states have enacted their own telephone solicitation statutes, commonly called mini-TCPA laws, that reach text messages and impose requirements stricter than federal law. Your obligations are determined by where the recipient is, not where your organization sits, which means a national donor file subjects you to the strictest rule that applies to any segment of it. Federal compliance is the floor. It is not the standard.

Florida's Telephone Solicitation Act is the one that reshaped the litigation landscape. It creates a private right of action for Florida residents receiving nonconsensual commercial texts, provides for enhanced damages in willful cases, narrows the permitted calling window to 8 a.m. through 8 p.m. in the recipient's local time, and has been read to require that the consent language specifically reference telephonic sales calls rather than merely describing texts generally. Oklahoma's Telephone Solicitation Act follows the Florida model closely and adds an emphasis on being able to produce consent records in a form a court will accept. Washington reaches commercial text messages through its own statutes with its own damages framework and an 8 a.m. to 8 p.m. window. Maryland's Stop the Spam Calls Act, effective in 2024, requires prior express written consent for automated calls and texts and closes the evening window earlier than the federal rule.

Quiet hours deserve separate attention because they are the easiest rule to break by accident and one of the most actively litigated. The federal restriction bars telemarketing calls and texts before 8 a.m. and after 9 p.m. in the recipient's local time, and several states compress that further. The accident happens because most scheduling tools send by the organization's time zone rather than the recipient's. A 7:30 p.m. Pacific send from a California nonprofit lands at 10:30 p.m. for donors in New York, which is outside the federal window for every one of them. If your file spans time zones, your sending system needs to schedule per recipient, and if it cannot, your send windows need to be narrowed until the earliest and latest recipients are both inside the tightest applicable limit.

The state layer got more consequential in 2026 rather than less. In July 2026 the Seventh Circuit held in Steidinger v. Blackstone Medical Services that text messages are not telephone calls for the purposes of the TCPA's do-not-call private right of action, closing one avenue for federal text claims in that circuit and creating a split with other courts that have read the statute differently. The practical effect is not that texting became safer. It is that plaintiffs' firms have more reason to bring claims under state statutes, which are unaffected by a federal appellate reading, frequently carry their own damages, and in Florida's case have already generated substantial litigation volume. Tracking the state patchwork is now the higher-value activity, which is the same conclusion nonprofits have reached about state privacy laws more broadly.

Practically, keep a short internal matrix of the states where you have meaningful donor concentration, with the consent standard, the permitted hours, and any state-specific disclosure language each requires. Store state alongside the phone number in your data model so you can segment by it, which sounds obvious and is frequently impossible in files where the address and the mobile number were collected at different times. Separately, remember that state charitable solicitation registration is a different obligation that also follows the donor's location, and a text asking for money is a solicitation for those purposes too. Our overview of charitable solicitation compliance covers that side of the map.

Where AI Helps, and the Line It Must Not Cross

Everything above is work, and most of it is the kind of structured, repetitive, documentation-heavy work that small development teams never get to. This is where AI earns its place in a compliance program: not by knowing the law, which it does unreliably and with unnerving confidence, but by doing the drafting, the sorting, the cross-checking, and the monitoring that turn a policy into a practice.

Drafting compliant disclosure language. The opt-in disclosure is a short piece of writing with a fixed list of required elements and a hard constraint that it must read like human language on a phone screen. Give a model the element list from this article, your organization's name, your actual message types and frequency, and your terms and privacy URLs, and ask for three versions at different lengths for the donation form, the event kiosk, and the paper card. What comes back is a genuine first draft with the elements accounted for. It then goes to counsel, because the version that satisfies Florida's specific wording expectations is not something you want a model to have guessed at.

Auditing your list for records of consent. This is the highest-value application and the one almost nobody runs. Define your consent record schema, export your subscriber list with whatever consent fields exist, and have a model classify each record against the schema: complete, incomplete and repairable, or undocumented. What emerges is a map of where your list came from and where the evidence is missing, usually grouped by source in a way that immediately identifies the two or three intake paths responsible for most of the gaps. The model is doing data classification against your rules, not making a legal call about any individual number, and that distinction is what keeps the use safe.

Classifying inbound replies for opt-out intent. Recall that revocation can be expressed in ordinary language, and that platform keyword matching catches only the literal keywords. A classifier reading inbound messages and flagging anything that plausibly expresses opt-out intent, including misspellings, mixed-language replies, and phrasings like "wrong number" or "this is my kid's phone," closes the largest practical gap in most programs. Configure it to be aggressively over-inclusive. A false positive costs you one subscriber who can opt back in. A false negative is a violation per subsequent message, and the asymmetry is not close.

Reviewing message drafts against your own policy. Before a send, a model can check a draft against your written rules: is this template tagged marketing or informational, does the tagging match the content, does the segment have the matching consent standard on file, does the message identify the sender, is the send window inside the tightest applicable state limit for this segment, and does it contain anything that would defeat a charitable-purpose characterization. This is a checklist run consistently rather than a judgment, which is precisely what automation is for. Logging each check also builds the kind of audit trail that demonstrates a program operating as designed.

Monitoring for change, and preparing the human conversation. A model can summarize developments in a narrow area you define, produce a monthly brief on TCPA and state telemarketing developments affecting your states, and turn that into a list of questions for counsel. Treat the output as a research brief and a question list, never as a compliance determination. Used that way it converts a week of reading into an afternoon of verification, and it means your annual legal review starts from a current picture rather than a two year old memory.

And now the line, which is not negotiable. AI must not decide whether a given number may legally be texted. That decision rests on evidence in your records and on law that applies to your facts, and a model asked to adjudicate it will produce a confident answer with no basis, which is worse than no answer because it will be relied on. AI must not generate, infer, backfill, or reconstruct a consent record. A consent record documents something a human being actually did at a specific moment, and a synthesized record is not weak evidence, it is fabricated evidence, and producing it in a dispute is a far more serious problem than the original gap. And AI must not be the source of a legal conclusion your program depends on. Models get regulatory detail wrong routinely, this area has changed three times in two years, and the confident tone with which an incorrect answer arrives is exactly what makes it dangerous.

The rule to write into your policy is short. AI prepares, drafts, classifies, flags, and monitors. A named person reviews the flags, owns the list, and answers the question of whether a number may be texted. Counsel reviews the disclosure language, the policy, and the program annually. Nobody, at any point, lets a model fill in a consent record. Organizations already thinking carefully about informed consent in their programs will recognize the underlying principle: consent is a thing a person gives, and no system can give it on their behalf.