Building a marketing platform under Canada's anti-spam legislation is an unpleasant education. CASL requires express consent in most commercial contexts, holds you to a documented record of when and how it was obtained, and puts the burden of proof on the sender. You don't get to argue that a customer probably wanted it.
That constraint shaped our architecture in ways that felt expensive at the time. Consent state had to be a first-class property of the customer record, not a flag on a list. Withdrawal had to propagate everywhere immediately. Every send had to be reconstructable after the fact.
Then the US rules moved, and it turned out we'd built for the harder problem first.
What actually changed in the US, and what didn't
There's a lot of confusion here, so let me separate two things that get conflated.
The one-to-one consent rule is gone. The FCC's requirement — that a consumer consent to be contacted by each individual seller by name, rather than through a shared lead-generation form — was scheduled for 27 January 2025. The Eleventh Circuit vacated it on 25 January 2025, two days out, in Insurance Marketing Coalition v. FCC. The FCC formally removed it by September 2025. Multi-seller consent remains legal at the federal level.
If your vendor told you in 2024 that everything was about to change and then went quiet, this is why.
The revocation rules are very much still here. These took effect 11 April 2025 and they're the ones that matter operationally:
- A consumer can revoke consent by any reasonable method — a reply text, a voicemail, an email, a social media message. You don't get to specify the format.
- You must honour it across all channels, within 10 business days.
- Do Not Call registry requirements now cover texts, not just voice calls.
- Every marketing text must carry clear opt-out instructions.
Read those together and the practical requirement is a system where consent lives on the customer, not on a channel — because a "STOP" in SMS has to stop the email too, inside ten business days, provably.
That is exactly what CASL forced us to build in Canada years earlier.
Then there's state law
The federal floor is not the ceiling. At least twelve states impose stricter requirements than federal rules. Florida's Telephone Solicitation Act, as one example, restricts automated calls and texts to 8am–9pm and requires prior express written consent.
For a national campaign the rule is unforgiving: you comply with the most restrictive jurisdiction applicable to each individual contact. Not the strictest state overall, not an average — per recipient. A single send to a national list is a dozen different compliance regimes running simultaneously.
If that logic isn't in the platform, it's in a spreadsheet, and eventually it's in a demand letter.
What this means for choosing a vendor
Five questions I'd put to anyone asking to text your customers. They're all answerable in a sentence if the vendor has done the work.
- Where does consent live? If the answer is "the list we imported," walk. Ours reads opt-in status from your CRM or DMS, at send time, not from an export.
- What happens when someone replies STOP to a text? Correct answer: it propagates to every channel, automatically, well inside 10 business days.
- How do you handle state-level timing restrictions? If they don't immediately mention per-recipient jurisdiction, they're running a national send and hoping.
- Can you reconstruct why a specific customer received a specific message on a specific day? This is the question that separates a marketing tool from a defensible one.
- Who carries the liability? Know the answer before you need it.
The uncomfortable bit for dealers
Most of the compliance risk in a dealership isn't the marketing vendor. It's the fifteen years of accumulated customer records where nobody logged how consent was obtained, plus the three other tools with their own copies of the list.
Consolidating that is genuinely tedious work and there's no product that makes it fun. But it is the thing standing between a store and a class action, and it gets harder every year you postpone it.
The good news, such as it is: the same consolidation that makes you compliant is what makes retention marketing work. One trustworthy customer record is the prerequisite for both.
Regulatory summary: TCPA changes 2025–2026. This is not legal advice — talk to counsel about your specific programme.
