Abandoned-Cart and Order Texts: TCPA Rules for Online Stores

Order and shipping updates are usually informational under the Telephone Consumer Protection Act. Cart reminders and win-back offers usually count as marketing, as do most texts with a discount code, because federal law asks whether a message was sent “for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services.” The label decides what consent a store needs and whether Do Not Call rules apply. A store that can show which flow sent each text has more defenses than a demand letter assumes.

Which store texts are marketing, and which are informational?

The test is why the store sent the message, and one text can have two purposes.

The FCC’s rules define telemarketing as “the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services, which is transmitted to any person,” and an advertisement as “any material advertising the commercial availability or quality of any property, goods, or services,” under 47 C.F.R. § 64.1200(f). A text telling a buyer that the order shipped doesn’t encourage a purchase. A text reminding a shopper that a jacket is still in the cart usually exists to close that sale.

The FCC said in its 2003 TCPA order that these “dual purpose” messages would, in most instances, be unsolicited advertisements, explaining that such messages may “inquire about a customer’s satisfaction with a product already purchased, but are motivated in part by the desire to ultimately sell additional goods or services.” The Ninth Circuit applied that idea to a retailer in Chesbro v. Best Buy Stores, where calls urging members to redeem rewards points were treated as marketing. The court wrote: “Neither the statute nor the regulations require an explicit mention of a good, product, or service where the implication is clear from the context.”

Here’s how I’d sort the common e-commerce messages:

The FCC’s shipping exemption doesn’t cover a store’s own delivery texts. The exemption in § 64.1200(a)(9)(i) covers “Calls made by a package delivery company to notify a consumer about a package delivery,” and only when the notice is free to the recipient and meets seven conditions, one of which is that it contain no “telemarketing, solicitation, or advertising content.” A store’s own shipping text rests on the consent the buyer gave at checkout.

Back-in-stock alerts are marketing in content, but the customer asked for them. The federal definition of a telephone solicitation excludes a message sent “To any person with that person’s prior express invitation or permission” under § 64.1200(f)(15). For Registry numbers, though, the rule’s permission defense calls for a “signed, written agreement between the consumer and seller,” under § 64.1200(c)(2)(ii), and an autodialed alert would also need written marketing consent. The sign-up form is the proof, so keep it.

Why does the label change a store’s exposure?

Because different rules attach to marketing texts, and the informational label takes a text out of most of them.

The robotext rules. Unless it’s sent for an emergency or under an FCC exemption, any text sent with an autodialer to a cell phone needs prior express consent. Marketing texts sent that way need more: prior express written consent, meaning a signed agreement (an electronic signature works) to receive marketing messages at that number, under § 64.1200(a)(2). Exposure under the statute’s robocall provision is $500 per violation (or actual loss, if greater), and a court may increase it to up to three times that amount, or up to $1,500 on a $500 award, if the violation was willful or knowing, under 47 U.S.C. § 227(b)(3). An autodialer needs “the capacity to use a random or sequential number generator to either store or produce phone numbers to be called,” as the Supreme Court held in Facebook, Inc. v. Duguid, and our post on autodialer defenses after Duguid covers how that fight plays out for texting platforms.

The written-consent requirement itself comes from the FCC’s rule, not the statute’s text. In June, in a private TCPA case, the Supreme Court held in McLaughlin Chiropractic Associates v. McKesson Corp. that “District courts are not bound by the agency’s interpretation, but instead must determine the meaning of the law under ordinary principles of statutory interpretation, affording appropriate respect to the agency’s interpretation.” That opens new defense arguments, but I wouldn’t build a checkout flow around them.

The Do Not Call rules. For texts, these reach only marketing. The FCC bars a “telephone solicitation” to a residential subscriber whose number is on the National Do Not Call Registry (the federal list of numbers whose owners have opted out of sales calls) or outside calling hours, and it requires an internal do-not-call list for “any call for telemarketing purposes,” under § 64.1200(c) and (d). The rule says those protections reach “telephone solicitations or telemarketing calls or text messages to wireless telephone numbers,” to the extent described in the FCC’s 2003 order. A private claim belongs only to someone who received “more than one telephone call within any 12-month period by or on behalf of the same entity” in violation of the FCC’s Do Not Call regulations, and the damages are “up to $500” per violation, up to three times that if a court finds the violation willful or knowing, under § 227(c)(5). The same subsection gives a defense to a company that “has established and implemented, with due care, reasonable practices and procedures” to prevent violations. A shipping update isn’t a telephone solicitation, so it shouldn’t support one of these claims on its own.

Whether a text is a “call” for Do Not Call claims. District courts split on this in 2025, and all three decisions concern § 227(c)(5). In Jones v. Blackstone Medical Services, a federal court in Illinois concluded in July that “under a plain reading, Section 227(c)(5) of the TCPA does not regulate text messages,” and the case is on appeal to the Seventh Circuit. A Florida federal court reached the same result in August in Davis v. CVS Pharmacy. In October, a federal court in San Jose went the other way in Wilson v. MEDVIDI, holding that the texts in that case were telephone calls under § 227(c), though it dismissed the complaint, with leave to amend, on other grounds. I’d raise the argument for any store facing Do Not Call claims based on texts alone. A store sued in California federal court shouldn’t count on it.

What should the checkout phone field and SMS checkbox say?

Keep the order-updates number and the marketing consent separate, and make the marketing box something the shopper checks on purpose.

Prior express written consent is a signed agreement that “clearly authorizes the seller to deliver or cause to be delivered to the person called advertisements or telemarketing messages” by autodialer or recorded voice, names the number, and tells the shopper in a clear and conspicuous disclosure that signing isn’t required “as a condition of purchasing any property, goods, or services,” under § 64.1200(f)(9). An electronic signature counts if federal or state law recognizes it. At checkout, that can be a box the shopper checks next to the disclosure, logged with a timestamp and the page version. Our post on sweepstakes texts and TCPA consent covers the same disclosure when the number comes from a giveaway entry.

I’d leave the box unchecked by default and keep its language apart from the order-updates notice. A pre-checked box invites the argument that the shopper never agreed to anything, and one disclosure covering both order texts and promotions blurs the record a store needs when a cart reminder is challenged. That record matters because the store carries it. In the Ninth Circuit, “Express consent is not an element of a plaintiff’s prima facie case but is an affirmative defense,” as the court put it in Van Patten v. Vertical Fitness Group.

Timing matters for cart reminders in particular. If the shopper typed a number into checkout and left without checking the marketing box, the store has a number for an order that doesn’t exist and, unless it got consent some other way, no marketing consent. Cart flows should fire only for numbers that opted in before the cart was abandoned.

Stores that gather numbers through partners or lead forms can stop worrying about the FCC’s one-seller-at-a-time consent rule. The Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, agreeing “that the FCC exceeded its statutory authority,” and the FCC removed the rule text effective August 29, 2025, according to its Federal Register notice. The consent still has to authorize the seller, though, so a partner’s form that never names the store is a weak record. Keyword sign-ups raise their own record questions, which our post on text-to-join and double opt-in consent works through.

What happens when a customer replies STOP to an order update?

Texts that rely on consent under the FCC’s rules have to stop, and a store shouldn’t wait for the April 2026 deadline to stop the rest.

Since April 11, 2025, for robotexts and Registry texts that rely on consent, the FCC’s rules treat a reply of “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” as a reasonable way to revoke consent per se, and a reply in other words counts “if a reasonable person would understand those words to have conveyed a request to revoke consent,” under § 64.1200(a)(10). Revocations “must be honored within a reasonable time not to exceed ten business days from receipt of such request.” A store may send one confirmation text, with no marketing in it, as its only further message, and “If the confirmation text is sent within five minutes of receipt, it will be presumed to fall within the consumer’s prior express consent,” under § 64.1200(a)(12). That text may ask whether the customer meant to stop every category of message, but if the customer doesn’t clarify, the store must stop all texts that require consent.

One piece of the 2024 rules isn’t in force yet. The FCC’s Consumer and Governmental Affairs Bureau delayed until April 11, 2026 the requirement that a revocation in response to one type of message be treated “as applicable to all future robocalls and robotexts from that caller on unrelated matters.” So for now, the delayed revoke-all provision doesn’t by itself require a store to treat a STOP sent to a shipping update as revoking consent for unrelated marketing texts. The confirmation-text rule above and the do-not-call rules can still reach those texts.

I’d build one suppression list now anyway. A STOP can also be read as a do-not-call request, and that kind of request ends the established business relationship with that seller for telemarketing purposes “even if the subscriber continues to do business with the seller,” under § 64.1200(f)(5). A store that keeps sending promotions after a STOP on any channel creates exposure it could have avoided.

Do quiet hours and state laws reach an online store?

Yes, for marketing texts, and the earliest state cutoff is the one to plan around.

The federal rule bars telephone solicitations to residential subscribers “before the hour of 8 a.m. or after 9 p.m. (local time at the called party’s location),” under § 64.1200(c)(1). Order and delivery updates aren’t telephone solicitations, so the federal rule doesn’t limit their hours. Cart reminders are the problem: a flow that fires an hour after abandonment sends at 11 p.m. to a shopper who left at 10. A store also has something a cold caller doesn’t, the shipping address. When the area code and the shipping address point to different time zones, I’d schedule by the stricter one.

State law adds tighter rules. Florida’s Telephone Solicitation Act defines a “telephonic sales call” as “a telephone call, text message, or voicemail transmission to a consumer for the purpose of soliciting a sale of any consumer goods or services,” under Fla. Stat. § 501.059, and our post on Florida Telephone Solicitation Act text claims covers its pre-suit STOP requirement. Maryland’s 2023 law, in effect since January 1, 2024, bars telephone solicitations between 8 p.m. and 8 a.m. in the called party’s time zone and more than three on the same subject in 24 hours, and its consent provisions expressly mention text messages, according to the enacted chapter. A send window of 8 a.m. to 8 p.m. local time for every marketing flow is a sensible starting point, with cart reminders that would land outside it held until morning, but check each state the store texts into for its own limits. Washington’s Commercial Electronic Mail Act reaches commercial texts too, covered in our post on Washington CEMA text claims.

What records should a store keep for each text flow?

Keep enough to prove, message by message, which flow sent a text and on what consent.

Before any claim arrives, that means a saved copy of every version of the checkout page and sign-up pop-up with the dates each ran, the consent log for each number, and a short internal document that labels each automated flow as informational or marketing. For marketing flows, the FCC requires a written do-not-call policy “available upon demand” and trained staff under § 64.1200(d), and the Registry safe harbor depends, among other conditions, on a registry copy no more than 31 days old and records “documenting this process.” Most of it lives in the texting platform, so I’d confirm how long the platform keeps it.

When a demand letter names one of your flows:

1. Preserve the messaging platform’s send and reply logs for the number, with timestamps, the flow or campaign behind each text, and the checkout or sign-up record that supplied the number.
2. Pull the number’s opt-out history across every flow, showing when each STOP or other reply arrived and when the platform suppressed the number.
3. Retrieve the National Do Not Call Registry scrub records, with the registry version dates, for any marketing flow that reached the number.
4. Assemble the checkout and pop-up versions the customer saw, the templates for each flow, and the contracts with the texting platform and any outside marketing agency.
5. Run any reply to the letter, any message to the customer, and any refund or credit offered to settle past a lawyer first.

The firm’s TCPA defense lawyers page summarizes how claims involving abandoned-cart and promotional texts are defended.

Questions online stores ask about text compliance

Is an abandoned-cart text telemarketing?

Almost always. A cart reminder exists to get the shopper to finish buying, which is the purpose the FCC’s telemarketing definition describes. The better questions are whether the shopper gave written marketing consent before leaving the cart and whether the platform is an autodialer at all. If the number is on the Registry, the store also needs a purchase, an inquiry, or written permission behind the text.

Can an order confirmation include a discount code for the next order?

It can, but then a plaintiff will call the whole message marketing. That’s the dual-purpose problem the FCC and the Ninth Circuit described. If a confirmation is sent to numbers without marketing consent, keep the code in the email receipt instead.

How long after a purchase can a store send promotional texts?

For the Registry rules, a purchase creates an established business relationship for 18 months and an inquiry creates one for three months, and either ends when the customer asks the store to stop. That relationship doesn’t satisfy the written-consent rule for autodialed marketing texts. A purchase alone isn’t a marketing opt-in.

When a cart-reminder text becomes a lawsuit

If your store is accused of sending marketing texts dressed up as order updates, the checkout records and the flow behind each message usually decide the case. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving abandoned-cart and promotional texts. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on November 7, 2025. The FCC materials are the 2003 TCPA Report and Order, FCC 03-153, 18 FCC Rcd 14014, and the Consumer and Governmental Affairs Bureau’s order in DA 25-312 (Apr. 7, 2025). The rule removal is the FCC’s final rule at 90 Fed. Reg. 42137 (Aug. 29, 2025). Florida’s statute is Fla. Stat. § 501.059 (2025), and Maryland’s law is 2023 Md. Laws ch. 413, codified at Md. Code, Com. Law §§ 14-4501 to 14-4503.

The court decisions are Facebook, Inc. v. Duguid, 592 U.S. 395 (2021); McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., 606 U.S. 146 (2025); Chesbro v. Best Buy Stores, L.P., 705 F.3d 913 (9th Cir. 2012); Van Patten v. Vertical Fitness Group, LLC, 847 F.3d 1037 (9th Cir. 2017); Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025); Jones v. Blackstone Medical Services, LLC, No. 1:24-cv-01074 (C.D. Ill. July 21, 2025), appeal pending, No. 25-2398 (7th Cir.); Davis v. CVS Pharmacy, Inc., No. 4:24-cv-00477 (N.D. Fla. Aug. 26, 2025); and Wilson v. MEDVIDI Inc., No. 5:25-cv-03996 (N.D. Cal. Oct. 7, 2025).

This post is general information about the Telephone Consumer Protection Act and related laws as of November 7, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.