Texting Patients Legally: Consent, Revocation, and Who Actually Pays for A2P 10DLC

The FCC rule that much of the texting guidance written for med spas points to for 11 April 2026 is not in force, and April 2026 is no longer the date. On 6 January 2026 the FCC's Consumer and Governmental Affairs Bureau issued order DA 26-12, extending the effective date of the cross-category part of 47 CFR 64.1200(a)(10) to 31 January 2027.

That is the paragraph which says an opt-out sent in reply to one type of message counts as an opt-out for unrelated messages from the same sender. It is waived. The rest of 64.1200(a)(10) has applied since 11 April 2025, so the error runs both ways: operators brace for a requirement that is on hold while ignoring four that are already live.

Reading the regulation will not correct this. The waiver lives in FCC Bureau orders, not in the Code of Federal Regulations, and the CFR text of (a)(10) reads as though the whole paragraph is operative.

This post sets out what is in force today and what is waived, the two different health care carve-outs and their two different qualifying tests, how revocation actually works when a patient replies, and what A2P 10DLC registration bills, taken from the registry's own rate card and two providers' published prices.

Every source on this page was read on 19 August 2026. We make med spa software, so we have an obvious interest in how you send appointment reminders. The regulations, FCC orders and rate cards below hold regardless of whose software you run them in.

The revoke-all requirement is waived until 31 January 2027

47 CFR 64.1200(a)(10) does two separate jobs. It sets out how a called party may revoke consent, and it says a revocation given in response to one type of message reaches unrelated messages from the same sender. The second job is the one that is not operating.

FCC order DA 25-312, adopted and released 7 April 2025 in CG Docket No. 02-278, granted "a limited waiver delaying the effective date of section 64.1200(a)(10) ... to the extent the rule requires callers to treat a request to revoke consent made by a called party in response to one type of message as applicable to all future robocalls and robotexts from that caller on unrelated matters." It ordered "that the effective date of section 64.1200(a)(10) is extended to April 11, 2026 to the extent discussed herein."

April 2026 is where much of the secondary coverage stopped. The Bureau moved the date again. Order DA 26-12, adopted and released 6 January 2026, ordered "that the effective date of section 64.1200(a)(10) is extended to January 31, 2027 to the extent discussed herein," this time describing the trigger as a revocation made in response to one type of informational message. We found no FCC order superseding DA 26-12 as of 19 August 2026.

Do not treat January 2027 as settled either. DA 26-12 points to a pending record as its reason for extending, and that record is FCC 25-76, the Further Notice of Proposed Rulemaking adopted 28 October 2025 and released 29 October 2025. At paragraph 101, under the heading "Recent Rules That Might Harm Consumers," the FCC seeks comment "on ways we can modify the requirement that a caller must treat an opt-out request made in response to one type of call to be an opt-out request for all types of calls." Paragraph 102 asks whether the rule "unduly restrict[s] consumers' ability to receive calls from healthcare providers that might have multiple locations or practice specialties or from pharmacies." A multi-location aesthetic practice is close to the example in the FCC's own question.

None of this shows up in the Code of Federal Regulations. The CFR text of (a)(10), in the annual edition revised as of 1 October 2025, reads as though the entire paragraph is in force and carries no editorial note about the waiver. Check the regulation and stop there and you will overstate what you owe.

What is actually in force right now

The table below separates the parts of the FCC's TCPA Consent Order that apply today from the one part that does not, with the document that fixes each date. Footnote 24 of DA 25-312 is the load-bearing citation for the live items.

Paragraph 11 of DA 25-312 draws the line explicitly: "We emphasize that this waiver extends only to section 64.1200(a)(10) to the extent discussed herein. This ruling does not otherwise delay the effective date of the other rules adopted in the TCPA Consent Order." The waiver is narrow. Everything else in the row list above is a live obligation.

The practical read for a clinic is unglamorous. You are not currently required to treat a STOP on a promotional blast as a global kill switch across appointment reminders and post-treatment instructions. You are required, today, to accept revocation by any reasonable method, to stop within ten business days at the outside, and to avoid telling patients that one channel is the only way out.

Build the global kill switch anyway. The requirement is deferred by a Bureau order that has already been extended once, and the alternative is a data model with no way to express it if the requirement does take effect.

There are two health care carve-outs, and they use different tests

Conflating them is the most common error in texting guidance written for aesthetic practices. The two provisions sit in the same section of the same rule and qualify differently.

The first is 47 CFR 64.1200(a)(2). It excludes from the prior express written consent requirement "a call that delivers a 'health care' message made by, or on behalf of, a 'covered entity' or its 'business associate,' as those terms are defined in the HIPAA Privacy Rule, 45 CFR 160.103." The residential-line twin is at (a)(3)(v) with the same hook. Read the scope carefully. This carve-out downgrades the standard from prior express written consent to ordinary prior express consent. It is not permission to text without consent.

It also depends on a question this post does not decide. 45 CFR 160.103 makes covered-entity status conditional: a health care provider is covered only if it "transmits any health information in electronic form in connection with a transaction covered by this subchapter." Whether a given med spa clears that bar turns on its own billing and transaction practices.

The second carve-out is 47 CFR 64.1200(a)(9)(iv), and it keys off something broader. It applies to "Calls made by, or on behalf of, healthcare providers, which include hospitals, emergency care centers, medical physician or service offices, poison control centers, and other healthcare professionals." No covered-entity test appears in it. What appears instead is a list of eight conditions, all of which must be met, plus a gating condition in the (a)(9) chapeau that the call must "not [be] charged to the called person or counted against the called person's plan limits on minutes or texts."

What the appointment-reminder exemption actually demands

The conditions at 64.1200(a)(9)(iv) are unusually concrete, and each one is a design constraint on the message your software sends. The table shows all eight, in the order the rule lists them.

Read (C) and (D) together and the commercial consequence is clear. The moment a reminder carries an offer, it stops being the kind of message this exemption covers. CTIA reaches the same conclusion from the industry side, and the two together are the reason a single template should never do double duty.

Condition (F) is the one that surprises operators running multi-step pre-treatment sequences. One message per patient per day, three per week across voice and text combined, is a tight budget once you add a confirmation, a pre-care instruction and a day-before reminder. Sequences designed without a frequency ceiling will breach it in the ordinary course.

Condition (H) also breaks a common assumption. Ten business days is the general ceiling in (a)(10). For messages riding this exemption, the rule says immediately. If your stop-processing is a nightly batch job, those two requirements are not the same requirement.

How revocation works when a patient replies

47 CFR 64.1200(a)(10) lets a called party revoke "by using any reasonable method to clearly express a desire not to receive further calls or text messages from the caller or sender." Seven words are per se reasonable in a text reply: stop, quit, end, revoke, opt out, cancel, unsubscribe. So is a website or telephone number the caller designated, and an automated key-press opt-out on a call.

The list is a floor, not a filter. The same paragraph says that if a reply "uses words other than" those seven, "the caller must treat that reply text as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent." A patient who replies "please take me off this" has revoked. Keyword-only matching will miss it.

The paragraph closes by banning exclusivity: senders "may not designate an exclusive means to request revocation of consent." Under 64.1200(a)(11), revocation by other channels, "such as a voicemail or email to any telephone number or email address intended to reach the caller," creates a rebuttable presumption of revocation once the called party produces evidence of the request, resolved on a totality of the circumstances.

Timing is a ceiling on reasonableness rather than an allowance. Requests "must be honored within a reasonable time not to exceed ten business days from receipt." The FCC arrived at that figure by abandoning a stricter proposal: FCC 24-24, adopted 15 February 2024, records that it "modified our proposal requiring that the revocation of consent requests and do-not-call requests must be processed within 24-hours."

One confirmation text is allowed. Under 64.1200(a)(12), effective 4 April 2024, a one-time message confirming revocation does not violate the rule "as long as the confirmation text merely confirms the text recipient's revocation request and does not include any marketing or promotional information, and is the only additional message sent." Sent within five minutes of receipt, it "will be presumed to fall within the consumer's prior express consent"; later than that, "the sender will have to make a showing that such delay was reasonable." Five minutes is a presumption threshold, not a deadline, and footnote 55 of FCC 24-24 states that confirmation timing does not extend the obligation to honor the revocation.

If you send several categories of message, the confirmation "may request clarification as to whether the revocation request was meant to encompass all such messages." The default is severe. FCC 24-24 paragraph 25: "The lack of any response to the confirmation text must be treated by the sender as a revocation of consent for all robocalls and robotexts from the sender." Paragraph 27 bars any attempt to persuade the recipient to reconsider. A clarification prompt that goes unanswered is a full opt-out, so build it that way in your client records or do not build it at all.

There is one textual tension worth naming rather than resolving. Condition (G) of the health care exemption says STOP "will be the exclusive means by which consumers may opt out of such messages," while (a)(10) forbids designating an exclusive means. The two can be reconciled on scope, since (a)(10) by its terms governs calls made under paragraphs (a)(1) through (3) and (c)(2) and (a)(9) messages are exempted from (a)(1)(iii). We found no FCC order resolving the point expressly, so treat that as a reading and not a holding.

The one-to-one consent rule never took effect

Guidance still circulates telling med spas to collect consent one seller at a time under an FCC one-to-one rule. The Eleventh Circuit vacated that rule three days before it would have applied, and the FCC has since deleted the language from the CFR.

Insurance Marketing Coalition Limited v. Federal Communications Commission, No. 24-10277, decided 24 January 2025, granted the petition and vacated Part III.D of the 2023 Order. The disposition line reads "PETITION GRANTED; ORDER VACATED IN PART AND REMANDED." The court's reasoning is short and quotable.

"all consumers must do to give 'prior express consent' to receive a robocall is clearly and unmistakably state, before receiving a robocall, that they are willing to receive the robocall"

The FCC then conformed its own rules. DA 25-621, published at 90 FR 42137 on 29 August 2025 and effective the same day, restored the pre-2023 text of 64.1200(f)(9) and records that the Eleventh Circuit "issued its mandate on April 30, 2025." The restored definition requires "an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver ... advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and the telephone number to which the signatory authorizes such advertisements or telemarketing messages to be delivered," with a clear and conspicuous disclosure that the person is "not required to sign the agreement ... as a condition of purchasing any property, goods, or services." Electronic and digital signatures count where valid under applicable federal or state law.

The chronology below is the fastest way to see how the current state of play was reached. Every row is a dated document you can pull.

Two rows deserve emphasis. The 24 January 2025 decision landed before the rule's 27 January 2025 effective date, so the one-to-one restriction never operated at all. And the 29 August 2025 CFR amendment means the current regulation text contains no one-to-one language and no "logically and topically associated" requirement.

The practical effect is that consent captured through a shared intake form, or through a partner referral, is governed by the ordinary definition of prior express written consent. That is a meaningfully lower bar than the vacated rule would have set, and it is the current bar.

Manual texts from the front desk are still regulated

Facebook, Inc. v. Duguid, No. 19-511, decided 1 April 2021, held that "To qualify as an 'automatic telephone dialing system' under the TCPA, a device must have the capacity either to store a telephone number using a random or sequential number generator, or to produce a telephone number using a random or sequential number generator." A platform texting a curated patient list, with no random or sequential generator involved, is not an autodialer under that holding, and 47 CFR 64.1200(f)(2) carries the same definition.

The risk moved. It did not disappear. Duguid narrowed the section 227(b) autodialer prohibition. It did not touch the do-not-call regime, and 47 CFR 64.1200(e) applies the rules in paragraphs (c) and (d) to "any person or entity making telephone solicitations or telemarketing calls or text messages to wireless telephone numbers." A promotional text typed by hand on a staff phone sits inside that regime.

Paragraph (d) sets out duties that are auditable in an afternoon. Under (d)(1) you "must have a written policy, available upon demand, for maintaining a do-not-call list." Under (d)(2), personnel "engaged in any aspect of telemarketing must be informed and trained in the existence and use of the do-not-call list." Under (d)(3) the request is recorded when made and honored within a period that "may not exceed ten (10) business days." Under (d)(4) you identify the caller, the entity and a contact number or address. Under (d)(6) "A do-not-call request must be honored for 5 years from the time the request is made."

An established business relationship helps with the national registry and only there. 64.1200(f)(5) defines it around "the subscriber's purchase or transaction with the entity within the eighteen (18) months immediately preceding the date of the telephone call," or an inquiry or application "within the three months immediately preceding." Eighteen months for a purchase, three for an inquiry. And an established business relationship is an exception to "telephone solicitation," not consent for section 227(b) purposes.

On exposure, state the arithmetic correctly. 47 U.S.C. 227(b)(3) allows recovery of "actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater," and lets a court, on finding a willful or knowing violation, increase the award to "not more than 3 times the amount available." The $1,500 figure is a discretionary ceiling on trebling, not an automatic second tier. Section 227(c)(5) provides a separate action for a person who received more than one do-not-call violation within a 12-month period.

CTIA's principles are voluntary, and they still decide whether your texts land

CTIA, the wireless industry trade association, sets three consent tiers in its Messaging Principles and Best Practices, May 2023, at section 5.1 and Exhibit II: implied consent for conversational messages, express consent for informational messages, express written consent for promotional messages. Informational is defined to cover the med spa case directly: "Appointment reminders, welcome texts, and alerts fall into this category because the first text sent by the business fulfills the Consumer's request."

The best single warning in the document is one sentence about re-tiering. CTIA writes that "Adding a call-to-action (e.g., a coupon code to an informational text) may place the message in the promotional category," and that before sending promotional messages "the Consumer should agree in writing to receive promotional texts." One appended offer line converts a reminder into a message that needs a different consent record behind it.

Section 5.1.3 requires that opt-out mechanisms work "regardless of whether Consumers have consented to receive the message," that senders "support multiple mechanisms of opt-out, including phone call, email, or text," and that "The validity of a Consumer opt-out should not be impacted by any de minimis variances in the Consumer opt-out response, such as capitalization, punctuation, or any letter-case sensitivities." Section 5.1.4 says senders "should not use opt-in lists that have been rented, sold, or shared," which is worth reading twice before buying an aesthetics lead list.

Treat all of that as filtering risk rather than legal risk. CTIA states in its own scope section that these are "voluntary best practices" that "do not impose, prescribe, or require contractual or technical implementation on messaging ecosystem stakeholders," and that they "do not constitute or convey legal advice." Enforcement comes through carrier and provider contracts, which CTIA says may add modified and additional requirements. We found no edition of the Messaging Principles later than May 2023 indexed on CTIA's own domain, read on 19 August 2026; a separate CTIA document titled Messaging Security Best Practices is dated October 2025, which is a different publication.

A2P 10DLC has no national price, and you never pay the wholesale one

The Campaign Registry publishes a rate card as Exhibit A to its Terms and Conditions, with page footers dated 30 October 2025. We found it inside the Terms PDF rather than on a pricing page when we looked on 19 August 2026. That card is billed to Campaign Service Providers under TCR's agreement, not to end businesses. A med spa pays a provider's retail price for the same registry service, and the retail prices differ.

The table sets TCR's wholesale card against two providers that publish their own numbers on their own domains.

Against the same underlying registry service, Bandwidth's published figures run roughly double TCR's card and Telnyx's run close to pass-through. Both are primary sources for what each company charges. Neither is a national price, and any article quoting one number as the cost of A2P 10DLC is quoting somebody's wholesale card or somebody's retail card without saying which.

The terms matter more than the headline fee for a small clinic. TCR's Exhibit A repeats for nearly every use case that campaigns are "Invoiced monthly for an initial three month period, after which will be renewed monthly," with Political as the exception. Bandwidth states the same commitment independently: "All campaigns, except for the Political use case, have an initial 3-month commitment." TCR's terms add that fees are "non-refundable, irrespective of whether the applicable campaigns are terminated or suspended for any reason," and that TCR "does not guarantee that any MNOs, or any particular MNO, will approve or maintain approval of any campaign."

One clause deserves attention if you are changing platforms. TCR states that brands "have the option to register through multiple CSPs, but registrations and the corresponding fees are specific to each CSP and not transferrable." Switching providers means registering again and paying again. Bandwidth also publishes a forward-dated change, listing Authentication+ Verification at $25 per brand as currently Public Profit only and noting "After 1/21/27, will apply to all brands."

Per-message carrier surcharges sit on top of all of this, per segment. Telnyx publishes, on its own domain, pass-through rates of $0.003 per SMS to send and receive for T-Mobile, $0.003 per SMS to send for AT&T, $0.0045 for Verizon Wireless and $0.005 for US Cellular, with MMS between $0.007 and $0.01. These are Telnyx's published pass-throughs rather than carrier-published schedules; we found no fee schedule published by the carriers themselves, read on 19 August 2026. At two thousand reminder texts a month those rates are single-digit dollars. The registration fees and the three-month commitment, not the per-message rates, are what shape a small clinic's bill.

How to audit your own texting in an afternoon

Work through this in order. Every step is checkable against a document or a screen, and none of it requires a lawyer to start, though the conclusions are worth reviewing with one.

1. Pull every message template your system can send and sort them into three piles: conversational, informational and promotional, using CTIA's May 2023 definitions in Exhibit II. Any template with an offer, a code or a call to action moves to promotional even if it is titled a reminder.

2. For each promotional template, find the consent record that backs it. Under the restored 64.1200(f)(9) that means a signed written agreement authorizing the messages and the number, with the not-a-condition-of-purchase disclosure.

3. Test revocation with free text, not keywords. Send yourself "please stop texting me" and confirm the system records a revocation. Then repeat with a voicemail and an email to a published address, because 64.1200(a)(11) gives those a rebuttable presumption.

4. Time your stop-processing. Measure the gap between a reply and the last message that could still go out. Ten business days is the outer ceiling under (a)(10); anything riding the (a)(9)(iv) health care exemption must be honored immediately.

5. Count messages per patient per day and per week across voice and text, if you rely on (a)(9)(iv). The cap is one per day and three per week combined.

6. Open your written do-not-call policy. If nobody can produce it on demand, 64.1200(d)(1) is unmet. Then check that opt-outs are retained for five years under (d)(6), and that everyone touching outbound campaigns has been trained under (d)(2).

7. Ask your messaging provider for its brand and campaign invoices, the use case each campaign is registered under, and the renewal terms. Compare them to the published rate cards above.

What your software has to do

Independent of vendor, the system holding your patient list needs a specific set of behaviors to make the steps above pass. It needs a per-contact consent state that distinguishes ordinary prior express consent from prior express written consent, with the capture timestamp and the exact language shown at capture. It needs a message classification on every template so a promotional send cannot go to a contact whose consent record only covers informational messages. It needs inbound parsing that treats an unlisted phrase as a revocation when a reasonable person would read it that way, and a revocation path that accepts phone, email and text without designating one of them as exclusive. It needs a global suppression scope that can be switched on if the cross-category rule takes effect, a per-patient frequency counter across voice and text, an immediate stop path for messages relying on the health care exemption, and a five-year retention of opt-out records. Those requirements are the same whether you send from a purpose-built platform, a general messaging tool or a phone on the front desk. The consent state that governs SMS governs app notifications too, and it sits alongside the retention and lifecycle records that explain why a patient is being contacted in the first place.

Frequently asked questions

Do I need written consent to text med spa patients?

It depends on the message. Under 47 CFR 64.1200(f)(9), as restored effective 29 August 2025, prior express written consent means a signed written agreement authorizing telemarketing messages to a specific number, with a disclosure that signing is not a condition of purchase. That standard applies to advertising and telemarketing texts. A health care message sent by or on behalf of a HIPAA covered entity or its business associate falls under 64.1200(a)(2), which relaxes the standard to ordinary prior express consent. It does not remove the consent requirement.

Is the FCC one-to-one consent rule still in effect?

It never took effect. The Eleventh Circuit decided Insurance Marketing Coalition Limited v. FCC, No. 24-10277, on 24 January 2025, granting the petition and vacating Part III.D of the FCC's 2023 Order, three days before the rule's 27 January 2025 effective date. The mandate issued 30 April 2025. The FCC then removed the language from the regulation, restoring the pre-2023 definition of prior express written consent effective 29 August 2025 at 90 FR 42137. The current text of 47 CFR 64.1200(f)(9) contains no one-to-one requirement.

When does an opt-out on one text apply to all my texts?

Not right now. The cross-category part of 47 CFR 64.1200(a)(10) is waived. FCC order DA 25-312 of 7 April 2025 delayed it to 11 April 2026, and order DA 26-12 of 6 January 2026 extended that to 31 January 2027. Treat 31 January 2027 as the current date rather than a settled one: FCC 25-76, released 29 October 2025, seeks comment on modifying or eliminating the requirement, and DA 26-12 cites that pending record as its reason for extending.

How fast do I have to stop texting after someone opts out?

47 CFR 64.1200(a)(10) requires revocation requests to be honored "within a reasonable time not to exceed ten business days from receipt." That is a ceiling on what counts as reasonable, not a grace period you are entitled to use. Messages sent under the health care exemption at 64.1200(a)(9)(iv)(H) must have opt-outs honored "immediately." Internal do-not-call requests under 64.1200(d)(3) run on the same ten business day ceiling and must be retained for five years under (d)(6).

Can I send a confirmation text after someone opts out?

Yes, one. 47 CFR 64.1200(a)(12), effective 4 April 2024, permits a single message that "merely confirms the text recipient's revocation request," contains no marketing or promotional content, and is the only further message sent. Sent within five minutes of receipt it is presumed to fall within prior express consent; later, the sender must show the delay was reasonable. If you send several message categories, the confirmation may ask which ones the opt-out covers, but FCC 24-24 paragraph 25 requires treating no response as a revocation of everything.

How much does A2P 10DLC registration cost for a med spa?

There is no single national price. The Campaign Registry's own rate card, Exhibit A to its Terms and Conditions dated 30 October 2025, lists brand registration at $4.50 one time and Marketing or Mixed campaigns at $10.00 per month, but bills those to Campaign Service Providers rather than to businesses. Providers set their own retail prices: Telnyx publishes $4.50 per brand and $10 per month for standard use cases, while Bandwidth publishes $9 per brand and $20 per month for Standard. Campaigns other than Political carry an initial three-month commitment.

Do appointment reminders count as marketing?

Only if you make them marketing. CTIA's Messaging Principles and Best Practices, May 2023, places appointment reminders in the informational tier, which calls for express consent rather than express written consent, and warns that "Adding a call-to-action (e.g., a coupon code to an informational text) may place the message in the promotional category." The FCC exemption at 47 CFR 64.1200(a)(9)(iv)(D) is stricter still: a qualifying health care text "must not include any telemarketing, solicitation, or advertising" and no billing or financial content.

Does the TCPA apply if my front desk texts patients from a normal phone?

The autodialer prohibition probably does not, but the do-not-call rules do. Facebook, Inc. v. Duguid, decided 1 April 2021, held that an automatic telephone dialing system requires the capacity to store or produce numbers using a random or sequential number generator. Separately, 47 CFR 64.1200(e) applies the do-not-call rules in paragraphs (c) and (d) to telemarketing calls and text messages sent to wireless numbers, with no autodialer involved. Manual promotional texts still require a written policy, staff training and a maintained opt-out list.