200 Texts, $500 Each: The TCPA Risk Inside Your CRM
Your CRM sent automated texts to your database today. Under the Telephone Consumer Protection Act (TCPA), every auto-text is legally classified as a phone call. If any reached a contact who revoked consent, the fine is $500 to $1,500 per message. Not per campaign. Per individual message.
Most agents know they need consent for cold calls. Fewer realize the same rules apply to drip sequences in Follow Up Boss, smart campaigns in kvCORE, and nurture texts in Lofty or Sierra Interactive. The FCC's April 2025 revocation rule tightened the standard for opt-outs, and most agent texting workflows haven't caught up.
Here's what changed, where CRM texting compliance falls short right now, and the 5-step audit that protects your business before Q4 campaigns launch.
The 3 Rules That Shifted Between 2024 and 2025
Three FCC changes reshaped texting compliance for agents. The 11th Circuit killed one-to-one consent, broadening how lead-source consent works. A new revocation rule expanded what counts as an opt-out, requiring businesses to honor any reasonable revocation within 10 business days. And AI-generated texts were formally classified as regulated A2P messaging.
One-to-One Consent Is Dead (But Consent Isn't)
In January 2025, the U.S. Court of Appeals for the 11th Circuit ruled that the FCC exceeded its authority with the one-to-one consent requirement. The FCC later formally dropped the mandate (Consumer Financial Services Law Monitor, Sep 2025). Under the prior rule, a lead form could only authorize contact from the specific company named on the form. Now, broader consent language covering multiple parties is legal, as long as the disclosure is clear and conspicuous.
For agents buying leads from Zillow, Realtor.com, or third-party portals: the consent framework is more flexible than it was in 2024. But "flexible" does not mean "optional." The lead form still needs to disclose that the consumer agrees to receive automated texts, and the language must identify who will contact them. If the form says "marketing partners" without naming your brokerage, the consent may not hold.
Revocation Got Broader
Since April 2025, FCC rules require that consumers can revoke consent "in any reasonable manner." Businesses must honor revocations within 10 business days (ActiveProspect, 2025). That standard is intentionally wide. All of these count as valid revocation:
- "Please stop texting me" in a reply
- An email to your brokerage asking to be removed
- A DM on Instagram saying "take me off your list"
- A phone call to your office
"STOP" still works. It's no longer the only valid method. If a past client texts back "quit sending me these," that's a legally binding revocation. You can't require a specific format.
Robin Take: The revocation rule is the change that catches the most agents off guard. Your CRM handles "STOP." It doesn't handle an Instagram DM. Build a manual bridge or accept the gap.
AI Texts Are A2P. Registration Required.
AI-generated responses from CRM platforms qualify as Application-to-Person (A2P) messaging under carrier regulations (GoPiperGo, 2026). A2P messaging requires 10DLC registration, a centralized registry maintained by AT&T, Verizon, and T-Mobile. Without registration, your messages get filtered, throttled, or blocked before they reach contacts.
If your CRM uses AI to auto-generate text replies, those messages need to flow through a registered 10DLC campaign. Most CRM providers handle this registration. But confirming it is your responsibility, not theirs. If your AI follow-up texts aren't landing, check your auto-response workflow first, then ask your provider about 10DLC status.
Where Agent Texting Breaks Compliance Today
The CRM software itself isn't the problem. Follow Up Boss, kvCORE, Lofty, Sierra Interactive, and CINC all have opt-out tracking built in. The gap? Three areas that sit outside the software's control. Your process determines whether you're compliant or exposed.
No Consent Documentation
Most agents can't prove when or how a contact opted in. Here's the typical chain: a lead arrives from a Facebook ad, the agent adds them to a drip campaign, and the CRM starts texting. Six months later, that person files a complaint. The question won't be whether you texted them. It'll be this: can you produce the consent record?
Under the TCPA, a pre-checked box on a web form doesn't count as valid consent. Consent must be affirmative: the contact actively checked a box, signed a disclosure, or took a clear action indicating agreement (GoPiperGo, 2026). Pre-checked consent language on your lead capture forms? Every text you send to those contacts carries risk.
Cross-Platform Revocation Blindness
Your CRM tracks "STOP" replies within its own texting channel. But the April 2025 rule says revocation on any platform counts. If someone emails your office manager, DMs your team's Instagram, or calls your front desk and says "take me off the list," your CRM has no way to know. The drip sequence keeps firing. Each text after the revocation is a separate $500 to $1,500 violation.
This is the gap that creates the highest per-incident liability for teams. A single missed revocation on a 90-day drip sequence could generate dozens of violations before anyone notices. If your CRM has texting built into its pricing, make sure opt-out coverage extends beyond that single channel.
Purchased List Auto-Texting
Agents who run purchased lists (expireds, FSBOs, cold data) through automated CRM texting face the sharpest risk. Those contacts did not give you prior express written consent to receive automated texts from your business. Every auto-text to that list is a potential violation.
A 200-contact blast at $500 per message: $100,000 in potential liability from a single campaign. That's not theory. Manual, one-by-one texts you personally type and send from your phone generally don't require prior express written consent (the TCPA specifically targets autodialed calls and texts). But if your CRM is doing the sending, it's automated, regardless of whether you typed the words.
The math: 200 purchased-list contacts x $500 minimum fine = $100,000 exposure. One campaign. One afternoon. The manual text workaround isn't convenient, but it's the only safe path for cold outreach.
What 10DLC Enforcement Means for Your Campaigns Next Year
TCPA compliance is not just about avoiding lawsuits. Carrier-level enforcement is creating a second layer of consequences that hits agent texting even without a legal complaint. 10DLC registration is now the standard for business texting, and unregistered campaigns face filtering, throttling, and outright blocking by major carriers (GoPiperGo, 2026).
Carriers are filtering A2P traffic more aggressively each quarter. If your CRM provider has not registered your texting campaigns with AT&T, Verizon, and T-Mobile's 10DLC system, your texts may not reach contacts at all. Your speed-to-lead advantage disappears, your drip sequences go silent, and your lead response times stretch from minutes to never.
Ask your CRM provider three questions before Q4:
- Is our account 10DLC registered?
- Which carrier networks are we registered on?
- What is our current message throughput limit?
If they can't answer clearly, your text campaigns are running on borrowed time. Agents building their marketing stack for Q4 should treat 10DLC verification as a prerequisite, not an afterthought.
Robin Take: If you're paying for a CRM texting plan and your messages aren't getting delivered, 10DLC registration is the first thing to check. Blocked texts don't generate error messages. They just vanish.
The 5-Step TCPA Audit for Your CRM
This audit takes 30 to 60 minutes. Do it once, build it into your team's onboarding, and you'll have covered the gaps that create the most liability. Every step maps to a specific rule change from the past 18 months.
When to run this: Before any Q4 campaign launch. Before onboarding a new agent to your CRM. After switching CRM providers. After buying a new lead list. If you haven't done it yet, today works.
Step 1: Verify Consent Records for Every Active Sequence
Pull your active drip sequences and auto-text campaigns. For each one, confirm you have documentation showing when and how each contact opted in. The consent must be affirmative, not pre-checked. If you cannot produce a consent record for a given contact, remove them from automated sequences immediately. Keep consent records tied to the contact in your CRM notes, not in a separate spreadsheet that gets lost.
Step 2: Build a Cross-Platform Revocation Process
Create a shared document, Slack channel, or CRM tag system where anyone on your team can log a revocation, regardless of which channel it came through. Email, DM, phone call, in-person request. When a revocation is logged, the contact must be removed from all automated sequences within 10 business days. Assign one person to check the log daily and action removals.
Step 3: Separate Purchased Lists from Opt-In Contacts
Never run purchased lists (expireds, FSBOs, cold data) through automated CRM texting. If you work those lists, text each contact manually and one at a time from your personal device. Or route them through a calling workflow where you establish consent verbally before adding them to automated follow-up. The liability difference between a manual text and an automated one is the difference between a conversation and a violation.
Step 4: Confirm 10DLC Registration
Email your CRM's support team and ask for written confirmation that your account's texting campaigns are 10DLC registered. Request the campaign ID and the list of carriers covered. If registration is missing or incomplete, push for immediate setup or pause automated texting until it is resolved. Most major real estate CRMs handle 10DLC registration, but some smaller platforms or add-on texting tools may not.
Step 5: Test Your Opt-Out Mechanism
Send yourself a text from your CRM's automated system. Reply "STOP." Confirm the removal is immediate. Then test with a non-standard phrase: "please take me off this list." Check whether that also triggers removal. If only "STOP" works, you have a gap that the April 2025 revocation rule makes actionable. Document the test and share results with your team.
Frequently Asked Questions
Can I text leads from Zillow or Realtor.com without extra consent?
It depends on the consent language in the lead capture form. If the form clearly disclosed that the consumer agrees to receive automated texts from your brokerage or team, not just "marketing partners," that consent may hold. The 11th Circuit's January 2025 ruling made broader consent language legal, but the disclosure still needs to be clear and conspicuous. Review the actual form language with your lead provider before assuming coverage.
Does the TCPA apply to texts I type and send manually?
If you personally type and send each text from your phone without using an autodialer or CRM automation, the prior express written consent requirement generally does not apply. You still need to honor revocation requests and comply with Do Not Call rules. The key distinction: if your CRM's texting feature sends the message through an automated system (and most do), it is regulated even if you typed the content yourself.
What is 10DLC and do I need it?
10DLC (10-Digit Long Code) is a carrier-registered system for business texting. AT&T, Verizon, and T-Mobile require businesses to register texting campaigns through 10DLC to prevent spam. If your CRM sends texts through an automated platform, 10DLC registration is required. Without it, your messages may be filtered or blocked. Most major CRM providers handle this registration, but you should confirm with yours in writing.
My CRM catches opt-outs automatically. Am I covered?
Your CRM catches opt-outs within its own texting channel. If someone replies "STOP" to a text, the CRM processes the removal. But the April 2025 FCC rule says revocation on any platform counts. An email, a DM, a phone call saying "remove me" are all valid revocations. Your CRM will not catch those. You need a manual process to log and action cross-platform revocations within 10 business days.
Your texting workflow should protect your business, not expose it. If your CRM leaves compliance gaps in consent tracking or opt-out handling, see how RobinFlow handles compliant lead management.