[cmatthias]

The TCPA requires express written consent to send marketing messages or phone calls to any personal phone number. Legal precedent dictates that online, this usually takes the form of a specific checkbox on the form where you're giving your phone number saying that you agree that the company can use the phone number for marketing purposes. I doubt Meta collects this type of express written consent for your 2FA phone number, but I guess it's possible.

There indeed used to be an exemption to the law involving an existing business relationship, but 1) this was only for residential land lines and never applied to cell phones, and 2) it was revoked on October 16, 2013. [1]

[1] https://tcpablog.com/new-tcpa-regulations-take-effect-on-oct...