The Compliance Cost Behind Every US SMB Automation Pitch

What a US small business actually finds in the inbox at month three of scaling automation

The vendor onboarding video shows a cheerful diagram: trigger arrives, workflow fires, customer smiles. Real month-three inbox looks different.

A law firm sends a certified letter alleging Telephone Consumer Protection Act violations under 47 USC § 227 — the SMS your automation sent to 3,400 customers on Tuesday morning was 'auto-dialed marketing content' without documented prior express written consent, and the plaintiff bar has organized this class before you finished breakfast. Statutory damages of US$500 per message stack fast when the class certification motion lands.

A privacy rights portal request arrives from someone identifying as a California resident, invoking rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. They want to know every data element you hold, every third party you shared it with in the last twelve months, every purpose. The clock starts at receipt. Forty-five days to complete, extendable another forty-five for complex requests, and California's Privacy Protection Agency has been actively enforcing since 2023.

An FTC inquiry email — not yet an investigation, just a request for information — asks about the 'AI-powered lead qualification engine' language on the pricing page. After Operation AI Comply in September 2024, the FTC has been visibly enforcing Section 5 substantiation standards for AI capability claims. Rytr agreed to stop generating fake reviews. DoNotPay paid a civil penalty for the 'AI-powered lawyer' framing. The Commission's official position (published at ftc.gov/business-guidance and reiterated in the 'Keep Your AI Claims in Check' guidance) is that existing consumer protection authorities apply directly to AI marketing.

A state Attorney General office contacts the business about a consumer complaint alleging the website did not honor a Global Privacy Control browser signal — the sole basis of the widely-cited Sephora settlement of US$1.2 million in California in 2022 (the settlement text is public on the California Attorney General website).

None of these surfaces were in the vendor sales deck. All of them are the operator's responsibility. The rest of this piece is a map of the four surfaces where AI automation exposes a US small business to regulatory risk, what the compliance work actually is (not the vendor's version), what the tools cost in ranges rather than fabricated precision, and where the failures repeatedly happen.

Four automation surfaces that expose a US small business to real regulatory risk

Rather than list every US regulator alphabetically (there are dozens; most do not apply to your automation unless you touch a specific data type or industry), the productive framing is by the four surfaces the automation itself exposes:

Surface one — outbound SMS and voice. The moment your automation sends an SMS or places an auto-dialed voice call to a US phone number, the Telephone Consumer Protection Act applies. Consent architecture, time-of-day restrictions, opt-out handling, and the entire 10-Digit Long Code (10DLC) registration framework via The Campaign Registry are all triggered. Damages are statutory, class actions are common, and the plaintiff bar is organized. Even businesses with no marketing intent get caught (wrong-number auto-dials, reactivation campaigns to old lists, appointment reminders miscoded as marketing).

Surface two — outbound email. CAN-SPAM (2003) is a lower bar than TCPA — no prior consent required, but functional one-click unsubscribe processed within ten business days is mandatory, plus non-deceptive subject lines, clear sender identification, ad disclosure, physical postal address in the footer. Some states add overlays. Non-compliance is not free — the FTC's civil monetary penalty per violation runs into the tens of thousands per message (verify current inflation-adjusted amount at ftc.gov/legal-library/browse/rules/can-spam-rule).

Surface three — personal data processing. Storing a customer's phone number, email, address, purchase history, or any identifier tied to a person triggers state privacy laws where thresholds are met. Nineteen-plus states now have general consumer privacy laws (verify current list and effective dates at the IAPP US State Privacy Legislation Tracker), with rights typically including access, delete, correct, portability, and opt-out of sale or targeted advertising. Response windows sit around 45 days, extendable another 45 for complex requests. Universal opt-out via the Global Privacy Control browser signal is required in California, Colorado, Connecticut, and Oregon among others.

Surface four — consequential decisions. When your automation contributes to a decision that materially affects a person — hiring, credit approval or pricing, health treatment, insurance underwriting, housing rental — a separate compliance regime kicks in. NYC Local Law 144 requires an annual independent bias audit for any Automated Employment Decision Tool used on NYC residents. Illinois AI Video Interview Act (820 ILCS 42/) requires notice and consent for AI analysis of video interviews of Illinois residents. Colorado AI Act (SB24-205) applies to high-risk AI systems making consequential decisions (verify effective date at leg.colorado.gov — subject to legislative amendment). Fair Credit Reporting Act 15 USC § 1681 requires adverse action notice with reason codes for any credit decision. Equal Credit Opportunity Act 15 USC § 1691 prohibits credit discrimination and imposes disparate impact liability. HIPAA governs Protected Health Information. Each of these is a separate regime with separate paperwork, and none of them are the vendor's problem.

The rest of this piece walks each surface with the operational detail an owner actually needs — not the vendor pitch.

Surface one: TCPA plus 10DLC — the SMS and voice compliance frame US SMBs miss

The Telephone Consumer Protection Act (TCPA), 47 USC § 227, is the oldest of the four surfaces and the one with the most developed plaintiff bar. Enacted in 1991, amended and litigated extensively. FCC is the primary regulator; consumer private right of action is the primary enforcement mechanism (statute of limitations is four years; retention of consent records at minimum four years post-consent is the operational baseline).

Prior express written consent for auto-dialed or pre-recorded marketing messages. The Supreme Court in Facebook v. Duguid 141 S. Ct. 1163 (2021) narrowed the definition of 'automatic telephone dialing system' (ATDS) — it must have the capacity to store or produce numbers using a random or sequential number generator. This helped defendants who could argue their systems did not meet ATDS. But two categories still require prior express written consent regardless of ATDS: pre-recorded voice, and (per FCC guidance) non-ATDS platforms that behave like autodialers for enforcement purposes. In practice, most SMS marketing infrastructure operators default to obtaining full TCPA consent because the ATDS question is expensive to litigate.

Elements of valid TCPA consent (drawn from FCC regulations and case law):

• Clear identification of the sender at time of capture.
• Statement that consent is not required as a condition of purchase.
• Description of the message frequency and content type.
• Method of opt-out disclosed (STOP keyword or equivalent per CTIA best practices).
• Affirmative act by the consumer — unchecked checkbox, signed document, voice recording with disclosure. Pre-checked boxes and buried ToS clauses have been repeatedly rejected in litigation.

Statutory damages. US$500 per violation for negligent, US$1,500 per violation for willful or knowing. Class actions common. Publicly reported multi-million-dollar settlements have involved major brands (Papa John's, Wells Fargo, JPMorgan Chase, Rite Aid, Yahoo, Meridian Insurance among others — verify specific settlement amounts and dates at the court docket or law firm case summary before citing).

Time-of-day restrictions. No calls or SMS before 8:00 AM or after 9:00 PM in the recipient's local time zone per 47 CFR § 64.1200(c). Automation must handle time-zone lookup by area code (imperfect but the standard) or by explicit consent to receive at other times.

National Do-Not-Call Registry administered by the FTC at donotcall.gov. Telemarketers must scrub against the registry every 31 days per FTC Telemarketing Sales Rule.

The 10-Digit Long Code (10DLC) framework. Since 2022, US carrier-terminated Application-to-Person SMS must originate from a 10DLC number registered at The Campaign Registry (thecampaignregistry.com), regardless of message content (marketing, mixed, customer care, or transactional). The workflow:

• Brand registration. Company name, EIN (Employer Identification Number), address, industry, website submitted to TCR. Two tiers: Standard brand and Vetted brand (higher throughput at higher cost — check TCR current fee schedule).
• Campaign registration. Use case classification (marketing, mixed, low-volume mixed, higher-education, charity, political, and others), sample messages, opt-in language, opt-out language, help language.
• Carrier approval. AT&T, T-Mobile, and Verizon review each campaign. Typical decision window three to ten business days. Rejection categories include prohibited content (gambling, adult, cannabis and controlled substances, high-risk financial without vetting), missing opt-out language, spam-appearing content, and brand-campaign mismatch.
• Throughput tiers. Trust Score assigned to the registered brand drives per-second-per-day messaging limits. Higher tier equals higher throughput. Sole proprietor use case is capped lower regardless of tier.
• Consequences of unregistered A2P traffic. Carrier penalty fees per message plus severe throttling plus outright delivery failure. Verify current carrier fee schedules — they change.

Toll-free A2P messaging has a separate verification framework via the SMS/800 database and Somos. Higher throughput than 10DLC and no monthly campaign fee, but stricter verification. Not identical to 10DLC and not interchangeable.

Short codes (five to six digit codes) are administered by the Common Short Code Registry via CTIA and Somos. Highest throughput, longest approval, highest cost — typical for enterprise brands at high volume, not SMBs.

Surface two: CAN-SPAM plus state email marketing overlays — a lower bar with real teeth

Email marketing has a lower entry bar than SMS but is not compliance-free. The CAN-SPAM Act of 2003, enforced primarily by the FTC with concurrent state AG authority, sets the federal floor. Requirements are procedural rather than consent-based:

• Non-deceptive subject line. Cannot misrepresent the content or origin of the message.
• Clear sender identification. From-name and from-address must accurately identify the sender.
• Clear ad disclosure. The message must identify itself as an ad (a subject-line requirement in effect for most commercial content, though the exact placement varies).
• Physical postal address. A valid physical address in the message body (a PO box or private mailbox is acceptable if properly registered).
• Functional one-click unsubscribe. No login required. Processed within ten business days of the request per 16 CFR Part 316.
• No harvested addresses. Cannot use email addresses obtained via harvesting scripts or dictionary attacks.

Civil monetary penalty per CAN-SPAM violation runs into the tens of thousands per message (adjusted annually for inflation — check ftc.gov/legal-library/browse/rules/can-spam-rule for current amount before assuming). Multiply by list size and the exposure gets serious fast.

State overlays. Most state privacy laws (see surface three) touch email as personal data, but California's Business and Professions Code § 17529.5 predates CCPA and specifically addresses unsolicited commercial email — private right of action, statutory damages. Some states have anti-spam statutes that layer on top of CAN-SPAM (Utah, Washington, and Maryland among others historically had specific spam laws; enforcement is uneven but the statutes remain on the books).

CASL if you touch Canadian recipients. Canadian Anti-Spam Legislation (S.C. 2010, c. 23) is one of the strictest in the world — express or implied consent required, penalties per violation up to CA$10 million for business, up to CA$1 million for individual. If any part of your email list contains Canadian recipients (business emails to Canada, US customers who moved north, cross-border e-commerce), CASL compliance applies to that segment.

Operational discipline. Suppression list updated immediately when an unsubscribe fires (not 'within 10 business days' — same-day is the practical target). Weekly audit of unsubscribe processing. Segmentation to prevent old lists from receiving new-campaign templates. Documented sender authentication (SPF, DKIM, DMARC) — not a compliance requirement but table-stakes for deliverability, and Google plus Yahoo enforced stricter bulk sender requirements starting February 2024.

Surface three: state privacy law map for US SMBs — the applicability question, not the encyclopedia

The count of US states with a comprehensive consumer privacy law has grown from one (California) in 2020 to nineteen-plus by mid-2026. Rather than reproduce a table that is stale the moment it publishes (the authoritative source is the IAPP US State Privacy Legislation Tracker at iapp.org/resources/article/us-state-privacy-legislation-tracker), the productive question for an SMB owner is: which of these actually applies to me?

Applicability follows two typical thresholds (with variations per state):

• Revenue threshold. Businesses with annual revenue at or above a specified level. California CCPA/CPRA sets US$25 million as one alternative trigger; Utah UCPA requires US$25 million revenue plus the resident-count floor; several other states use similar revenue floors.
• Resident-count threshold. Businesses processing personal data of a specified number of state residents. Common floors: 100,000 state residents (California, Colorado, Virginia, Connecticut, Texas, Oregon); 25,000 residents when combined with 50% of revenue from personal-data sale (Virginia, others). Maryland is notably broader with a lower floor (35,000 residents in some analyses — verify current statute).

Practical rule of thumb for US SMBs. If your annual revenue is under US$1 million and your customer base under 25,000 individuals total, most state comprehensive privacy laws do not apply (though sector laws like HIPAA and FCRA still do). Above that scale, California CCPA/CPRA and Virginia VCDPA likely trigger, and the newer states with lower thresholds follow. National e-commerce with an email list of 100,000+ almost certainly triggers California plus most of the newer states.

Rights that consumers can invoke across most state laws:

• Access — get a copy of the personal data held.
• Delete — request deletion of personal data.
• Correct — request correction of inaccurate data.
• Portability — receive data in a portable format.
• Opt-out of sale, targeted advertising, and (in some states) profiling for consequential decisions.

Response timelines. Typically 45 days from a verified request, extendable another 45 days for complex requests. Some states (Virginia) require a formal appeal process for denied requests. Miss the window and the state AG can enforce.

Universal opt-out signal. The Global Privacy Control (GPC), globalprivacycontrol.org, is a browser-level signal that a visitor is opting out of sale or targeted advertising. California, Colorado, Connecticut, and Oregon require honoring GPC as of their respective effective dates. The most widely-cited enforcement action is the California Attorney General settlement with Sephora (US$1.2 million, August 2022), which turned in significant part on failure to honor the GPC signal. Public press release and settlement text at oag.ca.gov/system/files/attachments/press-docs/Sephora%20Compliant.pdf.

Data Protection Assessments (DPAs). Several state laws (California, Colorado, Virginia, Connecticut, Texas, Oregon) require a documented Data Protection Assessment for high-risk processing — profiling for consequential decisions, targeted advertising, selling personal data, processing sensitive data. Not filed with the state routinely but must be produced on AG request.

Sensitive data categories are broader than the federal HIPAA/GLBA baselines in some states — biometrics, precise geolocation, religion, health, sexual orientation, immigration status, citizenship, contents of unread communications, and some children's data. Opt-in consent typically required.

Enforcement. Primarily state AG. California is different — the California Privacy Protection Agency (CPPA) has independent rulemaking and enforcement authority alongside the CA AG. Cure periods (30-60 days to fix a violation before enforcement) exist in some states (Virginia) but are being phased out or narrowed in others (California post-CPRA amendments).

Baseline operational discipline for a national SMB. Adopt a privacy policy that satisfies the strictest applicable state (CCPA plus Colorado plus Virginia baseline covers the majority of the field). Build a data subject request intake (email or web form) with case tracking. Test the request flow end-to-end quarterly. Honor GPC in web analytics and ad tracking. Document a Data Protection Assessment for any AI or profiling processing. Refresh at least annually — the field is moving.

Surface four: consequential decisions — hiring, credit, health, insurance

When automation contributes to a decision that materially affects a person's opportunities, liabilities, or health, a separate and stricter compliance regime applies. Horizontal iPaaS platforms do not distinguish this from other workflow automation, which is precisely the risk.

Hiring and employment decisions.

• NYC Local Law 144 (AEDT bias audit). Effective July 2023. Any Automated Employment Decision Tool used to substantially assist or replace discretionary decisionmaking for hiring or promotion of NYC residents requires: an independent bias audit within one year prior to use; notice to candidates that AEDT is being used; public summary of the audit results posted for at least six months. Enforcement by NYC Department of Consumer and Worker Protection. Fines run to hundreds or thousands of dollars per violation per day.
• Illinois AI Video Interview Act (820 ILCS 42/). Effective January 2020, amended 2022. Employers using AI to analyze video interviews of Illinois residents must notify the candidate before the interview, explain how the AI works, obtain consent, and limit sharing of the video.
• Colorado AI Act (SB24-205). Signed May 2024. Applies to high-risk AI systems making consequential decisions in employment, education, financial services, housing, insurance, health care, legal services, and government services. Requires impact assessment, consumer notice, and risk management program. Effective date has been subject to legislative amendment — verify current at leg.colorado.gov before assuming your obligations.
• Maryland labor code amendments and other state-specific hiring restrictions apply where relevant.

Credit decisions.

• Fair Credit Reporting Act (FCRA), 15 USC § 1681. If automation contributes to a credit decision (approval, denial, pricing) or generates a 'consumer report' as defined (character, general reputation, credit standing, credit capacity), the adverse action notice requirement applies: within 30 days of the adverse action, with specific reason codes and the source of any credit report used. Consumer private right of action.
• Equal Credit Opportunity Act (ECOA), 15 USC § 1691. Prohibits credit discrimination on race, color, religion, national origin, sex, marital status, age, and receipt of public assistance. Disparate impact liability — you can violate without discriminatory intent if the outcome is unequal. Regulation B implements ECOA. Enforcement by CFPB and FTC.
• Combined implication for automated credit decisions. The model must be tested for disparate impact across protected classes, adverse action notices must be generated with specific reason codes derivable from the model, and the credit report source must be disclosed.

Health decisions and health data.

• HIPAA (Health Insurance Portability and Accountability Act). If any automation touches Protected Health Information (PHI as defined by HIPAA), the business is either a Covered Entity or a Business Associate. Business Associate Agreement (BAA) must be executed with every vendor in the workflow touching PHI. Security Rule requires technical, administrative, and physical safeguards. Breach Notification Rule requires notification of affected individuals within 60 days and HHS within 60 days (500 or more affected) or annually (fewer than 500).
• State health data laws. Washington MyHealth MyData Act (2023) covers a broader definition of consumer health data than HIPAA, including data from period trackers, mental health apps, and other consumer-facing health tools. Consumer private right of action. Nevada and Connecticut have similar though narrower analogues.

Insurance decisions.

• State insurance commissioner regulations. Each state's Department of Insurance regulates rate-making, underwriting, and claims decisions. Model bulletins from the National Association of Insurance Commissioners (NAIC) on AI in insurance (Model Bulletin on Use of Artificial Intelligence Systems by Insurers, adopted December 2023) have been adopted by many states. Requirements include governance framework, testing for unfair discrimination, and third-party model risk management.

FTC AI enforcement across sectors.

• Operation AI Comply (September 2024). Coordinated FTC sweep against five vendors selling deceptive AI capabilities. Rytr settlement prohibits generation of fake consumer reviews. DoNotPay paid a civil penalty for the 'AI-powered lawyer' claim without substantiation. Other actions targeted AI e-commerce fraud schemes (Ascend Ecom, Ecommerce Empire Builders, FBA Machine).
• FTC 'Keep Your AI Claims in Check' business guidance. Published April 2023, ongoing enforcement. Substantiation required for every AI capability claim in marketing materials. Selling an 'AI-powered' capability when the mechanism is a hardcoded decision tree is deceptive under Section 5.
• California AB-2013 (Generative AI Training Data Disclosure). Effective January 2026. Requires generative AI developers to publish documentation about training data.
• California SB-942 (AI Transparency Act). Effective January 2026. Requires large AI providers to include manifest disclosure of AI-generated content.
• Utah AI Policy Act (SB 149). Effective May 2024. Requires disclosure when generative AI interacts with consumers in regulated occupations (law, medicine, mental health).

ADA Title III accessibility. Per DOJ guidance published March 2022, websites and mobile apps of public accommodations must be accessible. Chatbot flows must be operable by keyboard, compatible with screen readers, and offer an alternative contact method. WCAG 2.1 AA is the de facto standard cited by DOJ.

Vendor selection: DPA, BAA, cross-border transfer, GPC — the questions that matter more than feature bullets

Vendor sales decks emphasize features. Vendor onboarding checklists rarely emphasize compliance. The questions worth asking before signing any AI automation contract are narrower than the feature comparison suggests:

Does the vendor sign a Data Processing Agreement (DPA) covering your applicable state privacy laws? Every US-registered mid-market vendor has a boilerplate DPA — Zapier, HubSpot, Salesforce, Twilio, Stripe, QuickBooks. Small vendors may not. Non-US vendors need the additional layer of Standard Contractual Clauses or (for EU-US flow) certification under the EU-US Data Privacy Framework at dataprivacyframework.gov. Check the vendor's DPA before deployment, not after a DSR arrives.

Is a HIPAA Business Associate Agreement (BAA) available on your subscription tier? Most SaaS vendors offer BAA only on mid-tier or enterprise plans. Zapier makes BAA available starting on the Team plan. HubSpot Service Hub requires Enterprise for BAA. Twilio offers BAA on paid plans. Google Workspace requires Business Plus or higher. Microsoft 365 offers BAA on business plans with a HIPAA-specific amendment. If any part of your workflow touches Protected Health Information, the vendor's free or starter tier is disqualifying regardless of feature parity.

Is the vendor a registered Campaign Service Provider (CSP) with The Campaign Registry? For any SMS-adjacent automation, this question separates operational vendors from paper vendors. Twilio, Bandwidth, Vonage, Sinch, Telnyx, Plivo, and other established BSPs handle 10DLC brand plus campaign registration mechanics. A vendor that sends US SMS without TCR registration is passing throttling and delivery failure through to your customer experience.

Does the vendor honor the Global Privacy Control browser signal? For any web-facing automation or analytics integration, GPC honor is required in California, Colorado, Connecticut, Oregon, and expanding. The Sephora settlement (California AG, US$1.2M, August 2022) turned on this specific failure. Ask the vendor whether GPC is detected and how it maps to consent state.

Where does the vendor store data, and does it cross borders? US-only storage simplifies things. EU storage requires SCCs plus DPF for US operators. Any transfer to a non-adequacy country (much of Asia, most of Africa, much of Latin America) requires SCCs plus a Transfer Impact Assessment plus explicit consumer consent in some jurisdictions.

Does the vendor substantiate its own AI capability claims? Post-Operation AI Comply, this is not just a vendor-risk question. If you resell or attribute AI capabilities to your customers based on the vendor's marketing, and the vendor's marketing is deceptive per FTC Section 5, your resale exposure follows.

Vendor categories that map to US SMB automation stacks.

• Cross-app integration (iPaaS). Zapier (Delaware, San Francisco office, largest integration catalog at 6,000+), Make (Slovakia-parent with US operations, more granular multi-step logic), n8n (Berlin, open-source under Sustainable Use License with self-hosted free option). Microsoft Power Automate for M365 ecosystems.
• RPA over legacy interfaces. UiPath (New York, NYSE PATH). Automation Anywhere (San Jose). Blue Prism (SS&C-owned, UK-parent, enterprise). Microsoft Power Automate Desktop for M365.
• CX / help desk / support ticketing. HubSpot Service Hub, Freshdesk (Freshworks), Zoho Desk, Zendesk, Intercom, Salesforce Service Cloud, LiveAgent, HappyFox, BossBot. Purpose-built platforms typically win at cost-per-workflow for single-category businesses; iPaaS wins when connecting disparate systems.
• SMS and WhatsApp BSPs. Twilio (San Francisco, NYSE TWLO), Bandwidth (Raleigh NC, NASDAQ BAND), Vonage/Nexmo (Ericsson-owned since 2022), Sinch (Sweden-parent, US operations), Telnyx (Chicago), Plivo (San Francisco), Infobip (Croatia-parent, US operations), Bird (formerly MessageBird, Amsterdam).
• Accounting. QuickBooks Online (Intuit, dominant in US SMB), Xero (NZ-parent NASDAQ XRO with US operations), FreshBooks (Toronto with US operations), Wave (H&R Block-owned since 2019, free tier), Sage 50cloud, Zoho Books, NetSuite (Oracle, enterprise).
• Payment processing. Stripe, Square (Block Inc), PayPal, Braintree (PayPal-owned), Authorize.net (Visa-owned), Adyen, Chase Payment Solutions.

Cost tiers 2026: ranges with disclaimers, not fabricated precision

Vendor pricing changes. This section lists starting tiers and rough ranges as of mid-2026 with the explicit instruction to verify at the vendor's own pricing page before committing budget or signing contract. Prices vary by promotional cycle, currency, region, and enterprise negotiation. Every URL below is public.

iPaaS starting tiers.

• Zapier (zapier.com/pricing) — free tier for small volume; paid tiers starting around US$20/month climbing into three digits at team scale.
• Make (make.com/en/pricing) — free tier plus paid tiers starting around US$9/month, generally cheaper than Zapier at higher complexity.
• n8n (n8n.io/pricing) — self-hosted Community Edition free; Cloud tiers from around €20/month.
• Microsoft Power Automate (microsoft.com/en-us/power-platform/products/power-automate/pricing) — Premium standalone from around US$15/user/month; bundled with M365 Business plans.
• Workato (workato.com) — enterprise pricing, typically four to five figures annually; not SMB target.
• Tray.io — enterprise pricing; not SMB target.

RPA starting tiers.

• UiPath (uipath.com/pricing) — Community Edition free for individuals; commercial tiers priced per user, jumping significantly into enterprise brackets.
• Automation Anywhere — Community Edition free; paid tiers start in the hundreds of dollars monthly.
• Blue Prism — enterprise only.

CX / help desk starting tiers (per agent per month; verify current at each vendor).

• HubSpot Service Hub (hubspot.com/pricing/service-software) — free tier; paid tiers scaling from around US$20/seat/month into three digits at Professional and Enterprise.
• Freshdesk (Freshworks) (freshworks.com/freshdesk/pricing) — free tier with limited agents; paid tiers from around US$15/agent/month.
• Zoho Desk (zoho.com/desk/pricing) — paid tiers from around US$14/agent/month.
• Zendesk Suite (zendesk.com/pricing) — Team tier starts in the mid-US$50s per agent monthly and scales into the hundreds at Enterprise.
• Intercom (intercom.com/pricing) — Essential tier starts around US$39/seat/month; Fin AI Agent priced per resolution.
• Salesforce Service Cloud (salesforce.com/products/service-cloud/pricing) — Starter tier around US$25/user/month scaling significantly into Enterprise and Unlimited.
• LiveAgent and HappyFox — SMB-friendly tiers in the low-US$10s to US$50s per agent monthly.
• BossBot (bossbot.uk) — starter US$19/month with a 7-day trial without credit card.

WhatsApp Business Platform and SMS via 10DLC BSP.

• Twilio (twilio.com/pricing) — pay-as-you-go per message plus carrier fees; SMS in the low fractions of a cent per US domestic message plus 10DLC per-message carrier fees; WhatsApp conversations priced by category and country per Meta's rate card.
• Bandwidth, Vonage, Sinch, Telnyx, Plivo, Infobip — similar per-message pricing structures with enterprise volume discounts.

Meta WhatsApp Business Platform 2026 US pricing (business.whatsapp.com/products/business-platform/pricing — verify current). Categories are marketing, utility, authentication, and service. US per-conversation rates for marketing sit above utility, with authentication in a specific band and service (business responses within a 24-hour customer-initiated window) currently free following Meta's 2024 announcement.

Accounting software.

• QuickBooks Online (quickbooks.intuit.com/pricing) — tiers from Simple Start into Advanced, each with escalating features.
• Xero (xero.com/us/pricing) — Early, Growing, Established tiers.
• FreshBooks (freshbooks.com/pricing) — Lite, Plus, Premium, Select tiers.
• Wave — free basic tier plus paid Pro tier.
• Sage 50cloud, Zoho Books, NetSuite — vendor-specific pricing.

Payment processing — mostly percentage-of-transaction plus fixed per-transaction fees; Stripe, Square, PayPal, Braintree, Authorize.net all publish current schedules.

Illustrative cost patterns (verify each component at the current vendor page):

• Sole proprietor service business with occasional SMS, free-tier CRM, basic accounting: total tooling spend often under US$100/month.
• Multi-state e-commerce startup with paid CRM, dedicated help desk, paid accounting, marketing automation, and moderate messaging volume: often US$400 to US$800 monthly.
• Mid-market SMB with multi-user support desk, RPA layer, higher messaging volume, enterprise accounting: often US$1,500 to US$5,000 monthly plus per-transaction fees.

Exact figures depend on features, seats, volume, and negotiation. The point of the ranges is calibration, not budget commitment.

Five failure patterns that repeatedly turn up in the field

Rather than a catalog of every possible enforcement action, five patterns show up repeatedly when a US SMB scales automation without matching compliance discipline:

Pattern one: TCPA consent captured, but the record is not defensible. The consent checkbox exists on the sign-up form, but there is no timestamp, no capture method log, and no record of exactly what disclosure the customer saw at the moment of consent. Litigation demand arrives, plaintiff's counsel requests the consent record, business has nothing to produce. Statutory damages apply per message. Mitigation: consent capture pipeline stores timestamp + disclosure text + form version + IP address + customer identifier, retained a minimum of four years past last message sent. Test the retrieval quarterly by pulling a random customer's consent record end-to-end.

Pattern two: 10DLC brand registered, campaign auto-approved for 'mixed use case,' actual messages violate use-case restrictions. The Campaign Registry brand and campaign approval was based on sample messages that looked routine. Weeks later the business runs a marketing burst with different template content — carrier flags mismatch, throttles throughput, some messages never deliver. Mitigation: campaign sample messages match actual production templates; new campaign types get separate registrations; use-case classification is honest (marketing campaigns registered as marketing, not customer-care).

Pattern three: California resident submits a CCPA request, 45-day clock expires, no response. The privacy rights email sat in a shared inbox nobody checks. The business misses the window, the request is escalated to the California Privacy Protection Agency, an investigation opens. The base failure was operational — no ticket, no owner, no clock. Mitigation: DSR intake endpoint tied to a ticketing system with SLA tracking, 30-day work-back reminder, escalation policy for complex requests, quarterly test with a controlled DSR submitted internally to verify end-to-end.

Pattern four: Global Privacy Control signal ignored, discovered in an audit. The web analytics stack (Google Analytics, Meta Pixel, TikTok Pixel) fires regardless of GPC because nobody configured it to detect the signal. A privacy-rights nonprofit or a state AG audit surfaces the pattern. In California this is the Sephora fact pattern — public settlement US$1.2M in 2022 (California AG press release publicly available). Mitigation: Consent Management Platform (CMP) integrated with the analytics and ad tech stack, GPC detection tested via browser extension that broadcasts the signal, documented per state as of applicable effective date.

Pattern five: FTC or state AG inquiry about an AI capability claim on marketing pages. After Operation AI Comply, this pattern is more common than it was pre-2024. Homepage says 'AI-powered lead qualification' or 'AI writes your emails for you' — regulator asks for substantiation. If the actual mechanism is a hardcoded workflow with LLM API call in the loop, that is defensible with documentation. If it is marketing gloss over a decision tree, that is deceptive per FTC Section 5. Mitigation: substantiation file per every AI claim on public marketing pages — what the AI does mechanically, what model or approach, what training data, what accuracy testing, what comparison baseline. If the substantiation file is empty, the claim comes down.

What not to automate + honest ROI math without the vendor marketing gloss

Not everything should be automated. Beyond the compliance-hard 'human required' list (FCRA credit adverse action, HIPAA PHI without BAA, medical or legal or financial advice generation), a broader category exists where automation genuinely makes outcomes worse:

Categories where automation should not touch the final decision or first content.

• Complaint resolution past initial acknowledgment. A cheerful automated 'we hear you' response is fine as an acknowledgment. Final resolution needs a human who can compensate, apologize, adjust policy. Fully automated complaint handling generates FTC complaint patterns and churn.
• First-touch with a high-value prospect. If lifetime value per customer exceeds a few tens of thousands, a template SMS is worse than silence. Automation for cadence and reminder is fine; the first content the prospect reads should be human-written.
• Regulated statement generation. Medical dose recommendations, legal advice, tax positions, investment advice, real estate valuations. AI-generated content in these categories triggers professional licensure board action, FTC Section 5 unfair practices review, and state UDAP (Unfair or Deceptive Acts and Practices) statutes.
• Emergency safety signals. Message contains suicide language, physical threat, medical crisis vocabulary. Requires human eyes within minutes plus a documented escalation protocol.
• First-time customer high-consequence purchase. Wedding vendor contract, custom software agreement, home renovation quote in the US$25,000+ range. Trust needs a voice.

Categories where automation drafts and a human reviews.

• Legal contract clause suggestions. AI-generated language is a starting point, not final. Attorney reviews before send.
• Advertising copy for regulated categories. Health, weight loss, income claims, financial products, cannabis. AI drafts, human reviews, substantiation file assembled.
• Hiring screening. AI can filter for job requirements but not final decision — especially in NYC (Local Law 144 bias audit required), Illinois (Video Interview Act notice + consent required), Colorado (AI Act notice required if effective at time of use).
• Credit decisions. AI flags risk indicators but human review before adverse action. FCRA compliance requires reason codes + credit report source + right to dispute.

Categories where automation runs with confidence.

• Inbound triage — route inbound messages to correct queue or send auto-response with expected timeline.
• Appointment reminders — 24-hour and 2-hour reminders with confirm/reschedule links. High ROI, low risk.
• Post-transaction confirmations — order received, payment processed, appointment booked. Utility category, cheaper messaging tier.
• Recurring internal workflow orchestration — weekly reports, monthly reconciliation, quarterly renewals with human review checkpoints.

Measuring ROI honestly. Vendor marketing tends to inflate the ROI number by omitting setup cost, maintenance cost, and the compliance-workflow cost. Track four metrics against a 30-90 day pre-automation baseline:

• Time reclaimed. Log actual minutes per manual process pre-automation. Re-measure 30 days post-launch. Weekly volume times minutes reclaimed equals weekly time saved. Multiply by loaded hourly cost (US SMB rule of thumb: base salary times 1.4 to cover taxes, benefits, overhead).
• Revenue recovered or conversion lift. Incremental conversion rate times lead volume times average order value equals automation-attributed revenue. Compare against pre-automation baseline. Account for seasonality with a 12-month comparison if the history exists.
• Compliance risk avoided. This one is uncomfortable to quantify but real. TCPA class action median settlements sit in the mid-six-figure to eight-figure range. HIPAA fines scale by degree of neglect (unknowing through willful) into six or seven figures. State privacy AG enforcement typically in the six-figure to low-seven-figure band. A robust consent plus compliance workflow costs a fraction of a single class action exposure.
• Setup and maintenance real cost. Vendor marketing understates setup time by a factor of three to five. Budget 8-16 hours per major workflow for setup plus testing plus edge-case handling. Add one to two hours monthly for maintenance (broken integrations, template updates, exception handling).

Realistic 90-day outcomes for a US SMB with disciplined automation.

• Enquiry response automation: staff time reclaimed in the range of 60-120 minutes per day, and enquiry-to-booking conversion typically lifts 15-25% (industry ranges vary by vertical and starting response time).
• Booking reminder sequences: no-show reduction commonly in the 20-35% range.
• Invoice plus payment chase automation: 3-7 fewer hours weekly and median days-to-payment reduction in the 20-30% range.
• Compliance workflow (consent plus DSR plus opt-out plus BAA plus adverse action templates): near-zero direct revenue impact, and elimination or major reduction of class-action plus AG-enforcement exposure. That is the ROI story that gets under-told.

The tools pay for themselves at typical SMB revenue. The investment that pays for itself many times over is discipline — mapping processes before automating, building compliance workflow before scaling messaging, refusing to automate what should never be automated.