TCPA Compliance 101: What Salon and Barbershop Owners Need to Know Before Texting Clients

Texting is the most effective channel for reaching clients. Open rates for SMS hover around 98%, compared to 20% for email. But in the United States, sending marketing or promotional texts without following the right rules exposes your business to significant legal risk.

This guide covers what you need to know — in plain language, without the legalese.

What Is the TCPA?

The Telephone Consumer Protection Act (TCPA) is a federal law passed in 1991 that governs how businesses can contact consumers by phone and text. It was written before smartphones existed, but it has been updated and interpreted to cover modern SMS marketing.

The core rule: you need consent before you can send marketing texts to someone's phone.

Violations can result in fines of $500 to $1,500 per message. For a business sending hundreds of texts, that adds up fast.

The Key Rules Every Owner Needs to Know

1. Get express written consent before texting

For marketing messages, you need "express written consent" — meaning the client has agreed in writing (including digitally) to receive texts from your business. A signed intake form, a checkbox on your booking page, or a text-based opt-in all qualify.

2. Include opt-out instructions

Every marketing text must include a way for the recipient to stop receiving messages. The standard is: reply STOP to unsubscribe. This has to work — if someone texts STOP and you keep messaging them, that's a TCPA violation.

3. Respect quiet hours

The TCPA prohibits contacting consumers before 8am or after 9pm in their local time zone. Violating quiet hours — even accidentally — is a violation.

4. Keep records of consent

If a client claims they never consented and you can't prove they did, you're in a difficult position. Keep records of when and how consent was obtained for every client you text.

What Is 10DLC and Why Does It Matter?

10DLC stands for 10-digit long code — the standard US phone number format (like 555-867-5309). In 2021, US mobile carriers began requiring businesses to register their phone numbers before using them for commercial SMS.

This registration process (called A2P 10DLC registration) involves:

• Registering your business brand with The Campaign Registry (TCR)
• Submitting your messaging use case for approval
• Paying a one-time registration fee (typically $4–$20)

Without 10DLC registration, carriers may filter or block your messages entirely — meaning they never reach your clients, regardless of consent.

10DLC registration isn't optional. Unregistered business SMS is increasingly blocked by carriers, and the filtering is getting stricter every quarter.

Common Mistakes Small Business Owners Make

Importing a client list and texting everyone on it. Just because someone gave you their phone number for appointment reminders doesn't mean they consented to marketing messages. These are legally distinct.

Using a personal cell phone for business texting. Personal numbers are not 10DLC registered and don't have the same carrier treatment as registered business numbers. They also mix your personal and business communications in ways that create compliance headaches.

No opt-out mechanism. Every marketing text needs to include STOP instructions, and the opt-out must be honored immediately and automatically.

Texting outside quiet hours. Scheduling messages without accounting for time zones is a common mistake for businesses with clients across different regions.

What "Express Written Consent" Actually Means

You don't need a notarized document. Express written consent can be obtained through:

• A checkbox on your online booking form: "I agree to receive text messages from [Business Name] about appointments and promotions. Reply STOP to unsubscribe."
• A paper intake form with a signature line covering text communications
• A text-based opt-in where the client initiates a text to your number

The key elements: the client must actively agree (not a pre-checked box), the consent must cover your specific business, and it must reference text messages specifically.

How Protaja Handles Compliance

Protaja's Compliance Agent manages TCPA requirements automatically:

• Opt-outs are processed immediately when a client replies STOP, UNSUBSCRIBE, or similar
• Quiet hours (8pm–8am) are enforced automatically across all messages
• 10DLC registration is handled as part of onboarding
• Consent is documented at the point of client import

Compliance isn't a feature you have to think about — it's built into how Protaja works.