BonsAI
Get your free AI auditFree audit

Compliance

Hotel SMS & WhatsApp Consent Rules: Opt-In and Opt-Out

By Iskander Nekkaz - Le Roux, Founder & Automation Engineer · Updated October 9, 2026

A blossoming bonsai tree on a grassy point above a still lake at dawn

Hotel SMS marketing needs recorded opt-in consent, an opt-out that works and a sending policy checked against the rules where the recipient is. In the United States, the TCPA and FCC rules cover consent, revocation, do-not-call procedures and possible statutory damages. An international guest list needs its own review, country by country.

This page is general guidance, not legal advice. Confirm current rules for your markets before sending.

FCC rules require prior express written consent for automated telemarketing messages to covered numbers. The rule has its own definitions and exceptions. Don't treat a reservation phone number as blanket permission to send marketing. Read the current FCC delivery restrictions. Then ask a lawyer how they apply to your technology and your audience.

What hours and do-not-call rules apply?

The FCC rule restricts telephone solicitations before 8 a.m. or after 9 p.m. at the called party's location. It also requires do-not-call procedures. Treat that as a minimum for the US. It doesn't give you a worldwide schedule. State law, the type of message, the platform and the guest's country can each set different or stricter rules.

8 a.m.earliest local time for a US telephone solicitationFCC rule, 47 CFR 64.1200
9 p.m.latest local time for a US telephone solicitationFCC rule, 47 CFR 64.1200

How must a hotel handle opt-outs?

The current FCC rule recognizes several reply words, including STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE. It also says other reasonable revocation requests must be honored. Think of a guest who writes back "please stop texting me" instead of STOP. Decide ahead of time how your system will handle that reply. It should log every request and stop further covered messages. The rule says a revocation made in any reasonable way must be honored within a reasonable time, and no later than ten business days after you receive it. See the FCC's robotext consent and revocation rule.

  • STOP
  • QUIT
  • END
  • REVOKE
  • OPT OUT
  • CANCEL
  • UNSUBSCRIBE

What are the penalties for breaking the rules?

US law gives people a private right of action for actual monetary loss, or $500 for certain violations. For willful or knowing violations, a court has discretion to increase the amount. The exact claim depends on the statute, the facts, the jurisdiction and current case law. Read 47 U.S.C. § 227 and get legal advice. Don't treat a headline number as what every case will cost.

$500for certain violations, under the private right of action47 U.S.C. § 227

Do the US rules apply to international guests?

Don't reuse the US checklist as a global compliance table. Think of a US-built list with a few guests from Spain on it. The US checklist tells you little about them. Before you message an international guest list, work out the recipient countries, the sending channel, who controls the data and the local consent and privacy rules. Keep a dated legal register and review it whenever the audience, the channel or the provider changes.

For guests in the EU, the GDPR sets one rule worth building in from day one. Article 7 says a person can withdraw consent at any time, and that withdrawing must be as easy as giving it. If a guest opted in with one tap, a one-line reply should be enough to opt out.

What can BonsAI Luxury enforce?

A BonsAI Luxury setup can be configured to require a recorded consent flag and process supported opt-out signals. Those controls cut operational risk. They don't replace legal review, and they don't make a campaign compliant on their own.

This page is general information, not legal advice. Confirm the rules that apply in your jurisdiction with qualified counsel before sending.

Sources

Frequently asked questions

Is SMS marketing to hotel guests legal?

It can be, but it depends on the message, the consent, the technology, the recipient and the jurisdiction. In the United States, read the current TCPA and FCC rules and get legal advice for the specific campaign.

Does a guest's phone number count as consent to text them?

Don't treat a reservation phone number as blanket permission to send marketing. Record the consent basis for the specific channel, and have a lawyer check your collection wording and planned use.

What times can hotels send marketing texts?

For US telephone solicitations, the FCC rule restricts contact before 8 a.m. or after 9 p.m. at the called party's location. Other laws, message types and countries can set different rules.

How fast must a hotel stop texting a guest who opts out?

Under the current FCC rule, a request to revoke consent made in any reasonable way must be honored within a reasonable time, and no later than ten business days after it is received. Under the GDPR, an EU guest can withdraw consent at any time, and withdrawing must be as easy as giving it.

Do the same rules apply to WhatsApp?

The principles do. That means explicit opt-in, easy opt-out and restraint. WhatsApp also adds its own requirements. It wants opt-in that names your business and Meta-approved templates. It also uses a quality rating that penalizes over-messaging.

What compliance controls can BonsAI Luxury enforce?

A BonsAI Luxury setup can require recorded consent and process supported opt-out signals. You'll still need qualified legal review.