TCPA Compliance for Recruiting Texts: The 2026 Rules Every Staffing Agency Must Follow

Recruiting texts are almost always legal to send — but only if you get consent, honor opt-outs, and stay inside quiet hours. Under the Telephone Consumer Protection Act (TCPA), each non-compliant text carries $500 in statutory damages, trebled to $1,500 for a willful violation, with no proof of harm required (47 U.S.C. § 227; FCC TCPA rules). The good news for staffing agencies: courts have repeatedly held that texts recruiting people for jobs are not “advertisements” or “telemarketing,” so they need only prior express consent — not the stricter written consent that sales texts require (National Law Review). When a candidate hands you their number on an application, that’s usually the consent you need. This guide translates the 2026 rules into the exact settings, cadences, and opt-out logic to bake into your GoHighLevel recruiting workflows.

Key takeaways

• Penalties are per message: $500 negligent, up to $1,500 willful — and a single text can violate two sections at once for $3,000 (FCC / 47 U.S.C. § 227). No actual damages needed.
• Recruiting texts usually aren’t “telemarketing.” Messages recruiting a candidate for a role are informational, not advertisements, so they require prior express consent (which an applicant’s supplied number generally provides) — not prior express written consent (Nat’l Law Review).
• The “one-to-one consent” rule is dead. The Eleventh Circuit vacated it on January 24, 2025 (IMC v. FCC, No. 24-10277). Don’t build workflows around a rule that no longer exists.
• The opt-out rule took effect April 11, 2025. Candidates can revoke consent “in any reasonable manner” — STOP, QUIT, END, CANCEL, UNSUBSCRIBE — and you must honor it promptly (FCC).
• Litigation is exploding: 2,788 TCPA cases were filed in 2024 (up ~67%), and TCPA class actions spiked 283% year-over-year in September 2025 (Nat’l Law Review). Compliance is now a cost-of-doing-business, not a nicety.
• Quiet hours are 8 a.m.–9 p.m. local time (47 CFR § 64.1200(c)(1)). A candidate in California who applied to your East Coast desk still gets texted on their clock.

This article is operational guidance for staffing operators, not legal advice. TCPA rules shift by court and by state; confirm your specific cadences with qualified counsel before launch.

Table of contents

• What the TCPA is — and why recruiters keep getting sued
• The penalty math that should get your attention
• Are recruiting texts “telemarketing”? Usually not
• Consent: what you actually need to send a candidate a text
• The applicant-supplied-number rule (the staffing angle)
• Three 2026 rule changes recruiters keep getting wrong
• Quiet hours: 8 a.m.–9 p.m. in the candidate’s time zone
• Opt-outs: honor STOP the way the FCC now requires
• A2P 10DLC registration: the thing that gets your texts delivered
• A compliant recruiting SMS cadence you can copy
• How the Hiring Snapshot builds compliance in
• FAQ

What the TCPA is — and why recruiters keep getting sued

The Telephone Consumer Protection Act is a 1991 federal statute that governs how businesses may contact people by phone, and — as the FCC has repeatedly clarified — that includes SMS text messages. It restricts automated calls and texts, requires consent, mandates that you honor opt-outs, and limits the hours you can reach someone. It also carries a private right of action: any recipient can sue you directly, and because the damages are statutory, they don’t have to prove they lost a dime (47 U.S.C. § 227(b)(3)).

That last point is why the TCPA is a plaintiff’s-bar favorite. A candidate doesn’t need to show harm — they only need to show you sent a non-compliant message. Multiply that by a cadence (application confirmation, three nurture texts, an interview reminder, a re-engagement blast) and by every candidate in a purchased list, and a sloppy recruiting desk can manufacture six-figure exposure in a weekend.

The volume is not theoretical. 2,788 TCPA cases were filed in 2024, roughly a 67% jump over 2023, and about 80% of them were class actions (National Law Review). The trend accelerated into 2025: September 2025 alone saw 224 TCPA class actions filed, versus 79 in September 2024 — a 283% year-over-year increase (National Law Review). Filings cluster in Florida, California, and Texas, which together accounted for 58% of 2024 cases despite holding about 28% of the U.S. population (National Law Review).

For a staffing agency, the takeaway isn’t “stop texting candidates.” Texting is how you win the speed race — we make that case in full in SMS-first recruiting. The takeaway is that texting without a compliance layer is now a measurable liability, and the fix is process, not fear.

The penalty math that should get your attention

Here is the arithmetic every recruiting operator should internalize. The TCPA sets damages per violation, and a “violation” is generally a single call or text:

• $500 per negligent violation — the default. You didn’t mean to break the rule, but you did.
• Up to $1,500 per willful or knowing violation — courts may treble the $500 when your conduct was deliberate or reckless (47 U.S.C. § 227(b)(3); FCC rules; Burr & Forman, TCPA Recoverable Damages).

The number that surprises people: a single willful text can violate two separate TCPA sections at once — the consent requirement in § 227(b) and the do-not-call requirement in § 227(c) — supporting up to $1,500 under each, or $3,000 for one message (Burr & Forman).

Now scale it. Imagine a recruiter buys a list of 5,000 “job seekers,” loads it into GoHighLevel, and fires one blast without consent. At the negligent floor of $500 per text, that’s $2.5 million in theoretical exposure from a single send. That’s the mechanism behind the class actions in the chart above — and it’s why the cheapest compliance control in recruiting is simply never texting a number you didn’t collect with consent.

Are recruiting texts “telemarketing”? Usually not

This is the single most important — and most misunderstood — point for staffing agencies, and it works in your favor.

The TCPA treats marketing messages far more strictly than informational ones. A marketing (telemarketing) text — one that advertises or promotes the sale of goods or services — requires prior express written consent: a signed, disclosed opt-in. An informational text requires only prior express consent, which can be given orally or by the recipient simply providing their number in context (Wipfli, Prior express written consent requirements).

So which bucket does a recruiting text fall into? Courts have answered clearly: a text recruiting someone for a job is not an “advertisement” or “telemarketing.” In cases involving employment recruiting — including the well-cited Kale Realty matter and litigation over Uber’s driver-recruiting texts — courts reasoned that a recruiting message seeks to have the recipient provide their services, not to sell them a product. That puts recruiting squarely in the informational category (National Law Review; Womble Bond Dickinson).

Why this matters for your desk: you do not need the elaborate signed-writing consent flow that an e-commerce marketer needs. You need prior express consent — a much lower bar that an applicant typically clears the moment they hand you their cell number.

The caveat you cannot skip: “not telemarketing” does not mean “no consent required.” You still need prior express consent to send an automated recruiting text. Cold-texting a purchased list of potential candidates who never gave you their number is still a violation, full stop (PCRecruiter, Recruiter’s Guide to Texting). And the line blurs the moment your message stops being about a specific opportunity and starts promoting your agency’s services — a “check out our staffing agency” blast can be recharacterized as marketing.

Consent: what you actually need to send a candidate a text

Consent is the whole game. Here is how the two tiers map onto the messages a staffing agency actually sends:

The operational rule of thumb: if the text is about a specific opportunity or the candidate’s own application, it’s informational and the supplied number covers you. If the text promotes your agency or a bonus/referral offer to a broad list, treat it as marketing and get written opt-in. When in doubt, capture written consent — it costs you one checkbox and covers both tiers.

A defensible consent record includes four things you should be logging in GoHighLevel on every candidate contact:

1. The number, captured at the point the candidate gave it (application form, landing page, keyword opt-in).
2. A timestamp of when consent was given.
3. The exact opt-in language the candidate saw (store the form version).
4. The source — which form, ad, or page produced the contact.

If you’re ever challenged, that record is the difference between a $500-per-text problem and a dismissed claim. GoHighLevel captures all four automatically when candidates enter through a form or funnel — which is precisely why front-door capture beats importing spreadsheets. We walk through why leaky front doors cost placements (and now, potentially, lawsuits) in why recruiters lose candidates in the first 48 hours.

The applicant-supplied-number rule (the staffing angle)

Here is the nuance that makes staffing different from every generic “SMS compliance” article you’ll find online.

When a candidate provides their phone number as part of applying to a job, that act generally constitutes prior express consent to be contacted about that opportunity using the number they supplied (Grayscale, Recruiter’s Guide to TCPA Compliance). The candidate reached out to you, about a job, and handed over the channel — a reasonable person understands they’re going to get contacted about it.

That’s the compliant heart of speed-to-lead recruiting: the instant a candidate applies, you already have the consent to text them back. You don’t have to pause the fastest, highest-converting moment in your funnel to run a separate opt-in dance.

But the rule has edges, and staffing operators trip on all three:

• Scope is tied to the opportunity. Consent to be texted about the role they applied to is not blanket consent to text them about unrelated roles months later, and it’s definitely not consent to send marketing. When you re-engage an old applicant, you’re relying on a consent that has cooled — which is exactly why a clean re-engagement flow needs a re-opt-in step (we cover the mechanics in how to reactivate a dead candidate database).
• The number must be the one they gave you. Skip-tracing a candidate’s alternate cell and texting that is not covered.
• Consent can be revoked at any time — see the opt-out rules below. The moment they say STOP, the applicant-supplied-number consent is gone.

Treat the applicant-supplied number as a scoped, revocable license to text about the job in front of you. Used that way, it’s the cleanest consent basis a staffing desk has.

Three 2026 rule changes recruiters keep getting wrong

The TCPA landscape shifted hard in 2025, and a lot of advice online is now simply out of date. Three changes matter for recruiting.

1. The “one-to-one consent” rule is dead — stop building around it

In December 2023 the FCC adopted a rule that would have required separately obtained, seller-specific (“one-to-one”) consent, with each message “logically and topically related” to the interaction that produced consent. It was scheduled to take effect January 27, 2025. It never did: on January 24, 2025, the U.S. Court of Appeals for the Eleventh Circuit vacated the rule in Insurance Marketing Coalition, Ltd. v. FCC, No. 24-10277, holding it conflicted with the ordinary meaning of “prior express consent” (Eleventh Circuit opinion; Wiley). The FCC subsequently removed it (Womble Bond Dickinson).

What to do: if a vendor or template tells you that you must collect “one-to-one consent” for each recruiting text, ignore it — that requirement no longer exists. Don’t over-engineer your forms for a dead rule.

2. The revocation-of-consent rule DID take effect — April 11, 2025

While one-to-one died, a different FCC rule survived and is now binding. Effective April 11, 2025, consumers may revoke consent in any reasonable manner, and you may not force them into one exclusive opt-out channel (FCC; Bryan Cave Leighton Paisner). This one has teeth for recruiters — details in the opt-outs section below.

3. The written-consent framework is being challenged — but don’t relax yet

In March 2026, the Fifth Circuit held that the TCPA’s text does not actually require written consent and rejected the FCC’s telemarketing-versus-informational distinction (Holland & Knight). That sounds like a gift — but it applies only within the Fifth Circuit (Texas, Louisiana, Mississippi), other circuits and the FCC still follow the written-consent rule, and many states have their own SMS-consent statutes. For a staffing agency operating across state lines, the safe posture is unchanged: keep collecting written consent for anything that looks like marketing. A circuit split is a reason to be more careful, not less.

Quiet hours: 8 a.m.–9 p.m. in the candidate’s time zone

The TCPA prohibits telephone solicitations — including marketing texts — before 8 a.m. or after 9 p.m. in the recipient’s local time, codified at 47 CFR § 64.1200(c)(1). For a national staffing desk this is a trap, because your recruiters run on your clock: a Tampa recruiter firing a batch at 8:30 p.m. Eastern is texting a Los Angeles candidate at 5:30 p.m. Pacific (fine) but a Boston candidate applying to a West Coast role could be hit at 6:15 a.m. their time if your automation runs on Pacific.

There’s a live legal fight here worth knowing about. Since November 2024, a wave of class actions — one Florida firm filed 100-plus near-identical complaints — has targeted promotional texts sent outside the 8 a.m.–9 p.m. window (Buchalter). Courts are split on whether the quiet-hours limit even applies when a message is sent with prior express consent, since the rule targets “telephone solicitations” (Squire Patton Boggs). But “we might win the argument” is a terrible operating posture when the fix is trivial.

The operational fix: set your GoHighLevel sending windows to respect the candidate’s time zone, not the recruiter’s, and cap all automated sends to 8 a.m.–9 p.m. local. Capture time zone at application (or infer from area code as a fallback) and let the platform hold messages until the window opens. Your instant-reply speed barely suffers — a candidate who applies at 11 p.m. gets the same warm text at 8:01 a.m. — and you close off an entire category of copy-paste lawsuits.

Opt-outs: honor STOP the way the FCC now requires

The April 11, 2025 revocation rule is the change most likely to catch a busy recruiting desk. Three things you must get right:

1. Recognize opt-out keywords beyond STOP. The FCC identified a non-exhaustive list of words that must be treated as valid revocation: STOP, QUIT, END, REVOKE, OPT-OUT, CANCEL, and UNSUBSCRIBE (FCC). Your system can’t only listen for “STOP” — a candidate who replies “please cancel” has revoked.

2. Accept revocation “in any reasonable manner.” You cannot require the candidate to use a specific method or a special form. If they tell your recruiter over the phone, reply to an email, or text “take me off your list,” that’s a valid opt-out and the clock starts (Bryan Cave Leighton Paisner). This means opt-outs captured on a phone screen have to make it back into GoHighLevel and suppress the number everywhere — not just in the one workflow that triggered the reply.

3. Honor it promptly. The FCC requires revocation to be processed within a reasonable time — no later than the outer bound the rule sets — so a candidate who opts out on Monday cannot receive your automated Wednesday interview reminder. In practice, opt-out suppression must be immediate and global across every campaign and workflow.

One narrow, candidate-friendly exception the FCC built in: after someone opts out, you may send a single confirmation message acknowledging the opt-out — and nothing more.

The recruiting-specific danger is fragmentation. A candidate replies STOP to your nurture campaign, but your interview-reminder workflow and your re-engagement blast live in separate automations that never got the memo. Each subsequent text is a fresh violation. The only safe architecture is a single suppression list that every workflow checks before it sends — which is exactly how a well-built snapshot is wired.

Texting isn’t optional for a modern recruiting desk — SMS open rates run near 98% against roughly 20% for email, with SMS response rates around 45% and recruiting-specific responses often higher (Omnisend 2025 SMS benchmarks). Eighty-six percent of consumers now opt in to business texts, up about 20% since 2021 (Omnisend). Compliance is the price of playing in the channel that actually reaches candidates.

A2P 10DLC registration: the thing that gets your texts delivered

There’s a second compliance layer that isn’t the TCPA but that every GoHighLevel recruiting agency runs into: A2P 10DLC registration. A2P (“application-to-person”) 10DLC is the U.S. carrier framework for business texting over standard 10-digit long codes. Since 2023, carriers require you to register your brand and your messaging campaign before they’ll reliably deliver your texts. Skip it and your recruiting texts get filtered, throttled, or blocked — so your instant-reply automation silently fails and candidates think you ghosted them.

Registration asks for your business details, sample message templates, and your opt-in/opt-out language — which is why compliance and deliverability are the same project. The carriers want to see the exact consent flow the TCPA wants you to have. Get the opt-in wording right once and it serves both masters.

The Hiring Snapshot ships with free A2P 10DLC registration as part of setup, with the opt-in and opt-out language pre-written to satisfy both carrier review and TCPA consent — so your first recruiting text actually lands. If you’d rather not touch the carrier paperwork at all, our SMS automation feature and done-for-you setup handle it.

A compliant recruiting SMS cadence you can copy

Compliance isn’t a reason to text less — it’s a template for texting well. Here’s a defensible, high-converting cadence a staffing desk can run inside GoHighLevel, with the compliance control noted at each step.

1. Instant application reply (0–5 min). “Hi {first name}, it’s Priya at [Agency] about the {role} you applied for. Reply YES to grab a screening time. Reply STOP to opt out.” — Control: relies on applicant-supplied-number consent; includes opt-out language; scoped to the role.
2. Screening/qualification (same day). Conversational qualification texts. — Control: informational, in-scope; sent inside 8 a.m.–9 p.m. local.
3. Interview scheduling + reminders (T-1 day, T-2 hours). Logistics only. — Control: informational; suppressed instantly if the candidate ever replied STOP.
4. Post-interview follow-up. Status and next steps. — Control: in-scope; single suppression list checked before send.
5. Re-engagement of aged applicants (weeks/months later). “Hi {first name} — new {role type} roles opened up. Want in? Reply YES; reply STOP to opt out.” — Control: consent has cooled, so re-confirm interest; treat borderline-promotional wording as marketing and rely on written opt-in.

Two rules make the whole cadence defensible: every automated message honors quiet hours in the candidate’s time zone, and every workflow checks one global suppression list before it sends. Get those two controls right and you can run an aggressive, fast, SMS-first recruiting motion — the kind that compresses time-to-fill, as we detail in how to reduce time-to-fill — without manufacturing TCPA exposure.

A note on human recruiter texts: the applicant-supplied-number consent basis and the informational classification cover your manual recruiter texts too, but the opt-out obligation is identical. If a candidate tells a recruiter “stop texting me” on a call, that revocation has to reach the same suppression list your automations check.

How the Hiring Snapshot builds compliance in

The reason compliance breaks on most recruiting desks isn’t ignorance — it’s fragmentation. Consent lives in one form, texting lives in three disconnected campaigns, opt-outs get logged in a recruiter’s head, and quiet hours depend on whoever hit “send.” The TCPA punishes exactly that kind of gap.

A snapshot fixes it structurally, because everything runs through one connected system:

• Consent captured at the front door. Candidates enter through GoHighLevel forms and funnels that log the number, timestamp, opt-in language, and source automatically — a defensible consent record without a spreadsheet.
• One global opt-out suppression list. STOP (and QUIT, CANCEL, UNSUBSCRIBE, and the rest) suppresses the candidate across every workflow at once, and opt-outs captured on a phone screen can be pushed to the same list.
• Quiet-hours windows on every automated send, respecting the candidate’s time zone.
• Free A2P 10DLC registration with pre-written, carrier-and-TCPA-aligned opt-in/opt-out language, so texts actually deliver.
• The same infrastructure that qualifies and books candidates — see AI candidate screening in GoHighLevel and the AI recruiter line — inherits these controls, so speed and compliance aren’t a trade-off.

It’s a one-time purchase, not another monthly SaaS bill (see pricing), installed on your own GoHighLevel account within one business day. And because compliance is bigger than SMS, the snapshot’s cadences are also built to respect EEOC fair-hiring and FCRA background-check realities — see our EEOC policy for how we think about fairness in automated recruiting.

FAQ

Do I need written consent to text a job candidate?

Usually not. Courts have held that texts recruiting someone for a job are informational, not “telemarketing” or advertising, so they require only prior express consent — not the stricter prior express written consent that marketing texts require. A candidate who provides their phone number on your application generally gives that prior express consent to be contacted about the role. You do need written consent, however, for anything promotional (referral-bonus blasts, “check out our agency” messages), and some states impose stricter rules, so capturing written opt-in is the safest universal posture.

How much can a single non-compliant recruiting text cost?

$500 in statutory damages for a negligent violation, and up to $1,500 if the violation was willful or knowing, per message, with no proof of actual harm required. Because one text can violate two TCPA sections at once (consent and do-not-call), a single willful message can support up to $3,000. Multiplied across a cadence or a list, a non-compliant blast can create six- or seven-figure exposure, which is why the plaintiff’s bar filed 2,788 TCPA cases in 2024.

Is the FCC “one-to-one consent” rule still in effect for 2026?

No. The Eleventh Circuit vacated the one-to-one consent rule on January 24, 2025, in Insurance Marketing Coalition v. FCC, and the FCC subsequently removed it. It never took effect. You do not need to collect separate, seller-specific “one-to-one” consent for recruiting texts. Be wary of vendors or templates still built around this dead requirement — but do comply with the revocation-of-consent rule, which did take effect April 11, 2025.

What words count as an opt-out under the TCPA?

The FCC’s revocation rule (effective April 11, 2025) treats a non-exhaustive list — STOP, QUIT, END, REVOKE, OPT-OUT, CANCEL, and UNSUBSCRIBE — as valid revocation, and consumers may revoke consent “in any reasonable manner,” not just through a keyword. That means a candidate telling your recruiter “please take me off your list” on a phone call is a valid opt-out you must honor. Revocation has to be processed promptly and suppress the number across every campaign and workflow, not just the one that received the reply.

What are TCPA quiet hours for recruiting texts?

Automated marketing texts generally may not be sent before 8 a.m. or after 9 p.m. in the recipient’s local time zone under FCC rules (47 CFR § 64.1200(c)(1)). Courts are split on whether quiet hours apply to messages sent with prior consent, but because a wave of quiet-hours class actions began in late 2024, the safe practice is to cap all automated sends to 8 a.m.–9 p.m. in the candidate’s time zone — not the recruiter’s — and let your platform hold overnight applications until the window opens.

Does GoHighLevel handle TCPA compliance automatically?

GoHighLevel gives you the tools — consent capture on forms, opt-out keyword handling, sending-window controls, and A2P 10DLC registration — but it doesn’t configure a compliant recruiting motion for you out of the box. You have to wire consent logging, a single global suppression list, and time-zone-aware quiet hours across every workflow. The Hiring & Staffing GHL Snapshot ships those controls pre-built and pre-registered, so a recruiting desk gets a compliant SMS system on day one instead of assembling it under litigation risk.

About the author

Priya Raman is the Staffing Compliance & Operations Expert behind the Hiring Snapshot. With a background in HR operations and contingent-workforce compliance, she audits every cadence against TCPA, EEOC, and FCRA realities so automation never outruns the rules. She writes the compliance notes and operations deep-dives that keep agencies fast and defensible at the same time.

Related reading

• SMS-First Recruiting: Why Email-Only Agencies Are Losing the 2026 Talent Market
• Why Recruiters Lose Candidates in the First 48 Hours (And What to Do About It)
• How to Reactivate a Dead Candidate Database
• AI Candidate Screening in GoHighLevel: How to Qualify Applicants in Seconds
• Staffing Industry Benchmarks 2026: The Recruiting Metrics That Actually Matter

Ready to run recruiting SMS that’s fast and defensible? See how the snapshot works, book a live demo, or get the full snapshot — installed within one business day. Want it operated for you? Hire a trained GoHighLevel VA.