WhatsApp Marketing Rules in the USA: TCPA, the FCC's 2025–26 Changes, State Laws and Meta's Own Rules

Short answer: start with Meta, not Congress. Since April 1, 2025, Meta does not deliver marketing templates to WhatsApp users in the United States, so promotional broadcasts to +1 US numbers fail with error 131049 whatever the law says. What still reaches US customers is utility and authentication templates, replies within 24 hours of their last message, and Click-to-WhatsApp ad conversations. On the legal side, no court has ruled on whether the TCPA applies to WhatsApp, and the FCC has only noted that commenters agree over-the-top messaging falls outside its definition of "text" for blocking rules. The safe course is to treat WhatsApp like SMS: prior express written consent for marketing, opt-outs honored within 10 business days, sending between 8am and 8pm in the recipient's time zone, and attention to state laws in Florida, Oklahoma, Maryland, Washington, Virginia and Texas. The FCC's revised opt-out order, FCC 26-67, was published in the Federal Register today and takes effect November 25, 2026. This guide is general information, not legal advice.

First, the rule that overrides everything: Meta's US pause

Meta's developer documentation states: "Starting April 1, 2025, Meta does not deliver marketing messages sent to WhatsApp users in the United States." The restriction follows the recipient's number, applies across Meta's business messaging APIs, and has no published end date. A US business can still send marketing templates to customers outside the US, and Canadian numbers are not affected.

So in the US the legal questions below mostly concern utility messages, ad-driven conversations, and the list you are building for later. Our guide to sending WhatsApp marketing to US numbers covers the pause and the workarounds in detail.

The TCPA: what it covers and why WhatsApp is unsettled

The Telephone Consumer Protection Act (47 U.S.C. 227) and the FCC's rules at 47 CFR 64.1200 have two main parts:

• Section 227(b) restricts calls to mobile numbers made with an autodialer or an artificial or prerecorded voice without prior express consent, and prior express written consent for telemarketing. The FCC has treated SMS as "calls" for this purpose since 2003, and the Supreme Court accepted that in Campbell-Ewald v. Gomez (2016). Facebook v. Duguid (2021) narrowed "autodialer" to equipment that generates random or sequential numbers.
• Section 227(c) is the basis for the National Do Not Call Registry, company-specific do-not-call lists and the calling-hours rule, with a private right of action in 227(c)(5).

WhatsApp is an over-the-top (OTT) app that runs over the internet, not a carrier SMS. In its 2023 text-blocking order (FCC 23-21) the FCC wrote that "commenters generally agree that OTT messaging is not covered by our current definition of text". That sentence concerned carrier blocking rules; it is not an exemption from the TCPA, and no court has applied the TCPA to, or excluded, WhatsApp messages.

The courts are moving, in both directions

In McLaughlin Chiropractic v. McKesson (2025) the Supreme Court held that district courts are not bound by the FCC's interpretations of the TCPA. Since then courts have re-read the statute themselves. On July 14, 2026, the Seventh Circuit held in Steidinger v. Blackstone Medical Services that the 227(c)(5) private right of action does not cover text messages at all, because the statute says "telephone call". Commentators report that the Ninth Circuit, in Howard v. Republican National Committee (January 2026), treated texts as calls under 227(b). Supreme Court review looks likely.

Uncertainty is not a safe harbor. TCPA and state mini-TCPA litigation is heavy, and a WhatsApp campaign that would breach the SMS rules is an obvious test case. Plan as if the SMS rules apply.

Consent: what "prior express written consent" means

For marketing messages sent with automated technology, the FCC's definition (47 CFR 64.1200(f)(9)) requires a written agreement, which can be signed electronically, that clearly authorizes the seller to send marketing messages to a specific number and states that agreeing is not a condition of purchase. The 2023 "one-to-one" addition, which required consent to name a single seller, was vacated in Insurance Marketing Coalition v. FCC (11th Cir. 2025), but bundled consent buried in a comparison site's terms remains a litigation magnet. For WhatsApp, a good form:

☐ Yes, send me offers and updates from [Brand] on WhatsApp at this number. Message frequency varies. Reply STOP to opt out. Consent is not a condition of purchase. Message and data rates may apply.

Keep the box unticked, store the timestamp, page URL and wording shown, and keep a separate checkbox if you also want SMS consent. Meta's policy points the same way: it asks for opt-in "confirming that they wish to receive subsequent messages" and refers to obtaining opt-in by message category.

Opt-outs: the 2025 rule and what FCC 26-67 changes

Since April 11, 2025, the FCC's rules say consumers may revoke consent by any reasonable means and businesses must honor it within 10 business days. Reply words such as "stop", "quit", "end", "revoke", "opt out", "cancel" and "unsubscribe" count as revocation.

FCC 26-67, adopted September 30, 2026, was published in the Federal Register on October 26, 2026 (91 FR 67214) and takes effect November 25, 2026. According to the order's summary and law-firm analysis, it:

• replaces the never-effective "revoke all" rule: an opt-out from one category of informational messages (say, payment reminders) need not stop others (say, appointment reminders);
• keeps marketing all-or-nothing: an opt-out from one marketing message ends all marketing from that business;
• lets a business designate an exclusive opt-out method, such as a reply keyword, if it is disclosed clearly in every message; the standard keywords must still be honored;
• leaves the 10-business-day deadline in place, while a further notice proposes cutting it to 7 business days.

Whether any of this reaches WhatsApp is the same open question as the TCPA itself. Our recommendation is to apply it anyway.

Where QuickWA helps, and its limit

QuickWA automatically marks a contact as opted out when they send STOP, UNSUBSCRIBE, STOPALL, STOP ALL, OPT OUT, OPTOUT or STOP PROMOTIONS, and never sends them broadcasts again. It does not yet act automatically on QUIT, END, REVOKE or CANCEL, or on Spanish replies such as "ALTO" or "BAJA". Train your agents to opt those contacts out by hand the same day.

Quiet hours

The federal rule (47 CFR 64.1200(c)(1)) bars telephone solicitations before 8am or after 9pm in the recipient's local time. After Steidinger, whether people can sue over texts sent outside those hours depends on the circuit, but state laws are stricter: Oklahoma and Maryland limit marketing calls and texts to 8am to 8pm, and Florida's Telemarketing Act (section 501.616(6)) sets the same window and a three-per-24-hours limit for commercial solicitation phone calls.

The practical rule: send marketing between 9am and 8pm in the recipient's time zone, not yours. QuickWA's sending window, set in Settings and off until you switch it on, holds scheduled broadcasts until the window reopens. One window cannot follow every recipient, so pick a range inside 8am–8pm for every zone on your list: 11am to 8pm Eastern is 8am to 5pm Pacific.

State mini-TCPAs

Several states have their own telemarketing laws that explicitly cover text messages. None has been tested against WhatsApp; all are worth designing for.

"WhatsApp is not SMS" is a defense some lawyers would run. The Washington and Florida definitions ("any similar capability", "text message" left undefined) are broad enough that we would not bet a campaign on it.

CAN-SPAM, privacy laws and sector rules

CAN-SPAM is about email

The CAN-SPAM Act regulates commercial email, and the FCC's companion rule covers email sent to wireless carrier domains. It does not govern WhatsApp messages. It does govern the email in which you invite customers to join your WhatsApp list.

State comprehensive privacy laws

By 2026 about 19 states have comprehensive privacy laws in force, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. They mostly require a privacy notice that mentions WhatsApp, honoring opt-outs of targeted advertising and "sale" or "sharing", and opt-in consent for sensitive data such as health information. Uploading customer phone lists to Meta for ad audiences, or running Click-to-WhatsApp ads with pixels, can fall under those opt-outs, including browser signals such as Global Privacy Control where a state requires it.

Sector rules

• Healthcare: WhatsApp is not HIPAA compliant for patient health information; see is WhatsApp HIPAA compliant.
• Debt collection: Regulation F (12 CFR 1006.6(e)) requires an opt-out notice in every electronic communication.
• Real estate, insurance and finance: licence-advertising and disclosure rules apply to the message content.

Meta's rules for US businesses

The WhatsApp Business Messaging Policy (updated September 23, 2026) requires opt-in before you message anyone, makes you "solely responsible for determining the method of opt-in", and requires you to respect opt-out requests made on or off WhatsApp. Marketing must be submitted as a marketing template; Meta can recategorize a utility template that carries an offer, which in the US means it stops being delivered. Blocks and reports lower your number's quality rating, which can pause templates and cap growth, so annoying opted-in customers costs you even where no law is broken.

A US checklist

1. Check the recipient's country before planning any marketing template.
2. Collect unticked, separate WhatsApp consent with the "not a condition of purchase" line and store proof.
3. Keep utility templates free of offers.
4. Put "Reply STOP to opt out" in marketing templates and honor opt-outs from any channel within 10 business days, ideally the same day.
5. Handle QUIT, END, REVOKE, CANCEL and Spanish opt-outs manually.
6. Send between 9am and 8pm in the recipient's time zone and switch on QuickWA's sending window.
7. Keep no more than three marketing messages per 24 hours to anyone in Florida, Oklahoma or Maryland, and far fewer in practice.
8. Honor Virginia STOP requests for 10 years; keep a permanent suppression list.
9. Update your privacy notice and ad-audience opt-outs for state privacy laws.
10. Re-check FCC 26-67 and the courts before a large campaign; this area changes monthly.

For how QuickWA works for US businesses, including USA numbers and the shared inbox, see the QuickWA USA page. For channel choice, compare WhatsApp and SMS/10DLC in the US.

Sources

• Meta, marketing messages get-started guide (US delivery stopped April 1, 2025): developers.facebook.com (checked October 26, 2026)
• WhatsApp Business Messaging Policy (updated September 23, 2026): whatsappbusiness.com (checked October 26, 2026)
• Federal Register, "Enhancing the Ability of Consumers To Control the Robocalls", FCC 26-67, 91 FR 67214, effective November 25, 2026: federalregister.gov (checked October 26, 2026)
• FCC 26-67 order text: docs.fcc.gov; Nixon Peabody analysis, October 7, 2026: nixonpeabody.com (checked October 26, 2026)
• FCC 23-21, text-blocking order (OTT messaging and the definition of "text"): docs.fcc.gov (checked October 26, 2026)
• 47 CFR 64.1200: ecfr.gov; 47 U.S.C. 227: law.cornell.edu (checked October 26, 2026)
• Skadden on Steidinger v. Blackstone Medical Services (7th Cir., July 14, 2026): skadden.com (checked October 26, 2026)
• Goodwin on the FCC's removal of the one-to-one consent rule (2025): goodwinlaw.com (checked October 26, 2026)
• Florida Statutes 501.059 and 501.616: leg.state.fl.us (checked October 26, 2026)
• Washington RCW 19.190.010, .060 and .070: app.leg.wa.gov (checked October 26, 2026)
• Virginia Telephone Privacy Protection Act: law.lis.virginia.gov; Texas SB 140 analysis, Morgan Lewis: morganlewis.com (checked October 26, 2026)
• Oklahoma and Maryland mini-TCPA summaries: venable.com, insideprivacy.com (checked October 26, 2026)