Can your roofing company legally text customers? TCPA & A2P, explained.

The Telephone Consumer Protection Act is a federal law from 1991 that governs automated calls and texts. The part that matters to a roofing company: sending an automated marketing text to someone who didn't consent carries statutory damages of $500 to $1,500 per message, per recipient.

Two things make that number dangerous. First, it's per message — a five-text sequence to one non-consenting contact is five violations. Second, the TCPA has a private right of action, meaning any homeowner can sue you directly. No regulator has to get involved, and there's a plaintiff's bar that specializes in exactly these cases. A campaign to 500 contacts who never opted in is up to $750,000 of exposure before the second message even sends.

That's the stick. The good news is the rules are clear, and a compliant setup costs nothing extra — it just has to be built in from message one instead of bolted on after.

The TCPA doesn't treat all texts the same. The message type sets the consent bar, and this is where most contractors get it wrong.

Transactional messages— "your invoice is ready," "the crew arrives Tuesday at 9" — sit at a lower bar. The phone number a homeowner gave you for the job generally covers messages about that job.

Marketing messages — a referral bonus offer, a reactivation campaign, a spring inspection promo — sit at a higher bar: the FCC requires prior express written consent for automated marketing texts. Written consent means the contact affirmatively agreed, in writing, to receive marketing texts from you specifically — a checked box on your form, a signed intake, a keyword they texted in.

The trap: a customer who gave you their number to get a roof fixed consented to messages about that roof, not to promo blasts a year later. A prior business relationship is a foothold, not a free pass — per the FCC, the "established business relationship" concept from telemarketing rules is not a substitute for written consent when the text is automated marketing.

Buying a list of homeowner numbers and texting them is a TCPA violation on every send — no prior relationship, no opt-in, no defense. And there's no business-to-business exemption for SMS, so texting a scraped list of "company" numbers doesn't work either; most of those are someone's personal cell, the most protected category under the law.

Even if you were willing to gamble on the lawsuit risk, the carriers end the conversation first. The A2P registration system exists specifically to screen for unsolicited messaging — a cold-list campaign gets flagged, your number gets banned, and your legitimate messages stop delivering too. Cold SMS doesn't just risk a penalty; it burns the channel.

If you want to reach people who've never heard of you, the legal channels are email and careful phone outreach. SMS is the channel for people already in your world — past customers, old estimates, active leads. That's also exactly where it performs best.

Separate from the law, there are the carriers. Any business sending texts through software — a CRM, an automation platform, a mass-texting tool — must use an A2P 10DLC number: application-to-person messaging on a 10-digit long code, registered with The Campaign Registry. Carriers built this system because spam was drowning the channel, and they enforce it hard: unregistered business texting gets filtered or blocked outright.

Registration is a three-step process:

1. Brand registration.Your legal business name, EIN, website, and business type — proving you're a real company.
2. Campaign registration.A description of what you'll send — for a roofer, something like appointment reminders and lead follow-up. This step must reference a page on your website with explicit SMS opt-in language. A missing or non-compliant consent disclosure is the number one reason registrations get rejected.
3. Number assignment. The approved campaign gets attached to the phone number that will send.

Approval takes about 3–7 business days, and texting is completely blocked until it clears — so it's a day-one task on any new system, not a launch-week one.

Every form on your site that collects a phone number needs a consent disclosure next to it. A checkbox is the strongest version — it creates the written consent record that covers marketing messages. Here's the template that passes carrier review:

By checking this box, I agree to receive text messages from [Your Roofing Company] at the phone number provided. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Consent is not a condition of purchase. View our Privacy Policy and Terms of Service.

Your privacy policy also needs a messaging section, and one clause in it is effectively mandatory for A2P approval — carriers check for it verbatim:

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

Two pieces of copy, pasted once. That's the difference between an approved campaign and a rejection email three weeks before storm season.

Every recipient must have a working way out. STOP must always be honored — immediately and permanently. An opted-out contact never gets re-added, not even when you import a fresh list next year.

Here's the part that surprises people: the opt-out disclosure does notneed to appear in every text. CTIA carrier guidance says to include it in the first message of a sequence and periodically after that. On a registered A2P number, carriers honor STOP automatically even when the word isn't present. So message one carries "Reply STOP to opt out," and the follow-ups can read like a normal text from a real person — which, not coincidentally, is also what delivers best through carrier spam filters.

Timing matters too. Federal rules keep telemarketing contact between 8 a.m. and 9 p.m.in the recipient's local time zone. Schedule campaigns for business hours anyway — an 8:55 p.m. marketing text is technically legal and still a bad idea.

After a 2021 Supreme Court case (Facebook v. Duguid) narrowed the federal definition of an autodialer, several states passed their own, stricter versions of the TCPA. Florida's FTSAis the most aggressive — broader autodialer definition, tighter quiet hours (8 a.m. to 8 p.m.), and it's become a magnet for class-action suits. Oklahoma and Washington have their own versions with similar teeth.

Practical takeaway: if your service area or your list touches one of these states, the safest baseline is explicit written opt-in for everything and a compliance review before launch. "We followed the federal rules" is not a defense against a state statute.