iMessage marketing and TCPA consent: a practical guide

Does the TCPA apply to iMessage?

ZeroSettle's docs assume it does: they apply the TCPA's consent rules to every line because "a line is a real phone number sending real iMessages". Whether a particular campaign is covered is a question for your counsel. The Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, is the US law that restricts autodialed, prerecorded and telemarketing calls and lets consumers sue.

Texting a consumer without their prior express consent carries statutory damages of $500 to $1,500 per message, and class actions are routine. Marketing texts need written consent; the National Do Not Call Registry applies.

ZeroSettle iMessage API docs, "Compliance: you need consent"

The range comes from the statute's private right of action: $500 per violation (or the actual monetary loss, if greater), and a court may award up to three times that for a willful or knowing violation. The FCC's rules, 47 CFR § 64.1200, apply the calling-hours and Do Not Call rules to "telemarketing calls or text messages to wireless telephone numbers".

What does consent look like in practice?

ZeroSettle's docs spell out consent in practice as four rules, and its terms set the baseline: "Customers must secure explicit consent ('opt-in') from end users prior to initiating any engagements."

1. The person gave you their number for this purpose (a form, a checkbox, a purchase flow, a reply to you) and you can show the record.
2. Your first message says who you are, in the text itself, not only on the name-and-photo card. See how to write a first iMessage customers reply to.
3. STOP is honored immediately.
4. Nothing promotional before 8 am or after 9 pm in the recipient's time zone.

ZeroSettle suspends lines used for unsolicited messaging, and its docs settle doubtful cases: "If you are unsure whether you have consent, you don't."

Which texts need written marketing consent?

Offers, win-backs and abandoned-checkout nudges need written marketing consent, because ZeroSettle's docs say marketing texts do. Reminders, order updates and support replies rest on the consent the customer gave for that purpose. When a text could be read either way, treat it as marketing.

A planning default, not a legal classification. Use-case examples: review requests and abandoned checkout follow-up.

For support threads, ZeroSettle's docs add: "Do not send automated marketing into a support thread. It is a different consent, and it is how support lines get reported as spam."

How do you collect and store consent?

Collect marketing consent with an opt-in the customer chooses when they give their number, and store enough to prove it later. The FCC defines "prior express written consent" (47 CFR § 64.1200(f)(9)) as a signed written agreement, electronic signatures included, that clearly authorizes the seller to send advertisements or telemarketing messages by autodialer or prerecorded voice to a stated number, and discloses that signing is not a condition of purchase.

1. Use an unchecked checkbox beside the mobile number field, separate from the terms of sale. Wording to adapt with counsel: "Text me offers from Harbor Yoga at this number. Agreeing is not a condition of purchase. Reply STOP to opt out."
2. Store the record: the number with its country code, a timestamp, the source (page URL or form ID), the IP address and the version of the wording shown.
3. Treat text-first threads narrowly. A customer who starts the thread from an sms: link or QR code (see getting customers to text first) invited a reply in that conversation, not later promotions.
4. Record revocations from every channel: email, calls, "remove me" texts.
5. Never text purchased, rented or scraped lists.

When can you send promotional iMessages, and how often?

Only between 8 am and 9 pm in the recipient's time zone, and rarely. The hours are ZeroSettle's rule for anything promotional and match the FCC's rule for telephone solicitations (47 CFR § 64.1200(c)(1)), measured at "the called party's location".

• Use the recipient's clock. A promotion queued for 8:30 am Eastern reaches Los Angeles at 5:30 am; ZeroSettle's docs say to pass the user's time zone from your app to your backend.
• Keep promotions rare. The docs' rules of thumb for retention offers: one offer per trigger, one trigger per user per week, and three texts, not ten.
• Follow up once, then stop. On every plan, ZeroSettle refuses a third unanswered message to the same contact with 403 awaiting_reply; your code can set a stricter cap.
• Set the hosted AI agent's time zone. Its triggers fire in a morning (9 to 11 AM), afternoon (1 to 3 PM) or evening (6 to 8 PM) window in America/New_York by default, so a 9 AM Eastern text reaches Los Angeles at 6 AM, unless you change timezone. The setting is one time zone per line group, not per recipient.

What happens when a customer texts STOP, or opts out another way?

ZeroSettle enforces STOP for you: a text with the word STOP in it, or a clear request like "take me off your list", opts the sender out of every number on your account, and every later send to them, reactions, typing and name-and-photo shares included, returns 403 recipient_opted_out with nothing sent or stored. Details: how STOP and opt-outs work on a ZeroSettle line; a business texted me on iMessage shows the recipient's side.

• What counts: any text with "stop" as a word ("pls stop", "Don't stop", even "stop by at 3?"), but not "stops", "nonstop" or "unstop". Keywords such as "quit" count as the whole text or its first sentence, and about 58 opt-out phrases count anywhere in a text, such as "unsubscribe", "remove me", "wrong number" and "leave me alone". A tapback, photo or voice message never counts.
• Opting back in: only START (or unstop) as the whole message; if they ask another way, ZeroSettle can clear it.
• Visibility: you still receive the STOP and anything after it. GET /api/imessage/opt-outs lists each handle with opted_out_at, and the live stream sends an optout event on each STOP and START. Only STOPs since enforcement launched are recorded.

The FCC's rule is wider. For the texts it covers, 47 CFR § 64.1200(a)(10) treats a reply of "stop", "quit", "end", "revoke", "opt out", "cancel" or "unsubscribe" as revoking consent, and any other reply too "if a reasonable person would understand those words to have conveyed a request to revoke consent". Revocations must be honored within ten business days at most. ZeroSettle does not block on "cancel", "end", "revoke" or a polite "not interested", so your webhook has to catch them.

Does an AI agent have to say it is automated?

Yes, unless that is obvious: ZeroSettle's terms require "transparent disclosure of AI interaction in systems like chatbots, unless it is contextually evident". ZeroSettle's hosted AI agent (Beta) "never invents facts your business context doesn't give, says it is your automated assistant if sincerely asked, and points anyone who wants no more texts to STOP."

• Disclose early: say it in the agent's first_message ("Hi, it's Harbor Yoga's automated assistant"), never write a business_context that has it claim to be a person, and do the same in your own model's prompt.
• Consent still comes first: call POST /api/imessage/agent/start only for people who opted in. STOP and the new-contact limits apply to the agent's texts too.

What about customers outside the US?

Consent comes first there too. ZeroSettle's docs give Canada (CASL), the UK and EU (PECR, GDPR ePrivacy) and Australia (Spam Act) one rule: "consent first, an easy opt-out in every campaign, and records of who agreed and when."

• UK: the ICO says "You must not send marketing emails or texts to individuals without specific consent", with a limited "soft opt-in" for existing customers who bought, or negotiated to buy, similar products. It also says you must not conceal your identity and must give people a way to opt out.
• Canada: the government's CASL page says the law asks businesses to get consent before sending commercial electronic messages, and that spam includes unsolicited text messages.
• Everywhere: store numbers with their country code. ZeroSettle honors a leading +, 00 or 011 and otherwise assumes the US.

What does ZeroSettle enforce, and what is on you?

ZeroSettle enforces STOP, the new-contact limits and its ban on unsolicited messaging; consent records, content, timing and the Do Not Call Registry are yours. Under the terms, a breach of the consent or opt-out clauses means you indemnify ZeroSettle for the resulting claims, fines and costs.

Sources: ZeroSettle iMessage API docs, "Errors, limits, and compliance"; ZeroSettle iMessage API Terms, section 13. Why the limits exist: keeping a business iMessage number out of spam filters.

A pre-send check for promotional texts

This Python helper checks consent, opt-outs and the recipient's local hour before it calls POST /api/imessage/send.

import os
from datetime import datetime, timezone
from zoneinfo import ZoneInfo
import requests

BASE = "https://portal.zerosettle.io"
AUTH = {"Authorization": f"Bearer {os.environ['ZEROSETTLE_TOKEN']}"}

def zerosettle_opt_outs() -> set[str]:
    r = requests.get(f"{BASE}/api/imessage/opt-outs", headers=AUTH, timeout=30)
    r.raise_for_status()
    return {o["handle"] for o in r.json()["opt_outs"]}

def send_offer(contact: dict, text: str, suppressed: set[str]) -> str:
    consent = contact.get("marketing_consent")   # your record: wording, time, source, IP
    if not consent or consent.get("revoked_at"):
        return "no_consent"
    if contact["handle"] in suppressed:          # E.164 (or lowercased email), as ZeroSettle stores it
        return "opted_out"
    tz = ZoneInfo(contact["tz"])                 # the recipient's zone, e.g. "America/Los_Angeles"
    local = datetime.now(timezone.utc).astimezone(tz)
    if not 8 <= local.hour < 21:                 # 8 am to 9 pm, recipient time
        return "quiet_hours"
    r = requests.post(f"{BASE}/api/imessage/send", headers=AUTH,
                      json={"to": contact["handle"], "text": text}, timeout=90)
    if r.ok:
        return "sent"
    code = r.json()["error"]["code"]
    if code == "recipient_opted_out":
        suppressed.add(contact["handle"])        # never retry
    return code

Build suppressed from zerosettle_opt_outs() plus your other channels' opt-outs. Your own webhook receiver (see ZeroSettle's webhooks guide) has to add the opt-outs ZeroSettle does not block, such as "cancel" or "not interested".

How do you start a consent-first line on ZeroSettle?

Put the checks above in your code, then get a number. ZeroSettle's Pro plan is $49/month for one number with a 30-day money-back guarantee; Growth, for several numbers working as one, is from $599/mo. See pricing, get a number, read what ZeroSettle is, or browse the other guides.