TCPA and 10DLC rules for AI text messaging

Two frameworks, two completely different failure modes

The reason this trips up otherwise careful businesses is that the two frameworks fail in ways that look nothing alike. A 10DLC failure is loud and immediate: you register badly, your campaign is rejected, your messages do not arrive, somebody notices within a week because the numbers are flat. It is annoying, costs you days, and then it is fixed. A TCPA failure is silent for months. Everything works. Messages deliver. Engagement looks normal. Then a demand letter arrives referencing a specific date and a specific number, and the question is not whether the message was delivered — everyone agrees it was — but whether you can produce the record showing you were allowed to send it.

That asymmetry is why compliance budgets in this category are consistently misallocated. The registration fees get scrutinised because they appear on an invoice. The consent architecture gets deferred because it appears nowhere until it is the only thing that matters. If you are building the business case for an AI agent, the honest version prices both — and if you have not yet built that case, the AI agent ROI model takes the compliance layer as an explicit input rather than an afterthought.

The rules at a glance

Every number that matters, in one place

Does the TCPA apply to AI-generated messages?

Yes, unambiguously, and it is worth being precise about why — because the reasoning determines what else is captured. The FCC has long treated text messages as “calls” for TCPA purposes, which pulls SMS into the same core restrictions that govern phone calls: consent, revocation, do-not-call scrubbing, time-of-day windows. Nothing about that analysis turns on who or what composed the message. A text generated by a large language model is a text.

On the voice side the FCC went further and said the quiet part out loud: AI-generated voices are “artificial” voices under the statute. That places an AI voice agent in the same category as a prerecorded message, requiring the same prior express consent — a materially higher bar than a person dialling manually. Businesses deploying AI calling and texting agents are therefore deploying them directly into TCPA scope, and in our experience a great many do so without realising the consent requirements attach at all.

Why AI raises the stakes rather than lowering them

There is no AI exemption anywhere in the framework, and the structural argument runs the other way: AI warrants tighter governance than a manual process, because exposure is assessed per message and AI scales message volume faster than any human workflow. A team that would have sent four hundred texts by hand might send forty thousand with an agent. Nothing in the policy changed; the theoretical liability multiplied by a hundred. Volume is the multiplier on every number in the table above.

The second reason is subtler and specific to language models. A scripted system fails predictably — you can read the flow and know what it will do. A model generates, which means the compliance-relevant behaviours you care about (recognising an opt-out, refusing to send outside a window, declining to re-engage a suppressed contact) are not properties of the copy, they are properties of the system around the copy. Compliance for an AI agent lives in the send layer and the classification layer, not in the message template. That distinction is the difference between an AI agent and a traditional chatbot, and it has consequences well beyond compliance.

The three rules that changed, and where each stands

Most published guidance in this area is out of date, and it is out of date in both directions — describing requirements that were struck down, and omitting requirements that are now in force. Here is the current state of the three that matter.

1. The consent revocation rule — in force since 11 April 2025

This is the operative rule today, and the one most businesses are quietly non-compliant with. Its terms are specific:

2. The one-to-one consent rule — vacated

Scheduled to take effect on 27 January 2025, it was vacated by the Eleventh Circuit three days beforehand. It is not in force. Guidance telling you to obtain separate consent for each individual seller is describing a rule that no longer exists — and there is a lot of that guidance still circulating, because compliance content ages badly and nobody revisits a published checklist.

Do not over-read the vacatur, though. The underlying prior express written consent standard is entirely untouched. Consent still does not transfer between companies. And a consent form that lists hundreds of unrelated “marketing partners” in a scrolling box remains very hard to defend as clear and conspicuous disclosure, whatever the one-to-one rule’s fate. The rule was struck down; the reasonable-consumer standard behind it was not.

3. The revocation-all requirement — delayed to 31 January 2027

This provision turns any opt-out into a global one. Once effective, an opt-out would revoke consent for all automated marketing messages from that sender, and — unless the consumer indicates otherwise — for informational and transactional calls and texts too, across every purpose and every channel. It had been due in April 2026; in January 2026 the FCC issued an order delaying it to 31 January 2027.

Build for it now anyway. Not out of caution, out of arithmetic. If opt-out state lives as four separate flags in your SMS platform, your email tool, your CRM and your helpdesk, unifying them later is a data migration with a deadline attached. If every channel checks one suppression service before sending, you are already compliant and the deadline is a non-event. That is a design decision available to you today at close to zero cost, and a project with a fixed date and a legal consequence if you defer it.

Also on the horizon: AI disclosure

The FCC has an open proceeding on AI-generated voice and text communications. The proposals under consideration include requiring disclosure that a message was AI-generated at the outset of an interaction, and extending revocation rights across all AI-generated channels. These are proposals, not final rules, and should not be treated as current obligations. But the direction is clear enough to design toward — and separately, several US states have enacted or proposed bot-disclosure requirements in specific contexts, and the EU AI Act imposes transparency obligations on systems that interact with people. If you operate anywhere beyond a single US state, disclosure is heading toward you from more than one direction.

What valid consent actually requires

Consent is where TCPA cases are won and lost, and the standard is more demanding than most businesses assume. It is not a checkbox. It is a documented record of a specific disclosure shown to a specific person at a specific moment, and the burden of producing it falls on you.

The three assumptions that cause the most damage

“They are our customers, so we can text them.” A purchase is not consent to receive marketing texts. Transactional messages directly tied to that order stand on firmer ground, but promotional messages need separately captured consent, and the boundary between the two is narrower than marketing teams like. A shipping notification with a discount code appended is not a shipping notification.

“It is a business number, so the TCPA does not apply.” B2B texts to wireless numbers are subject to the same restrictions as B2C, and most business contacts today are mobile numbers. A business card, a LinkedIn connection, a downloaded whitepaper and an existing vendor relationship are none of them prior express written consent.

“We bought the list from a reputable source.” Consent does not transfer between companies. Selling or sharing consent with third parties does not create valid consent for those third parties, regardless of what the original form said about partners. Consent also does not last forever — a record from a form filled in years ago, for a business that has since changed name and message types, is a weak record even where it technically exists.

10DLC: registration, trust scores and throughput

10DLC — 10-Digit Long Code — is the registration system US carriers use to authorise business texting from standard 10-digit numbers, administered through The Campaign Registry. If you send any automated SMS in the US, whether marketing, reminders or order updates, you need it. Since February 2025 all major carriers block unregistered application-to-person traffic, which changed this from a deliverability optimisation into a precondition for the channel existing at all.

The registration sequence, and where it goes wrong

You register a brand first — your legal business identity, EIN, address — and then one or more campaigns, each describing a specific messaging use case with sample messages and an account of how you collect opt-in. Brand registration typically clears in one to five business days. Campaign registration takes three to seven, stretching to ten or fifteen in busy periods. Budget one to four weeks end to end and assume at least one rejection.

Trust scores between 75 and 100 permit meaningfully higher messages per second. If your business is not on the Russell 3000, you are capped at a lower throughput tier without paying for third-party vetting — roughly $40, and usually worth it the moment volume matters. The most common causes of rejection are mundane and entirely avoidable: a legal name that does not match your EIN registration exactly, sample messages that do not correspond to the described use case, an opt-in flow a reviewer cannot find or complete on your live site, and sample messages missing the opt-out instruction.

Price your own exposure

Eight inputs. The first seven price the visible cost of the outbound lane — registration, campaign fees, carrier surcharges. The eighth prices the invisible one. Outputs are illustrative estimates generated from your inputs, not a legal assessment, a quote or a prediction of any actual liability.

TCPA vs 10DLC: the distinction that catches people out

These are separate requirements that apply simultaneously, and the single most costly misunderstanding in this area is treating one as evidence of the other. Carriers do not check your consent records. Courts do not check your trust score.

Inbound vs outbound: the compliance fork

Almost the entire burden described on this page attaches to one thing: sending automated messages to people who did not message you first. Flip the direction and most of it simply does not arise — not as a loophole, but because the question the TCPA exists to answer does not come up. You are not interrupting somebody; they interrupted you.

State the conflict of interest here, because it is real. Jugl sells inbound AI agents, so a page concluding that inbound is simpler is a page concluding that you should buy what we sell. The distinction is nonetheless accurate and is the reason the row above is worth reading — but read the next paragraph too, because it is where the argument stops.

Inbound is not a compliance-free zone. General consumer protection law applies. State privacy and session-recording statutes apply, and two-party consent states have specific requirements for recorded or monitored conversations. Data protection obligations apply to whatever you store. Platform policies apply and are enforced by quality rating rather than by regulator. And the instant you capture a phone number in an inbound conversation and send an outbound text to it, you are back inside the TCPA in full, regardless of where the conversation began. The channel of capture does not determine the channel of obligation.

The commercial argument, separate from the compliance one

There is a cost advantage running alongside the compliance advantage, and it happens to point the same way. Meta bills WhatsApp per delivered template message, but replies inside the customer-initiated 24-hour service window are free, and click-to-WhatsApp ads open a 72-hour free window. An inbound-first strategy sits inside those windows by design, which makes instant response financially trivial rather than expensive. Meta has announced it will begin charging for service messages from 1 October 2026, which is worth modelling now rather than discovering later. The full channel economics are in the WhatsApp platform comparison.

The intent argument is stronger still. Outbound guesses who is interested. Inbound already knows — somebody asking whether an item is in stock at 11pm on a Sunday has told you exactly where they are in the purchase, and they are not going to wait until Monday to find out. That is not a support ticket appearing in a queue metric; it is a sale appearing in a competitor’s revenue. How agents read those signals is covered in the concierge model, and the broader shift is documented in the conversational commerce report.

Channel by channel: what is regulated and what is not

A single “messaging compliance policy” that treats every channel identically will be wrong in both directions — over-restricting where nothing applies, and under-restricting where a great deal does. The obligations differ by channel, and so should your agent’s behaviour.

Channel classification is a starting point for a conversation with counsel, not a substitute for one. State law in particular varies significantly, several states have mini-TCPA statutes with independent private rights of action, and the analysis can turn on facts specific to how you capture and use a number.

The trap in the middle of that table

Look at the WhatsApp row and the outbound SMS row together. The same customer, the same question, the same AI agent, the same answer — and completely different legal machinery, depending only on which app the message travelled through. That is worth internalising before you design your channel strategy, because it means the channel decision is a compliance decision made months before anybody in legal sees a document. Businesses that pick channels on marketing grounds and discover the compliance consequences afterwards are the ones who end up retrofitting consent capture into a live system.

It is also why multi-channel AI is worth more than it looks. If your agent runs across WhatsApp, Instagram, Messenger, web chat and email with one shared customer history, the customer chooses the channel and you inherit the lightest applicable obligation. Getting that architecture right from the start is covered in the customer support agent guide, and the multilingual dimension in multilingual AI support.

What your AI agent must actually be able to do

Compliance for an AI messaging system is not a policy document, it is a set of behaviours in the send layer and the classification layer. These are the capabilities to require of any vendor, and to verify rather than accept on assurance.

The comparisons buyers ask for

AI agent versus traditional chatbot, on compliance

Outbound-first versus inbound-first, as a strategy

Jugl versus a typical outbound SMS stack

Stated as a disclosure rather than a finding: this is our own product, and the last row is the honest one. Choosing inbound changes which obligations attach to you. It does not delegate any obligation to us. Worked comparisons against named platforms are on the comparison hub, and Jugl vs Meta’s own business agent covers the closest adjacent option.

The six questions behind every compliance review

How to launch AI messaging without a compliance problem

Seven steps, in this order. The order is the point — most of the pain in this area comes from doing step three before step one.

What none of this protects you from

A compliance page that only lists reassurances is worse than useless, because it produces confidence without protection. Here is what remains after you have done everything above.

Where Jugl fits — and where it does not

What it changes. Jugl’s AI agents work on inbound channels — WhatsApp, Instagram, Facebook, web chat and email — where customers reach out to you. That removes A2P 10DLC brand registration, campaign fees, carrier surcharges, the one-to-four-week approval wait and the outbound consent infrastructure from your project, because none of them attach to a conversation the customer started. As a Meta Business Partner, Jugl connects those channels natively rather than as an integration project, so the whole thing is live the same day.

What it changes commercially. Replies inside the customer-initiated 24-hour WhatsApp service window are free and click-to-WhatsApp ads open a 72-hour free window, so an inbound-first agent answers at essentially no marginal cost — while outbound template messages carry per-message pricing on top of carrier surcharges. Jugl’s own pricing is flat and published, with nothing metered per resolution, so the cost of answering more conversations does not rise as the agent succeeds. Full pricing is on the pricing page, and the wider return is modelled on the ROI page.

What it changes for your customers. The agent answers instantly in your brand voice across every channel, reads what the customer is actually asking for, and hands off to a real person the moment it matters — with the full transcript, so nobody has to explain themselves twice. Jugl is used by 1,000+ businesses. What that looks like in practice is on what is Jugl, and the handoff design specifically on the AI-to-human handoff guide.

What we cannot do for you. We are not your compliance function and we are not a law firm. If you send outbound SMS, you still need registration, consent capture, suppression, DNC scrubbing and legal review, and none of that becomes our obligation because you bought software. Choosing the inbound lane changes which rules attach to you; it does not delegate any rule to a vendor. Any platform telling you otherwise is selling you a comfort that will not survive a demand letter.

Methodology and disclosure

TCPA and 10DLC for AI messaging: 26 questions answered

People also ask