Latest / Marketing Automation with Fexingo: HubSpot, Marketo, and Automated Customer Journeys / When Marketing Automation Workflows Fail at SMS Compliance
Transcript
- Lucas: If these marketing conversations have sparked something you've actually used — a tweak to a workflow, a new suppression list — there's a good chance this show is part of your Tuesday. Which is great. But here's the thing: this whole operation stays ad-free because a small group of listeners chips in monthly. You can too, at buy me a coffee dot com slash fexingo. No perks, just knowing you're part of keeping this going. Luna: Yeah, it genuinely helps. And it means we never have to pitch you a mattress or a meal kit. Lucas: Right. So let's stay on topic — and today's topic is the one that keeps compliance officers up at night: SMS in your automation workflows. Luna: Oh this is big. I feel like every marketing team I talk to is adding SMS to their automated journeys. Abandoned cart texts, shipping updates, appointment reminders. But the regulatory side — it's getting sharper. Lucas: Sharper is putting it mildly. In late 2025, the FCC clarified something that a lot of brands had been fudging: the TCPA's definition of an 'autodialer' now explicitly includes any automated workflow platform that stores or queues phone numbers. That means if your HubSpot or Marketo instance sends a text without a verifiable opt-in — you could be looking at statutory damages of $500 to $1,500 per violation. Luna: Per text. Not per campaign. Per individual message. Lucas: Exactly. So let's look at a real case. There's a mid-size outdoor gear retailer — I'll call them TrailCo — who set up a post-purchase SMS sequence in early 2025. Standard stuff: 'Thanks for your order', 'Your package shipped', 'How did it fit?'. They imported their entire customer list into the SMS workflow — about 50,000 contacts — and assumed that because they had email consent, SMS consent was implicit. Luna: And that assumption cost them. How bad? Lucas: They ended up sending texts to 1,200 landline numbers. Under the TCPA, a landline is still a 'residential line' and automated texts to them are presumed non-consensual unless you have prior express written consent. That's $500 per text, minimum. And because the workflow ran for six weeks before they caught it — with each contact receiving three texts — they were looking at potential liability north of $200,000. Luna: That's brutal. And the thing is, the marketing team had no idea. The automation platform didn't flag it. The sales team had collected phone numbers for years without ever noting whether it was a mobile or a landline. Lucas: Right. And this is the central problem: automation amplifies your data quality issues. If your CRM has a phone field with no type designation, and you pipe that into an SMS workflow, you're essentially playing russian roulette with regulatory compliance. Luna: So what's the fix? I mean, besides the obvious — don't send texts to landlines. Lucas: The fix starts with consent architecture. You need a separate opt-in for SMS that captures the subscriber's phone number, carrier, and timestamp. And you need to verify that number — either through a double opt-in text or by checking it against a carrier lookup service. There are third-party APIs that can tell you if a number is mobile, landline, or VoIP in real time. Luna: And you need to do that before the workflow ever fires. Not after. Lucas: Exactly. Which means your marketing automation platform needs a pre-send validation step. Most platforms — HubSpot, Marketo, Salesforce Marketing Cloud — have webhook capabilities. You can set up a custom action that calls a carrier lookup API before the SMS is queued. If the number comes back as landline, the workflow either suppresses that contact or routes them to an email-only path. Luna: But that's a technical configuration. What about the legal side? Consent records need to be audit-proof. Lucas: Great point. So beyond suppression, you need a consent audit trail. For every SMS sent, you should be able to produce: the exact opt-in language the user agreed to, the timestamp and IP address of that opt-in, and the method of collection — whether it was a web form, a point of sale terminal, or a text to join keyword. If you can't produce those three things, the FTC or a plaintiff's attorney will assume you didn't have consent. Luna: And this is where automation can be a double-edged sword. Because workflows are great at scaling, but they're also great at scaling mistakes. A single bad data import can trigger tens of thousands of non-compliant texts before anyone notices. Lucas: That's why I recommend a 'consent freshness' check in your workflow. Don't just check if consent exists — check when it was given. If someone opted in for SMS in 2019 and hasn't received a text since 2020, that consent may no longer be valid under state-level privacy laws like the California Consumer Privacy Act updates that took effect this year. Luna: So a sunset clause on consent. Automatically expire opt-ins after a certain period unless the person re-confirms. Lucas: Yes. And that's becoming best practice. I know of one financial services firm that now runs a quarterly 'consent refresh' workflow — sends a single text to all active SMS subscribers asking them to reply 'YES' to stay opted in. No response? The workflow suppresses them. It reduces their list by about 15% each time, but it also reduces their legal risk dramatically. Luna: And it improves engagement. Because the people who do stay are actually paying attention. Lucas: Right. So let's talk about the workflow design itself. When you're building an SMS automation, you need to think about timing and frequency differently than email. An email at 2 AM might get opened the next morning. A text at 2 AM is a violation of the TCPA's restricted hours — you can't send marketing texts between 9 PM and 8 AM local time. Luna: And that's another place automation can trip you up. If your workflow's time zone logic is based on the contact's profile time zone, but that field is empty or wrong, you could be sending texts at 3 AM in their local time. Lucas: Exactly. I've seen workflows that default to Eastern Time if no time zone is set. That means a contact in California gets a 'good morning' text at 5 AM their time. That's not just annoying — it's a $500 risk per violation. Luna: So what's the practical checklist? If a marketing team is reviewing their SMS workflows today, what should they look at first? Lucas: Three things. One: does your SMS opt-in capture the phone number type? At a minimum, a dropdown asking 'Is this a mobile number?' that defaults to 'I confirm this is a mobile number'. Two: do your workflows include a pre-send suppression check for landlines and VoIP? If not, you need to add a custom webhook or use a third-party integration. Three: do you have a consent audit trail that's easily exportable? If legal asks you to produce proof of consent for every SMS sent in the last year, can you do that within 24 hours? Luna: And I'd add a fourth: are you monitoring regulatory changes? Because the rules are shifting. The FCC is expected to release new guidance on SMS consent by the end of this year's third quarter. Lucas: That's coming soon. And it's likely to tighten the definition of 'prior express written consent' further. So if your SMS program is built on a loose interpretation, now is the time to tighten it up. Luna: One thing I've started recommending to teams is to run a full SMS compliance audit on a sample of your workflows — maybe the top five by volume. Export the recipient list, cross-reference with your consent database, and check for any numbers that shouldn't have received texts. You'll often find the landline issue or the wrong time zone issue. Lucas: And that audit should be recurring. Not a one-time fix. Because as your contact database grows, the risk grows with it. Luna: Alright, so to wrap this one up: SMS in automation is powerful, but it demands a different level of rigor than email. Consent verification, landline suppression, time zone accuracy, audit trails — these aren't optional extras. Lucas: They're table stakes now. And with the regulatory environment tightening, the brands that get ahead of this will avoid the fines and build better relationships with their customers. Because nothing says 'I don't respect your boundaries' like a 3 AM text from a brand you barely remember opting into. Luna: Exactly. So check your workflows, check your consent, and maybe think twice before hitting 'send all' on that SMS list. Lucas: Good advice. That's it for this episode. We'll be back on Thursday with a look at something I've been digging into — the hidden cost of marketing automation platform migrations. See you then.