Real estate texting laws by state: the 2026 compliance map

Last verified: August 1, 2026.

Is it legal to cold text property owners? Not safely, and not the way most investors do it. Federal law requires prior express written consent before you send a marketing text with an automatic dialing system, and a skip traced list is not consent. On top of that, eleven states now have their own texting statutes with their own consent rules, message caps and private rights of action. Four of those states cap you at three messages per person per day. Cold outreach can be run in a way that reduces exposure. It cannot be run in a way that eliminates it.

This page is the reference. Federal baseline first, then what actually changed in the last eighteen months, then a row for every state, then the checklist. If you only read one section, read the state table.

The federal baseline

Every state rule stacks on top of the Telephone Consumer Protection Act. Get the federal layer right first, because a state statute never lowers the floor.

Consent

Marketing texts sent with an automatic telephone dialing system require prior express written consent. That means a signed written agreement, electronic signature counts, that clearly authorizes you to send advertising or telemarketing messages to that specific number, includes a clear and conspicuous disclosure, and is not a condition of purchase. A phone number pulled from a county record, a skip trace, or a purchased list carries none of that.

The consent has to be provable by you, not assumed. Courts put the burden on the sender. A checkbox flag in a CRM with no timestamp, no IP address and no copy of the disclosure language is worth very little when someone asks you to produce it. We go deeper on the consent mechanics in our breakdown of whether cold texting is legal.

Do Not Call

National Do Not Call Registry protections extend to text messages. That extension survived the 2025 court ruling that struck down the one-to-one rule, so it is live. Scrub the national registry at least every 31 days. Twelve states also run their own separate registries that you have to scrub in addition, listed in the table below.

You also have to maintain your own internal do-not-call list. Anyone who tells you to stop goes on it permanently, across every campaign and every number you own.

Quiet hours

Send only between 8am and 9pm in the recipient's local time. The recipient's, not yours. Mobile area codes are a bad proxy for where someone lives, since people keep numbers when they move. The practical fix most operators use is to compress the send window to about 9am to 7pm and run it against the property's location rather than the area code. You lose a little coverage and you stop guessing.

Opt-out handling

The FCC's revocation rules took effect on April 11, 2025, and they are stricter than most platforms are configured for. The requirements:

• A consumer may revoke consent in any reasonable manner. You cannot designate one exclusive method and reject everything else.
• STOP, QUIT, END, REVOKE, OPT-OUT, CANCEL and UNSUBSCRIBE are reasonable on their face. So is plain language. A reply of "please don't text me again" is a valid revocation even though your keyword parser will not flag it.
• Revocation must be honored as soon as practicable, and no later than 10 business days after receipt.
• You may send one clarification message, and it must go out within five minutes. It cannot be a save attempt.
• An opt-out in response to an informational message stops both informational and marketing messages. An opt-out in response to a marketing message stops marketing.

The FCC granted a one-year waiver on the piece requiring an opt-out to one type of message to be treated as revoking all types across unrelated business lines. That waiver ran to April 11, 2026 and has now expired, so treat every revocation as broad by default.

Record retention

The TCPA statute of limitations is four years. Keep consent and opt-out records for five as a working default. Store the artifact, not the flag: timestamp, IP address, the exact disclosure text that was displayed, the source URL, and the full message history. Virginia sets a hard number of 10 years for opt-out records as of 2026, which is the longest in the country and a sensible ceiling to design toward.

Damages

Statutory damages are $500 per message, rising to $1,500 per message for willful or knowing violations. There is no aggregate cap. A single campaign to 3,000 numbers is a $1.5 million exposure at the base rate before anyone argues about willfulness. TCPA filings rose roughly 27% in early 2026 against the prior year, according to WebRecon's February 2026 statistics, so the plaintiff bar is expanding, not contracting.

The one-to-one consent rule: what actually happened

This is the fact most compliance content on the internet currently gets wrong, and it matters because the wrong version pushes investors into rebuilding consent flows they do not need to rebuild.

In December 2023 the FCC adopted a rule requiring "one-to-one" consent for marketing calls and texts, aimed at closing what it called the lead generator loophole. Under it, a consumer would have had to consent to one identified seller at a time, and messages would have had to be logically and topically related to the interaction that produced the consent. It was set to take effect January 27, 2025.

You will still find guides, platform help pages and law firm summaries published through 2026 stating that one-to-one consent "goes into effect January 2026." That date traces back to an FCC order postponing the rule pending judicial review, issued days before the court vacated it outright. The postponement was overtaken by the vacatur. There is no January 2026 effective date.

What this means in practice: the pre-existing prior express written consent framework still governs. Shared or multi-seller consent forms are not automatically invalid at the federal level. That is not a green light. It just means the standard is the older, well-litigated one rather than a stricter new one, and that several states have moved to impose their own versions regardless of what the FCC does. The extension of Do Not Call protections to texts was never part of the vacated rule and remains fully in force.

Texting laws by state

Every state gets a row. Where a state has no mini-TCPA, the row says so and the federal baseline applies in full, which is not the same thing as "no rules."

How to read the risk column. The rating assumes cold outreach without prior express written consent. If you have real consent, every state drops at least one level.

• Low is federal exposure only. No state texting statute, no separate state registry. Still $500 per message federally.
• Elevated means a state registry, a solicitor registration regime, or a text-specific restriction sits on top of federal law.
• High means a mini-TCPA with a private right of action and a plaintiff bar that uses it.
• Avoid means all of the above plus message caps, procedural traps, and demonstrated filing volume. Do not run cold campaigns into these states.

The "key extra restriction" column is a pointer to where the exposure sits, not a legal opinion on your specific campaign. Registration requirements and exemptions turn on what you sell, who you contact, and how the contact is initiated, and several of these statutes have real estate or licensee exemptions that may or may not reach a wholesaler. Confirm with counsel per state before you send.

The states that matter most to wholesalers

Texas: SB 140

Texas matters more than any other state to investors, both because of deal volume and because SB 140 is the newest and sharpest statute in the country. Signed June 20, 2025 and effective September 1, 2025, it amends Business and Commerce Code Chapters 301 through 305 and redefines "telephone solicitation" to include text messages, image messages and other transmissions. It applies to anyone texting into Texas, not just Texas businesses.

As originally drafted it required registration with the Texas Secretary of State with a $200 filing fee, a $10,000 surety bond, quarterly updates and annual renewal. Chapter 302 violations run up to $5,000 per violation, and violations are deemed unfair or deceptive acts, which imports a private right of action under the Texas DTPA: $500 to $5,000 per violation, trebled for willful misconduct, with no cap on repeat claims. That last part is what creates the serial litigation exposure.

That is a meaningful change and it is not a free pass. Chapters 304 and 305 remain fully in force. The DTPA linkage is intact. The Texas No-Call list still has to be scrubbed, including the 60-day window after a number is added. And the exemption is keyed to genuine consent, so it does nothing for pretextual consent language bolted onto cold outreach. A First Amendment challenge to SB 140 is pending, so the scope is unsettled and could move again. Cold texting into Texas remains high risk. Our full Texas SB 140 walkthrough covers the three compliant paths in detail.

Florida: SB 1120

Florida is the most litigated texting jurisdiction in the country and the FTSA is why. Three restrictions do the damage. You are capped at 3 messages per recipient per 24 hours. You must include a call-back number that reaches a live human, not a voicemail box and not an IVR tree that dead ends. And there is a 15-day safe harbor after an opt-out request, which is a shorter grace period than it sounds like once you count vendor sync delays.

Florida also runs its own do-not-call registry separate from the national list. The plaintiff bar there is organized and fast. If you are building a national list pull, Florida is the first state to segment out.

Oklahoma: HB 3168

Oklahoma copied Florida's structure closely. Same 3 messages per 24 hours cap, same requirement for a call-back number that reaches a person, and its own state DNC list on top of the national registry. Filing volume started later than Florida's and has been climbing since. Treat Oklahoma exactly the way you treat Florida.

Connecticut: SB 1058

Connecticut requires written consent for all telephonic sales, with no meaningful gray area for manual sending, and penalties reach $20,000 per violation. That per-violation number is forty times the federal statutory floor. Connecticut is a small market for most wholesalers, which makes the cost-benefit obvious: exclude it unless you have documented opt-in.

Washington: HB 1497

Washington folds SMS solicitations into the Consumer Protection Act, and the detail that catches investors is that there is no established-business-relationship exemption for residential contacts. In most states, a prior relationship gives you some cover. In Washington it does not, for residential numbers. Since almost every property owner you contact is a residential number, the exemption you might be relying on elsewhere is simply absent.

Maryland: SB 90

Maryland imposes consent and disclosure requirements on telephonic sales, carries a private right of action, and applies the 3 messages per 24 hours cap. Combined with the Baltimore and DC-adjacent investor density, Maryland produces more claims per capita than its size suggests.

New Jersey: SB 921

New Jersey amended its Telemarketing Act to explicitly cover text messages, with a private right of action and the same 3 per 24 hours cap. New Jersey's consumer protection enforcement has historically been aggressive on per-violation penalties, so a modest campaign compounds quickly.

Compliance checklist for an investor running outreach

This is the operational version. It assumes you are the buyer contacting owners about acquiring property, not a lead broker reselling responses, which is its own separate legal question.

1. Fix the entity and the site first. Real LLC with an EIN, a website with a privacy policy that specifically addresses SMS, terms, a physical address and a working phone number. Everything downstream depends on this.
2. Register A2P 10DLC before you buy the list. Campaign review is slow. See the registration guide for the use case declarations that get investors rejected permanently.
3. Build a consent source. A landing page, a direct mail QR code, a Google form, a driving-for-dollars capture flow. Anything that produces a real timestamped opt-in. This is the difference between a defensible program and an expensive one.
4. Scrub the national DNC every 31 days, plus the twelve separate state registries for any state in your pull.
5. Suppress the Avoid states from cold campaigns: Florida, Oklahoma, Texas. Put Connecticut, Maryland, New Jersey and Washington behind a consent gate.
6. Cap frequency at 2 messages per recipient per 24 hours nationally. The strictest state cap is 3. Running one under it everywhere is simpler than maintaining per-state logic and it removes an entire category of mistake.
7. Set the send window to 9am to 7pm local, keyed to the property location rather than the area code.
8. Rebuild your opt-out parser. Keywords plus natural language plus intent. Test it with "remove me," "wrong number," "stop texting me," "not interested please don't contact again." All four should suppress.
9. Suppress on the first request, every time, across all campaigns and all sending numbers. The 10 business day rule is the outer limit, not the target.
10. Identify yourself in the first message. Business name, and a call-back number that reaches a human. Florida and Oklahoma require it and it improves reply rates everywhere. Our seller text templates are written this way.
11. Never text a number you cannot tie to a record. Skip trace confidence scores matter. Wrong-number texts to unrelated consumers are the most common source of complaints that become claims.
12. Log everything for five years. Full message history, consent artifacts, opt-out events with timestamps, and which list each number came from.
13. Re-verify quarterly. Four states passed or amended texting statutes in the last two years. Assume something changed.

What A2P 10DLC does and does not do

Investors conflate these two layers constantly, and the conflation is expensive in both directions.

Two consequences follow. First, being fully A2P registered proves nothing about consent. A registered sender texting Florida homeowners off a skip traced list has excellent deliverability and full legal exposure at the same time. Second, unregistered traffic on a 10-digit local number does not degrade gracefully to lower volume. It is generally blocked outright, and the failure often shows up as silence in your reply column rather than as visible errors, so people spend weeks blaming their copy.

Toll-free and short code sit under different registration regimes with different vetting, and neither changes the legal analysis either. If you want the deliverability side in depth, including Trust Score throughput tiers and the rejection reasons that end an investor campaign permanently, that is covered in the A2P 10DLC guide. For channel strategy and what actually gets replies once you are compliant, see our real estate SMS marketing breakdown and the campaign case study with real cost-per-deal numbers.

Frequently asked questions

Is it legal to cold text property owners?

Not safely, and not in the way most investors do it. The TCPA requires prior express written consent before you send a marketing text using an automatic telephone dialing system, and a list of skip traced numbers is not consent. Manually dialed, individually typed messages sit in a narrower gray zone that some operators rely on, but that position has never been comfortable and it collapses the moment a CRM or automation is in the loop. The safer model is to generate consent first, then text.

Which states are the most dangerous for cold texting?

Florida, Oklahoma and Texas carry the most exposure. Florida and Oklahoma both cap you at three messages per recipient per 24 hours, require a call-back number that reaches a live person, and have private rights of action that support high volume filings. Texas SB 140 pulls text messages into telephone solicitation law and links violations to the Texas DTPA, where damages can be trebled with no cap on repeat claims. Connecticut, Maryland, New Jersey and Washington are the next tier down.

Did the one-to-one consent rule take effect in 2026?

No. The one-to-one consent rule never took effect at all. The Eleventh Circuit vacated it on January 24, 2025 in Insurance Marketing Coalition Ltd. v. FCC, holding that the FCC exceeded its statutory authority by redefining prior express consent. A lot of published compliance content still says the rule is effective January 2026. That is wrong. The pre-existing prior express written consent framework is what applies, and the extension of National Do Not Call protections to text messages was not affected by the ruling.

What are the TCPA quiet hours for text messages?

You may send between 8am and 9pm in the recipient's local time, not yours. Local time is determined by where the recipient actually is, which for a mobile number is not reliably indicated by the area code. Most investors solve this by narrowing their own send window to roughly 9am to 7pm across all time zones, which stays inside the rule everywhere in the continental US.

How fast do I have to honor an opt-out?

As soon as practicable, and no more than 10 business days after receipt, under the FCC revocation rule that took effect on April 11, 2025. In practice you should suppress the number immediately and automatically. You may send one clarification message, and it has to go out within five minutes. That message cannot try to talk the person out of opting out.

What words count as an opt-out?

More than the keyword list your platform recognizes. The FCC treats stop, quit, end, revoke, opt out, cancel and unsubscribe as reasonable on their face. Consumers may also revoke in plain language, so a reply along the lines of please do not text me again is a valid opt-out even though no keyword appears. You cannot require a consumer to use one exclusive method. If your system only catches STOP, you are missing revocations you are legally required to honor.

Does A2P 10DLC registration make my texting legal?

No. A2P 10DLC is a carrier requirement about whether your messages get delivered. It is not a legal permission to contact anyone. Registration does not create consent, does not exempt you from the Do Not Call registry, and does not satisfy state statutes. Unregistered traffic on a local 10-digit number is generally blocked outright rather than throttled, so you need registration to operate at all, and you separately need a lawful basis to send.

Do I have to register with Texas to send marketing texts?

Probably not, if your consent is genuine. Under a November 2025 settlement, Texas agreed that consent-based marketing texts are exempt from the Chapter 302 registration, bonding and quarterly reporting requirements. That removed the 200 dollar filing fee and the 10,000 dollar surety bond for well-run opt-in programs. It did not repeal anything else. Chapters 304 and 305 remain in force, the DTPA linkage is intact, and the Texas No-Call list still has to be scrubbed. It also does nothing for pretextual consent attached to cold outreach.

What does a TCPA violation cost?

Statutory damages are 500 dollars per message, rising to 1,500 dollars per message for willful or knowing violations, with no aggregate cap. The per-message structure is what makes this dangerous, because a single campaign to a few thousand numbers becomes a seven figure exposure very quickly. State mini-TCPA penalties generally run from 500 to 20,000 dollars per violation on top of that, plus attorney fees.

How long do I need to keep consent and opt-out records?

Plan on five years as a working default, because the TCPA statute of limitations is four years and you want margin. Virginia is the outlier that sets a specific number, requiring opt-out records to be retained for 10 years as of 2026. Keep the consent artifact itself, meaning the timestamp, the IP address, the exact disclosure language that was shown, and the source page, not just a checkbox flag sitting in a database.

The honest summary

Cold texting is not a solved problem and nobody selling you software has solved it either. Federal law wants consent you probably do not have. Eleven states have written their own rules on top, four of them with hard message caps, and the two newest statutes are still being litigated. The trend line is one direction, and filings are up.

What works is narrower and less exciting than a national blast: register properly, exclude the states where the math does not work, build a real consent source so the outreach you do run is defensible, cap frequency under the strictest limit anywhere, and honor opt-outs the moment they arrive in whatever words they arrive in. That is a program you can run for years without a letter showing up.

Sources: Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025); FCC Report and Order and Further Notice of Proposed Rulemaking, CG Docket No. 02-278, FCC 24-24 (Feb. 16, 2024); FCC Order DA 25-312 (Apr. 7, 2025) granting a limited waiver of the universal revocation requirement to April 11, 2026; 47 C.F.R. 64.1200; 47 U.S.C. 227; Texas SB 140, 89th Legislature (enrolled, effective Sept. 1, 2025) amending Tex. Bus. and Com. Code Chs. 301 to 305; Florida SB 1120 (FTSA); Oklahoma HB 3168; Maryland SB 90; New Jersey SB 921; Connecticut SB 1058; Washington HB 1497; Arizona HB 2498; Georgia SB 73; West Virginia HB 4886; New York General Business Law Article 26; state do-not-call program listings for Colorado, Florida, Indiana, Louisiana, Massachusetts, Mississippi, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas and Wyoming; WebRecon monthly consumer litigation statistics (February 2026).