Most residential window contractors think compliance starts and ends with TCPA federal rules. That's incomplete. Several US states have layered “mini-TCPA” statutes on top of federal law, with stricter consent requirements, broader coverage, and in some cases lower thresholds for what triggers liability. A contractor operating across multiple states inherits the strictest applicable rule for each customer's location. Here's the framework, the most-active state laws to know, and the practical compliance posture that protects you.
The compliance pyramid
For SMS and call compliance, three layers stack:
- Federal TCPA, the federal floor. Applies everywhere. TCPA basics here.
- State-specific statutes, additional requirements based on the recipient's state.
- Carrier rules (A2P 10DLC, TCR), commercial SMS routing requirements layered on top of legal compliance.
Compliance posture must satisfy the strictest applicable layer for each contact. For a multi-state contractor, that effectively means designing the system to satisfy every layer.
The lookup-by-recipient principle
The state laws to know
Florida, FTSA (Florida Telephone Solicitation Act)
Florida Statutes section 501.059 is the one most contractor compliance conversations start with. What the statute actually says:
- Prior express written consent is required for a telephonic sales call made with an automated dialling system, a recorded message, or a prerecorded voicemail.
- That consent is defined tightly. The written agreement has to bear the called party's signature, clearly authorize the person making or allowing the call, include the telephone number being authorized, and carry a clear and conspicuous disclosure that the called party is not required to sign it as a condition of purchasing anything.
- Damages: a called party aggrieved by a violation may recover actual damages or $500, whichever is greater, and the court may increase the award to not more than three times that amount for a willful or knowing violation. There is an express private right of action.
- Note what is not in section 501.059: a calling-hour restriction. Earlier versions of this article said Florida ran a stricter 8 a.m. to 8 p.m. window. The hours you must actually observe come from the federal rule, which bars telephone solicitations to a residential subscriber before 8 a.m. or after 9 p.m. local time at the called party's location. Florida's separate do-not-call provisions live elsewhere in chapter 501; read them with counsel rather than relying on a summary.
Window contractors with Florida customers should design their consent capture to the section 501.059 definition, because it is the most prescriptive one most of them will encounter.
Oklahoma, Telephone Solicitation Act of 2022
Oklahoma enacted its Telephone Solicitation Act of 2022 with contours similar to Florida's: prior express written consent for automated commercial calls, a restriction on the hours calls may be made, a cap on how many calls on the same subject may be made to one person in a 24-hour period, and a private right of action with damages that may be trebled for willful violations. Read the enacted text before you set your dialler rules.
Washington, CEMA (Commercial Electronic Mail Act)
Washington's chapter 19.190 covers commercial email and commercial text messages, barring misleading subject lines and false transmission information. On damages, correct a figure that circulates widely and appeared in an earlier version of this article: the statute sets damages to the recipient of a commercial electronic mail message or text message at $100, or actual damages, whichever is greater, not $500. Damages to an interactive computer service are $1,000 or actual damages, whichever is greater. The exposure is still real at volume, and it is a per-message exposure.
Massachusetts, General Laws chapter 93A
Massachusetts runs unfair telemarketing practices through its general consumer-protection statute rather than a dedicated mini-TCPA. Chapter 93A has its own procedure and its own remedies, and neither maps cleanly onto the statutes above. If you message Massachusetts consumers, read section 9 with counsel rather than working from anyone's summary of it, including this one.
California, multiple statutes
California layers several statutes: the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) on data privacy, and the Invasion of Privacy Act on recording. On the recording point the statute is specific. Penal Code section 632 makes it an offence to use an electronic recording device to record a confidential communication without the consent of all parties, with fines up to $2,500 per violation and up to $10,000 per violation for a repeat offence. That is a criminal provision, not a civil compliance box.
Various other states
Several other states run narrower telemarketing or robocall statutes, some of which add registration requirements for telemarketers. Coverage and damages vary enough that a summary is worse than useless; what your CRM needs is the ability to track the recipient's state and apply a rule per state, so that adding one later is a configuration change rather than a rebuild.
Why the lead form is the exposure
Practical compliance posture for multi-state operations
For a window contractor operating in multiple states, the cleanest compliance approach is a single high-bar standard that satisfies all applicable state rules:
1. Express prior written consent on every form
Single TCPA-compliant consent text that names your specific business, covers SMS + autodialed calls + prerecorded messages, includes opt-out instructions and HELP keyword. No bundled “and our partners” language.
2. Server-side consent record capture
At submission: exact consent text shown, IP address, timestamp, page URL, user agent. Stored alongside the contact record. Our own retention policy is to keep it for at least four years, on the reasoning that the record needs to outlive the window in which a claim can be brought; set yours with counsel. Compliance audit framework here.
3. State-aware sending hours
The federal floor bars telephone solicitations to a residential subscriber before 8 a.m. or after 9 p.m. local time at the called party's location. Some states run a tighter window, Oklahoma's act among them. Defaulting your whole operation to 8 a.m. to 8 p.m. in the recipient's local time clears both without needing a lookup table, which is why we set it there. Your CRM has to know the recipient's state and time zone either way.
4. STOP/HELP keyword propagation
STOP / STOPALL / UNSUBSCRIBE / CANCEL / QUIT / END all propagate to the do-not-call list immediately. On the deadline: the current federal rule requires a do-not-call request to be honoured within a reasonable time that may not exceed ten business days (the limit was 30 days before the Federal Communications Commission amended the rule in 2025), and CASL sets the same ten-business-day outer limit for unsubscribe requests from Canadian recipients. Both are outer limits, not targets. Process within minutes via SMS platform automation.
5. All-party-consent recording where required
California requires the consent of all parties to record a confidential communication, under Penal Code section 632. Several other states apply an all-party standard rather than the one-party standard federal law sets, and the list is not static. If your AI receptionist or your sales reps record calls, run a beginning-of-call disclosure on every call rather than trying to branch by state, and confirm the current list with counsel.
6. State-specific privacy disclosures
California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Washington (My Health My Data), Oregon, Texas, and others all have state privacy laws. Privacy policy should address each.
The CRM-side requirements
State-specific compliance requires CRM-level capability:
- Recipient state and time zone tracked per contact.
- State-aware sending logic that applies the strictest applicable rule to each outbound message.
- Consent metadata stored server-side, queryable for discovery requests.
- DNC list propagation across all messaging systems.
- Audit logging for all sends and consent updates.
Most contractor CRMs handle some of this; few handle all without configuration work. CRM selection considerations here.
The legal-review cadence
State telemarketing law is genuinely volatile in 2026, new state statutes emerging, federal interpretations shifting. Recommended cadence:
- Annual review of consent text and disclosures with counsel.
- Quarterly audit of CRM compliance configuration.
- Real-time monitoring of major-state legal updates (Florida and California specifically).
- Documented compliance trail in case of plaintiff demand letter.
Per message
The unit every one of these statutes prices in. Florida allows actual damages or $500, trebled to three times that for a willful or knowing violation. Washington sets $100 or actual damages to the recipient of a commercial email or text. Multiply either by a list size and the reason to get consent right is arithmetic, not caution.
Sources
- 47 Code of Federal Regulations section 64.1200, the Federal Communications Commission telemarketing rules, the source for the bar on solicitations to a residential subscriber before 8 a.m. or after 9 p.m. local time and for honouring a do-not-call request within a reasonable time not exceeding ten business days.
- Florida Statutes section 501.059, the source for the prior express written consent definition, for recovery of actual damages or $500 whichever is greater with up to three times that for a willful or knowing violation, and for the private right of action.
- Oklahoma House Bill 3168 as enrolled, the Telephone Solicitation Act of 2022, which requires prior express written consent, restricts calling hours, caps calls on the same subject within a 24-hour period, and provides a private right of action with damages that may be trebled.
- Revised Code of Washington section 19.190.040, which sets damages to the recipient of a commercial electronic mail message or text message at $100 or actual damages, whichever is greater, and damages to an interactive computer service at $1,000 or actual damages.
- California Penal Code section 632, which makes it an offence to record a confidential communication without the consent of all parties and sets the fines for a first and a repeat offence.
Ready to talk numbers on your own pipeline?
On the strategy call, we'll lay out the plan we'd run for your business and talk through how it fits your market.
Final thought
TCPA federal rules are the floor, not the ceiling. State statutes layer additional requirements that can produce substantial liability for contractors operating cross-state. The cleanest posture for a multi-state residential window contractor: design to the strictest applicable rule, capture compliance metadata robustly, configure the CRM for state-aware sending, and review annually with qualified counsel. The cost of doing this right is an order of magnitude less than the cost of getting it wrong.
This article is for informational purposes only and is not legal advice. State and federal telemarketing law changes frequently. For specific compliance questions about your business, consult qualified counsel.
Tagged