It is 7:40am and you have three open toddler spots to fill before the billing cycle turns. You still have last spring’s inquiry list in a spreadsheet, forty-odd parents who toured or called and never enrolled. The obvious move is to blast all of them a friendly “spots just opened, want to come see us?” text from your cell. Stop before you do, because that one text to the wrong list is the single most expensive mistake in this whole post.
Here is the short version so you can stay out of trouble. You can absolutely text parents. What matters is who gave you permission, whether your number is registered to send business texts, and whether a child’s face or name shows up anywhere in your marketing. Get those three right and you can automate almost everything. Get them wrong and you are looking at real money, blocked messages, or a licensing complaint. And FERPA, the school-records law everyone worries about, almost certainly does not apply to you.
What this post covers
- Can you text parents at all? Start with consent
- Register your number or your texts vanish: A2P 10DLC
- The consent rule you can ignore, and the one you cannot
- Photos and names: the child-record rules that actually bind you
- Keep the parent channel and the marketing list separate
- Email too: CAN-SPAM in one minute
- Run it three ways: home daycare, single center, multi-site
- The objections I hear from directors
- Your questions, answered
Can you text parents at all? Start with consent
Yes, but the answer splits into two buckets, and mixing them up is where directors get hurt.
The first bucket is transactional. A parent texts you and you reply. An enrolled family gets a pickup reminder, a closure notice, a tuition receipt. These are operational, the family expects them, and they sit on solid ground. The second bucket is marketing: the “we have spots open,” the “refer a friend,” the “come to our open house” blast. That is promotional, and it is the bucket the law watches closely.
The rule that governs it is the Telephone Consumer Protection Act, the TCPA. For automated marketing texts, the standard is prior express written consent: the parent has to have knowingly agreed, in writing, to receive marketing texts from you at that number. A tour booking is not that. A “more information” contact form is not that, unless it said so clearly and the parent checked a box agreeing to it.
The penalty is per message. Statutory damages run $500 per violation, up to $1,500 if a court finds it willful, with no requirement that the parent prove any harm. Each text to each person is its own violation. Run the math on that old inquiry list.
Potential TCPA exposure from one non-consented blast, at the $500 statutory floor per message. A willful finding trebles each figure to $1,500 per text. Illustrative math on the statutory minimum, not a prediction. Source: 47 U.S. Code § 227.
That is why the 7:40am blast is a bad idea: forty texts to parents who never opted in is, on paper, a $20,000 problem.
How it breaks in real centers. Three ways, over and over. Someone imports an old lead list and hits send, treating “they inquired once” as consent. It is not. A director assumes the enrollment paperwork covered texts, when it only mentioned email. Or a family replies STOP and the automation keeps texting because the opt-out never synced back. Any one turns a helpful message into a liability.
Register your number or your texts vanish: A2P 10DLC
This one is not a law, it is the phone carriers, and it trips up more centers than the TCPA because it fails quietly.
A2P 10DLC is Application-to-Person messaging over a 10-digit long code, the ordinary local number your software texts from. To send business texts to US numbers, you have to register your business and your use case through The Campaign Registry, the industry body the carriers set up: your center as a “brand” (legal name and EIN) and your texting as a “campaign” (what you send, with a sample). Your texting platform, whether a standalone tool or the SMS automation inside a full system, walks you through it.
Skip it and US carriers filter or block unregistered A2P traffic, and since early 2025 that filtering is close to total. Your tour reminder does not bounce with an error, it just never arrives, and you conclude that “texting does not work for us.”
How it breaks in real centers. The classic is sending reminders from a personal cell or an unregistered Google Voice number, watching reply rates crater, and blaming the copy. The second is an EIN mismatch: the name on your registration does not match your IRS record, so the brand gets rejected and every campaign under it stalls. The third is running two tools on one number, which confuses the registration and throttles both.
- 🏢Step 1
Register the brand
Your legal center name and EIN, matched exactly to your IRS record, through The Campaign Registry via your texting platform.
- 💬Step 2
Register the campaign
Describe what you send, with a sample message and your opt-in language.
- ⏳Step 3
Wait for approval
Usually a few business days. Until it clears, keep messaging light.
- ✅Step 4
Send from the registered number only
One registered number, one purpose. Never text business messages from a personal cell.
The consent rule you can ignore, and the one you cannot
There is a lot of noise online about a “one-to-one consent rule” that supposedly makes texting far stricter, and you will see SMS vendors’ blogs warning it takes effect in 2026. Here is the honest status so you do not waste a morning on it. The FCC did pass that rule, but a federal appeals court struck it down in January 2025 in Insurance Marketing Coalition v. FCC, and the FCC then reinstated the prior standard and said it would not fight the decision. The tougher rule is not in force. Any post telling you it is effective in 2026 is out of date.
What you cannot ignore is the standard that came back: prior express written consent for marketing texts, the same one from the section above. The lesson is not that the rules got easier. It is that a clear, specific, written opt-in has always been the thing that keeps you safe, whichever way the rulemaking swings. Collect it properly and you are covered. This is the whole game, and it is why I keep hammering the checkbox.
Photos and names: the child-record rules that actually bind you
Now the part that worries directors most, and the part where the internet is most wrong.
First, clear the myth. FERPA, the Family Educational Rights and Privacy Act, is the one people invoke, and it almost never applies to you. FERPA binds schools that receive US Department of Education funding, and private schools at the early levels generally do not receive it, which the Department’s own guidance confirms covers most center-based and home-based child care. Do not let a vendor scare you with FERPA. It is not your law.
Your actual constraints come from your state’s childcare licensing rules on child-record confidentiality and on photo and video consent. Most states fold image consent into the licensing packet, sometimes under “parent rights” or “confidentiality of child records” rather than “photos.” Texas centers operate under 26 TAC Chapter 746 from HHSC; New York centers under 18 NYCRR Part 418 from OCFS. The specifics differ, but the thread is the same: you need written parental consent before a child’s image goes into anything public or promotional. And good practice is that this consent should never be forced. A parent should be able to enroll and still say “keep my child off your Facebook page,” and you should honor it.
The bright line for marketing: never name or show a specific, identifiable child in any ad or public post unless you have that child’s consent on file. One reshared classroom photo in a boosted Facebook ad, one five-star review quoting a parent using a kid’s full name, is enough to draw a complaint to your licensing office.
Keep the parent channel and the marketing list separate
This rule is mostly about plumbing. Your center runs two different streams of contact. One is operational and often sensitive: attendance, pickup, allergies, incident notes, health updates. The other is promotional: openings, events, referrals, reviews. The mistake is letting them touch. If your AI chatbot or front-desk assistant collects a note that a child has a nut allergy, that data belongs in the child’s record and the parent-only channel, never in the audience you send a “we have summer spots” campaign to.
Where does COPPA fit? The Children’s Online Privacy Protection Act governs online services that collect personal information from children under 13, requiring verifiable parental consent when it applies. For your own marketing it usually does not bite, because your lead forms collect information from parents, not from children online. Where it can matter is the parent-facing app or vendor you use, which may itself be a COPPA-covered operator. The FTC tightened the rule in 2025, with a compliance deadline in April 2026, so it is a good question for any software rep: “how do you handle children’s data under COPPA?”
How it breaks in real centers. A well-meaning setup routes every inbound message, including a parent reporting a fever, into one big list, and later a broadcast goes to “everyone we have a number for.” Now a health disclosure sits next to a promo blast. Separate the lists by purpose from day one, tag operational and marketing-opted-in contacts differently, and never let a broadcast pull from the operational pool.
Email too: CAN-SPAM in one minute
If you email parents about openings and events, the CAN-SPAM Act adds three easy-to-skip requirements. Tell the truth in your subject lines: no “RE: your application” on what is really an open-house invite. Include a real physical postal address in every marketing email. And honor opt-outs within ten business days. A decent email tool handles the address and unsubscribe link for you, so the part you own is just not tricking people with the subject line. Far lighter than the texting rules.
Run it three ways: home daycare, single center, multi-site
The rules are the same at every size, but the effort and the risk scale differently.
The home daycare (8 to 12 children). Small exposure, same traps. You are most likely to text from a personal cell, the exact A2P 10DLC problem, and to skip the written opt-in because “I know these families.” Do two things: register a proper business number, and add the consent checkbox to your intake form. A couple of hours, once. Photo consent you handle on paper at enrollment.
The single center (40 to 80 children). Volume makes the TCPA math real: a blast to a lapsed list is no longer 10 texts, it is 200, and the exposure crosses into serious money. With staff posting to social media, the photo-consent trap is live too. Put a consent field in your CRM, make marketing-cleared photo status visible to whoever runs the page, and route all texting through one registered number.
The multi-site group (100-plus children). Now it is a systems problem. Each location generates inquiries and has staff posting photos, and one un-consented ad run centrally can pull children from any site. Standardize the opt-in language, register at the brand level so every location’s campaigns clear, and centralize photo-consent status so the family that declined at Location B is not in a corporate ad. At this scale the follow-up is a full job, which is why groups this size lean on a system, not a spreadsheet.
The objections I hear from directors
“But my families want the texts. This feels like overkill.” Enrolled families who asked to hear from you are the easy, safe case, and you should text them. The rules bite on the other group: people who inquired once, old lists, anyone you market to who did not clearly say yes. The choice is texting the people who opted in versus texting everyone, and only the second one is the problem.
“I already pay for Brightwheel or Procare. Isn’t compliance handled?” Partly, for what those tools do: send operational messages to enrolled families, the low-risk bucket. But management software is not enrollment marketing, as I broke down in the software pricing teardown. The moment you market to inquiries and lapsed families, the consent and registration rules land on you, whatever app you pay for.
“Do I need to hire a lawyer for this?” For the everyday setup, no. Collect written opt-in with an unchecked box, register for A2P 10DLC, keep a real photo-consent record, and separate your lists. That covers the situations that generate complaints. Talk to a lawyer if you are buying a contact list, running large paid campaigns, or your state rules are unusually specific. This post is a practical guide, not legal advice, and your licensing office is the authority on the child-record parts.
“What about STOP replies and opt-outs?” Handle them automatically and instantly. Every marketing text needs a clear “reply STOP,” and STOP has to remove that person in real time, across every tool. The failure I see most is an opt-out that registers in one system but not the other, so the automation keeps texting a family that already said stop. Test it: text STOP to your own number and confirm the messages stop.
Your questions, answered
Can I legally text daycare parents?
Yes. Operational texts to enrolled families who expect them (reminders, closures, receipts) are low risk. Marketing texts (openings, events, referrals) require prior express written consent under the TCPA, and your number must be registered for A2P 10DLC. Get an unchecked opt-in checkbox on your forms and register your business number.
Does FERPA apply to my daycare?
Almost certainly not. FERPA applies to schools that receive US Department of Education funding, which most privately funded daycares and preschools do not, and the Department's own guidance says it generally does not cover center-based or home-based child care. Your real obligations come from your state's childcare licensing rules on child records and photo consent.
What is A2P 10DLC and do I need it?
It is the carrier registration required to send business texts from a standard 10-digit US number, done by registering your business and use case through The Campaign Registry, usually via your texting platform. Skip it and US carriers filter or block your messages, so they silently fail to arrive. Any center sending business texts needs it.
Do I need parent consent to post a child's photo in marketing?
Yes. In most states photo and video consent is part of the licensing packet, and you need written parental consent before a child's image appears in anything public or promotional. Good practice, reflected in many states' parent-rights rules, is that this consent should not be forced, so a parent can enroll and still decline photos. Check your state's specific rule.
Is the FCC one-to-one consent rule in effect in 2026?
No. A federal appeals court vacated it in January 2025, and the FCC reinstated the prior standard. Posts claiming it takes effect in 2026 are out of date. The operative standard remains prior express written consent for marketing texts, so a clear written opt-in keeps you compliant.
What happens if I text parents without consent?
The TCPA allows statutory damages of $500 per message, up to $1,500 for willful violations, with no need to prove harm. Because it is per message and per person, a single blast to a non-consented list adds up fast, which is exactly what class-action attorneys look for. Collect written consent first.
So, back to 7:40am and those three open toddler spots. You do not blast the whole spring list. You text the parents who checked the box, from your registered number, with a STOP option, and you leave the families who declined photos out of any ad. Same five minutes, same seats filled, and nobody hears from a lawyer or a licensing inspector. Compliance here is not a wall. It is a clean opt-in, a registered number, an honest photo record, and two lists that never touch. If you want the enrollment follow-up and tour reminders built this way from the start, that is what a done-for-you system is for.