What happens when someone replies STOP

In this guide

1. 01What actually happens when someone texts STOP?
2. 02Why an opt-out has to survive your whole account, not one campaign
3. 03The replies that mean stop but don't say STOP
4. 04The re-import: how people break this by accident
5. 05How to keep one suppression list that everything respects

What actually happens when someone texts STOP?

Two separate systems react, and they are not connected to each other. One is machinery you did not build and cannot turn off. The other is a record you are responsible for keeping, and nothing in the stack will keep it for you. Confusing the first for the second is how careful people end up out of compliance. Before either of them, though, there is a question about your list that decides which rules are in play at all — so start there.

First, the part the question skips: a cold list has no consent

Almost everything written about STOP assumes a fact that is not true of a skip-traced list — that consent existed and is now being withdrawn. Consent under the TCPA runs from a specific person to a specific caller. A number a data vendor pulled out of a public record is not that, and nothing you write in the message creates it. The FCC's revocation rules at § 64.1200(a)(10) through (a)(12) are written in exactly those terms, as revocation of prior express consent. On a cold list there is, strictly, nothing to revoke.

That does not leave you freer. It means the rules that reach you are the ones with no consent element at all, and two of them are registries you have to go and get. The national Do Not Call registry bars telephone solicitations to registered residential subscribers — it applies before anyone has replied to anything, and no reply is required to trigger it. Several states run their own registry on top of it, along with their own telemarketing statutes, some of which reach texts specifically and carry their own private rights of action; which ones apply turns on where the called party is, and sometimes on where you are as well. The third rule is the internal do-not-call duty at § 64.1200(d), which is triggered by the request itself rather than by any consent that preceded it. That third one is what this post is about. The registry side is its own subject: TCPA rules for real estate investors.

Layer one: the block that happens without you

Universal support for STOP is an industry baseline, not a courtesy — CTIA's Messaging Principles and Best Practices treats a working opt-out as a condition of running a messaging program at all, and expects senders to honor plain-language opt-outs regardless of capitalization or punctuation. Providers implement it below your application. Twilio, whose behavior is publicly documented, treats STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE and OPTOUT as default opt-out keywords on long codes, and START and UNSTOP as the opt-in keywords that undo it.

Once that fires, the send stops being your decision. Twilio rejects further messages with error 21610, described in its own docs in terms of the sender: the recipient has opted out of messages from your phone number, your Channels sender, or your Messaging Service. You cannot clear it from your side. Only the recipient can, by texting START — which is exactly right, and worth internalizing before you go looking for a way around it.

Layer two: the record you are required to keep

Nothing above satisfies the rule. The FCC's do-not-call requirements at 47 C.F.R. § 64.1200(d) say that when you receive a request not to be contacted, you must record it and put that number on your do-not-call list at the time the request is made — and honor it within a reasonable time not to exceed ten business days from receipt. Paragraph (e) applies both the registry rule and this internal-list rule to solicitations made to wireless numbers, and the FCC has long treated a text as a call for that purpose. Paragraph (d)(1) also asks for a written policy, available on demand, and (d)(2) asks that anyone touching the outreach be trained on the list.

Two different parts of the rule reach list-based texting, and they reach it for different reasons. The revocation rule at § 64.1200(a)(10) governs how consent gets withdrawn — which is the rule that applies when you actually have consent, and the one your provider and your vendors will point at either way. The internal do-not-call machinery at § 64.1200(d) attaches to telemarketing calls and texts, does not turn on how the message was sent, and does not turn on whether consent ever existed. Whether a "we buy houses" text is telemarketing is a question you do not want to be the test case for. Assume both are in play; the engineering is the same either way.

Why an opt-out has to survive your whole account, not one campaign

Here is the whole problem in one sentence: the automatic block is defined in terms of a sender, and your obligation is defined in terms of you. Those are different objects, and they drift apart the moment your account has more than one phone number in it.

Numbers change under you constantly and for ordinary reasons. You buy a second local number to match a new market. A number gets flagged and you replace it. You stand up a separate messaging service for a different kind of campaign. What survives those moves depends entirely on where your provider filed the opt-out, and it files it against the sender that received it: on Twilio that is the number itself, or the Messaging Service the number sends through. So a pool of numbers inside one Messaging Service does carry the block across the pool — that scope is real. Anything you stand up beside it does not. A new standalone number, a second messaging service, a second account: each one starts clean, and the person who told you to stop is reachable again from a number they have never seen. That is a hazard to design against, not a technique — and treating it as a technique is precisely the conduct the rules exist to catch.

The rule has something to say about the corporate version of the same move, and it is worth reading in the direction it actually points. Section 64.1200(d)(5) is a limit on how far a request travels, not an expansion of it: absent a specific request to the contrary, a do-not-call request applies to the particular business entity making the call or on whose behalf it is made, and does not apply to affiliated entities unless the consumer would reasonably expect them to be included, given the identification of the caller and the product advertised. That exception is narrow and fact-bound, and the paragraph is about affiliates — not about your own phone numbers. A second number under the same entity was never outside the request, because paragraph (d) is already written in terms of that person or entity. What § 64.1200(d)(3) does close is the outsourcing door: where a party other than the one on whose behalf the contact is made keeps the records, the party on whose behalf it was made is liable for failures to honor the request. You can hire the list out. You cannot hire the liability out.

The replies that mean stop but don't say STOP

The automatic block is keyword matching. The rule is not. That gap is the single most under-appreciated thing in SMS compliance, and it gets wider the colder your list is, because people who never opted in do not answer with tidy keywords.

Read the paragraph below for what it is: a revocation standard, written for consent that exists. Where there was never any consent, the same reply is a do-not-call request under paragraph (d) instead — which starts the same ten-business-day clock and produces the same five-year record. The two rules arrive at the same operational answer from opposite directions, and neither of them is satisfied by keyword matching. What follows is the FCC's own description of how loose the wording is allowed to be.

Section 64.1200(a)(10) says a called party may revoke consent by any reasonable method, and makes seven replies reasonable per se: stop, quit, end, revoke, opt out, cancel, unsubscribe. Then it keeps going.

If a reply to an incoming text message uses words other than "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe," the caller must treat that reply text as a valid revocation request if a reasonable person would understand those words to have conveyed a request to revoke consent.

— 47 C.F.R. § 64.1200(a)(10)

None of the following fires a keyword. All of them are the kind of reply a reasonable person reads exactly one way:

• "take me off your list"
• "wrong number — quit texting me"
• "not interested, don't contact me again"
• "how did you get this number? remove me"
• "I've asked you people three times already"

The same paragraph adds two more things worth knowing. You may not designate an exclusive means of revoking consent — "reply STOP" cannot be the only door. And § 64.1200(a)(11) says that using some other channel, such as a voicemail or an email to a number or address meant to reach you, creates a rebuttable presumption that consent was revoked once the consumer produces evidence they made the request. A voicemail counts. A reply to your email footer counts. Neither one will ever touch your texting platform unless a person puts it there.

The practical consequence: somebody has to read the replies. Not skim the ones that look like leads — read them. On a cold list this is a daily job, and it is the only place in the whole system where a human is genuinely irreplaceable.

Can you text back to confirm the opt-out?

Yes, once, and carefully. Section 64.1200(a)(12) permits a single confirmation message so long as it merely confirms the request, contains no marketing or promotional content, and is the only additional message sent after the revocation. Send it within five minutes and it is presumed to fall within the consumer's prior express consent; take longer and you have to show the delay was reasonable. If the person had agreed to several categories of messages from you, that confirmation may ask which ones they meant — and until they answer, everything requiring consent stops.

The re-import: how people break this by accident

Almost nobody sets out to text someone who opted out. What actually happens is that the list gets refreshed. You pull the county again six months later. You buy the same market from a second vendor. A partner sends over a file. Same human, new row — and the row is clean, because the thing that marked them was attached to the old row, not to the person.

There are four ways this happens, and most tools have at least one of them:

1. The import creates a second record for the same person. Holding the flag on a contact record is fine as long as a later file can find that record. The failure is when it cannot: the import writes a new contact, the flag stays behind on the old one, and now there are two rows for one human — one suppressed, one not. The one that sends is the new one.
2. Phone formats drift. (555) 555-0100, 5555550100 and +15555550100 are the same person and three different keys. If the import matches on the raw string, dedupe misses, and so does suppression. Normalizing every number to one canonical shape on every write path is not housekeeping — it is the thing that makes the opt-out findable later.
3. The opt-out is scoped to a campaign or a list. Some tools record the unsubscribe against the send it came from. Start a new campaign and you have a fresh audience with no memory of the last one.
4. Suppression is only applied at import. Scrubbing the CSV against your do-not-call file at upload is worth doing and is not sufficient. Anyone who opts out after the upload is already sitting inside the list, looking exactly like everybody else. The check has to run at send time, on every path that sends without a human in the loop.

A do-not-call request must be honored for 5 years from the time the request is made.

— 47 C.F.R. § 64.1200(d)(6)

And remember what this looks like from the other side. The person does not know they are in a new import, and they have no idea which of your numbers they replied to. To them there is no campaign and no CRM — there is you, texting them again after they told you not to.

How to keep one suppression list that everything respects

The fix is not complicated, it is just structural. One list, five properties. Whatever software you use, these are the questions to ask it.

1. Scoped to your whole account, and attached to the person rather than to the row. Not to a campaign, not to a segment, not to the particular import that produced today's copy of them. Whatever object holds the flag, one canonical phone format written by every path that creates a contact is what lets a later file find that object again.
2. Written by every opt-out route. The keyword webhook, a person marking a reply by hand, a bulk pass after a review session, an imported do-not-call file. All four write to the same place and mean the same thing.
3. Read at send time by every automated send path. Campaigns, bulk send, auto-replies, AI replies — a gate that only the campaign builder calls is not a gate. Hand-typed one-to-one messages are the one case where reasonable people differ, because a human is making the decision rather than the software; the question to ask there is whether the person typing can see the opt-out before they hit send.
4. Applied as a filter, not an afterthought. If suppression is applied after the recipient count is calculated, the number you approved and the number you sent are different — and so is the money.
5. Never cleared by an import, and never cleared by you. Undoing an opt-out is the recipient's decision, expressed by texting START. It is not a data-cleanup task.

Full disclosure: reitexter is ours, so here is the shape with the edges showing. One suppression gate decides whether a contact may be texted, and it reads the union of every suppression signal on that contact record rather than a single flag — a block, a manual unsubscribe, the flag the inbound STOP webhook sets, and membership in the account's unsubscribers group. Any one of them suppresses, so it does not matter which route did the writing. Every automated send path calls it: campaign and bulk sends apply it as a filter on the recipient query, so the count you approve is the count that sends; the per-message worker re-checks each contact on the way out; and the keyword auto-replies, the missed-call auto-text and the AI SMS replies each check before they answer. The one exception is a message you type by hand to one person — a human is making that call, not the software — and it is called out as an exception rather than quietly folded in.

Two edges you should know rather than assume. First, the message you type by hand in the chat window does not pass through that gate — a person is choosing to send that one, with the contact's unsubscribed state visible in the thread — so it is a deliberate exception, not a claim that the software is catching it for you. Second, our inbound handler records an opt-out automatically on a one-word reply of stop or unsubscribe. Twilio blocks a wider keyword set at the sender, so a reply of cancel or quit still stops that sender — but it does not by itself write the record on our side, and neither does any of the sentences above. Those get marked by a person, which is one action, in bulk or one at a time.

What makes an opt-out survive a refresh is the import path rather than the gate. A CSV is normalized to one canonical phone format and matched against the contacts the account already has, so a row for someone who already said stop updates that record instead of creating a second, clean one. And if someone texts STOP from a number you have never imported, the record is created already suppressed, so a later file lands on it too. The limit that follows from the same design is worth stating plainly: the opt-out lives on the contact record, not in a separate number-keyed vault beside it. Delete the contact and you delete the evidence of what they said. Plans start at $99.99/month and every plan includes every feature — the tiers differ by numbers, segments and seats. See pricing.

I am not a lawyer and this is not legal advice — it is a description of how the rules and the plumbing fit together, with the citations attached so you can check every line yourself. If you are texting cold lists at volume, have someone who does this for a living read your setup, and read the registry side before the opt-out side. But the engineering half is not a judgment call. One list, scoped to your account, written by everything, read by everything, that outlives every import. Build that once and the legal question stops being an operational question.

Frequently asked questions

Sources

• 47 C.F.R. § 64.1200 — Delivery restrictions (current text, eCFR)
• FCC Report and Order FCC 24-24 — Strengthening the Ability of Consumers to Stop Robocalls (Feb. 2024)
• Hunton — FCC's TCPA global revocation rule now effective January 31, 2027
• CTIA — Messaging Principles and Best Practices (May 2023)
• Twilio — Advanced Opt-Out: default opt-out and opt-in keywords
• Twilio — Error 21610: attempt to send to an unsubscribed recipient
• FTC — National Do Not Call Registry access for sellers and telemarketers