TCPA and the Franchise Industry: A Compliance White Paper

Executive Summary

The Telephone Consumer Protection Act (TCPA), enacted in 1991, has evolved into one of the most actively litigated federal statutes in the United States. Originally designed to curb unwanted telemarketing calls, it now governs virtually all forms of automated business text messaging — and its enforcement posture has never been more aggressive.

For franchise operators, the TCPA presents a compounded risk that single-location businesses do not face: a non-compliant texting campaign at one franchisee location can generate liability exposure for the entire brand. Courts have established — and continue to refine — the doctrine of vicarious liability as it applies to franchise networks, meaning a franchisor may be held responsible for the texting conduct of its franchisees under specific, fact-dependent conditions.

This white paper examines the current TCPA litigation environment, the legal doctrines uniquely applicable to franchise networks, notable case outcomes across multiple industries, and a practical framework for building a compliant SMS program across a multi-location franchise system.

Section 1: The TCPA Core Legal Framework

Statutory Basis

The Telephone Consumer Protection Act is codified at 47 U.S.C. § 227. It prohibits:

• Making any call — including a text message — using an automatic telephone dialing system (ATDS) to a cellular telephone without prior express consent
• Making calls using prerecorded or artificial voice messages without consent
• Calling numbers registered on the National Do Not Call (DNC) Registry
• Sending marketing messages outside permitted hours: before 8:00 AM or after 9:00 PM local time at the recipient’s location

The TCPA has been interpreted by multiple federal circuits to apply to text messages with the same legal force as voice calls, a principle established in Satterfield v. Simon & Schuster, Inc., 569 F.3d 946, 952 (9th Cir. 2009) and affirmed across subsequent litigation.

Consent Standards

The TCPA distinguishes between two levels of consent:

Prior express consent is required for informational messages — appointment reminders, transactional notifications, delivery alerts. A consumer providing their phone number in a commercial transaction may constitute prior express consent for non-marketing contacts directly related to that transaction.

Prior express written consent is required for all marketing or promotional text messages. This is a materially higher standard. It requires a signed written agreement — digital consent is legally acceptable — that clearly and conspicuously authorizes the sender to send promotional messages and discloses their nature. Verbal consent is insufficient.

Statutory Damages

The TCPA is a strict-liability statute. No intent to violate the law is required to trigger liability:

Because there is no aggregate cap, a single SMS campaign sent without proper consent to tens of thousands of recipients can generate exposure in the tens of millions of dollars. The Heartland Automotive Services case — discussed in Section 4 — involved 2.3 million recipients and carried theoretical maximum liability exceeding one billion dollars at $500 per violation.²

Section 2: The Litigation Landscape Quantified

The scope of TCPA litigation has reached levels that legal commentators describe as unprecedented. The following data is sourced from WebRecon LLC (a litigation tracking service widely cited in legal publications) and reporting by attorneys actively practicing in TCPA defense.

Annual Filing Volume

2025 Acceleration

Class Action Dominance

75–80% of all TCPA lawsuits are filed as class actions, compared to 2–5% for the Fair Debt Collection Practices Act (FDCPA) and 1.4% for the Fair Credit Reporting Act (FCRA).⁴

This disparity reflects the TCPA’s unique damage structure: $500 to $1,500 per violation with no aggregate cap. When multiplied across a class of thousands, a single campaign can generate settlement leverage that dwarfs other consumer protection claims.

Settlement Economics

• The average TCPA class action settlement exceeds $6.6 million.⁴
• Even businesses that successfully defend TCPA cases typically spend six to seven figures in legal fees.⁶
• A single non-compliant SMS campaign targeting 10,000 recipients can generate $5–$15 million in financial exposure before factoring in defense costs.⁶

Professional Plaintiffs

Analysis of 2024 TCPA filings found that 31–41% were filed by individuals who had previously filed TCPA suits, with some individuals filing dozens of cases over multiple years.⁴ Professional plaintiffs employ documented tactics to generate litigation opportunities, including maintaining multiple phone numbers across carriers to maximize exposure to non-compliant messages.⁴

Geographic Concentration

Section 3: How TCPA Liability Applies in Franchise Networks

Direct Franchisee Liability

Every franchisee that sends text messages using an automated platform without documented written consent, without honoring opt-out requests, or outside permitted quiet hours faces direct TCPA liability identical to any other business. The TCPA makes no exception based on company size or franchise structure.

Vicarious Franchisor Liability — The Legal Framework

The more consequential question for franchise leadership is whether a franchisor can be held liable for a franchisee’s texting conduct. The FCC’s 2013 Declaratory Ruling established that TCPA vicarious liability can arise under three theories:

• Actual agency: The franchisor controlled the manner and means of the franchisee’s text campaign
• Apparent authority: Consumers reasonably believed the franchisee was acting on the franchisor’s behalf
• Ratification: The franchisor knew of the franchisee’s non-compliant texting and accepted its benefits without repudiation

The foundational franchise TCPA case is Thomas v. Taco Bell Corp., 879 F. Supp. 2d 1079 (C.D. Cal. 2012), affirmed 582 F. App’x 678 (9th Cir. 2014). A Chicago-area Taco Bell franchisee advertising association sent promotional texts to 17,000 consumers without consent. The Ninth Circuit affirmed dismissal of Taco Bell Corp. because Taco Bell did not direct or supervise the campaign, and the brand’s financial contribution to the advertising fund alone was insufficient to establish agency.⁷

The inverse of that risk is the solution: a franchisor that recommends or deploys a purpose-built, TCPA-compliant SMS platform is not creating liability — it is eliminating it. Courts have consistently found that the mechanism of harm matters. Recommending a platform that captures documented written consent, enforces brand-wide opt-out, automates quiet hours compliance, and maintains a complete audit trail is categorically different from recommending a generic blast-text tool with no compliance infrastructure, or leaving it to the franchisee’s discretion.

Franchisors who standardize texting across their network on a compliant platform accomplish three things simultaneously: they protect franchisees from direct liability, they protect the brand from vicarious liability, and they create the documented compliance record that is the primary defense in any TCPA litigation.

The risk is not franchisor involvement in franchisee SMS. The risk is franchisor involvement in the wrong kind of SMS program.

Section 4: Landmark Franchise Cases Across Industries

Section 5: The Opt-Out Failure Problem in Franchise Networks

Of all TCPA compliance failures, opt-out handling represents the single highest-risk exposure point in a multi-location franchise network. The legal standard is clear: opt-out requests must be honored immediately and the suppression must propagate across every location and campaign associated with the brand.

Courts have not accepted “we didn’t know the other location received a STOP request” as a defense.

Cases Directly Illustrating Opt-Out Failure Risk

• DSW / Designer Brands ($4.42 million, 2025): Settled a class action specifically for continuing to send marketing texts after consumers had opted out. DSW had an opt-out system; it simply failed to propagate opt-outs across all marketing lists and segments.¹⁷
• &Pizza / Ima Pizza LLC ($750,000, 2024): Settled after sending marketing texts to consumers who had explicitly opted out. &Pizza operates across Washington D.C., Maryland, Virginia, Pennsylvania, New Jersey, and New York.¹⁸
• Albertsons Companies ($5.9 million, 2025): Agreed to pay nearly $6 million to settle a TCPA class action specifically over SMS messages sent after consumers had submitted STOP requests.¹⁹

The common thread: these companies had opt-out processes. Those processes failed at scale. For a franchise network where locations operate on independent systems or databases, the risk of inter-location opt-out failure is structurally embedded unless the SMS platform is specifically architected to prevent it.

Section 6: 10DLC Registration and Its Compliance Significance

Since 2021, major U.S. wireless carriers have required commercial SMS senders to register their brand and messaging campaigns through the 10-Digit Long Code (10DLC) system administered by The Campaign Registry (TCR). This is a carrier-level requirement independent of TCPA, but it intersects significantly with legal defensibility.

What Franchises Need to Know

• Each commercial SMS sender must register its brand with TCR; each distinct messaging use case (marketing, appointment reminders, transactional alerts) must be registered as a separate campaign
• Non-registered SMS traffic is subject to carrier filtering, blocking, or throttling — meaning non-compliant messages may be silently suppressed without the sender knowing
• T-Mobile and other carriers have published explicit prohibitions against consent-sharing arrangements where one registration covers multiple distinct sending entities
• Failure to register does not itself constitute a TCPA violation, but a franchise network without proper 10DLC registration has no documented audit trail of its SMS program’s structure — weakening its defense position in litigation

Section 7: State Mini-TCPA Laws — The Emerging Layered Risk

Federal TCPA liability is only one layer of exposure for multi-state franchise networks. As of mid-2026, numerous states have enacted their own telephone consumer protection statutes that in several cases exceed federal requirements:

Florida Telephone Solicitation Act (FTSA): Covers any automated system capable of selecting or dialing telephone numbers — a broader definition than the federal ATDS standard. Florida plaintiffs can assert both TCPA and FTSA claims simultaneously, increasing per-violation damages exposure and creating additional procedural advantages for plaintiffs.²⁰

Texas Mini-TCPA (SB 140, effective September 2025): Expanded registration and compliance requirements for businesses engaging in telephone solicitations, including SMS marketing. A November 2025 federal court order clarified that businesses operating consent-based text marketing programs are exempt from the new registration requirement, but the statute continues to create additional compliance obligations for Texas-based recipients.²¹

West Virginia (proposed 2026): Legislation proposed in 2026 would expand “telephone solicitation” to include surveys, impose a three-call daily cap, and enact criminal penalties for spoofing — illustrating the direction of state legislative activity.²²

For franchise networks operating across multiple states, compliance must be evaluated against the most restrictive state law applicable to each recipient’s location, not just federal TCPA.

Section 8: A Compliance Framework for Franchise SMS Programs

The following represents the minimum infrastructure a franchise network should have in place before operating an SMS marketing program.

Conclusion

The TCPA litigation environment of 2025 & 2026 is not a temporary phenomenon. The acceleration in class action filings, the increasing sophistication of the plaintiff’s bar, the emergence of professional plaintiff networks, and the proliferation of state mini-TCPA laws layered on top of federal requirements represent a structural shift in the compliance risk facing franchise networks of every size.

The franchise model’s multi-location structure creates compound exposure that single-location businesses do not face. Siloed opt-out systems, inconsistent consent capture across locations, and franchisor vicarious liability when corporate touches the texting program are franchise-specific vulnerabilities. The cases of Heartland Automotive Services, Keller Williams Realty, and others make the financial stakes concrete: these are not hypothetical risks. They are documented outcomes.

Franchise networks that architect their SMS programs for compliance from the start — with brand-wide opt-out infrastructure, documented consent, automated quiet hours enforcement, and a complete audit trail — are the ones that avoid these outcomes.