Every local business website has the same form. Name, email, phone, message, a Send button. Someone fills it in asking about a quote. You do the obvious, human thing and text them back to arrange a time.
Under the US Telephone Consumer Protection Act, depending on how that message is sent and what it says, that text may have been unlawful. Not in a technical, nobody-enforces-it way — the TCPA is among the most heavily litigated consumer statutes in the country, and it carries statutory damages that do not require the recipient to prove they were harmed.
This is the single most common defect we find on local business websites, and it is almost always because the person who built the form never considered it.
What the law actually asks for
The TCPA restricts calls and texts made using an automated telephone dialing system or an artificial or prerecorded voice, and it restricts telemarketing messages specifically. Where a message is marketing rather than a purely transactional reply, the standard is prior express written consent.
“Written” is less demanding than it sounds — the E-SIGN Act means a checkbox on a web form counts as a signature. But the consent has to have particular properties, and this is where forms fail:
- It must be a separate, affirmative act. A checkbox the visitor ticks. Submitting the form is not consent to be texted, because the visitor was doing something else when they clicked Send.
- It cannot be pre-checked. A pre-ticked box is not an affirmative act. This is settled across the TCPA, the GDPR, and ordinary contract logic.
- It must disclose what is being agreed to — who will contact them, at what number, by what means (calls and texts are different things and should both be named), and that automated technology may be used.
- It cannot be a condition of anything. If the visitor must tick it to submit the form, the consent was not freely given and it is worthless. The box must be optional and the form must work without it.
- It must be conspicuous. Language buried in a terms of service document that nobody opened does not qualify.
Alongside that, the messaging carriers themselves require disclosure of message frequency, a “message and data rates may apply” notice, and clear opt-out instructions — usually STOP. These are carrier requirements rather than statutory ones, but ignoring them gets your number filtered, which is its own kind of expensive.
The number that gets people’s attention
Statutory damages are $500 per violation, and up to $1,500 where the violation is willful or knowing. Per message. Not per campaign, not per person.
A modest follow-up sequence sent to a few hundred leads who never gave written consent is not a small exposure. And because damages are statutory, the plaintiff does not have to demonstrate any actual loss — the violation itself is the claim. There is a substantial plaintiffs’ bar that does nothing else.
Where most forms go wrong
We audit a lot of local business sites. The failure modes are consistent:
No checkbox at all. By far the most common. The form collects a phone number, the business calls and texts leads, and nobody involved has heard of the TCPA.
One checkbox for everything. “I agree to the Privacy Policy and Terms and to be contacted.” Bundling separate permissions makes none of them clearly given. Email consent and phone/SMS consent are different permissions and belong in different boxes.
A required checkbox. The developer marked it required because that is what you do with important fields. This actively destroys the consent, because consent that is a condition of submitting the form is not freely given.
Consent with no record. There was a checkbox, it was correct, and the business kept no record of who ticked it or what it said at the time. In a dispute, the burden of proving consent is on the business. “We had a checkbox on the site” is not evidence, particularly if the wording has been edited since.
What a compliant form looks like
Concretely, on our own contact page:
The phone field is optional and says so. Below the message field there is a fieldset with two separate checkboxes. The first covers email — required, because we cannot answer an enquiry we are not permitted to reply to. The second is the phone one. It is unchecked, it is not required, and it reads:
I agree that SearchScallers may contact me at the phone number provided, including by automated dialing system, prerecorded voice, and SMS text message, about my enquiry and its services. Consent is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help.
That wording is submitted with the form as a hidden field. The server stores it alongside the timestamp, the IP address, the user agent and the page URL, and writes the record to storage that outlives the email.
That last detail is the part that gets skipped and the part that matters most. Storing the verbatim text captures what was actually on screen at the moment of consent, so editing the wording next year cannot retroactively change what someone agreed to in the past. That is the entire evidentiary value of the record.
What to do if your form does not have this
- Stop marketing calls and texts to numbers collected without consent. Replying to a direct enquiry by the channel they contacted you through is a different situation from adding them to a campaign — but if you are unsure which you are doing, you are probably doing the second one.
- Fix the form. Separate, optional, unchecked, with full disclosure language.
- Start keeping records from that day: timestamp, the consent text shown, and identifying details.
- Talk to a lawyer about the existing list. What to do with numbers already collected is a legal judgment, not an engineering one, and it depends on how you have been using them.
Why nobody mentions this
Because it is not anyone’s job. The designer is thinking about layout. The developer is thinking about whether the form submits. The marketer wants the phone number captured with as little friction as possible, and an optional consent checkbox is, from that narrow angle, friction.
The result is that a compliance problem gets built into thousands of small business websites by people who each had a good reason not to be the one thinking about it.
It takes about twenty minutes to do properly. We build it into every site we ship, including this one — go and look at our contact form and you will see the checkbox described above, unticked and optional.
We are software engineers, not lawyers, and this is not legal advice. It is a description of what the regulations require and how we implement them. The TCPA landscape shifts — FCC rulemaking and court decisions have moved several times in recent years — so if you are in a regulated industry or running high-volume outreach, have a licensed attorney in your jurisdiction review your specific setup. Our part is making sure the technical mechanics are correct and the records exist.