Federal TCPA compliance is the floor, not the ceiling. As of 2026, more than 15 states enforce their own telemarketing and SMS laws that stack stricter rules on top of the federal standard — broader autodialer definitions, tighter quiet hours, steeper penalties, and additional registration requirements that the TCPA does not impose.
For any business using SMS marketing lists or telemarketing lists to reach contacts across state lines, a campaign that is fully TCPA-compliant can still violate state law in Florida, Connecticut, Texas, or any other state with a mini-TCPA statute. The penalties are real, the private lawsuits are increasing, and “I followed the federal rules” is not a defense.
This guide covers the highest-risk states, what makes each one different from the federal TCPA, and how to build a compliant multi-state SMS program.
Why State Laws Matter More Than Ever
The wave of state mini-TCPA legislation began with Florida in 2021 and has accelerated rapidly. Oklahoma followed in 2022, Connecticut in 2023, Maryland and Georgia in 2024, and Virginia and Texas strengthened their laws in 2025-2026. The trend is clear: states are filling gaps they perceive in federal enforcement by creating their own consent requirements, penalty structures, and private rights of action.
The practical impact for marketers is that your compliance program must account for the strictest applicable state law for each recipient on your SMS list — not just the federal minimum. A single campaign to a national list touches dozens of jurisdictions simultaneously.
High-Risk States: Detailed Breakdown
Florida — Telephone Solicitation Act (FTSA)
Statute: Fla. Stat. § 501.059
Key differences from federal TCPA: Florida broadens the autodialer definition beyond the federal standard set by the Supreme Court in Facebook v. Duguid (2021). While the federal TCPA only covers equipment that generates numbers using a random or sequential number generator, the FTSA covers any automated system used for the selection or dialing of phone numbers. Florida also imposes a three-call-per-24-hour limit to the same number and restricts quiet hours to 8:00 AM to 8:00 PM (one hour earlier cutoff than the federal 9:00 PM).
Consent requirement: Prior express written consent required for all commercial calls and texts using automated systems.
Penalties: $500 per violation ($1,500 for willful violations) plus attorney’s fees. Private right of action — individual Florida residents can sue directly.
What this means for marketers: Even if your dialing platform does not meet the federal ATDS definition, it may still trigger FTSA liability if it automates the selection or dialing process in any way. Any SMS campaign to Florida contacts requires strict attention to the broader autodialer definition, the three-call cap, and the 8 PM cutoff.
Connecticut — SB 1058
Key differences from federal TCPA: Connecticut has the steepest penalties of any state. It requires prior express written consent for essentially any telephonic sales call or text and narrows permissible hours to 9:00 AM to 8:00 PM — a shorter window than both the federal TCPA (8 AM-9 PM) and Florida (8 AM-8 PM).
Penalties: Up to $20,000 per violation. The Connecticut Attorney General may pursue civil penalties and restitution orders. This is the single highest per-violation penalty of any state mini-TCPA.
What this means for marketers: One unwanted text to a Connecticut resident can carry a $20,000 penalty. If your national SMS list includes Connecticut contacts, you need the strictest consent documentation and must ensure sends fall within the 9 AM-8 PM window.
Texas — Amended Telephone Solicitation Laws (Effective September 2025)
Key differences from federal TCPA: Texas explicitly defines marketing text messages as “telephone solicitations,” closing any ambiguity about whether SMS falls under the state’s telemarketing statute. Texas requires Secretary of State registration for many businesses sending promotional SMS to Texas residents. Quiet hours are 9:00 AM to 9:00 PM Monday through Saturday and noon to 9:00 PM on Sundays — the only state with separate Sunday restrictions.
Penalties: $500 per violation with a private right of action. Texas’s Deceptive Trade Practices Act can also apply, potentially triggering treble damages.
What this means for marketers: If you are sending SMS at volume to Texas contacts, you may need to register with the Texas Secretary of State before sending. The Sunday noon start time is unique and easy to miss — scheduling a Sunday morning campaign that is compliant in every other state will violate Texas law.
Oklahoma — Telephone Solicitation Act (OTSA)
Statute: 15 O.S. §§ 775C.1-775C.6
Key differences from federal TCPA: Oklahoma mirrors Florida’s FTSA almost word for word, including the broadened autodialer definition, the three-call-per-24-hour limit, and the 8:00 AM to 8:00 PM quiet hours. Oklahoma also requires prior express written consent that names the specific business — blanket consent covering multiple companies is not valid.
Penalties: $500 per violation ($1,500 for willful). Private right of action.
Virginia — Telephone Privacy Protection Act (Effective January 1, 2026)
Statute: Va. Code § 59.1-510 et seq. (SB 1339)
Key differences from federal TCPA: Virginia explicitly covers text messages and specifies that opt-out commands (STOP, UNSUBSCRIBE) must be honored for at least 10 years — the longest opt-out retention period of any state. Virginia also adds enhanced consent requirements beyond the federal baseline.
Penalties: Civil penalties enforced by the Attorney General. Private right of action for consumers.
What this means for marketers: Your internal suppression list for Virginia contacts must be maintained for a full decade. If someone opts out of your SMS in 2026, you cannot contact them again until 2036 — even if they appear on a newly purchased list.
Georgia — SB 73 (Effective 2024)
Key differences from federal TCPA: Georgia’s 2024 amendments significantly strengthened the state’s telemarketing framework by eliminating damage caps that previously limited recovery, removing the “knowing” requirement (making violations easier to prove), adding vicarious liability provisions that extend liability up the chain to the brand even when a vendor makes the call, and permitting class actions that were previously limited.
Penalties: No damage cap. Vicarious liability means the brand, the agency, and the calling vendor can all be held liable.
Maryland — Stop the Spam Calls Act (Effective 2024)
Key differences from federal TCPA: Maryland requires prior express written consent for any automated system used for the selection or dialing of phone numbers — matching Florida’s broader autodialer definition. Quiet hours are 8:00 AM to 8:00 PM.
Penalties: $500 per violation ($1,500 for willful). Private right of action.
Washington — Robocall Scam Protection Act
Key differences from federal TCPA: Washington created a private right of action with statutory damages up to $1,000 per violation for repeat conduct. The “commercial solicitation” definition is broader than the federal TCPA, sweeping in more types of outreach.
Quiet hours: 8:00 AM to 8:00 PM.
Quick Reference: State Comparison Table
| State | Quiet Hours | Max Penalty/Violation | Private Right of Action | Key Difference |
|---|---|---|---|---|
| Federal TCPA | 8 AM – 9 PM | $500 / $1,500 | Yes | Baseline (narrow ATDS definition) |
| Florida | 8 AM – 8 PM | $500 / $1,500 | Yes | Broad ATDS, 3-call cap/day |
| Connecticut | 9 AM – 8 PM | $20,000 | AG enforcement | Highest per-violation penalty |
| Texas | 9 AM – 9 PM (Sun: noon-9 PM) | $500 + DTPA treble | Yes | SOS registration, Sunday rules |
| Oklahoma | 8 AM – 8 PM | $500 / $1,500 | Yes | Mirrors Florida FTSA, 3-call cap |
| Virginia | Federal (8 AM – 9 PM) | Civil penalties | Yes | 10-year opt-out retention |
| Georgia | Federal (8 AM – 9 PM) | No cap | Yes + class actions | Vicarious liability, no damage cap |
| Maryland | 8 AM – 8 PM | $500 / $1,500 | Yes | Broad ATDS (matches Florida) |
| Washington | 8 AM – 8 PM | $1,000 repeat | Yes | Broad solicitation definition |
Additional States to Watch
California: While California does not have a standalone mini-TCPA, the CCPA/CPRA applies data subject rights to SMS contact data. California consumers can request deletion of their phone numbers from your database, and your compliance program must honor these requests.
Arizona and New Jersey: Both require telemarketer registration and bonds before conducting outbound campaigns to their residents. These are not consent-based restrictions like the states above, but administrative requirements that create compliance exposure if ignored.
New state proposals: Multiple states introduce mini-TCPA legislation each session. The trend is toward stricter rules, broader definitions, and more private enforcement. Any business running national SMS campaigns should monitor state legislative activity or work with compliance counsel who tracks these changes.
How to Build a Multi-State Compliant SMS Program
Default to the Strictest Standard
Rather than managing different rules for each state, the most practical approach is to default your entire program to the strictest standard across all states. That means 9:00 AM to 8:00 PM send windows (satisfies Connecticut, Florida, Oklahoma, Maryland, and Washington), prior express written consent for every recipient, honoring opt-outs for 10 years (satisfies Virginia), three-call/text cap per 24 hours per number (satisfies Florida and Oklahoma), and business-specific consent naming your company (satisfies Oklahoma).
Maintain State-Level Suppression Lists
Your suppression management must track opt-outs by state so you can apply the correct retention period. Virginia’s 10-year requirement means you cannot simply purge old opt-outs after the federal minimum.
Work with Compliant Data Providers
Your SMS marketing list provider should deliver data that has been scrubbed against the National DNC Registry and any applicable state-level registries. At ProMarketing Leads, we scrub every list against federal and state DNC registries before delivery.
Document Everything
Maintain consent records including the date, time, method, specific business named, and exact disclosure language the consumer agreed to. In a state mini-TCPA lawsuit, your documentation is your primary defense.
Frequently Asked Questions
Which state has the strictest SMS marketing laws?
Connecticut has the highest per-violation penalty at up to $20,000. Florida and Oklahoma have the broadest autodialer definitions and impose a three-call daily cap. Virginia requires the longest opt-out retention at 10 years. Texas is the only state requiring Secretary of State registration for SMS marketers.
Do state SMS laws apply if my business is in a different state?
Yes. State telemarketing and SMS laws apply based on where the recipient is located, not where your business is headquartered. If you send a text to a Florida resident, the Florida FTSA applies regardless of where you are located.
Is federal TCPA compliance enough?
No. Federal TCPA compliance is the minimum baseline. At least 15 states impose stricter requirements including broader autodialer definitions, earlier quiet-hour cutoffs, higher penalties, and additional registration or consent requirements. A TCPA-compliant campaign can still violate state law.
How do I know which state laws apply to my SMS list?
State laws apply based on the recipient’s location. Your SMS list should include state-level geographic data so you can identify which recipients are in high-risk states and apply the appropriate compliance requirements.
What is the safest approach for multi-state SMS campaigns?
Default to the strictest standard across all states: 9 AM-8 PM send windows, prior express written consent, 10-year opt-out retention, three-text daily cap per number, and business-specific consent. This single standard satisfies every current state law.
Stay Compliant Across Every State
State-level SMS compliance starts with your data. At ProMarketing Leads, every SMS marketing list we deliver is scrubbed against federal and state DNC registries, built with documented consent procedures, and delivered with state-level geographic data so you can apply the right compliance rules to every contact.
Contact us today for a free consultation. Call (866) 397-2772 to speak with a list expert.