TCPA + CAN-SPAM for real estate outreach

The two big federal laws

• CAN-SPAM Act — governs commercial email. Federal law. Penalties run over $50,000 per violation (the FTC adjusts the cap for inflation each year).
• TCPA (Telephone Consumer Protection Act) — governs SMS and calls. Federal law. Penalties $500-$1,500 per violation (private right of action — anyone can sue).

CAN-SPAM — what you must do for email

1. Don't use false or misleading header info. Your from-name and from-address must accurately identify you.
2. Don't use deceptive subject lines. Subject must reasonably reflect the content.
3. Identify the message as an ad. Some kind of disclosure that you're contacting them for business purposes. "I'm reaching out about a real estate matter" usually satisfies this.
4. Include your physical postal address. Required in every commercial email. Put it in the signature.
5. Provide a working unsubscribe mechanism. A link or reply-with-unsubscribe option. Must work for at least 30 days after the message goes out.
6. Honor opt-outs within 10 business days. Direct REI tracks opt-outs automatically.

Edit it, or turn it off. Settings → Email → Email footer & unsubscribe link is the account owner's control. Write your own footer text with the tokens [Your Name], [Your Company], [Postal Address] and [Unsubscribe Link] (the preview shows exactly what goes under the -- line; if you leave the link token out, the link is added on its own line). Untick the switch and automated emails go out as plain messages — no footer and no hidden unsubscribe header, so Gmail files them more like a personal email but also shows no Unsubscribe button. Opt-outs are then only caught when someone replies "unsubscribe" or "remove me", which reply detection already handles. Keeping CAN-SPAM compliance on what you send is on you, and Gmail requires one-click unsubscribe from anyone sending 5,000+ messages a day.

Good news: CAN-SPAM is relatively easy to comply with for cold email. You don't need prior consent — you just need to honor opt-outs and include the required disclosures.

TCPA — the much stricter SMS + call rules

Cold-texting requires prior express written consent from the recipient before you can send a marketing message. This is dramatically stricter than email.

"Marketing" includes anything promoting a product or service. Cold real-estate outreach is marketing.

What counts as "prior express written consent"

• A signed agreement (electronic signature is fine) that specifically authorizes texts from your business
• Includes the recipient's phone number
• Clear language that they understand they'll receive marketing texts
• Not buried in a generic privacy policy or terms of service

Buying a phone list and texting it is illegal under TCPA. So is scraping numbers from public sources.

What's allowed without prior consent (limited exceptions)

• B2B-to-B2B — texting a verifiable business landline / business cell with a business message is on better ground, though still risky. Phone numbers in DNC databases are off-limits regardless.
• Existing business relationship — if someone's a current customer, you generally have a 90-day window to follow up by text. Doesn't apply to cold prospects.
• Informational only — appointment reminders, order status, transactional. Pure marketing isn't covered.

In practice: most cold-real-estate SMS without explicit opt-in is in legal grey-to-illegal territory. Many operators do it anyway. Risk profile is yours.

SMS opt-out handling (STOP keywords)

If a recipient texts STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE, OPTOUT, or OPT-OUT (case-insensitive, matched against the first word of the message), they must be removed from all future texts immediately.

Direct REI does this automatically for inbound SMS. The flow:

1. Inbound webhook matches the keyword regex against the first word of the message
2. Sets the contact's sms_opted_out_at timestamp + flips status to notinterested
3. Cancels every pending or processing SMS in the follow-up queue for that contact
4. Skips queueing any AI reply (silence is the only correct response to an opt-out)
5. Three outbound guards refuse future sends to that number — send-sms aborts at send time, queue-send filters them out of new batches, process-followups re-checks at dispatch time

Once a contact is opted out of texts, the app won't text them again unless you clear the opt-out after they give you permission again (see Clear an opt-out below).

Email opt-out handling

CAN-SPAM doesn't mandate specific keywords the way TCPA does for SMS. Direct REI scans inbound email replies for clear phrases like "unsubscribe", "stop emailing me", "take me off your list", "remove me", and a few common variants. On a clear match:

• The contact is opted out of email for good and marked Not interested
• Pending email follow-ups for that contact are cancelled, and the AI does not reply
• The contact is flagged red with "Unsubscribe / opt-out reply" so you see it

Email opt-out language is often conversational ("can you stop emailing me about this property?" is an opt-out; "please stop using all-caps" is not). When the wording isn't clear, the AI doesn't opt them out on its own. It flags the contact "Possible opt-out request — review before emailing again" and skips its reply. Open the contact: the red banner has Confirm opt-out if it was a removal request, or Mark resolved if it wasn't.

Mark someone opted out yourself

When someone asks you on a call, in a voicemail, or anywhere else to stop contacting them:

• One contact: open the contact, then ⋯ More → 🚫 Mark opted out…
• Many at once: in the CRM (Buyers, Sellers or Other), check the contacts and click 🚫 Opt out… in the bar above the list

Pick the channels: Email, Texts, Calls (stops AI calls and voicemail drops and takes them out of the Dialer queue; you can still dial them by hand from their card). You can also set their status to Not interested. Anything already scheduled to them by email or text is cancelled, and from then on every send path refuses them, including messages you type yourself. Their card shows an "Opted out" pill, and the CRM's Status → Opted out filter finds them. Oliver can do it too ("stop texting John Smith").

Clear an opt-out (when they agree again)

If someone who opted out later asks to hear from you again, open the contact and click Clear next to the "Opted out" pill (or ⋯ More → ↩ Clear opt-out…). For several at once, check them in the CRM — ↩ Clear opt-out… appears in the bar above the list as soon as the selection includes someone who opted out. Tick the channels to re-open, say how they agreed (for example "They called back on Oct 6 and asked us to text them the offer"), and confirm that you have their permission. The app adds the date, your name and that reason to their notes and keeps a record of it.

• Clearing texts also takes their phone numbers off your account's STOP list, so your texts go through again.
• If they replied STOP, your phone provider may still block texts to that number until they text START to your number. Ask them to.
• Their status doesn't change. If it's Not interested, campaigns keep skipping them until you change it; texts and emails you send yourself go through.
• A call opt-out has its own Clear link, next to "Do not call" on the card.

Only clear an opt-out when the person really gave permission again. Contacting someone who opted out is what TCPA and CAN-SPAM complaints are made of.

State-level rules

Some states add TCPA-like rules of their own — Florida (FTSA), Washington (CEMA), Oklahoma, and others. These typically:

• Apply to in-state recipients regardless of where the sender is
• Carry similar or higher penalties
• Specify additional disclosure requirements

If you text people in Florida, Florida's rules apply to you even if you're in Texas.

Direct mail — much more permissive

Direct mail has no equivalent to CAN-SPAM or TCPA. USPS has its own rules (no obscene/threatening content, valid return address), but there's no consent requirement.

The risk profile for direct mail is dramatically lower than SMS or email.

Practical recommendations

• Email: Cold outreach is generally OK with CAN-SPAM compliance (signature with address, working unsubscribe, no deception).
• SMS: Get explicit opt-in OR limit to B2B with extreme caution. Read state laws for your target markets.
• Direct mail: Lowest legal risk. Highest cost per piece.
• Cold calling: TCPA applies. Don't call cells on the DNC registry. Check state-level DNC rules.
• When in doubt, consult a lawyer. Compliance costs less than litigation.

What's next

To measure how compliance constraints affect channel choice: Reading cross-channel attribution.