TCPA Consent Requirements Every U.S. Marketer Must Know
If you use an autodialer, a prerecorded voice, or an AI-generated voice for marketing texts or calls, you need prior express written consent that names the seller and includes every required disclosure. No shortcuts. No verbal handshake. No “they gave us their number once at a trade show, so we’re covered.”
Consent has to be seller-specific, tied to the exact number contacted, and backed by proof you can produce on demand. If you’re marketing anything, from insurance quotes to real estate listings, and touching an autodialer or AI voice, that’s your baseline. Here’s what to do about it right now:
- Audit every intake point where a phone number gets collected, forms, landing pages, phone scripts, lead marketplace feeds, and flag any that lack seller-specific disclosure language.
- Update your disclosure copy to include the seller’s name, a clear statement that consent isn’t a condition of purchase, and an autodialer/AI-voice notice.
- Start building proof packages now, timestamp, IP address, page URL, and the exact disclosure text shown at opt-in, stored together, not scattered across systems.
The FCC’s 2024 Report and Order codified a consumer’s right to revoke consent through any reasonable method and set firm timelines for honoring that revocation. That single change reshaped how compliant sales operations have to think about opt-out handling, and it’s why “we’ll get to it” is no longer an acceptable internal policy.
Key Takeaways
Compliant TCPA marketing requires seller-specific prior express written consent for autodialed or AI-voice campaigns, documented proof at capture, and revocation systems that honor opt-outs within days, not weeks.
| Point | Details |
|---|---|
| Match consent type to channel | Use PEWC for autodialed/AI-voice marketing; PEC may suffice for purely informational messages. |
| Capture full proof packages | Store disclosure text, timestamp, IP, URL, and signature together, not scattered across systems. |
| Honor revocation fast | Treat a reasonable time as the outer limit and propagate opt-outs across every connected vendor. |
| Scrub DNC and reassigned numbers | Run scrubs at least every 31 days regardless of prior consent status. |
| Block unverified leads at intake | Require proof of consent before any lead reaches a dialer queue, especially in insurance and healthcare. |
Ready to attach consent proof to every lead before it reaches your team? See how RevRing’s platform routes only verified leads to your dialer queues, keeping your compliance program and your sales velocity in sync.
Table of Contents
- What Are TCPA Consent Requirements and Which Type Applies to You?
- FCC Rule Changes From 2024 to 2026: What Changed and When
- How to Write TCPA-Compliant Consent Language
- Proof of Consent: What You Need to Store and Produce
- Revocation and Opt-Out: What Counts and How Fast You Must Act
- DNC Lists, Reassigned Numbers, and How They Interact With Consent
- A 180-Day Compliance Rollout Checklist
- How RevRing Operationalizes Consent Capture and Routing
- Where to Verify These Rules Yourself
- Why Most Compliance Programs Are Fighting the Last War
- Sources
What Are TCPA Consent Requirements and Which Type Applies to You?
TCPA consent isn’t one standard. It’s three, and picking the wrong one is how compliance programs quietly collapse.
1. Prior Express Written Consent (PEWC) This is the strictest tier, and it’s what you need for any marketing call or text placed using an autodialer, prerecorded voice, or AI-generated voice. Under 47 C.F.R. § 64.1200(f)(9), a valid PEWC agreement must include:
- A clear, conspicuous disclosure that the consumer authorizes the seller to deliver marketing calls or texts using an autodialer or prerecorded/AI voice
- The specific seller’s name (not a vague “our partners” clause)
- A statement that consent is not required as a condition of purchasing goods or services
- Some form of signature, wet ink or electronic, tying the consumer to that specific disclosure
2. Prior Express Consent (PEC) A lower bar that applies mainly to informational or non-telemarketing calls and texts, think appointment reminders, fraud alerts, or delivery notifications. Giving a business your number in the normal course of a transaction can qualify as PEC for related informational messages, but the moment that message pivots to pitching a new product or upsell, you’re back in PEWC territory.
3. Prior Express Invitation or Permission (PEIP) This applies mostly to fax communications under the TCPA’s junk fax provisions. A business relationship or an invitation to send materials can establish PEIP, but it’s a narrower and less commonly relied-upon category for most marketers running voice or text campaigns today.
Technology is what pushes the consent requirement upward. A live agent manually dialing a number from a spreadsheet has more flexibility than a predictive dialer, prerecorded voice message, or AI voice agent placing that same call. The Hunton compliance guide on TCPA marketing campaigns draws a hard line between informational and telemarketing content, and that distinction is fact-specific. A “your appointment is confirmed” text is informational. That same text with “and here’s 20% off your next visit” tacked on the end just became telemarketing, and now it needs PEWC.
FCC Rule Changes From 2024 to 2026: What Changed and When
The last two years brought the most significant regulatory shift to TCPA enforcement since the original statute passed. Marketers who haven’t updated their consent stack since 2023 are almost certainly out of step with current requirements.
The FCC’s February 2024 Report and Order (FCC-24-24A1) codified several provisions that reshape day-to-day compliance work:
- Revocation by any reasonable means. Consumers can revoke consent using any method that clearly conveys their intent, not just the specific opt-out channel a business designates. Replying “STOP” to a text works, but so does telling a live agent to stop calling, or emailing a support inbox.
- Defined timing for honoring revocations. Callers must stop within a reasonable time after receiving a revocation request, honoring such requests promptly as required by the FCC.
- One-time confirmation texts. A single text confirming that a consumer’s opt-out request has been processed is permitted without additional consent, as long as it’s sent promptly and contains no marketing content.
- Wireless provider obligations. Carriers gained clearer authority to block illegal robocall traffic at the network level, adding another layer of enforcement pressure on noncompliant senders.
These provisions were formalized in the Federal Register’s November 2024 final rule, which restates the disclosure and consent content requirements alongside the regulatory record supporting the CFR updates. Worth noting: the FCC’s separate one-to-one consent rule for lead generators, originally set for a January 2025 effective date, was postponed, a shift the National Association of Realtors covered in detail as it directly affects real estate lead flows. Don’t assume postponed means abandoned. Treat it as delayed, not dead, and build your lead-vendor contracts as if it’s coming back.
The practical fallout hits three areas hardest. First, consent models built around a single “designated opt-out number” no longer hold up, since revocation now has to be honored regardless of channel.
Second, lead vendors face new pressure to prove seller-specific consent rather than bundled, resold permission strings. Third, any business buying leads from third parties needs contractual warranties that consent was collected correctly, because courts consistently put the burden of proof on the caller, not the lead seller. If you’re pulling leads through a lead marketplace, that warranty language belongs in your vendor agreement today, not after a demand letter arrives.
How to Write TCPA-Compliant Consent Language
Getting the legal elements right on paper means nothing if your opt-in form buries them in fine print.
The disclosure requirements under 47 C.F.R. § 64.1200(f)(9), often called the Troutman Nine among compliance practitioners, boil down to a practical checklist:
- Identify the seller by name. No generic “our company” or “our partners” language.
- Disclose the autodialer/AI-voice method. State plainly that calls or texts may be sent using automated technology.
- State that consent is not a purchase condition. This sentence has to appear, not be implied.
- Specify the phone number being authorized. Consent tied to a form field, not a blanket authorization.
- Capture a signature. Electronic signatures via checkbox-plus-submit satisfy this if implemented correctly.
- Use clear, conspicuous formatting. No 6-point gray text at the bottom of a footer.
- Keep the checkbox unpopulated by default. Pre-checked boxes have been a recurring target in litigation.
- Place consent language near the submit button. Proximity matters for the “clear and conspicuous” standard.
- Separate consent from other terms. Don’t bury it inside a general terms-of-service wall of text.
The Klein Moynihan Turco primer on TCPA consent language makes a point worth internalizing: courts scrutinize checkbox placement, font size, and color contrast as evidence of whether consent was actually “clear and conspicuous,” not just technically present.
Here’s a compact web form example: “By checking this box, you agree that [Company Name] may contact you at the number provided using an autodialer, prerecorded voice, or AI voice for marketing purposes. Consent is not required to purchase our services. Message and data rates may apply.”
Pro Tip: Run your consent language past someone who has never seen your form before. If they can’t explain in one sentence what they’re agreeing to, your disclosure isn’t clear and conspicuous, it’s just present.
Proof of Consent: What You Need to Store and Produce
CRM entries alone rarely hold up in litigation. That’s the blunt reality practitioners keep repeating, and it’s backed by Foley’s guidance on the FCC’s consent rules, which stresses that a full proof package is what actually survives a court challenge.
Store these elements together, not scattered across three systems that don’t talk to each other:
- The exact disclosure text shown to the consumer at the moment of opt-in
- Timestamp of consent capture, down to the second where possible
- IP address of the device used
- The specific page URL where consent was given
- Checkbox state (checked, and by whom, meaning which session or account ID)
- Signed e-signature record or, for phone-based consent, the audio recording itself
Disclosure text changes over time as legal guidance evolves, so version it. Archive a screenshot or a saved snapshot of the page as it appeared at the moment of capture, then link that archived record to the specific lead ID.
The most common defense failure isn’t bad consent language. It’s good consent language that nobody can prove was actually shown to the consumer at the time they agreed to it.
Set a retention policy that outlasts the TCPA’s statute of limitations (generally four years for most claims), restrict who can edit archived consent records, and if you’re buying leads, require vendor warranties that specify what proof elements they’ll hand over if a claim surfaces later.
Revocation and Opt-Out: What Counts and How Fast You Must Act
The FCC’s codified standard means a consumer can revoke consent through any reasonable method, texting STOP, telling a live agent, emailing support, or posting on social media in some interpreted cases. You can’t limit revocation to a single designated channel and ignore the rest.
- Recognize per-se SMS keywords: STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE should all trigger automatic suppression.
- Build natural-language parsing beyond keywords, because Cove Law’s analysis of prior express consent notes that courts have upheld revocation through plain conversational language too, not just magic words.
- Honor requests fast. A reasonable time is the legal standard; in practice, treat a timely response as essential and aim to stop solicitations as soon as possible after revocation requests.
- Propagate STOPs across every vendor and platform touching that number, since a suppressed number in one system but live in another is exactly how liability compounds.
Pro Tip: If your dialer, texting platform, and CRM don’t sync opt-outs automatically, you have three separate points of failure. Fix the sync before you fix anything else.
DNC Lists, Reassigned Numbers, and How They Interact With Consent
Prior consent doesn’t override the National Do Not Call Registry once a number lands on it for marketing purposes, and an established business relationship exemption has real limits that don’t apply broadly to cold telemarketing.
- Scrub against the National Do Not Call Registry at least every 31 days, which aligns with the safe harbor timeframe regulators generally recognize.
- Check the FCC’s Reassigned Numbers Database before every campaign, since a number that had valid consent six months ago may now belong to someone who never agreed to anything.
- Maintain your own internal DNC list separate from the national registry, honoring every individual opt-out permanently regardless of registry status.
A 180-Day Compliance Rollout Checklist
Treat this as a phased build, not a weekend fire drill.
- This week: Audit every intake point collecting phone numbers. Pause any campaign using autodialers or AI voice without documented PEWC.
- Within 30 days: Rewrite opt-in disclosure language to meet the nine required elements, add proof-capture fields (timestamp, IP, URL) to every form, and revise vendor contracts to require consent warranties.
- Within 90 days: Automate DNC and reassigned-number scrubbing on a recurring schedule, and build cross-vendor opt-out propagation so a STOP in one system suppresses the number everywhere.
- Within 180 days: Train sales and support staff on revocation handling, run an internal consent audit against a sample of active leads, and repeat that audit quarterly going forward.
How RevRing Operationalizes Consent Capture and Routing
Consent proof shouldn’t live in a spreadsheet that nobody checks before a lead hits a dialer. It should travel with the lead record itself.
That means attaching the disclosure text, timestamp, IP address, and signature record to each lead the moment it enters your system, then blocking any lead lacking that proof package from reaching the dialer queue at all. No proof, no dial. That’s the rule, and it removes the human judgment call that gets compliance teams into trouble.
- Insurance and healthcare workflows need stricter proof thresholds given regulatory overlap with HIPAA and state insurance codes.
- Real estate lead flows benefit from seller-specific consent tagging when leads move between agents or brokerages.
- Lead marketplace purchases should require the seller to hand over a signed consent string, not just a phone number and a name.
If your current CRM or lead routing setup can’t block unverified leads automatically, that’s the gap to close first, before you add another campaign to the queue.
| Consent Element | Where to Enforce It |
|---|---|
| Disclosure proof attached to lead | Before the lead enters any dialer queue |
| Seller-specific consent tagging | At the point of lead purchase or intake |
| Revocation propagation | Across CRM, dialer, and texting platforms simultaneously |
Where to Verify These Rules Yourself
- FCC Report and Order (FCC-24-24A1)
- Federal Register: TCPA Final Rule, November 2024
- 47 C.F.R. § 64.1200
- FTC: Complying with the Telemarketing Sales Rule
- National Do Not Call Registry
Why Most Compliance Programs Are Fighting the Last War
Most TCPA compliance advice still treats consent as a checkbox problem, get the disclosure language right, get a signature, file it away. That mindset made sense before 2024. It doesn’t anymore.
The FCC’s revocation-by-any-reasonable-means standard flipped the harder problem from collection to maintenance. Getting consent right at intake is table stakes now. The real exposure lives in what happens after that, whether a STOP typed into one system actually suppresses that number everywhere else it exists. Most companies I’d expect to see audited aren’t failing because their opt-in forms are bad. They’re failing because their dialer, CRM, and texting platform don’t talk to each other fast enough.
Prioritize the sync problem before you prioritize prettier consent copy. A well-worded disclosure attached to a lead that never gets suppressed after revocation is worse than no disclosure at all, because it creates a paper trail proving you knew better.
— Marc