The FCC Will Let a STOP Reply Cover One Kind of Text. Your Messaging Code Has to Know Which Kind.

Say a user replies STOP to your app’s payment reminder. Can you still send their login codes?

Under the rule the FCC wrote in 2024, the safe answer was no. Under the rule that takes effect November 25, the answer for informational messages is yes, as long as the opt-out was aimed at a different category [1]. That’s a change to your data model as much as to your legal posture.

What the FCC changed

The FCC adopted FCC 26-67 on September 30 and released it October 1; the Federal Register published it October 26 as a final rule and a further notice of proposed rulemaking [1, 2]. The final rule does three things that matter if you send automated texts or calls.

Category-level opt-outs. Callers “may interpret a revocation request made in response to an informational call or text message” as applying only to “the specific category of informational robocalls and text messages to which the revocation was directed” [1]. The FCC’s example is a consumer who opts out of payment reminders and, under the old reading, would also lose fraud alerts, multi-factor authentication, appointment reminders and outage calls [1]. Marketing is different. An opt-out from a call or text with advertising or telemarketing revokes consent to all future marketing calls and texts from that caller [1].

An exclusive opt-out channel. Before, callers had to honor revocations made “using any reasonable method,” and in 2024 the FCC said callers “may not infringe on that right by designating an exclusive means to revoke consent” [3]. The new rule reverses that. A caller may make any of three methods the only one it processes: an automated key-press or voice opt-out on a call, reply-text words, or a website or phone number it designates [1]. The catch is disclosure. The method has to be “clearly and conspicuously” disclosed on the call or in the text [1]. Text senders can satisfy that by including just one standardized word, such as “stop,” in each message, but they still have to honor all seven: “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel” and “unsubscribe” [1]. A caller that skips the designation keeps the old regime: any reasonable means, with a rebuttable presumption that an undesignated request worked [1].

The FCC turned down one request that will matter to fintech and health teams. A commenter asked that callers regulated by another agency be allowed to use that agency’s opt-out method as their exclusive one. The FCC said the record didn’t show enough about those methods’ consumer protections [1].

Fraud alerts from banks. The exemption for financial institutions’ fraud and identity-theft messages to wireless numbers used to require that the customer gave the bank the number. Now a number from a “reliable source” works: one supplied by an authorized family member on the account, captured when the customer calls in, or in records from another financial institution [1].

The ten-business-day deadline to honor a revocation stays [1]. The FCC also declined a request to push the effective date out as much as 12 months after publication [1].

How the 2024 rule got here

The 2024 order is the rule this one replaces before it ever fully took effect. FCC 24-24 codified “any reasonable manner” revocation, set the ten-business-day deadline and listed the seven standard words, but the main revocation paragraphs were “delayed indefinitely” pending OMB review [3]. According to the new order, that delayed date had most recently been extended to January 31, 2027, and the November 25 date supersedes it [1].

Under that 2024 language, a revocation by any listed method meant “the caller may not send additional robocalls and robotexts” [3]. Agreeing with a broad range of commenters, the FCC now calls that requirement overinclusive [1]. One party filed an ex parte arguing the new approach makes compliance more complex; the FCC disagreed [1].

What this means if you send texts from a product

This part is opinion.

You need a category field, and you need to define it. The rule lets you scope an opt-out to “the specific category,” but the rule text doesn’t say what a category is [1]. Is “account security” one category, or are login codes and new-device alerts two? I’d want the answer written down before November 25, mapped to message templates, and stored per user and per phone number. If you can’t show which category a STOP answered, I don’t see how you get the benefit of the rule.

Mixed messages are a trap. A receipt text with a promo line at the bottom is arguably no longer informational. Under the new rule, an opt-out from a message with advertising stops all your marketing [1]. Keep the two streams apart in code, not just in copy.

Designating a channel is cheap; doing it halfway isn’t. If you designate reply words, every text needs the disclosure, and your inbound handler has to match all seven words [1]. If you send from a protocol that can’t take replies, each text has to say so and give another way out [1]. Teams that never designate stay on “any reasonable means,” which means a support email or a voicemail can count as a revocation [1].

The confirmation text changed too. The 2024 version of paragraph (a)(12) let a confirmation text ask whether the recipient meant to opt out of every category [3]. The revised paragraph printed this month doesn’t include that sentence, and the synopsis doesn’t say why [1]. The further notice separately notes a request from Vibes to allow exactly that kind of clarifying question [2]. If your opt-out flow sends a “Did you mean all messages?” reply, look at it again.

The FCC’s reading isn’t the last word in a lawsuit. The TCPA lets people sue over violations of the statute “or the regulations prescribed under this subsection” for $500 per violation, and a court can triple the award for willful or knowing violations [4]. In June 2025 the Supreme Court held in McLaughlin that district courts in those cases make their own call: “The District Court is not bound by the FCC’s interpretation of the TCPA” [5]. The FCC frames category-level revocation as “the better reading of the TCPA” [1]. I think that’s a reasonable reading, and it’s now a codified rule, which should carry weight. But a plaintiff texting STOP to a reminder and then getting a fraud alert will argue the statute says otherwise, and the per-message damages add up quickly. I could be wrong about how courts will take it. I wouldn’t bet a messaging roadmap on it either way.

One more thing I liked: the FCC told its consumer bureau to rewrite section 64.1200 in plain language, with no substantive changes [1]. The section has piled up three decades of robocall rules [1]. A rule small teams can actually read is worth more than most of the substantive tweaks.

What I’m watching

• November 25. The rule takes effect and comments on the further notice are due the same day, in CG Docket No. 02-278; replies follow December 28 [1, 2]. The notice asks whether to require a one-step “revoke all” method, whether to cut the deadline (the June 30 joint letter from the American Bankers Association, National Consumer Law Center and ACA International suggests seven business days), and whether to eliminate one-way texting, possibly only for marketing [2].
• Affiliates. The FCC asks whether an opt-out should reach affiliates, separate lines of business or divisions, and whether a revocation covers only the phone number on which consent was revoked or every number on the customer’s account, as EEI has asked [2]. For a company with several apps under one parent, that’s the question with the biggest engineering bill.
• The word list. The joint letter proposes trimming the seven standardized words and dropping the rebuttable presumption for undesignated methods [2]. If either happens, inbound parsers change again.