A working field guide for medspa owners, growth heads and agency practice leads who run SMS programmes on 10-digit long codes, short codes and toll-free numbers. Written against the Telephone Consumer Protection Act, the 2024 Federal Communications Commission rulemakings on one-to-one consent and revocation, and the enforcement patterns established across two decades of TCPA private litigation and class-action settlements in the aesthetic and cosmetic-medicine vertical.
Primary Care · North Dallas, TXCase study →
MedSpa · North Dallas, TX
Skin Care · Beverly Hills, CA
Dental · Christiansburg, VACase study →
Pediatrics · Blacksburg, VACase study →
Pediatric Dentistry · Blacksburg, VACase study →
Dental · Roanoke, VACase study →
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
The Telephone Consumer Protection Act of 1991 was written before commercial SMS existed. Congress and the FCC have spent the better part of thirty years extending it to text messages through a chain of declaratory rulings — most importantly the 2003 FCC order that classified SMS to a wireless number as a "call" under section 227, and the Supreme Court's 2021 Facebook v. Duguid decision that narrowed the definition of an automatic telephone dialling system but left the broader statutory framework intact. For a medspa marketing operator, the practical outcome is that every commercial SMS you send is subject to the TCPA even though the statute never uses the word "text."
The two operative sections for a medspa SMS programme are 47 USC 227(b), which restricts calls and texts made using an automatic telephone dialling system, an artificial voice, or a prerecorded voice, and 47 USC 227(c), which authorises the Do Not Call registry and the residential-telemarketing rules that flow from it. A well-run programme satisfies both — not one or the other. Confusing 227(b) consent with 227(c) DNC compliance is the single most common structural error in aesthetic-vertical TCPA claims.
The FCC's 2012 order raised the consent standard for telemarketing calls and texts from prior express consent to prior express written consent. The written consent must be a written agreement bearing the signature (electronic signatures under E-SIGN qualify) of the person called or texted, identifying the specific seller who may make the calls or texts, and containing a clear and conspicuous disclosure that the person is not required to sign as a condition of purchasing any property, goods or services. Buried terms in a booking form, a pre-checked box, or a scroll-past ToS line do not satisfy this. Aesthetic-vertical plaintiffs' firms have built entire practice areas on exactly this failure mode.
In December 2023 the FCC adopted an order — FCC 23-107 — that closes what the Commission called the lead-generator loophole. Under the old regime, a single web form could obtain the consumer's consent to be contacted by "our marketing partners" and then sell that consent onward to hundreds or thousands of sellers, each of whom could then treat the shared submission as valid prior express written consent for TCPA-restricted outreach. The FCC concluded that this practice does not meet the "clear and conspicuous" bar and does not identify a specific seller as the statute requires.
The remedy, phased in through 2024 and 2025 (effective January 27 2025 for the one-to-one provisions before an eleventh-circuit ruling further shaped the timeline), is a rule that consent must be to receive calls or texts from a single seller — one form, one seller, one consent — and only on topics logically and topically associated with the interaction that prompted the consent. A medspa cannot rely on a submission harvested by a comparison-shopping affiliate to text an unrelated laser service the consumer never enquired about.
A medspa lead who consented to be contacted about laser hair removal has not consented to be contacted about weight-loss injectables, membership plans, aesthetic dermatology or a partner clinic's cosmetic dentistry offer. Topical drift is the second-most-common failure mode after shared consent. Segmentation logic in the CRM should tag each consent with the specific service line it authorises and enforce that at send-time — not rely on marketer judgement.
The companion order — FCC 24-24, adopted February 15 2024 — codifies a rule that recipients may revoke prior express consent through any reasonable means. The core revocation provisions became effective April 11 2025. Callers must treat the revocation as effective as soon as they reasonably can, and in no case later than 10 business days from the request. The order also settled a long-running circuit split by adopting the recipient-favourable reading that consent revocation extends to all future calls and texts on that topic from that caller, not only to messages of the exact same medium or campaign.
The 10-business-day maximum is not a target — it is a ceiling. The safe operational rule is that STOP replies suppress within seconds through the SMS platform's native STOP handler, other channels flow into the CRM within one business day, and a nightly suppression sync ensures no queued campaign can send to a revoked record.
47 CFR 64.1200(c)(1) prohibits telephone solicitations to residential telephone subscribers before 8AM or after 9PM in the recipient's local time. The rule applies to SMS to wireless numbers by extension of the 2003 declaratory ruling and has been enforced in text-message class actions. The two failure modes are (a) a national medspa chain scheduling a 7:30AM Eastern send that reaches West Coast recipients at 4:30AM, and (b) a boutique medspa scheduling an "end of day" send at 9:30PM local that violates the ceiling on its own home turf.
The FCC counts quiet-hour violations on a per-message basis. A single mis-scheduled campaign of 40,000 messages sent one hour after the local ceiling is not one violation — it is potentially 40,000 violations. Statutory damages at USD 500 per violation, before any wilfulness enhancement, produce a face-value exposure of USD 20 million on a single campaign of that size.
Every credible aesthetic-vertical SMS platform — including HIPAA-safe options that medspas use for combined appointment and marketing traffic — supports per-recipient time-zone gating. Turning that gate on is a one-time configuration, not a per-campaign decision. The area code is not a reliable time-zone proxy for a mobile number; the correct field is the recipient's stated residence time zone captured at consent, or a downstream lookup keyed on ZIP code or self-selected timezone.
The FCC has repeatedly recognised that appointment reminders, prescription refill notifications, and other purely informational communications occupy a different regulatory posture from marketing under the TCPA. The 2015 healthcare declaratory ruling (FCC 15-72) carved out a narrow exemption for certain healthcare messages, though its interaction with the 2013 HIPAA Omnibus Rule and the 2024 rulemakings has evolved. For a medspa the practical distinction is content, not intent.
The third example is the trap. Adding a single promotional line to an otherwise informational reminder converts the entire message to marketing under the FCC's treatment. The correct architecture is two templates, two send-time gates, two consent scopes — never a single template that mixes both.
An appointment reminder that discloses treatment type, provider name, or condition is a PHI disclosure under HIPAA. The SMS platform must be under a Business Associate Agreement — HIPAA-safe options include CallRail Healthcare for call and text tracking, PatientEngage, JaneApp, Zenoti and Boulevard for combined booking and reminder traffic, and Retreaver HIPAA for enterprise conversion routing. The intersection matters because a "one platform for everything" decision made by a growth team without compliance review often lands the practice on a consumer SMS platform that will not sign a BAA, forcing either a costly migration or a defensible information-minimisation posture on every send.
Named seller, single seller, clear disclosure that consent is not required for booking. Any older shared-partner text needs to be replaced site-wide, and legacy leads captured under the old copy need to be re-consented or suppressed.
Reply STOP must suppress across every campaign platform in seconds, not days. Multiple intake channels — inbound call, email, website form — must flow into the same canonical suppression table within one business day.
Recipient-local 8AM-9PM enforced at send time. Area-code proxy is not sufficient; capture the timezone at consent or use ZIP-based lookup. State overlays (FL, OK, WA, MD) applied where tighter.
Appointment reminders never carry a promotional line. Two templates, two consent scopes, two send-time gates. Content review at the template layer, not per-campaign, so a well-meaning coordinator cannot mix them.
The TCPA private right of action under 47 USC 227(b)(3) allows a recipient to sue in state or federal court to recover the greater of actual monetary loss or USD 500 per violation. Where the court finds that the violation was knowing or wilful, the court may in its discretion increase the amount up to three times — the widely cited USD 1,500 ceiling. Actual monetary loss is rarely proven; the statutory floor is the operative number.
Every unlawful message is a separate violation. Class actions aggregate. A representative plaintiff who received four unlawful messages does not stand in a USD 2,000 case — she stands in a case that, if certified as a class of everyone in a similarly situated position, may involve hundreds of thousands or millions of messages. The typical enforcement pattern in aesthetic-vertical TCPA cases has been common-fund class settlements in the seven- and eight-figure range, plus injunctive relief that reshapes the defendant's SMS infrastructure for years afterward.
Separately from the private right of action, the FCC can impose civil penalties under 47 USC 503 and forfeitures under 47 USC 227(e) for unlawful spoofing. The 2024 FCC one-to-one order specifically emphasised that the Commission will use its enforcement bureau to pursue lead-generator abuse. A medspa insulated from private class exposure by a robust arbitration clause is not insulated from an FCC forfeiture on the same underlying conduct.
The TCPA federal statute of limitations is four years under 28 USC 1658. The practical documentation floor is therefore four years of rolling audit records, per recipient, retained in a form that can be produced under a subpoena without prompting a spoliation motion. The minimum record set for each opt-in is:
Store the full record set inside the medspa's CRM or EHR (JaneApp, Nextech, Modernizing Medicine, Zenoti, Boulevard and Aesthetic Record all support versions of this pattern). Do not rely on the SMS platform alone — SMS platforms rotate features and vendors change; the practice needs a durable record independent of any one dependency.
A defensible medspa outreach programme lives inside a federal-plus-state compliance envelope. Every SMS decision is scored against six overlapping rule sets — miss any one and the programme is exposed on the axis you did not check.
Patients praise the care almost without exception. The one area where complaints outnumber praise is booking and communication, and that is where most med spas can win.
Full study · 555 US med spas across 20 metros · roughly ±4% nationally · review velocity and themes from a 115-spa subsample · verified against raw data.
Every TCPA-scoped medspa engagement is reviewed by a senior member of the Leadership Team with direct experience of the 2024 FCC rulemakings, aesthetic-vertical class litigation patterns, and the intersection with state medical board advertising codes.
ICG's results are reproducible because they are built on proprietary infrastructure — not agency intuition or generic tools. These nine HealthApex OS platforms are what power every ICG engagement.
WhatsApp AI Lead Qualifier
An AI assistant that holds a short WhatsApp conversation with every enquiry, decides whether it fits your criteria, and posts qualified leads to your CRM labelled Qualified. Team inbox, campaigns and consent handling included. $40/mo for US practices.
CRM Intelligence & Lead-Ops MIS
Sits as the business intelligence layer above your CRM — AtomCRM or any other CRM you run, including custom builds. Shows where leads are leaking, which effort is wasted, and which good leads were quietly downgraded by automation — not by a human decision.
Attribution Engine & CAPI Middleware
Sits at the centre of every ICG attribution architecture. CAPI middleware connecting Meta Ads, Google Ads, WhatsApp and IVR to your CRM. Lifts Event Match Quality from 2.5 to 6+, reducing CPM 30–40% from the same budget.
PMS with built-in revenue intelligence layer
A PMS built to track cross-sell and up-sell opportunities within your existing patient base. 12 modules covering OPD, IPD, Pharmacy, Labs, Billing, Inventory, Patient Portal, Smart Scheduling, RBAC, AES-256 encrypted storage.
Revenue intelligence built over your existing PMS
If you already have a PMS, whichever one it is, Phoenix builds the business intelligence layer on top of it without replacement. Built for single clinics and multi-centre chains alike.
YouTube analytics that measures patients, not views
A YouTube intelligence platform built for healthcare business outcomes. Connects video performance to actual consultation bookings — not views, not subscribers. Patient testimonial videos generate 6.9× more consultations per view than condition explainers.
Full transparency. Instant diagnosis. Zero surprises.
ICG's centralised governance platform — every client sees everything in real time, and ICG's team sees every problem the moment it surfaces. 30+ real-time alert systems fire the moment a metric drifts outside its performance envelope.
AI Overview + LLM citation tracking, healthcare-tuned
Knows the moment ChatGPT, Perplexity, Google AI Overviews and Gemini cite your brand in patient answers — and which content drove the citation. Bot-aware dashboard with GA4-registered custom dims (AIO source, AIO referrer) and IndexNow + GSC API integration.
Every Meta + Google ad your competitors run, watched daily
Tracks 75+ Indian healthcare brands, 2,150+ active ads, ₹50Cr+ aggregate ad spend visibility per month. Surfaces what's working, what's been killed, what offers are emerging. Powers every ICG Meta Ads brief, Performance Marketing diagnostic, and IVF / derm / dental specialty campaign with real competitive intelligence.
Every Google Business Profile scored, tracked, protected, and grown from one command centre
ICG's proprietary Google Business Profile intelligence platform. Scores every listing across 7 dimensions, tracks rank on a live geo-grid across your actual service area, audits NAP + citations, monitors 531 suspension-risk factors continuously, and drafts Google Posts on cadence. Currently managing 143 healthcare listings with 0 suspensions and 4.76★ portfolio average across 28,137 reviews.
Every ICG engagement runs on some combination of these ten HealthApex OS tools. The diagnostic determines which combination is right for your practice.
Explore HealthApex OS → See the full stack live on your account — free 30-min audit →In December 2023 the FCC closed the lead-generator loophole under the TCPA. Prior express written consent must now identify a single, clearly identified seller — one form, one seller, one consent. Bulk-consent flows that authorise dozens of sellers at once no longer meet the standard for medspa call or text outreach.
FCC 24-24 was adopted February 15 2024, with core revocation provisions effective April 11 2025. Callers must honour opt-out through any reasonable method — reply STOP, inbound call, email, website form, in-person — within a maximum of 10 business days.
Yes. Under 47 CFR 64.1200(c) telephone solicitations to residential lines cannot be initiated before 8AM or after 9PM in the recipient's local time. The rule extends to SMS by declaratory ruling. Post-consent messages are not automatically exempt; the safe posture is a hard time-zone gate at send.
An appointment reminder that is strictly about a scheduled visit is treated as informational. The moment the same message adds a promotion, package or rebooking offer, it becomes marketing and prior express written consent applies.
USD 500 per violation under 47 USC 227(b)(3), or actual monetary loss if greater. Knowing or wilful violations may be trebled to USD 1,500. Each unlawful message is a separate violation and class actions aggregate rapidly.
Prior express written consent is a defence to a DNC claim for the specific named seller. It does not survive revocation, does not extend to other sellers, and does not authorise messages outside the topical scope of the original consent.
The federal statute of limitations is four years under 28 USC 1658, so a four-year rolling audit log is the practical minimum. Capture the verbatim consent copy shown at opt-in, timestamp, channel, named seller and topical scope.
Under the 2012 SoundBite declaratory ruling, a one-time confirmation that contains no promotional content and is sent within five minutes of STOP is not a new marketing message and does not violate the TCPA.
US carriers require every A2P sender on a 10-digit long code to be brand-registered and campaign-registered through The Campaign Registry. Unregistered traffic is filtered and pass-through fees apply. Registration is a carrier requirement, not a TCPA rule.
Yes — with a HIPAA-safe provider that will sign a BAA (CallRail Healthcare, Retreaver HIPAA), a named-seller consent that identifies the medspa (not the number provider), and the same TCPA gates that apply to any other originating number.
Book a 30-minute call with a senior member of the Leadership Team, email the US practice lead, or call the Dallas office. Retainers are custom-scoped per engagement · from USD 250 per month equivalent, with SMS compliance audits priced on scope.
A representative slice of the 150+ healthcare brands ICG has delivered for across India. Full client list available under NDA during a Brand and Growth Diagnostic.
Our US team will reach out within one business day. For a faster reply, WhatsApp us or call +1 (724) 612-3694.
💬 WhatsApp Us
Director, Ichelon Consulting US. Book a free 30-minute diagnostic and we'll show you what we'd fix first for your practice.
Book a free diagnostic → WhatsApp Us
