Medspa TCPA SMS compliance — the 2024 FCC update, revocation of consent, quiet hours and statutory damages
A working field guide for medspa owners, growth heads and agency practice leads who run SMS programs on 10-digit long codes, short codes and toll-free numbers. Written against the Telephone Consumer Protection Act, the Federal Communications Commission's 2024 revocation-of-consent order (and the 2023 one-to-one consent rule the Eleventh Circuit vacated in January 2025), and the enforcement patterns established across two decades of TCPA private litigation and class-action settlements in the aesthetic and cosmetic-medicine vertical.
- The TCPA at 47 USC 227 restricts calls and texts placed using an automatic telephone dialling system or an artificial or prerecorded voice, and separately restricts telephone solicitations to residential lines and Do Not Call registered numbers. SMS from any commercial medspa platform is squarely inside scope.
- The FCC's 2023 one-to-one consent rule would have required consent to name a single seller, but the Eleventh Circuit vacated it on January 24, 2025, before it took effect. Prior express written consent still has to be specific and documented, and a single, clearly identified seller on the consent form remains the safest practice. A vague "our marketing partners" consent is weak evidence in litigation.
- The FCC's February 2024 revocation-of-consent order requires that any reasonable method of opt-out be honored — reply STOP, inbound call, email, website form, in-person — within 10 business days (in effect since April 11, 2025). Silence, buried terms, or a "reply UNSUBSCRIBE only" narrow channel are not compliant.
- Statutory damages are USD 500 per violation, trebled to USD 1,500 for knowing or willful violations. Every unlawful message is a separate violation. Class-action settlements in aesthetic-vertical TCPA cases have typical enforcement patterns of seven- and eight-figure common funds plus injunctive relief.
- The defensible posture is: named-seller prior express written consent, 8AM-9PM local quiet hours, honor STOP within seconds not days, appointment reminder templates strictly separated from promotional templates, and a four-year rolling consent audit log.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
What the TCPA actually covers — and why SMS is not a lighter version of a phone call
The Telephone Consumer Protection Act of 1991 was written before commercial SMS existed. Congress and the FCC have spent the better part of thirty years extending it to text messages through a chain of declaratory rulings — most importantly the 2003 FCC order that classified SMS to a wireless number as a "call" under section 227, and the Supreme Court's 2021 Facebook v. Duguid decision that narrowed the definition of an automatic telephone dialling system but left the broader statutory framework intact. For a medspa marketing operator, the practical outcome is that every commercial SMS you send is subject to the TCPA even though the statute never uses the word "text."
The two operative sections for a medspa SMS program are 47 USC 227(b), which restricts calls and texts made using an automatic telephone dialling system, an artificial voice, or a prerecorded voice, and 47 USC 227(c), which authorizes the Do Not Call registry and the residential-telemarketing rules that flow from it. A well-run program satisfies both — not one or the other. Confusing 227(b) consent with 227(c) DNC compliance is the single most common structural error in aesthetic-vertical TCPA claims.
Prior express written consent — the 2012 uplift that never went away
The FCC's 2012 order raised the consent standard for telemarketing calls and texts from prior express consent to prior express written consent. The written consent must be a written agreement bearing the signature (electronic signatures under E-SIGN qualify) of the person called or texted, identifying the specific seller who may make the calls or texts, and containing a clear and conspicuous disclosure that the person is not required to sign as a condition of purchasing any property, goods or services. Buried terms in a booking form, a pre-checked box, or a scroll-past ToS line do not satisfy this. Aesthetic-vertical plaintiffs' firms have built entire practice areas on exactly this failure mode.
One-to-one consent — the vacated lead-generator rule
In December 2023 the FCC adopted an order — FCC 23-107 — aimed at what the Commission called the lead-generator loophole. Under the old regime, a single web form could obtain the consumer's consent to be contacted by "our marketing partners" and then sell that consent onward to hundreds or thousands of sellers, each of whom could then treat the shared submission as valid prior express written consent for TCPA-restricted outreach. The FCC concluded that this practice did not meet the "clear and conspicuous" bar.
The rule would have required consent to be given to a single seller — one form, one seller, one consent — and limited calls and texts to topics "logically and topically associated" with the interaction that prompted the consent. It was due to take effect January 27, 2025. On January 24, 2025, the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, holding that both requirements went beyond the statute's ordinary meaning of prior express written consent. The FCC then restored the earlier text of 47 CFR 64.1200(f)(9) in an order (DA 25-621) effective August 29, 2025. The one-to-one rule is not current law.
That does not make shared-partner consent safe. Prior express written consent still has to be a signed (including e-signed) written agreement, clear and conspicuous, that authorizes marketing calls or texts to a specific number, and the medspa has to be able to prove it. A submission harvested by a comparison-shopping affiliate that never mentions the medspa by name is hard to defend, and many practices keep single-seller consent as a best practice.
Topical relevance — still a sound practice
The vacated rule's "logically and topically associated" test is not binding, but it is still good practice. A medspa lead who consented to be contacted about laser hair removal has not consented to be contacted about weight-loss injectables, membership plans, aesthetic dermatology or a partner clinic's cosmetic dentistry offer. Topical drift is the second-most-common failure mode after shared consent. Segmentation logic in the CRM should tag each consent with the specific service line it authorizes and enforce that at send-time — not rely on marketer judgment.
Any reasonable method — the February 2024 revocation order
The companion order — FCC 24-24, adopted February 15 2024 — codifies a rule that recipients may revoke prior express consent through any reasonable means. The core revocation provisions became effective April 11 2025. Callers must treat the revocation as effective as soon as they reasonably can, and in no case later than 10 business days from the request. The order also requires a revocation to apply to all future robocalls and robotexts from that caller on unrelated matters, but the FCC has delayed that "revoke-all" piece: first to April 11, 2026 (DA 25-312), then to January 31, 2027 (DA 26-12), while it reviews a further rulemaking that may change it.
Reasonable methods a medspa must accept
- Reply STOP, END, QUIT, CANCEL, UNSUBSCRIBE, REVOKE or OPT-OUT to the originating short code, toll-free number or 10DLC number.
- An inbound voice call to any phone number the medspa uses in commerce — including a listed booking line, a Google Business Profile phone number, or a call-tracking DID.
- An email to any address listed in the medspa's privacy notice, contact page, or footer.
- A website form submission on any generic contact form or a dedicated preferences center.
- A verbal or written request made in person during a treatment visit.
The 10-business-day maximum is not a target — it is a ceiling. The safe operational rule is that STOP replies suppress within seconds through the SMS platform's native STOP handler, other channels flow into the CRM within one business day, and a nightly suppression sync ensures no queued campaign can send to a revoked record.
8AM to 9PM local — the rule marketing teams routinely break
47 CFR 64.1200(c)(1) prohibits telephone solicitations to residential telephone subscribers before 8AM or after 9PM in the recipient's local time. The rule applies to SMS to wireless numbers by extension of the 2003 declaratory ruling and has been enforced in text-message class actions. The two failure modes are (a) a national medspa chain scheduling a 7:30AM Eastern send that reaches West Coast recipients at 4:30AM, and (b) a boutique medspa scheduling an "end of day" send at 9:30PM local that violates the ceiling on its own home turf.
The FCC counts quiet-hour violations on a per-message basis. A single mis-scheduled campaign of 40,000 messages sent one hour after the local ceiling is not one violation — it is potentially 40,000 violations. Statutory damages at USD 500 per violation, before any wilfulness enhancement, produce a face-value exposure of USD 20 million on a single campaign of that size.
Time-zone logic in the campaign platform
Every credible aesthetic-vertical SMS platform — including HIPAA-safe options that medspas use for combined appointment and marketing traffic — supports per-recipient time-zone gating. Turning that gate on is a one-time configuration, not a per-campaign decision. The area code is not a reliable time-zone proxy for a mobile number; the correct field is the recipient's stated residence time zone captured at consent, or a downstream lookup keyed on ZIP code or self-selected timezone.
Appointment reminder vs marketing — where informational content crosses the line
The FCC has repeatedly recognized that appointment reminders, prescription refill notifications, and other purely informational communications occupy a different regulatory posture from marketing under the TCPA. The 2015 healthcare declaratory ruling (FCC 15-72) carved out a narrow exemption for certain healthcare messages, though its interaction with the 2013 HIPAA Omnibus Rule and the 2024 rulemakings has evolved. For a medspa the practical distinction is content, not intent.
- Informational (no PEWC required, still subject to consent-in-fact and STOP). "Reminder: your Botox follow-up with Dr. Patel is tomorrow at 2:15 PM at our Uptown Dallas location. Reply C to confirm or R to reschedule."
- Marketing (PEWC required). "It's been three months since your last visit — 20% off your next filler treatment this week. Reply BOOK to schedule."
- Marketing (PEWC required). "Reminder: your Botox follow-up with Dr. Patel is tomorrow at 2:15 PM. Ask about our new membership plan when you check in."
The third example is the trap. Adding a single promotional line to an otherwise informational reminder converts the entire message to marketing under the FCC's treatment. The correct architecture is two templates, two send-time gates, two consent scopes — never a single template that mixes both.
Where HIPAA and TCPA intersect
An appointment reminder that discloses treatment type, provider name, or condition is a PHI disclosure under HIPAA. The SMS platform must be under a Business Associate Agreement — HIPAA-safe options include CallRail Healthcare for call and text tracking, PatientEngage, JaneApp, Zenoti and Boulevard for combined booking and reminder traffic, and Retreaver HIPAA for enterprise conversion routing. The intersection matters because a "one platform for everything" decision made by a growth team without compliance review often lands the practice on a consumer SMS platform that will not sign a BAA, forcing either a costly migration or a defensible information-minimization posture on every send.
The four highest-risk surfaces on a medspa SMS program
1. Lead-form consent copy
Named seller, single seller, clear disclosure that consent is not required for booking. The one-to-one rule was vacated, but as a best practice any older shared-partner text should be replaced site-wide, and legacy leads captured under the old copy re-consented or suppressed.
2. STOP handling latency
Reply STOP must suppress across every campaign platform in seconds, not days. Multiple intake channels — inbound call, email, website form — must flow into the same canonical suppression table within one business day.
3. Time-zone gate on campaign send
Recipient-local 8AM-9PM enforced at send time. Area-code proxy is not sufficient; capture the timezone at consent or use ZIP-based lookup. State overlays (FL, OK, WA, MD) applied where tighter.
4. Informational vs marketing separation
Appointment reminders never carry a promotional line. Two templates, two consent scopes, two send-time gates. Content review at the template layer, not per-campaign, so a well-meaning coordinator cannot mix them.
What we found when we studied 555 US med spas on Google
Patients praise the care almost without exception. The one area where complaints outnumber praise is booking and communication, and that is where most med spas can win.
Full study · 555 US med spas across 20 metros · roughly ±4% nationally · review velocity and themes from a 115-spa subsample · verified against raw data.
USD 500 to USD 1,500 per message — how the arithmetic actually runs
The TCPA private right of action under 47 USC 227(b)(3) allows a recipient to sue in state or federal court to recover the greater of actual monetary loss or USD 500 per violation. Where the court finds that the violation was knowing or willful, the court may in its discretion increase the amount up to three times — the widely cited USD 1,500 ceiling. Actual monetary loss is rarely proven; the statutory floor is the operative number.
Every unlawful message is a separate violation. Class actions aggregate. A representative plaintiff who received four unlawful messages does not stand in a USD 2,000 case — she stands in a case that, if certified as a class of everyone in a similarly situated position, may involve hundreds of thousands or millions of messages. The typical enforcement pattern in aesthetic-vertical TCPA cases has been common-fund class settlements in the seven- and eight-figure range, plus injunctive relief that reshapes the defendant's SMS infrastructure for years afterward.
FCC enforcement in parallel
Separately from the private right of action, the FCC can impose civil penalties under 47 USC 503 and forfeitures under 47 USC 227(e) for unlawful spoofing. The FCC has repeatedly signaled that lead-generator abuse is an enforcement priority, even after the court vacated its one-to-one consent rule. A medspa insulated from private class exposure by a robust arbitration clause is not insulated from an FCC forfeiture on the same underlying conduct.
The four-year consent audit log — what to capture and why
The TCPA federal statute of limitations is four years under 28 USC 1658. The practical documentation floor is therefore four years of rolling audit records, per recipient, retained in a form that can be produced under a subpoena without prompting a spoliation motion. The minimum record set for each opt-in is:
- Exact, verbatim consent copy displayed at the time of opt-in — not the current version of the copy, but the historical version the recipient actually saw. A screenshot or a versioned HTML archive is the standard evidence.
- Timestamp with time zone.
- Channel and identifier — website form URL, in-clinic tablet form ID, verbal consent captured in the EHR by staff member name.
- IP address if web-collected. Device information optional.
- Named seller listed in the consent copy.
- Topical scope authorized (which service lines, membership tier, offer categories).
- Every subsequent revocation event with channel, timestamp, and the campaign or list from which the record was suppressed.
Store the full record set inside the medspa's CRM or EHR (JaneApp, Nextech, Modernizing Medicine, Zenoti, Boulevard and Aesthetic Record all support versions of this pattern). Do not rely on the SMS platform alone — SMS platforms rotate features and vendors change; the practice needs a durable record independent of any one dependency.
Where TCPA sits in the medspa marketing stack
A defensible medspa outreach program lives inside a federal-plus-state compliance envelope. Every SMS decision is scored against six overlapping rule sets — miss any one and the program is exposed on the axis you did not check.
Backed by Ichelon Consulting US leadership
Every TCPA-scoped medspa engagement is reviewed by a senior member of the Leadership Team with direct experience of the 2024 FCC rulemakings, aesthetic-vertical class litigation patterns, and the intersection with state medical board advertising codes.
Our own tools run inside every engagement
Ichelon Consulting US uses software built by our own product team. Practices can also use most tools on their own, billed in USD.
Medspa TCPA SMS — common questions
Is the FCC one-to-one consent rule in effect?
No. The FCC's 2023 one-to-one consent rule (FCC 23-107) would have required consent to name a single seller, but the Eleventh Circuit vacated it on January 24, 2025, in Insurance Marketing Coalition v. FCC, before its January 27, 2025 effective date. The FCC restored the prior text of 47 CFR 64.1200(f)(9) in an order effective August 29, 2025. Prior express written consent still has to be signed, clear and conspicuous, and documented, and many medspas keep single-seller consent as a best practice.
When did the FCC revocation-of-consent rule take effect?
FCC 24-24 was adopted February 15 2024, with core revocation provisions effective April 11 2025. Callers must honor opt-out through any reasonable method — reply STOP, inbound call, email, website form, in-person — within a maximum of 10 business days. The separate requirement to apply one opt-out to all future robocalls and robotexts on unrelated matters has been delayed by the FCC, most recently to January 31, 2027.
Do TCPA quiet hours apply to medspa marketing texts?
Yes. Under 47 CFR 64.1200(c) telephone solicitations to residential lines cannot be initiated before 8AM or after 9PM in the recipient's local time. The rule extends to SMS by declaratory ruling. Post-consent messages are not automatically exempt; the safe posture is a hard time-zone gate at send.
Is an appointment reminder text a marketing message?
An appointment reminder that is strictly about a scheduled visit is treated as informational. The moment the same message adds a promotion, package or rebooking offer, it becomes marketing and prior express written consent applies.
What are TCPA statutory damages per violation?
USD 500 per violation under 47 USC 227(b)(3), or actual monetary loss if greater. Knowing or willful violations may be trebled to USD 1,500. Each unlawful message is a separate violation and class actions aggregate rapidly.
Does DNC apply if the recipient has consented to marketing texts?
Prior express written consent is a defense to a DNC claim for the specific named seller. It does not survive revocation, does not extend to other sellers, and does not authorize messages outside the topical scope of the original consent.
How long must consent records be retained?
The federal statute of limitations is four years under 28 USC 1658, so a four-year rolling audit log is the practical minimum. Capture the verbatim consent copy shown at opt-in, timestamp, channel, named seller and topical scope.
Is a STOP-confirmation autoresponder itself a violation?
Under the 2012 SoundBite declaratory ruling, a one-time confirmation that contains no promotional content and is sent within five minutes of STOP is not a new marketing message and does not violate the TCPA.
Do medspas need to register with 10DLC?
US carriers require every A2P sender on a 10-digit long code to be brand-registered and campaign-registered through The Campaign Registry. Unregistered traffic is filtered and pass-through fees apply. Registration is a carrier requirement, not a TCPA rule.
Can we use a call-tracking number for medspa marketing SMS?
Yes — with a HIPAA-safe provider that will sign a BAA (CallRail Healthcare, Retreaver HIPAA), a named-seller consent that identifies the medspa (not the number provider), and the same TCPA gates that apply to any other originating number.
Scope your TCPA-safe medspa SMS program
Book a 30-minute call with a senior member of the Leadership Team, email the US practice lead, or call the Dallas office. Retainers are custom-scoped per engagement · from $499/month, with SMS compliance audits priced on scope.
Continue the compliance stack
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
More questions answered
Is an autoresponder confirming STOP itself a TCPA violation?
A one-time confirmation text that simply confirms an opt-out has been processed is not treated as a new marketing message under the FCC 2012 SoundBite declaratory ruling, provided it contains no promotional content and is sent within five minutes of the STOP command.
Do medspas need to register their brand and campaigns with 10DLC?
US carriers now require every A2P SMS sender on a 10-digit long code to be brand-registered and campaign-registered through The Campaign Registry (TCR). Unregistered traffic is filtered, deliverability collapses, and carriers assess pass-through fees. Registration is a carrier requirement, not a TCPA rule — but non-registration causes marketing programs to fail silently.