TCPA + CAN-SPAM for real estate outreach

The two big federal laws

• CAN-SPAM Act — governs commercial email. Federal law. Penalties run over $50,000 per violation (the FTC adjusts the cap for inflation each year).
• TCPA (Telephone Consumer Protection Act) — governs SMS and calls. Federal law. Penalties $500-$1,500 per violation (private right of action — anyone can sue).

CAN-SPAM — what you must do for email

1. Don't use false or misleading header info. Your from-name and from-address must accurately identify you.
2. Don't use deceptive subject lines. Subject must reasonably reflect the content.
3. Identify the message as an ad. Some kind of disclosure that you're contacting them for business purposes. "I'm reaching out about a real estate matter" usually satisfies this.
4. Include your physical postal address. Required in every commercial email. Put it in the signature.
5. Provide a working unsubscribe mechanism. A link or reply-with-unsubscribe option. Must work for at least 30 days after the message goes out.
6. Honor opt-outs within 10 business days. Direct REI tracks opt-outs automatically.

Good news: CAN-SPAM is relatively easy to comply with for cold email. You don't need prior consent — you just need to honor opt-outs and include the required disclosures.

TCPA — the much stricter SMS + call rules

Cold-texting requires prior express written consent from the recipient before you can send a marketing message. This is dramatically stricter than email.

"Marketing" includes anything promoting a product or service. Cold real-estate outreach is marketing.

What counts as "prior express written consent"

• A signed agreement (electronic signature is fine) that specifically authorizes texts from your business
• Includes the recipient's phone number
• Clear language that they understand they'll receive marketing texts
• Not buried in a generic privacy policy or terms of service

Buying a phone list and texting it is illegal under TCPA. So is scraping numbers from public sources.

What's allowed without prior consent (limited exceptions)

• B2B-to-B2B — texting a verifiable business landline / business cell with a business message is on better ground, though still risky. Phone numbers in DNC databases are off-limits regardless.
• Existing business relationship — if someone's a current customer, you generally have a 90-day window to follow up by text. Doesn't apply to cold prospects.
• Informational only — appointment reminders, order status, transactional. Pure marketing isn't covered.

In practice: most cold-real-estate SMS without explicit opt-in is in legal grey-to-illegal territory. Many operators do it anyway. Risk profile is yours.

SMS opt-out handling (STOP keywords)

If a recipient texts STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE, OPTOUT, or OPT-OUT (case-insensitive, matched against the first word of the message), they must be removed from all future texts immediately.

Direct REI does this automatically for inbound SMS. The flow:

1. Inbound webhook matches the keyword regex against the first word of the message
2. Sets the contact's sms_opted_out_at timestamp + flips status to notinterested
3. Cancels every pending or processing SMS in the follow-up queue for that contact
4. Skips queueing any AI reply (silence is the only correct response to an opt-out)
5. Three outbound guards refuse future sends to that number — send-sms aborts at send time, queue-send filters them out of new batches, process-followups re-checks at dispatch time

Once a contact is SMS-opted-out, they can't be re-added without explicit re-opt-in (you'd need to clear the timestamp manually after collecting fresh written consent).

Email opt-out handling

CAN-SPAM doesn't mandate specific keywords the way TCPA does for SMS, so the email side is more permissive. Direct REI scans inbound email replies for phrases like "unsubscribe", "stop emailing me", "take me off your list", "remove me", and a few common variants. On match:

• The contact is flagged red with attention reason "Unsubscribe / opt-out reply"
• Pending email follow-ups for that contact are cancelled
• The AI does not auto-reply
• You manually decide how to honor it (most operators clear future sends + log the opt-out date)

This is intentionally less aggressive than SMS because email opt-out language is more conversational and ambiguous ("can you stop emailing me about this property?" is opt-out; "please stop using all-caps" is not). A human deciding is safer than an auto-block on every fuzzy match.

State-level rules

Some states add TCPA-like rules of their own — Florida (FTSA), Washington (CEMA), Oklahoma, and others. These typically:

• Apply to in-state recipients regardless of where the sender is
• Carry similar or higher penalties
• Specify additional disclosure requirements

If you text people in Florida, Florida's rules apply to you even if you're in Texas.

Direct mail — much more permissive

Direct mail has no equivalent to CAN-SPAM or TCPA. USPS has its own rules (no obscene/threatening content, valid return address), but there's no consent requirement.

The risk profile for direct mail is dramatically lower than SMS or email.

Practical recommendations

• Email: Cold outreach is generally OK with CAN-SPAM compliance (signature with address, working unsubscribe, no deception).
• SMS: Get explicit opt-in OR limit to B2B with extreme caution. Read state laws for your target markets.
• Direct mail: Lowest legal risk. Highest cost per piece.
• Cold calling: TCPA applies. Don't call cells on the DNC registry. Check state-level DNC rules.
• When in doubt, consult a lawyer. Compliance costs less than litigation.

What's next

To measure how compliance constraints affect channel choice: Reading cross-channel attribution.