The Privacy Filter: SB 140 Explained: New Rules for Text Message Marketing

In this episode, Brian McGinnis is joined by Megan New to break down Texas SB 140 and what it means for companies that rely on SMS to engage customers. They walk through how the law builds on the federal TCPA, why it initially created significant disruption, and how recent developments have clarified (but not eliminated) compliance risk.

The conversation focuses on what’s changed, where uncertainty remains, and how organizations can adapt their marketing programs to reduce exposure.

Transcript

0:00

Welcome to the Privacy Filter, Barnes and Thornburg's briefing on privacy law and policy. Subscribe for the latest updates. Welcome back, everybody. Thank you for joining us here on Decrypted the Privacy series. This is a show that we're trying out that focuses on privacy, data protection, and AI issues focused on businesses, the types of businesses that we work with and our clients' needs across the legal space at the intersection here of technology and the law. My name is Brian McGinnis. I'm a partner at Barnes and Thornburg Law Firm based out of our Indianapolis office. I help head our data security and privacy practice group. And pleased to have alongside us today Megan New, my partner in the Chicago office of Barnes and Thornburg, where she is the head of our advertising, marketing, and promotions practice group. Megan's a trial lawyer, protects IP, including in disputes involving false advertising, trademarks, and other marketing-related claims. She's led high-stakes IP and advertising cases across industries and regularly works with brands aligning legal strategy to their businesses and marketing goals. Megan, thanks for joining us. Thanks for having me. All right. So today a little something definitely out of my wheelhouse, but certainly in yours, Megan. I want to talk through Texas and SB 140 and what's been going on over the last few months with that. So we know that Texas has expanded their telemarketing rules to pull many of these marketing text messages that a lot of our clients regularly send into a regime that has historically been more focused on telemarketing phone calls as opposed to text messages. And I know that this caused quite a lot of uh consternation amongst our clients and some changes in the way they had to operate their marketing programs. I understand there's some requirements, including registration, a 10,000 security bond, at least initially, uh, and a more plaintiff-friendly framework for lawsuits when something goes wrong or maybe doesn't live up to uh what the law wanted exactly. Right. If a business is relying on text messages to reach their customers, it's now forced to consider not just with the federal government and TCPA, like we always have uh had to worry about, say, but now whether an individual state in this case expects us to register, post a bond, potentially defend itself under uh a regime that provides for enhanced remedies tied to that particular state law. The recent settlement case has been brought by an industry group, it's carved out some relief for these programs that uh I think has calmed down some of the initial concern about this law that uh if you can prove prior consent, especially around the registration and bond requirements, uh, but it's also highlighted how important it is in this area to have clean consent flows for your text messaging programs. And of course, in this space, uh strong documentation and policy around that is gonna be really important. So for some companies, this means they can maybe unwind some of the registrations they made initially uh out of caution. But for others, it's a bit of a wake-up call that they've got some work to do to fix their SMS practices before a regulator or plaintiff's firm tests the limits of these rules. So with that, Megan, I want to dig into what's actually changed in Texas, uh, what our client teams should learn that depend on the SMS marketing, how do they do it the right way now, and how do they stay on the right side of this new landscape? Uh so with that as our background, I guess before we get too far into the details, uh I'd like to hear from you and your words, just give us a little bit of that Texas SB 140 story in a in a few sentences. Why has this been such a big deal for our clients? Sure. So prior to the passage of SB 140 in Texas at least, the governing law was really the TCPA, which is the federal law that regulates solicitation of consumers by telephone. And probably many of our clients are familiar with TCPA litigation. Um, it has been a very hot topic at the plaintiff's bar for years. And it is an issue that, you know, there have been repeated cases trying to seek clarification of how that law works. Many states have what we call a mini TCPA, so sort of their own state-specific rules around solicitation by phone. Texas, through SB 140, expanded its mini TCPA to address not just telephone calls, but now to include SMS text message marketing. Obviously, that is a big deal for a few reasons. Number one is that so many businesses communicate now by text message. And I think probably anybody listening to this podcast probably gets a couple text messages a day from retailers, from healthcare providers, from wellness groups, from your gym. Um, and you always have the option to opt out, but you're usually receiving those messages, usually because you've opted in. So SB140 is now regulating when, where, and how those text messages can be sent. But also the big deal was Texas is a huge market, right? There are millions and millions of people who live in Texas. And so if you have an SMS text message marketing plan and you are sending hundreds of thousands, if not millions, of text messages into the state of Texas or to people with a Texas telephone number, um, you have to be very aware now of the requirements of SB 140. Yeah. So certainly understandable why this really threw a lot of companies for a loop in your experience hearing from clients like were there certain types of businesses that were the most worried? Uh, what were you hearing from clients, at least initially? No, I would say no, there's not a specific type. I have I personally have talked to retail clients, clients in the food and hospitality industry, marketing and PR firms. We've talked with, you know, the businesses that run the SMS programs for the retail industry, for the food and hospitality industry, et cetera. I've talked to wellness companies, um, both like fitness-focused companies and supplement-focused companies. I've talked to healthcare providers and we've talked to pharmaceutical companies. So it really does kind of run the gamut, which I think shows, and maybe we don't even appreciate it, but SMS text message marketing is so pervasive now in how you communicate with so many businesses. Yeah, absolutely. So does it extend beyond just SMS in any way? Uh, what about other types of promotions that get sent, I don't know, through mobile devices? Like what? Like a like an alert or a notification through an app or something like that. I guess any other means that this would touch, or we're strictly talking about SMS messages. Yeah, we're just talking about so now the Texas mini TCP8 covers telephone calls and SMS text message marketing. Right. Okay. So still that traditional telemarketing piece as well is touched? Yeah. Yes. Yes. Okay. I guess maybe we'll dig in a little bit more than in business terms, I guess. What has SP 140 changed for these companies across all these various industries that are sending marketing text into Texas? What's sort of the best practice now or what's the big change uh perhaps from the way that they're used to operating? Yeah, I think the biggest thing now is something that you mentioned at the beginning, which are, you know, essentially what are best practices in terms of information flow? How do you make sure that you are sending messages to people who have consented? How do you identify whether you are sending messages to people who have not consented or who have opted out? If somebody does opt out, how do you ensure that they are immediately removed from getting any additional text message communications? Um, how do you communicate with customers to ensure that they are aware that they have the option to opt in or opt out? So, you know, and some of those things are probably in place for a lot of businesses because of the TCPA. Right. But now there are more, there's just so much more on the line under SB 140 because it does create a private cause of action that didn't exist before in Texas. And it does involve heightened damages awards and more available remedies for plaintiffs. So it is, again, clients should always be complying with the TCPA, but it has created sort of an additional incentive, so to speak, for clients to be hyper-aware of how that information flow is working in terms of, again, whether, when, and how they can communicate with customers through SMS text message marketing. Yeah. And so consents is something that we talk a lot about in my world, primarily in the privacy and AI space. When do you have to get a consent? When is the notice sufficient? What does that look like? And then how do you track all those things? I guess where do you see things settling out or what are they seeing currently uh with respect to best practices for this particular law when you're targeting this? And I guess how does that slot into their broader programs in terms of consents and tracking all of that? Yeah. So maybe let's take a little step back. So one of the things that SB 140 did is it said, look, there are a bunch of exemptions here. There are there are different ways that you don't have to comply with this registration requirement. But if you don't qualify for an exemption, you have to go through this very arduous process of registering with the Texas Secretary of State. You have to pay a $10,000 bond. And then you have to renew the registration every year. And the law created a situation where marketers could not send SMS text messages unless and until the registration had been accepted and they had paid the bond. So there were going to be there's a lot of work that had to be done if you didn't qualify for an exemption and you had to wait for you had these delays of waiting for the state to approve the registration. There were a lot of questions around the idea of consent at the time that the law was passed, because the law wasn't clear about whether it applied to consent-based text message marketing. So if prior to the passage of SB 140, you already had asked customers or potential customers to opt in, they had agreed to receive text message marketing and then you were communicating with them by text message, were you exempt or did you have to register anyway? And there was a lawsuit that I think we'll talk about later that did seek clarification on that. We now know, and the state of Texas has now clarified that SB 140's registration requirements do not apply to consent-based text message marketing. So if you if you are only texting people who consent, you do not have to register with the state. But it kind of circles back to what we talked about a minute ago. And they can do that for it, right? Yeah. Right. And you can set up different ways for customers to do it, right? They can do it on your website, they can do it when they complete a purchase. Um, they can do it at a point of sale, you know, when you pay in person and you can put your email address or your phone number in. There are different ways to do it, but then you have to give them the option to opt out every time you text them. So it does create a lot of, I think, sort of rigidity around consent and marketers have to be hyper aware of making sure that they are only texting people who have consented. And if people don't want those text messages anymore, they better be removed from the data set as quickly as possible. Because I think that is going to be one of the highly litigated issues coming out of SB 140 if we think about these private causes of action that have been created. Yeah. And I definitely want to dig in on the litigation side before we get to that piece next. One of the things that stood out to me is this $10,000 bond. Talk us through a little bit about why was that put in there? What is the effect and impact of that? Yeah. So I think the purpose of the $10,000 bond is to make sure that people are complying. Um, I mean, you got to have a little bit of skin in the game and make sure that you are, you know, reporting the information that you need to report to the Secretary of State for Texas. And um, you're giving the state a way to exercise its control over you through that bond if you don't comply with the law. And so I, you know, I think it it is a way for the state to ensure that marketers really are complying with the law, not just registering and then saying, okay, we registered, we can go do whatever we want. Now you have to register, but you also have to continue to follow all of the other requirements of the law. Because, you know, just because a customer is consented doesn't mean that you don't have to follow the law. You still have to follow the law. You just don't have to go through the registration requirements. Yeah. Interesting. Recall they threw in. All right. So tell us a little bit about some of the litigation that started to come out. I know some came pretty, pretty quickly after the law was passed or went into effect anyway. Yeah, very quickly afterwards. There was a litigation filed by um three plaintiffs, the e-commerce innovation alliance, which is just a nonprofit that works with, you know, various online e-commerce um companies to ensure that there are fair like legal and regulatory policies in place. Industry group. I'm sorry, an industry group. Yeah, exactly. Postscript, which is a company that administers SMS text marketing for its customers, and then an actual footwear retail brand called Flux Footwear. And they um sued the state of Texas and sought an injunction saying that it was unconstitutional for the um state to be regulating consent-based text message marketing. And in briefing on the um motion for an injunction, the state admitted that the law was not meant to apply to consent-based text message marketing. And the Secretary of State, the so the case settled very quickly, and the state later clarified, and you can actually now see it on the Secretary of State website, that if you are engaged in only consent-based marketing, a company does not have to register with the Secretary of State and pay that bond. If a company has already registered and that paperwork is pending, you can withdraw the paperwork. Um, I I don't know actually what the answer is. If you have already registered, paid the bond, and been approved. I I guess I would go back to the Secretary of State and ask for my money back. But um, you certainly wouldn't have to renew in a, you know, in a year when the law would require you to typically renew if you weren't engaged in consent-based text message marketing. What would go into the decision to try and withdraw the registration? Why not just leave it if you've already registered? Because then you don't have to pay the bond. So if you've already applied, but you're but it's pending, you're not required to register anymore if you if you've ensured that you're only engaged in consent-based marketing. Now, if you we I actually have talked to some clients who want to reach out to prospective customers who may not have consented. And so so clients like that would still register anyways, if you had, like, for example, a mix of customers who have consented and customers who may be receiving a text message for the first time and have not yet provided consent. Let's sort of put a pin in whether or not that might be a violation of the TCPA, but it is a question that I've been asked by a couple different clients. All right. So these lawsuits came pretty quick uh on behalf of the industry and presumably plaintiffs that are heavily involved in text messaging, automatic. How did that change Texas's position? You mentioned at least one of those cases was settled very quickly. Um I guess what does it look like post at least those initial lawsuits? How did that change things? It's very quiet now. Um it is when the law first passed, um, we had a lot of questions from a lot of clients about what does this mean and what are we supposed to do? And helping clients sort of figure out what their actual practices are. Now that Texas has clarified that if you're engaged in the consent-based marketing, you don't have to do the registration requirements, the focus has really shifted more to let's make sure that we have best practices in place. Let's make sure that we know how that information flow is working. How do we ensure that we're only texting people who consent? How do we ensure that we're removing people who opt out? So it shifted a, you know, sort of away from do I have to, you know, do I qualify for an exemption and and um do I have to register with this for the Secretary of State? And it shifted more to an internal focus. And it's caused a lot of clients to have to start going and reviewing what their practices are and ensuring that they have mechanisms in place to continue to comply with the law. Aaron Powell Other big, like still unsettled questions based on the statutory reading and the litigation that we've seen thus far that we expect to be answered in the short term, or has the dust kind of settled as it were, and now it's more you said, or like you said, about the internal compliance and governance? Yeah, there are, you know, there are still a couple issues. Um, one is do you have to register? Um, so there are still, you know, let's sort of take the consent piece off the table. There are other exemptions that that are available, and a lot of clients do have questions about whether they qualify for those exemptions. And some of that is a little unclear. For example, there's an there's a an exemption for companies who text former or current customers and have had the same name for the last two years. And I think there's some uncertainty around like what is a former customer? Is it someone who you had consented to receiving the marketing and then and then withdrew? Is it somebody who actually made a purchase? Is it somebody who, right? I mean, there's a lot of vagueness around like what a former customer is. What if a customer or excuse me, a consumer is on the national do not call registry, but then they opt, they've opted in to receive text messages. Yeah. There could also be a question, there are quiet hours on, there are quiet hours under the TCPA. And then there are also more strict quiet hours under the under SB 140, which I believe is no text messages after noon on Sunday. And I personally get so many text messages on Sunday afternoons and evenings. And I always think about like, I wonder if people in Texas are getting these text messages. So that could be an issue too. Um, and then one thing that we have seen, I've had a couple of clients who have received notice letters, um, like pre-litigation notice letters, where consumers have claimed that they didn't opt in. And we have been able to resolve all of those because luckily every client that those letters have been directed to did have like very clear documentation of when the customer opted in and opted out. But I do think that we're going to see a lot of sort of fishing expeditions to see just what the what the documentation of the consent looks like. Yeah. Um, so I think we're gonna see a lot of testing of the waters on that from plaintiff's counsel to see if maybe you are engaged in consent in what you think is only consent-based marketing, but maybe you don't have the right documentation to be able to prove that that's the case to a plaintiff's attorney or to a court. So those are some of the issues that we're continuing to see. But for the most part, a lot of the focus now is internal for best practices for clients and and for the marketing teams that they work with. Yeah. Huge risks there too, right? I mean, you've got this private right of action always opens the door to this stuff. And then if you get a huge class who's all going in and saying maybe even like a particular third-party vendor that you utilize for your consent documentation isn't sufficient for some reason, I'm sure they'll poke around on that. Exactly. Interesting stuff. So unfortunately, it sounds like SP 140's not uh not gone. Some of the early dust is settled, but yeah, uh still very much something that needs to be included as part of people's compliance programs, text messaging policies, procedures, et cetera. Um so why don't we close out here with like let's get super practical into it? What do we do about this, right? So it's still an issue, it's not going anywhere. There's uh Texas, perhaps other states come along that pass similar laws seeing what's being done here. And then, like you said, we still have federal requirements under TCPA and otherwise. Uh so very practically speaking, I guess what can we tell clients in this new landscape? How do they work this into their overall compliance and what do they need to make sure that they have done uh here in let's say Q1 of 2026? Yeah. Initial matter, right? Like make sure you are getting consent for people, you know, to opt in to the text messages that you want to send. A lot of clients now work with these third parties like Postscripts, who sort of manage a lot of those communications for them. So you want to make sure that you, whether whether you're doing it internally or you're working with an external company, you want to make sure that you understand for every text message campaign that we're sending out, you know, how who is it going to? How are we ensuring that those people have consented? Um, are we including an opt-out when we send the text message? Um, and what practices do we have in place to A, maybe remove people where consent is unclear prior to the campaign going out, and B, remove Moving people who may respond to the camp campaign with a request to opt out. I think those are sort of really most important things that you need to be doing in order to comply. I think you also want to make sure that, again, whether you're doing it internally or you're using an external third party to actually disseminate the marketing for you, you want to make sure that they are, you know, abiding by the quiet hours, that they are checking the do-not-call registry. I my my understanding is that if you have opted into the to an SMS marketing campaign, that sort of overrides the do-not call registry. But I do have some clients who have talked about like if you're on the do-not-call registry, we just take you off. Like we will not send you text messages even if you ask for them. So that's another thing to consider. And then make sure you have a way that you're documenting all of this. So one of my clients, luckily, they got a notice letter, and within a day, I had a record of when the potential plaintiff had opted in. I had a record of every single text message campaign that she had received. I had the date that she had opted out, and then I had clear documentation that she had not received a text after that date. So make sure you have some software system in place that is keeping track of that. And make sure that you have a realistic document retention policy that will allow you to like hold on to that stuff because you could send a text message in 2026 and get a notice letter in 2027 or 2028. So it's something to think about in terms of making sure that you have that data at your disposal if and when you do get a notice letter. Yeah. Great tips. Uh, really helpful. Let me close out then. Anything you're keeping your eye on in this space, anything that's coming next or down the pipeline that we should be aware of? Um, we are kind of keeping our eye on, you know, as as happens a lot, there tend to be like a few plaintiff counsel firms that sort of lead the pack on testing the waters with these new laws. We're kind of keeping an eye on who that is and trying to see what level of success they are having. We haven't seen much yet, but you know, SB 140 only passed in September of last year. So I think we're sort of headed in the direction of more litigation. Um, and then, you know, just keeping an eye on other parties that have challenged the law in other ways besides um on the consent issue to see if we can get further clarification on on some of the ambiguities in the law. Perfect. I think, and you know, there one thing we didn't really talk about, but there are these like very excessive fines and penalties and damages awards that can that are available under SB 140, including damages for mental anguish from I apparently receiving too many text messages. I'd like to kind of see how that unfolds. I'm not yeah, who knows if a case will ever get to a point where a plaintiff actually um claims mental anguish damages, but it'd be very interesting to see how a plaintiff proves that um and on what kind of damages award you could actually get for that. Yeah. I'm sure they'll get there at some point if it's in the law. Yeah, I think so. Might take a little time, but we're keeping our eye on it. Well, I think we're at time because the lights in this room just shut off on amazing. I saw that. We'll we'll we'll call it there. But Megan, awesome, amazing. Thank you. Uh, and thanks for all the help that you've given uh our clients on on these issues. I know you guys have been staying on top of it, but uh always great to get an opportunity to work with you. So appreciate you coming on and uh sharing some knowledge. Thanks for having me. I appreciate it.