Your support system sends an SMS: "Your refund of $47.99 has been processed. Allow 3-5 business days to appear in your account."

Helpful, right? Fast. Personal. The customer gets the update on their phone instead of buried in email.

One problem: the customer didn't consent to receive SMS from you. Under the Telephone Consumer Protection Act (TCPA), that text just cost you $500 to $1,500 in potential statutory damages. Per message.

If you texted 100 customers this week without proper consent, your exposure is $50,000 to $150,000.

TCPA litigation is a billion-dollar industry in the US. Plaintiff's firms actively look for companies sending texts without proper consent. Class action settlements routinely reach millions of dollars. And support SMS is one of the most common accidental violation vectors because support teams don't think of update texts as "marketing."

What TCPA Requires

The TCPA (passed in 1991, updated multiple times since) restricts unsolicited communications via phone and text. For SMS, the key requirements:

Prior express consent is required for non-marketing texts (like support updates). The customer must have provided their phone number voluntarily in a context where texts are expected. Providing a phone number on a contact form doesn't automatically consent to SMS.

Prior express written consent is required for marketing texts. This means a signed (or digitally signed) opt-in that specifically authorizes marketing messages.

An opt-out mechanism must be available. The customer must be able to reply "STOP" and immediately stop receiving texts.

The phone number must be provided by the customer, not obtained from a directory or purchased list.

Where Support Teams Get Tripped Up

"They gave us their phone number." Yes, for their account. Not for SMS. A phone number in your CRM for account verification purposes doesn't constitute consent to send SMS support updates. The consent must be tied to the specific communication channel.

"It's a support update, not marketing." TCPA still applies. Support texts require prior express consent (a lower bar than marketing, which requires written consent, but still a bar that must be cleared). Many companies assume support communications are exempt. They're not.

"We use an automated system." Using an autodialer or automated text-sending system (which includes most support tools that send automated SMS) triggers stricter TCPA requirements. Manual, one-off texts from an agent's personal phone are less regulated, but automated systems are squarely in TCPA territory.

"The customer contacted us first." Even if the customer initiated the support interaction, you can't switch to SMS without consent. If they emailed you, respond by email. If they chatted, respond by chat. Channel-switching to SMS requires separate consent.

How to Comply

Get explicit SMS consent. During sign-up or account setup, include a clear opt-in: "I agree to receive SMS updates about my account and support interactions at [phone number]." This must be a separate checkbox, not bundled into your ToS agreement.

Record the consent. Store the timestamp, the exact language the customer agreed to, and the phone number they provided. If a lawsuit comes, you'll need to prove consent for each phone number.

Include opt-out instructions in every SMS. "Reply STOP to unsubscribe" at the end of every text. Process opt-outs immediately (within 10 minutes per FCC guidelines).

Honor channel preference. If the customer consented to SMS, great. If they didn't, don't text them. Respond in whatever channel they used to contact you. Supp routes responses back through the originating channel by default, which avoids accidental channel-switching.

The Class Action Risk

TCPA class actions are lucrative for plaintiff's firms. Statutory damages of $500 per violation (or $1,500 for willful violations) make even small-scale violations expensive when aggregated across a class.

Example: you sent automated SMS shipping updates to 5,000 customers without proper consent. If a class action is certified, exposure is $2.5 million at $500 per text, or $7.5 million at the willful rate. Settlements are typically 30 to 50% of maximum exposure, but $1 million+ settlements for small companies are common.

The defense costs alone (even if you win) run $50,000 to $200,000 for a class action.

Compare this to the cost of compliance: a consent checkbox on your signup form and an opt-out mechanism in your SMS system. Maybe $500 in development time.

The Support-Specific Guidance

For support teams that want to use SMS:

Do: text customers who explicitly opted in to SMS support updates. Include opt-out instructions. Send only support-relevant content (ticket updates, resolution confirmations, outage notifications).

Don't: text customers who only provided their phone number for account security. Don't send marketing content disguised as support updates ("Your issue is resolved! By the way, check out our new Pro plan."). Don't text customers who opted out, even if they submit a new ticket.

For AI-automated support: if your system (including Supp) sends automated messages, make sure the SMS channel is only active for customers with documented consent. The automation makes compliance easier (consistent opt-out handling) and also increases risk (automated messages to large lists multiply the per-violation exposure).

The safest approach for most support teams: don't use SMS unless you have a clear business need and a clear consent mechanism. Email, in-app messaging, and chat are all TCPA-safe channels. SMS adds value (faster delivery, higher open rates) but also adds legal risk that's disproportionate to the benefit for most support use cases.

If you do use SMS, get consent properly, process opt-outs immediately, and keep records. The $500 you spent on compliance saves you from the $500-per-text consequences of skipping it.