Written Policy for Texting Customers: Consent, Opt-Out, and Why Personal Cell Numbers Create Liability

Most independent lots already text customers. A salesperson sends a photo of the car, confirms an appointment, follows up after a test drive. Texting isn't the problem. The problem is that almost no small lot has a written texting policy, and the habits that took hold were never checked against the rules.

This post is the process side: which texts need what kind of consent, what the opt-out and do-not-call rules actually say, and why running texts through a store-owned number instead of a salesperson's personal cell is the difference between a documented process and a liability that walks out the door when someone quits. It is not legal advice. Every rule below is linked to the regulation or statute it comes from, state laws add their own requirements, and you should have your attorney review the finished policy.

What the federal rules actually say

The law is the Telephone Consumer Protection Act (47 U.S.C. 227), and the FCC's rules under it are in 47 CFR 64.1200. The FCC treats a text message as a call under these rules, which is why the do-not-call and consent rules reach your texts at all (FCC 23-107).

There are two levels of consent, and which one you need depends on the message. For a text sent to a cell phone with an autodialer, the rule is:

• Marketing texts (a price drop, "we just got in a car you'd like", a trade-in promotion) need prior express written consent. The FCC defines that as a signed written agreement, which can be signed electronically, that clearly authorizes the dealership to send those messages, lists the phone number, and says the customer doesn't have to sign it to buy anything (64.1200(a)(2) and (f)(9)).
• Non-marketing texts (an appointment confirmation, "your car is ready", a title update) need prior express consent, which does not have to be written or signed (64.1200(a)(1)(iii)).

The catch is the word "autodialer." In 2021 the Supreme Court read the statute's definition narrowly, as equipment that uses a random or sequential number generator (Facebook v. Duguid). Whether a particular texting platform qualifies is something lawyers argue case by case, and some states define it more broadly. Florida's version, for example, requires prior express written consent for sales calls and texts made with "an automated system for the selection and dialing of telephone numbers" (Fla. Stat. 501.059). Don't build your policy on the argument that your platform isn't an autodialer. Get signed written consent for anything promotional and you don't have to win that argument.

Lead-site consent is a federal gray area, not a green light. In 2023 the FCC adopted a rule that would have required consent to name one seller at a time, which would have ended "you agree to be contacted by our partners" forms. The Eleventh Circuit vacated that rule on January 24, 2025, one business day before it was due to take effect (Kelley Drye), and the FCC then repealed it (Womble Bond Dickinson). So federal law doesn't currently require one-seller consent. The carriers' own messaging guidelines still say an opt-in shouldn't be transferable and senders shouldn't use rented, sold or shared opt-in lists (CTIA Messaging Principles, sections 5.1.2.2 and 5.1.4). The practical rule: when a third-party lead comes in, your first text should be a reply to the customer's question, and you collect your own consent before anything promotional.

The do-not-call rules apply no matter how you send

Consent rules turn on the autodialer question. The do-not-call rules don't. They cover telephone solicitations, and the FCC applies them to texts sent to cell phones (64.1200(e)):

• National Do-Not-Call Registry. You can't send solicitations to a registered number unless the customer gave you permission or you have an established business relationship (64.1200(c)(2)). That relationship lasts 18 months after a purchase or transaction and 3 months after an inquiry or application (64.1200(f)(5)). A customer who bought from you two years ago and is on the registry is not fair game for a trade-in blast.
• Quiet hours. No solicitations before 8 a.m. or after 9 p.m. in the customer's local time (64.1200(c)(1)). State rules can be stricter, so check yours.
• Your own do-not-call list, and a written policy for it. This is the part most lots don't know about. If you send telemarketing, the FCC already requires a written policy, available on demand, for keeping an internal do-not-call list. Staff have to be trained on it, a request has to be honored within 10 business days, the request lasts 5 years, and your messages have to identify the dealership and give a number or address where you can be reached (64.1200(d)).

So for any lot that texts promotions, a written policy isn't just good practice. Part of it is already required.

Checklist of what a dealership texting policy needs: consent records, a store-owned number, opt-out handling, a do-not-call list, quiet hours and same-day offboarding.

Opt-outs: what's settled and what keeps moving

The settled part comes from the FCC's 2024 revocation rules, now in 64.1200(a)(10) and (a)(12):

• A customer can revoke consent by any reasonable means. A text reply of stop, quit, end, revoke, opt out, cancel or unsubscribe counts automatically.
• You have to honor it within a reasonable time, no more than 10 business days.
• You may send one confirmation text afterward, with no marketing in it.

The moving part is scope: does one STOP end every kind of message you send, or only the type the customer replied to? That piece was delayed several times, and the FCC released a revised order on October 1, 2026 that, according to law-firm summaries, keeps "stop means stop everything" for telemarketing, narrows it for informational messages, lets senders designate specific opt-out methods, and takes effect November 25, 2026 (Brownstein). For a used-car lot the safe reading hasn't changed. When someone texts STOP, they stop getting texts from the store. And the policy should say "we honor opt-outs as current FCC rules require," not spell out a mechanism that may change again next year.

The FCC's limit is a ceiling, not a target. Ten business days is plenty of time for a salesperson to send another "still interested?" from a phone nobody else can see. The policy should require that opt-outs are logged the same day, in a place every salesperson checks before texting.

The money: what a violation costs

The penalties are written into the statute, and they're per message:

• A consumer can sue for actual losses or $500 per violation, whichever is greater. If the violation was willful or knowing, a court can raise that to as much as three times, $1,500 (47 U.S.C. 227(b)(3)).
• Do-not-call violations carry the same amounts. A consumer can sue after receiving more than one solicitation from the same business within 12 months (227(c)(5)).
• A state attorney general can sue on behalf of residents for actual losses or $500 per violation, up to three times that if willful (227(g)).
• State laws stack on top. Florida's lets a consumer recover $500 per violation, up to triple if willful, though before suing over texts the customer has to reply STOP and give the sender 15 days to stop (Fla. Stat. 501.059(10)). Other states have their own versions, which is one more reason to have an attorney review the policy.

Do the math on one bad send: a trade-in promotion texted to 200 customers who never agreed to marketing texts is 200 potential violations. At the $500 floor, that's $100,000 of exposure from one afternoon.

Four figures from the TCPA and FCC rules: $500 per violation, up to $1,500 if willful, 10 business days to honor an opt-out, and 5 years to honor a do-not-call request.

The honest tension: personal-phone texting isn't illegal, it's unmanaged

A DealerRefresh forum thread on exactly this question is older than the current rules, but it captures the argument every store has. One side says don't let salespeople text from their own phones, period. The other says a commission-driven sales floor is going to text customers anyway, so a flat ban just gets ignored. The useful answer in that thread is the same one I'd give: make the store's texting tool as easy to use as a personal phone, so nobody has a reason to go around it. Several dealers there suggested a dedicated business number, such as Google Voice, or a platform where conversations are stored centrally and stay the dealership's property.

A salesperson texting a sold customer about a delivery time isn't the same risk as a blast to the whole customer list. The trouble is that if both happen in someone's personal Messages app, the store can't tell them apart, can't prove the customer agreed, and can't check that a STOP was honored.

Why the personal phone becomes a liability the moment someone quits

When a salesperson leaves, the customer relationships on their phone leave too. They can keep texting your customers from the same number, send something the store would never approve, or take your recent buyers to the store down the street. Meanwhile any consent the customer gave, and any STOP they sent, exists only in that ex-employee's message history. If a customer later sues, consent is the store's defense, and the evidence for it is on a phone the store doesn't own.

A store-owned number solves this the same way turning off a login does. Access ends the day someone leaves, the conversation history stays with the business, and so does the customer.

Build the policy around five sections, not one rule

A policy that works reads like a short checklist a manager can walk a new hire through, not a legal memo. Open with a one-line purpose, then:

Authorization. Who can text customers, and about what. For example: any salesperson can send non-marketing texts about a car or deal the customer asked about; only the manager sends promotional texts, and only to customers with signed written consent on file.

Consent capture. Define the moment consent is collected (a website form, a credit application, a signed sheet at the desk, a customer texting your store number first) and what gets recorded. The carriers' guidelines list what to keep: when consent was given, how, the wording the customer agreed to, the phone number, and who the customer is (CTIA Messaging Principles, section 5.1.2). For marketing consent, use a signed form with the "you don't have to agree to this to buy a car" disclosure from the FCC's definition. If it isn't written down somewhere permanent, assume you can't prove it.

Platform. Name the store-owned number or system every customer text goes through. Not "use the business line when convenient." It is the default, and personal numbers are not an option for marketing.

Opt-out and do-not-call handling. STOP and any other "don't text me" request gets logged the same day and honored right away, well inside the FCC's 10-business-day limit. Requests go on the internal do-not-call list for 5 years. Promotional texts check the national registry and stay inside 8 a.m. to 9 p.m.

Offboarding. Texting access is cut the day someone leaves, the same as their software login and their key to the lot.

Five steps for writing a dealership texting policy: authorization, consent capture, platform, opt-out and do-not-call handling, offboarding.

Then get every salesperson to sign it. The FCC's do-not-call rule requires staff to be trained on the list, and a signed policy is your record that they were.

Where DealerVLO fits, and where it doesn't

DealerVLO is a dealer management system, not a texting platform. It does not send texts or make calls, and it doesn't send bulk, campaign or automated messages to leads. For the texting itself you need a separate store-owned number or texting service, and that service is where opt-outs actually get enforced.

What DealerVLO does is keep the lead record with the store instead of with one salesperson. Every lead that comes in through your dealer website's forms (vehicle inquiry, contact, financing, credit application) lands in one lead inbox with its source recorded, so you can see where the conversation started, which is the point where you'd capture or check consent. Each lead has a status (New, Contacted, Qualified, Converted or Lost) and internal notes, so "signed text consent at the desk 10/30" or "texted STOP, do not text" goes on the lead where the next salesperson will see it. There's no separate consent field, so the notes are where that goes. The dashboard shows new leads awaiting contact, and the whole team works from the same list.

Two limits to know. There's no manual lead entry, so walk-in and phone shoppers aren't in the lead inbox, and their consent records need to live wherever you keep their signed paperwork. And DealerVLO doesn't enforce opt-outs on texts it never sends; your texting platform does that.

For the rest of the lead workflow, see the posts on turning online leads into appointments, following up dead leads, and tracking where your leads come from. If you're choosing software for this, the CRM roundup for independent dealers compares tools that do send texts.

Put the policy in writing, then keep it current

A written policy does two jobs. It tells staff exactly what's expected before there's a problem, and it's what you hand over, along with your do-not-call list, when a customer or a regulator asks how the store handles this. The FCC's rule says the do-not-call policy must be available on demand, so keep a copy where a manager can find it.

Review it at least once a year. The opt-out rules have been revised several times since 2024, and the November 2026 changes won't be the last. Keep the specific mechanics (which keywords, which platform settings) in a one-page reference a manager updates, and keep the signed policy at the level of "we follow current FCC rules and our state's law."

Frequently asked questions

Do I need written consent before texting a customer?

It depends on what the text says and how it's sent. Under the FCC's TCPA rules, an advertising or telemarketing text sent with an autodialer needs prior express written consent: a signed agreement that names the phone number and says signing isn't a condition of buying. A non-marketing text sent that way (an appointment confirmation, "your car is ready") needs prior express consent, which doesn't have to be written (47 CFR 64.1200). Because what counts as an autodialer is argued case by case and some states set their own rules, signed written consent is the safe default for anything promotional.

Should salespeople text customers from their personal phone?

No law flatly bans it, and a one-on-one reply to a customer who asked you to text is a different thing from a blast to a list. The problem is control: the store has no record of the consent, no way to make sure an opt-out is honored within the FCC's 10-business-day limit, and no way to stop the texting when that salesperson leaves. A dealership-owned texting number that's as easy to use as a personal phone fixes all three.

What happens if a customer texts STOP?

Under 47 CFR 64.1200(a)(10), a reply of stop, quit, end, revoke, opt out, cancel or unsubscribe is a valid revocation, and it has to be honored within a reasonable time, no more than 10 business days. You can send one confirmation text with no marketing in it. Whether one STOP covers every kind of message you send has been delayed and revised several times; the FCC released another revision on October 1, 2026, so write your policy to follow current FCC rules rather than freezing one version into it.

What's the real financial risk of ignoring this?

The TCPA (47 U.S.C. 227) lets a consumer sue for actual losses or $500 per violation, whichever is greater, and a court can raise that to as much as three times ($1,500) when the violation was willful or knowing. State attorneys general can sue for the same per-violation amounts. Each unconsented text can be a separate violation, so the exposure is that figure multiplied by every message, not one fine.

Does a CRM or DMS make texting TCPA-compliant automatically?

No. Compliance comes from how you capture consent, honor opt-outs and keep the records. Software helps by keeping those records with the dealership instead of on one person's phone. DealerVLO's lead inbox records each lead's source, status and internal notes, but DealerVLO does not send texts, so you still need a separate store-owned texting number or platform for the messages themselves.

Bottom line

You don't make texting safe by banning personal phones. You do it by making the store's texting path easier than the alternative, matching consent to the message (signed written consent for anything promotional), logging every STOP the same day, keeping a do-not-call list the way the FCC already requires, and cutting access the day someone leaves. Write it down, have your attorney check it against your state's rules, and keep your lead records somewhere that survives staff turnover. If you want that last part handled, start a free 14-day DealerVLO trial.