There is no single marketing law. Email is governed by the federal CAN-SPAM Act and a few aggressive state laws, texts and calls by the Telephone Consumer Protection Act (TCPA) and state “mini-TCPAs,” influencers and reviews by FTC rules, giveaways by state lottery and sweepstakes laws, and subscriptions by federal and state automatic renewal laws, with the FTC Act’s ban on deceptive advertising over all of it. Texting is the biggest risk, because every recipient can sue for $500 to $1,500 per message.
Key takeaways
- Marketing email doesn’t need opt-in consent in the US, but every message needs an accurate sender, an honest subject line, a postal address and a working unsubscribe. B2B email is covered too.
- Get signed, written consent before sending marketing texts, keep proof, and honor opt-outs within 10 business days.
- Send marketing texts only between 8 a.m. and 8 p.m. in the recipient’s time zone (9 a.m. to 8 p.m. in Connecticut).
- Anyone you pay or give free product to must disclose it in the post itself, and you’re responsible for what they say.
- A giveaway that requires a purchase to enter is usually an illegal lottery.
- Have evidence for every claim, and make cancelling as easy as signing up.
What rules apply to marketing emails?
The CAN-SPAM Act covers any email whose primary purpose is to promote a product or service, and it makes no exception for business-to-business email. It doesn’t require consent before you send. It does require accurate “From” and routing information that identifies your company, a subject line that isn’t misleading, a label identifying the email as an ad unless the recipient opted in, a valid postal address (a registered PO box works), and a clear unsubscribe that works for at least 30 days after sending. You must honor opt-outs within 10 business days, can’t ask for more than an email address to process one, and can’t sell the address afterward. Receipts and account notices are largely exempt, and if an agency sends for you, you’re both liable. The FTC can seek up to $53,088 per email, the 2025 inflation-adjusted figure it kept for 2026.
CAN-SPAM preempts most state email laws, but not laws aimed at falsity or deception, and that is where the lawsuits are. California lets recipients sue for $1,000 per email with misleading headers or subject lines. In April 2025, Washington’s Supreme Court held in Brown v. Old Navy that its law bars any false or misleading subject line, such as a “48 hours only” sale that runs longer, and more than 100 suits followed. Washington cut the penalty from $500 to $100 per email and added a knowledge requirement from June 11, 2026, but plaintiffs are now filing similar claims under Maryland’s and Florida’s laws.
What consent do I need to send marketing texts?
The TCPA has two separate tracks.
Automated texts and calls. Marketing texts sent with an autodialer, and calls using a prerecorded or artificial voice, need “prior express written consent”: a written agreement, which can be an online checkbox signed electronically, that clearly authorizes your company to send marketing messages to that number and states that consent isn’t a condition of purchase. In Facebook v. Duguid (2021), the Supreme Court narrowed “autodialer” to equipment using a random or sequential number generator, so many texting platforms arguably aren’t autodialers. Don’t rely on that. State laws define autodialers more broadly, the FCC treats AI-generated voices as artificial, and since McLaughlin Chiropractic v. McKesson (2025), courts needn’t follow the FCC’s readings of the statute.
Do Not Call. Regardless of equipment, you can’t send telephone solicitations to numbers on the National Do Not Call Registry or your internal do-not-call list, or during quiet hours, without the person’s permission (or, for the national registry, a recent customer relationship). Courts are split on whether texts are covered. The Seventh Circuit said no in July 2026 (Steidinger v. Blackstone Medical Services), but other courts have let text claims proceed. Written consent covers you either way.
Damages. The TCPA awards $500 per violating message, up to $1,500 if willful or knowing, with no cap. One unconsented text to 20,000 people is a potential $10 million to $30 million class action.
What changed for texts in 2025 and 2026?
The one-to-one consent rule is gone. A 2023 FCC rule would have required consent to be given to one seller at a time, ending lead-generation forms that collect consent for many companies. In Insurance Marketing Coalition v. FCC (January 2025), the Eleventh Circuit vacated it days before it took effect, holding that the FCC had exceeded its authority. Consent must still clearly authorize your company, so purchased leads remain risky.
New opt-out rules took effect in April 2025. People can revoke consent by any reasonable means, including replies like “stop,” “cancel” or “unsubscribe.” You must honor revocations within 10 business days and may send one confirmation text, with no marketing, within five minutes. An FCC order adopted September 30, 2026, not yet in effect, replaces a broader, delayed “revoke-all” rule: a marketing opt-out covers all your marketing, and you may require opt-outs through one method disclosed in every message, such as a keyword reply. Build your system so an opt-out stops all marketing now.
Quiet hours became a class action theory. Federal rules bar telephone solicitations before 8 a.m. or after 9 p.m. in the recipient’s local time. In 2025, plaintiffs filed over 100 class actions over consented texts sent outside them. One federal court held in April 2026 that consent takes a text outside the rule, but the FCC hasn’t acted on a petition asking it to say so.
Which state texting laws matter?
Florida requires prior express written consent for automated sales texts and calls, limits them to 8 a.m. to 8 p.m. and three per 24 hours on the same subject, and allows $500 per violation, trebled if willful. Since 2023, a Florida recipient must first reply “STOP” and give you 15 days before suing over texts. Oklahoma (since November 2022) and Maryland (since January 2024) have the same hours and three-per-day limits with their own penalties. Connecticut allows telemarketing texts only from 9 a.m. to 8 p.m.
Texas extended its telemarketing law to marketing texts on September 1, 2025. Unless exempt, a sender must register with the Secretary of State and post a $10,000 security deposit, and consumers can sue under Texas consumer protection law. The State has said in litigation, and the Secretary of State’s FAQ says, that consent-based texts don’t require registration, but no court has decided it.
Register for 10DLC. Separately from the law, carriers require businesses texting from standard 10-digit numbers to register their brand and each campaign through The Campaign Registry, and they began blocking unregistered traffic in early 2025.
What do the FTC rules on influencers and reviews require?
The FTC’s Endorsement Guides, updated in June 2023, require anyone promoting your product who has a “material connection” to you to disclose it clearly and conspicuously. Payment, free product, affiliate commissions, employment and family ties all count. The disclosure belongs in the post itself and must be hard to miss: “#ad” or “Paid partnership with [Company]” at the start of a caption, and spoken in a video, not buried in a bio or a pile of hashtags.
You’re responsible for what your influencers say. If they skip the disclosure or make a claim you couldn’t support, the FTC can pursue you as well as them. Use a written agreement, monitor posts and fix problems. Employees who post about your product must disclose that they work for you, so cover it in a short social media policy.
The FTC’s Consumer Reviews and Testimonials Rule, in effect since October 21, 2024, carries civil penalties of up to $53,088 per knowing violation. It bans fake reviews, including AI-generated reviews from people who don’t exist, rewards for reviews with a particular sentiment, undisclosed reviews by employees and their families, “independent” review sites you secretly control, threats to suppress negative reviews, and buying fake followers or views. The FTC sent its first warning letters under it in December 2025.
Review gating, meaning asking only customers you expect to be happy, isn’t banned by name, but the FTC’s guidance says not to do it and treats it as potentially deceptive. Ask every customer. You may offer a small incentive for an honest review if it doesn’t depend on the review being positive and the review discloses it.
How do I run a sweepstakes or contest legally?
A promotion with a prize, chance and consideration is a lottery, which private companies generally can’t run. A sweepstakes removes consideration: no purchase or payment can be required, and a free method of entry must get equal treatment, which is what “no purchase necessary” means. A contest removes chance: winners are picked by skill against published criteria.
Every promotion needs official rules covering eligibility, entry methods, dates, odds or judging criteria, prizes and their values, and the sponsor. Instagram also requires a statement that it doesn’t sponsor or administer the promotion. Three states add filings based on total prize value:
| State | Threshold | What you must do |
| New York | Prizes over $5,000 (games of chance) | Register at least 30 days before the start ($100 fee), bond or trust the full prize value, and file a winners list within 90 days after it ends |
| Florida | Prizes over $5,000 (games of chance) | File at least 7 days before the start, bond or trust the full prize value, and file a winners list within 60 days |
| Rhode Island | Prizes over $500, retail stores only | File a statement with the Secretary of State ($150 fee) |
Prizes are taxable to winners and may need IRS reporting, so ask a tax advisor.
What can I say in my ads?
You need a reasonable basis for every objective claim before you make it. “Saves teams 10 hours a week” needs supporting data, and “clinically proven” needs clinical evidence. The FTC has brought cases against companies that overstated what their AI could do, and environmental claims fall under its Green Guides. See ESG for Startups.
Comparative advertising, including naming a competitor, is legal if it’s truthful and you can back it up. But competitors can sue under the federal Lanham Act over false comparisons, so test against their current product and don’t imply an affiliation. See How Do Trademarks Work?
Under the FTC’s guide on the word “free,” every condition must be stated clearly at the outset, and you can’t recover the cost by raising the price of what customers must buy. A free trial that converts to a paid plan is also an automatic renewal. An unqualified “Made in USA” claim means all or virtually all of the product, including significant parts and processing, is made here, and the FTC can seek civil penalties for false claims on labels.
What rules apply to subscriptions and automatic renewal?
The Eighth Circuit vacated the FTC’s nationwide “click-to-cancel” rule in July 2025 on procedural grounds. The FTC restarted with an advance notice of proposed rulemaking in March 2026, and a new rule will take time.
The federal Restore Online Shoppers’ Confidence Act (ROSCA) still applies: before taking billing information, clearly disclose all material terms, get express informed consent before charging, and provide a simple way to cancel. The FTC used it to obtain a $2.5 billion settlement from Amazon over Prime in September 2025.
State laws go further. California’s amended law, effective July 1, 2025, requires express affirmative consent to renewal terms, proof of consent kept for three years or one year after the contract ends, whichever is longer, an annual reminder, cancellation through the same medium used to sign up, and coverage of free trials that convert to paid. New York’s amended law took effect in November 2025, and Minnesota, Utah and Massachusetts added rules in 2025. Build to the strictest version. See How to Draft Terms of Service for a Startup for the renewal terms to include.
Can I use my customer list for marketing?
Mostly, if your privacy policy says so and you follow the channel rules above. Emailing customers and sign-ups is fine with a working unsubscribe. Texting them isn’t, unless they consented in writing to marketing texts. A number collected for account security or delivery updates carries no marketing consent, and a purchased phone list almost never carries consent naming your company. Uploading customer emails to ad platforms, or running their pixels, can be “selling” or “sharing” under state privacy laws, and EU and UK contacts generally need opt-in consent for marketing email. See US Data Privacy Laws and Does My Startup Need a Privacy Policy?
What does this look like in a real launch campaign?
Example. A seed-stage company launching a $12 a month consumer app has a waitlist of 8,000 email addresses. It plans to text the waitlist on launch day, pay a creator $3,000 plus a free annual plan for a video, and run an Instagram giveaway for a $6,000 prize package.
The texts. The waitlist gave email addresses, not text consent, so the company can’t text it. It emails the waitlist instead, with an invitation to opt in through an unchecked box: “Yes, send me marketing texts from [Company] at this number. Consent isn’t required to buy. Message frequency varies. Msg and data rates may apply. Reply STOP to opt out.” It logs each opt-in with a timestamp and page version, registers a 10DLC campaign, and schedules launch texts for 10 a.m. in each recipient’s time zone.
The creator. The agreement requires “#ad” at the start of the caption and a spoken disclosure, lists approved claims (“set up in five minutes” is backed by onboarding data, “the best app for families” isn’t) and gives the company review and correction rights.
The giveaway. The first draft said “subscribe and tag three friends to enter.” Requiring a subscription is consideration, which makes it a lottery. The fix is free entry by commenting, an alternate entry form on the website, and official rules linked from the post. At $6,000 the prize exceeds the New York and Florida thresholds, so the company either registers and bonds in both states, starting 30 days out, or cuts the prize to $5,000. It also drops bonus entries for app store reviews, which would reward reviews, and doesn’t make text opt-in a condition of entry.
Checklist: marketing setup for a seed-stage company
- Email templates with your postal address, a one-click unsubscribe and honest subject lines.
- Text opt-in language naming your company and stating that consent isn’t a condition of purchase, stored with a timestamp.
- Opt-outs honored within 10 business days, texts sent only 8 a.m. to 8 p.m. recipient time (not before 9 a.m. in Connecticut), and 10DLC registration done.
- Written influencer and affiliate agreements, and an employee social media policy.
- Review requests sent to every customer, with no sentiment-based rewards.
- A file of evidence for each product and comparison claim.
- Official rules for every giveaway, and New York and Florida filings when prizes exceed $5,000.
- Subscription checkout with clear terms, recorded consent, reminders and online cancellation.
For more, see What Are the 10 Contracts Every Startup Should Have on Hand?, Startup Contractor Agreement and What Are the Startup Best Practices for Data Privacy?
If you’re planning a launch campaign, a text program or a giveaway, contact us before it goes live.
