Texting Your Prospects: The Rules of the Game (TCPA, GDPR and Common Sense)

The principle is simple: you don't text someone who never reached out to your business. Conversely, a customer or prospect who called you — or messaged you first — has, in most jurisdictions, implicitly consented to a response. That's exactly the case of an automatic text after a missed call: it answers an inbound request, it doesn't precede one.

The red line: cold outreach. Promotional texts to a purchased or scraped list are the fast lane to fines — in the US, the TCPA provides for $500–1,500 in damages per unlawful message, and class actions are real. For outbound marketing, explicit, documented consent is non-negotiable.

Whatever the country, the first message must answer three questions: who's speaking (the business name), why (a callback to the customer's request) and how to stop (the word STOP). A text that identifies itself and offers immediate opt-out is compliant in the spirit of every regulation — that's the disclosure.

STOP must be processed fast and unconditionally: under 24 hours in our setup, immediate on the platform side. A customer who opts out and still receives a text is the textbook litigation scenario — the opt-out registry isn't paperwork, it's your protection.

In the US, the TCPA bans unsolicited calls and texts outside 8 AM–9 PM, in the recipient's local time. The GDPR sets no numeric window but penalizes intrusive messages under fair-processing principles. Common sense agrees with the law: nobody enjoys a commercial text at 10:30 PM.

Important nuance: the immediate response to an inbound request is not a solicitation. A text-back message can therefore go out at 3 AM — it answers someone who just called. It's follow-ups and appointment reminders that must stay within the 8 AM–9 PM window.

Volume best practice fits on one line: one response to a request, one polite follow-up if no answer, no series. Every extra message raises opt-outs, degrades your sending number's reputation and, over time, the deliverability of all your texts.

Keep records: who called first, when, what consent, which opt-outs. In a dispute — customer, carrier, authority — that registry is the difference between "impeccable practice" and "practice you can't prove". Serious platforms maintain it for you.

The GDPR requires a lawful basis for every processing of personal data — for text-back, that's legitimate interest: the person called you, you're answering their request. It also grants a right to erasure: a deletion request must be handled without undue delay; aiming for under 30 days is standard good practice.

Morocco similarly regulates personal data through Law 09-08, under CNDP oversight: lawful basis, declared purpose, rights of access, rectification and objection. The global thread is the same: answer those who contact you, send nothing to those who didn't ask, and delete on request.

A final, sincere reminder: this guide is educational, not legal. Statutes evolve, so do court rulings, and your situation may have specifics. For a high-stakes decision, consult a lawyer in your jurisdiction.