It is a slow Thursday and a certified letter lands on the desk. It is from a state agency you have barely heard of, asking why you have been selling trips to their residents without a registration you did not know existed. Your stomach drops. You run tours, not a law firm, and there is a number in that letter with a lot of zeros. The short answer: four US states make travel sellers register before they can legally sell, every state’s residents are covered by federal texting and email rules, and a signed waiver is the cheapest insurance you will ever buy. None of it is complicated, and most of it you set up once.
This covers the four compliance areas that actually reach a small tour or activity operator: Seller of Travel registration, texting under the TCPA, emailing under CAN-SPAM, and liability waivers. No legalese, just what applies, what it costs, and how to handle it.
Why compliance sneaks up on tour operators
Most operators start the same way. You are good at running a kayak trip, a food walk, a brewery crawl or a fishing charter. You build a little website, take bookings, send a few reminder texts. Nobody tells you that “selling travel” and “texting customers” are both regulated, because the software you bought does not care whether you comply. And the rules do not trigger when you incorporate. They trigger quietly, the first time you sell into a regulated state or send your first bulk text. By then you are exposed. The good news: none of this is hard, and most of it you set up once and forget.
Seller of Travel: the four states that make you register
A “Seller of Travel” law makes anyone who sells travel to that state’s residents register, post financial security, and follow disclosure rules. It protects travelers who pay up front for a trip that might not happen. As of 2026, four states run active programs: California, Florida, Hawaii and Washington. Iowa repealed its requirement in 2020, so an older checklist listing Iowa is out of date (Fora).
The part that catches operators off guard: the law follows the customer, not your office. Run tours out of Colorado, sell to someone who lives in California, and California’s rules can reach you. So anyone taking online bookings from anywhere has to think about all four states, not just their home one (Travel Weekly).
It matters most once you move off the OTAs and win direct bookings, because selling direct is when these rules land on you. Now the honest nuance. These laws were written mainly for sellers of air and sea transportation and packaged travel, like traditional agencies. A pure activity operator running a two-hour walking tour sits in a grayer area than an outfitter selling multi-day packages with lodging and transport bundled in. Some activity providers are exempt; many are not sure. So check with the state, and if you sell packages, transport or multi-day trips, assume you are covered until told otherwise.
What each state actually requires
The four programs differ. Here is each, with the load-bearing detail and a source.
California is strictest on marketing. You register with the Attorney General’s Consumer Protection Section, pay a $100 filing fee per location, plus a one-time $75 assessment if you join the Travel Consumer Restitution Fund (CA Attorney General). The rule that trips people up: your registration number must be clearly and conspicuously displayed on all advertising, and the statute spells out “all”, from business cards to internet sites to any writing that offers travel for sale (CA Bus. & Prof. Code 17550-17550.59). In practice, that number lives in your footer.
Florida has the real annual price tag: register with the Department of Agriculture and Consumer Services (FDACS), pay $300 a year, and post a performance bond of up to $25,000 (or $50,000 for “vacation certificates,” add $100) (FDACS). Your number goes on contracts and marketing, including website and social (SuretyBonds.com). Operate cleanly for five years and you can apply for a bond waiver.
Hawaii requires travel agency registration before you sell or advertise travel, with client funds in a trust account at a Hawaii bank (Hawaii DCCA). Washington folds registration into its master business license and makes you keep customer money held over five business days in a trust account (Washington DOL). For both, the theme is deposits held in trust.
| State | What it costs | The catch to remember | Source |
|---|---|---|---|
| California | $100 filing per location (+$75 fund assessment) | Registration number in every ad you run | CA AG |
| Florida | $300/yr + bond up to $25,000 | Number on contracts, website and social | FDACS |
| Hawaii | Registration + Hawaii trust account | Register before you advertise | Hawaii DCCA |
| Washington | Master license + trust account | Hold deposits over 5 days in trust | WA DOL |
How this breaks: the common failure is not skipping registration, it is registering and then forgetting the disclosure. An operator gets a California number, never adds it to the website, then runs a Facebook ad without it. The registration is real; the ad is still a violation. Build the number into your footer, booking confirmation and ad templates the day you get it.
Texting travelers without breaking the TCPA
Reminder texts are the single best no-show fix you have. But the Telephone Consumer Protection Act (TCPA) governs how you text. It gives customers a private right to sue for $500 per violation, rising to $1,500 for willful or knowing violations (Cornell LII, 47 U.S.C. 227(b)(3)). One bad text is $500. Send that same non-compliant blast to 500 people who never opted in and you are looking at $250,000, trebled if a court finds it willful.
Potential TCPA statutory damages in US dollars, at $500 per violation and up to $1,500 for willful violations. Source: 47 U.S.C. 227(b)(3), Cornell LII.
The distinction that matters is between two kinds of text. A transactional message tied to a booking, like a confirmation or departure reminder, sits on safer ground because they gave you the number to make that booking. A marketing message, like a midweek discount blast, needs prior express written consent, meaning they agreed in writing (FCC). Consent for a reminder is not consent for a promo.
Four rules keep you clean. Get consent with a clear opt-in, not a pre-checked box. Put reply-STOP in your messages and honor it immediately. Respect quiet hours. And keep records of when and how each person opted in, because the burden is on you.
How this breaks: the classic mistake is importing an old customer list and blasting a promo. Those people booked with you, but they never consented to marketing texts, and a booking two years ago is not a live opt-in. Start consent fresh and never buy or scrape numbers. Our full SMS marketing playbook covers the sequences in depth.
A2P 10DLC: the registration behind your texts
Here is a layer most operators never hear about until their texts stop arriving. A2P 10DLC stands for Application-to-Person messaging over a 10-Digit Long Code, the phone number your business texts from. US carriers now require every business to register a brand and each campaign through The Campaign Registry before they reliably deliver your traffic (The Campaign Registry). It is a carrier requirement, not a federal law, so it sits separate from the TCPA, but it is just as real: skip it and your carrier throttles your messages, so reminders never land and no-shows creep back up (Microsoft Learn).
Registration means telling carriers who you are (legal name, EIN, address) and what you send (reminders, updates, offers). A little paperwork, a few days of approval, then it runs quietly. Any done-for-you texting setup worth paying for handles this at onboarding.
Email: staying on the right side of CAN-SPAM
Email is the gentlest of the four, which is why people get lazy with it. The CAN-SPAM Act sets a handful of rules for commercial email, and the FTC can fine you up to $53,088 per non-compliant email, a figure set in early 2025 that still holds in 2026 (FTC, Federal Register). Per email. It stacks fast.
You can meet all the rules today. No deceptive subject lines or “from” names. Say so if it is an ad. Include a valid physical postal address (a PO box counts). Give a clear unsubscribe and honor opt-outs within 10 business days. That is the whole law for a small operator.
How this breaks: the failure is almost never a nasty spammer, it is an operator using a personal inbox to email 800 past guests with no unsubscribe and no address. It feels harmless. It is still every rule broken, 800 times. Use a real email platform, or fold email into the system that runs your bookings. If bringing past guests back is the goal, our guide to winning back past travelers shows how.
Waivers and e-signatures
If you put people on a boat, a bike, a raft or an ATV, a signed liability waiver is not paperwork, it is what stands between a bad day and a lawsuit that ends the business. Waivers are governed by state law and how strongly courts enforce them varies, but a clear, well-drafted, signed waiver is enforceable in most states.
A usable waiver names the specific risks of your activity in plain language, includes an assumption-of-risk acknowledgment, and gets signed before the activity, by the participant or a guardian for a minor. Electronic signatures are legally valid for this under the federal ESIGN Act, so a waiver signed on a phone at check-in holds up the same as ink on paper (FTC / ESIGN Act). That is what lets you automate it.
The move that saves you is collecting the waiver at booking, not at the meeting point. Send a signable link with the confirmation, and a guest still unsigned gets one automatic reminder before they arrive. No clipboard, no scramble, no guest turned away.
Do not grab a competitor’s waiver and swap the name. Enforceability turns on the exact language and your state’s law, and a form for a different activity in a different state may not protect you. Pay a lawyer once for a waiver built for what you do, then let the system send and store it. Cheapest legal spend on this list.
What this looks like for solo, mid-size and large operators
The rules are the same for everyone. What changes is how big a lift compliance is, and where to spend your limited time. Here is the honest version for three sizes.
The solo operator or independent contractor. You run trips yourself, maybe under a host agency, selling mostly to locals. First job: the 60-second self-check, then confirm your status with any of the four states that applies. Your texting is mostly transactional, so nail the opt-in on your booking form and add reply-STOP to every message. Get one waiver drafted. Use a real email tool. That is most of it, and your exposure is small once the basics are in place.
The mid-size team. A few year-round staff, seasonal guides, real booking volume, and you run promos, so you are firmly in marketing-consent territory. Registration usually becomes non-negotiable in at least one state, and A2P 10DLC stops being optional. Consent records, opt-out handling and waiver storage need to be systematic, not “somewhere in an inbox,” because at your volume one sloppy blast is a real number of violations.
The large or multi-state operator. Multiple locations and states, big lists, maybe multi-day packages with transport and lodging, which puts you squarely inside the Seller of Travel definition. You likely register in several states, keep your California number on everything, and run trust accounts where Washington and Hawaii require them. Your risk is scale: a gap that is a rounding error for a solo operator is a headline for you. Here it is a named job with an annual calendar and a lawyer on call.
Common objections
“I’m tiny, nobody’s coming after me.” Maybe not the state, at least not first. But the TCPA gives customers the right to sue, and there is a small industry of people who hunt for non-compliant texts because the damages are fixed and easy to prove. Do not be the cheap, obvious target.
“This sounds like it’ll cost a fortune.” It does not. Florida’s $300 a year is the biggest recurring fee on the list. Everything else is one-time setup: a waiver drafted once, consent added to a form once, an email footer fixed once, a 10DLC registration filed once. The expensive path is the one where you skip it and get the letter.
“I already pay for booking software, doesn’t it handle this?” Usually no. Booking tools take the booking. They do not register you as a Seller of Travel, do not draft your waiver, and most leave TCPA consent and A2P 10DLC to you. See our breakdown of what booking software actually costs.
“I run activities, not travel packages. Does Seller of Travel even apply to me?” Possibly not. The laws lean toward sellers of transportation and packaged travel. But “possibly not” is not “no,” and the only way to know is to ask the state. An afternoon confirming you are exempt is worth the certainty.
FAQ
Frequently asked questions
Which states require Seller of Travel registration in 2026?
Four run active programs: California, Florida, Hawaii and Washington. Iowa repealed its requirement in 2020. The rules generally apply based on where your customer lives, so selling to a resident of one of these states can create an obligation even if your business is based elsewhere. Confirm your status with each state agency.
Can I text booking reminders to customers legally?
Yes. Reminders and confirmations tied to a booking the customer made are on much safer ground than marketing texts, because the customer gave you their number to make that booking. Still get a clear opt-in, put a reply-STOP opt-out in every message, honor it immediately, and keep records of consent. Marketing texts like promos need separate prior express written consent.
What is A2P 10DLC and do I have to register?
A2P 10DLC is the carrier system for business texting from a normal 10-digit phone number. US carriers require you to register your business (brand) and message types (campaigns) through The Campaign Registry before they reliably deliver your texts. It is a carrier requirement, not a federal law, but skip it and your reminders get filtered or throttled and may never arrive.
What does CAN-SPAM require for my marketing emails?
A truthful subject line and sender, a valid physical postal address, and a clear, working unsubscribe you honor within 10 business days. If the message is an ad, say so. Penalties reach up to $53,088 per non-compliant email, so use a real email platform that builds these in rather than blasting from a personal inbox.
Do these laws apply if I'm based in another state?
They can. Seller of Travel laws protect the state's residents, so the trigger is usually selling to someone who lives there, not where your office is. If you take online bookings from anywhere, California, Florida, Hawaii or Washington rules may reach you depending on what you sell and to whom.
Are electronic signatures valid on liability waivers?
Yes. Under the federal ESIGN Act, an e-signature is valid for a waiver, so a guest signing on their phone at check-in holds up the same as ink on paper. That is what lets you collect and store waivers automatically. Have the waiver itself drafted by a lawyer for your specific activity and state, since enforceability turns on the language. This article is a plain-English overview, not legal advice.
Compliance is not the exciting part of running tours. It is the quiet stuff you set up once so it never becomes the certified letter on a Thursday. Run the self-check, register where you have to, fix your consent and footer, get a real waiver, then get back to filling departures.