TCPA Compliance for Real Estate: 2026 Guide

A single TCPA violation carries a penalty of $500 per message. Willful violations jump to $1,500 per message. A class action suit against a brokerage that sent 10,000 non-compliant texts can result in a $5 million to $15 million judgment. These aren't hypothetical numbers — they're the reason every real estate agent and loan officer who uses text messaging needs to understand TCPA compliance inside and out.

The Telephone Consumer Protection Act has been the primary federal law governing automated calls and text messages since 1991, but the rules have tightened significantly in recent years. The FCC's 2025 one-to-one consent rule changed the game, and 2026 brings additional enforcement priorities that directly affect how real estate professionals communicate with leads. This guide covers what you need to know, what you need to change, and how to build a compliant messaging program from the ground up.

What TCPA Is and Why It Matters for Real Estate

The TCPA restricts how businesses can contact consumers via phone calls, text messages, and fax. For real estate agents and loan officers, the relevant parts boil down to this: you cannot send automated or marketing text messages to someone without their prior express written consent.

The law applies to:

Text messages sent to cell phones (including SMS, MMS, and WhatsApp)
Automated calls using prerecorded voices or autodialers
Calls and texts to numbers on the Do Not Call Registry for marketing purposes

Real estate is a high-risk industry for TCPA violations because agents rely heavily on text messaging to communicate with leads, and the line between a "personal" text and a "marketing" text isn't always clear. Class action attorneys specifically target real estate brokerages and mortgage companies because the volume of texting is high and compliance practices are often weak.

Express Written Consent Requirements

The foundation of TCPA compliance is consent. There are two types that matter:

Prior express consent allows you to send non-marketing, informational messages. This can be implied — if someone gives you their phone number and asks about a listing, you have implied consent to respond to that specific inquiry.

Prior express written consent is required for any marketing or promotional messages. This is a higher bar and must include:

A clear, written agreement (can be electronic)
The specific phone number being consented to
Disclosure that the consumer agrees to receive automated messages
Disclosure that consent is not a condition of purchase
The identity of the business that will be sending messages

A lead filling out a contact form on your website can serve as written consent — but only if the form includes proper disclosure language and the consent is specific to your business. Generic "I agree to receive communications" language buried in terms of service is not sufficient.

The 2025 One-to-One Consent Rule

The FCC's one-to-one consent rule, which took effect in January 2025, eliminated the practice of lead generators selling a single consumer's consent to multiple companies. Under the new rule:

Consent must be given to one specific company, not a group of companies
Lead forms that say "by submitting, you agree to be contacted by our network of partners" are no longer valid consent
Each company that wants to text or call a consumer must obtain its own separate consent

For real estate teams, this means you cannot rely on consent obtained by a lead aggregator or portal that also sells leads to other agents. If you buy leads from a third party, you need to verify that the consent specifically names your brokerage or business.

10DLC Registration

10DLC (10-Digit Long Code) is the registration system that carriers now require for businesses sending SMS messages from standard phone numbers. If you're sending business text messages from a 10-digit number (as opposed to a short code or toll-free number), you must be registered.

What 10DLC Requires

Brand registration: Your business is registered with The Campaign Registry (TCR), which verifies your identity, EIN, and business details.
Campaign registration: Each type of messaging you do (lead follow-up, marketing, appointment reminders) is registered as a separate campaign with a description of the use case and sample messages.
Vetting: Your registration is reviewed and scored. Higher trust scores get higher messaging throughput. Low scores can result in message filtering or blocking.

How to Register

Most messaging platforms (Twilio, OpenPhone, Heymarket, etc.) handle 10DLC registration through their interface. The process typically takes 1–3 weeks and requires:

Your business legal name and EIN (or SSN for sole proprietors)
Your business address and website
A description of your messaging use case
Sample messages for each campaign type
Your opt-in and opt-out mechanisms

If you're not registered, carriers will increasingly filter or block your messages. Unregistered business messaging is being phased out entirely — this isn't optional.

One-to-One vs. Marketing Messages

The TCPA draws a critical distinction between conversational messages and marketing messages. Understanding this distinction keeps you out of trouble.

One-to-one conversational messages are direct responses to a consumer's inquiry. A lead asks about 123 Main Street, and you text them back about that property. A client asks what time their closing is, and you respond. These require only prior express consent (which can be implied by the lead reaching out to you).

Marketing messages are promotional in nature. Texts about new listings, price reductions on properties they didn't ask about, open house invitations to non-clients, market updates, or any message designed to generate business. These require prior express written consent.

Where agents get in trouble:

A lead asks about one listing, and you start texting them about every new listing in the area. That's marketing.
A past client closed a transaction, and you add them to a drip campaign of market updates without re-obtaining consent. That's marketing.
You text your entire database about an open house. Unless every recipient gave written consent to receive marketing messages from you, that's a violation.

The safe approach: treat every message that isn't a direct response to a specific inquiry as marketing, and make sure you have written consent before sending it.

Opt-In Mechanics

Proper opt-in is your legal protection. Here's how to implement it across channels:

Website Forms

Every form that captures a phone number should include consent language directly above (not below) the submit button. Example:

"By submitting this form, you consent to receive text messages from [Your Business Name] at the number provided. Message frequency varies. Message and data rates may apply. Reply STOP to opt out. Consent is not a condition of purchase."

The consent checkbox should be unchecked by default. Pre-checked boxes are not considered valid consent under current FCC interpretation.

Text Keywords

You can use a keyword opt-in system where consumers text a word (like "HOME" or "INFO") to your number to opt in. The response should immediately confirm: "You've subscribed to messages from [Business Name]. Reply STOP to unsubscribe."

Paper Forms

For open houses and in-person events, include a physical consent form with the same disclosure language. The consumer should write their phone number and sign (or initial) the consent. Keep these records — you may need them.

Record Keeping

Maintain records of every consent you obtain: the date, the method (web form, text keyword, paper), the exact language shown to the consumer, and the phone number. If you're ever challenged, the burden of proof is on you to show you had consent.

Opt-Out Requirements

TCPA and carrier regulations require that you honor opt-out requests immediately and completely.

STOP handling: When someone replies STOP (or QUIT, CANCEL, END, UNSUBSCRIBE), you must immediately stop all messaging to that number. You may send one final confirmation: "You've been unsubscribed and will receive no further messages."
No re-opt-in without new consent. Once someone opts out, you cannot add them back to your messaging list unless they provide new, affirmative consent. "They didn't really mean to unsubscribe" is not a defense.
Consistent across channels. If someone opts out of SMS, don't switch to WhatsApp. An opt-out from your messaging should be treated as an opt-out from all automated messaging channels.
Processing time. Opt-outs must be processed within a reasonable time — ideally immediately, and no longer than 24 hours. Messages sent after an opt-out request are violations.

Timing Rules

Federal TCPA rules restrict when you can make marketing calls and send marketing texts:

No calls or texts before 8 AM or after 9 PM in the consumer's local time zone
This applies to the recipient's time zone, not yours — if you're in Philadelphia and texting a lead in California, you need to account for the three-hour difference

Some states have stricter windows. Always default to the more restrictive rule.

For speed-to-lead purposes, this creates a tension: a lead who submits a form at 11 PM should get a fast response, but texting them at 11 PM is risky. The safest approach is to send an immediate acknowledgment during permitted hours and queue overnight leads for first thing in the morning. AI agents can be configured to respect these timing windows automatically.

State-Specific Variations

Federal TCPA is the floor, not the ceiling. Several states have enacted laws that add additional requirements:

Florida (effective July 2021): Requires prior express written consent for all commercial calls and texts. Restricts calling hours to 8 AM–8 PM local time (tighter than federal). Creates a private right of action under state law.

California (CCPA/CPRA): While focused on data privacy, the CCPA gives consumers the right to know what data you've collected, to delete it, and to opt out of its sale. If you're selling lead data or sharing it with partners, CCPA applies.

New York, Connecticut, Illinois, Washington: Each has state-level telemarketing and texting regulations that layer additional requirements on top of TCPA. If you operate in these states, consult with a compliance attorney for state-specific rules.

DNC registries: In addition to the federal Do Not Call list, many states maintain their own DNC registries. You must scrub against both before making outbound marketing calls or texts.

Common Violations That Get Agents Sued

These are the most frequent TCPA violations in real estate:

Texting purchased lead lists without individual consent. Buying a list of homeowners and texting them about your services is almost certainly a violation. The leads on that list didn't consent to receive messages from you.
Continuing to text after STOP. Even one message sent after an opt-out request is a violation. If your system doesn't immediately honor STOP replies, fix it now.
Using consent from a lead aggregator. Under the one-to-one rule, consent given to a lead form that distributes leads to multiple agents is not valid consent for your business unless you were specifically named.
Texting past clients without re-consent. Closing a transaction with someone doesn't give you perpetual consent to send them marketing texts. If you want to add past clients to a marketing drip, get new written consent.
Blasting your database with mass texts. Sending the same message to your entire contact list — even if some gave consent — violates TCPA for anyone who didn't. You need consent records for every recipient.
No opt-out mechanism. Every marketing message must include a way to opt out. If your texts don't mention STOP or provide an unsubscribe option, you're out of compliance.

Compliance Checklist for SMS and WhatsApp

Use this checklist before launching or continuing any messaging program:

[ ] All contacts have documented prior express written consent for marketing messages
[ ] Consent was obtained specifically for your business (not a lead aggregator's network)
[ ] Consent records include date, method, phone number, and exact disclosure language
[ ] Web forms include consent language above the submit button with unchecked opt-in box
[ ] 10DLC registration is complete and campaigns are approved
[ ] STOP and opt-out keywords are processed immediately and automatically
[ ] Messages are only sent between 8 AM and 9 PM in the recipient's time zone
[ ] All marketing messages identify your business name
[ ] Your contact list is scrubbed against federal and state DNC registries
[ ] Opt-out records are maintained and checked before any message is sent
[ ] You have a system to prevent re-messaging anyone who has opted out

How AI Agents Handle Compliance Automatically

One of the underrated benefits of using an AI agent for lead communication is built-in compliance. A properly configured AI system:

Enforces timing windows by checking the recipient's time zone before sending any message
Processes opt-outs instantly — STOP replies are handled in real time with zero delay
Maintains consent records automatically as part of the lead intake flow
Distinguishes between conversational and marketing messages based on the context of the interaction
Logs every message for audit and compliance purposes
Prevents agents from accidentally texting opted-out contacts by maintaining a suppression list that overrides manual attempts

This doesn't mean AI eliminates all compliance risk — you still need proper consent mechanisms, correct 10DLC registration, and appropriate opt-in language on your forms. But AI removes the human error element that causes most violations: the agent who forgets to check the DNC list, the ISA who doesn't see the STOP reply, or the mass text that goes out to the whole database without filtering.

What Changes in 2026

The regulatory landscape continues to tighten. Key developments to watch in 2026:

FCC enforcement of one-to-one consent. The rule took effect in 2025, but enforcement actions and court cases in 2026 will establish precedents for how strictly it's applied. Lead generators and agents relying on shared consent forms need to transition now.

Carrier filtering expansion. T-Mobile, AT&T, and Verizon continue to expand message filtering for unregistered or low-trust senders. Proper 10DLC registration and high trust scores become more important as carriers block more unregistered traffic.

State-level activity. Multiple states are considering or have recently passed TCPA-like laws with private rights of action. The trend is toward more regulation, not less.

AI-specific guidance. The FCC is expected to provide additional guidance on how AI-generated calls and messages are treated under TCPA. Current interpretation treats AI messages the same as human messages for consent purposes, but formal rulemaking could add specific requirements.

Moving Forward

TCPA compliance isn't optional and it isn't something you can figure out later. The penalties are severe, class action attorneys actively target real estate, and the rules are getting stricter. But compliance isn't complicated — it's mostly about getting consent right, honoring opt-outs, and maintaining records.

Start with your current messaging practices. Audit your consent records. Make sure your forms include proper disclosure language. Verify your 10DLC registration. And build compliance into your workflow from the beginning rather than trying to retrofit it after a violation.

If you want help setting up compliant messaging workflows — including AI agents that handle timing, opt-outs, and consent automatically — schedule a free consultation. We'll review your current setup, identify any compliance gaps, and make sure your lead communication is both effective and legally sound.