Marketing Consent Rules: TCPA, CAN-SPAM, and State Laws

Marketing consent rules split sharply by channel: under the Telephone Consumer Protection Act, a business generally needs the consumer’s prior express written consent before sending marketing calls or texts, while under the CAN-SPAM Act, commercial email can go out without upfront permission as long as the message follows formatting rules and honors opt-out requests. Getting the wrong framework for the wrong channel is where most compliance trouble starts.

Calls and Texts Under the TCPA

The Telephone Consumer Protection Act (47 U.S.C. § 227) bars the use of automated dialing systems or prerecorded voices to contact a cell phone without consent, and it prohibits prerecorded-voice calls to residential landlines without permission.¹ The Federal Communications Commission writes the rules that give “consent” its working definition.

Consumers can sue in state court and recover $500 per unauthorized call or text. Willful or knowing violations can be tripled to $1,500 per contact.¹ Class action attorneys track TCPA violations closely, and the per-message math makes the exposure serious even for a modest campaign.

Email Under CAN-SPAM

Commercial email runs on a different model. The CAN-SPAM Act (15 U.S.C. § 7701 et seq.) does not require a business to obtain permission before sending a marketing email. It regulates how the message is sent and gives the recipient a right to stop future messages. A compliant commercial email must avoid deceptive subject lines, identify itself as an advertisement, include a valid physical mailing address, and offer a clear opt-out mechanism.²

The Federal Trade Commission enforces CAN-SPAM and can impose civil penalties of up to $53,088 per violating email, adjusted annually for inflation.² The takeaway is straightforward. Sending a marketing text without consent violates federal law. Sending a marketing email without consent does not, provided the message and the opt-out process follow the rules.

What Valid Written Consent Looks Like

The TCPA distinguishes two consent standards. Informational calls (appointment reminders, delivery updates, account alerts) require “prior express consent,” which can be as simple as the consumer providing their phone number. Marketing and telemarketing require the higher standard of “prior express written consent.”

Valid written consent for marketing calls or texts must include:

A clear disclosure stating that the person is authorizing the business to send marketing messages using automated technology or prerecorded voices.
The specific phone number the business is authorized to contact.
A statement that agreeing to receive marketing is not required as a condition of buying anything.
An affirmative action by the consumer, such as checking an unchecked box or signing a form. A pre-checked box does not count.

The pre-checked box is where a lot of businesses get caught. A pre-populated checkbox tucked into a terms-of-service page is not valid consent, even if the consumer submitted the form. Consent requires a deliberate step the business can later prove happened.

When an Existing Relationship Substitutes for Consent

An existing business relationship can substitute for formal consent in certain telemarketing situations. Two windows apply.

For purchases and completed transactions, the window runs 18 months from the date of the last transaction or payment.³ A company that sold you a water heater in March 2025 can call about maintenance plans or related products through September 2026 without separate written consent.

For inquiries, where someone requested a quote, filled out a contact form, or submitted an application, the window is three months from the date of the inquiry.³ After 90 days, the business must either get fresh consent or stop calling.

Both windows close immediately if the consumer asks to stop receiving calls, regardless of how much time remains.

One-to-One Consent Starting January 2026

A rule change scheduled to take effect on January 26, 2026 reshapes how lead-generation companies collect consent. Under the FCC’s “one-to-one” consent requirement, a consumer’s written consent must name a single, specific seller.⁴ The older practice of one checkbox authorizing an entire network of partners is going away.

A comparison-shopping site that wants to share leads with five insurance companies will need to present five distinct consent options, each clearly identifying the company that will be calling. Businesses that buy leads from third-party generators should look closely at how those leads are collected. If the consent trail does not clearly connect back to your specific company, calling that number carries the same $500-to-$1,500-per-call exposure as any other unauthorized contact.

AI-Generated Voice Calls

In February 2024, the FCC issued a declaratory ruling confirming that AI-generated voices qualify as “artificial or prerecorded voices” under the TCPA. A marketing call that uses AI to simulate a human voice, whether it sounds robotic or convincingly natural, requires the same prior express written consent as a traditional prerecorded message.⁵ The technology used to generate the voice does not change the analysis. If it is not a live human speaking, TCPA consent applies.

How Consumers Revoke Consent

A consumer can revoke marketing consent at any time, through any reasonable method. The FCC has kept this standard deliberately broad, so no specific form or magic words are required.⁶ Each channel has its own conventions.

Text Messages

Replying “stop” is the most common opt-out, and the FCC recognizes several other keywords as automatically valid, including “quit,” “end,” “revoke,” “cancel,” and “unsubscribe.” Other phrasing can also work. The standard is whether a reasonable person would read the message as a revocation request.

Email

Every commercial email must include a functioning unsubscribe mechanism that stays active for at least 30 days after the email is sent. Once a recipient clicks unsubscribe, the business has a maximum of 10 business days to stop sending marketing emails to that address.² Companies cannot require you to log in, pay a fee, or navigate extra steps to opt out.

Phone Calls

During a live telemarketing call, you can tell the representative to place you on the company’s internal do-not-call list. The representative must honor that verbal request. Businesses are required to maintain these company-specific lists for at least five years.⁷

The National Do Not Call Registry

Beyond company-specific opt-outs, the National Do Not Call Registry blocks most telemarketing across the board. Once a number is on the registry, telemarketers cannot call it without prior express written consent or a qualifying existing business relationship.

Businesses that make telemarketing calls must scrub their lists against the registry at least every 31 days. For fiscal year 2026, the first five area codes are free to download, each additional area code costs $82 per year, and nationwide access is capped at $22,626 annually.⁸

Proving Consent Existed

When a TCPA lawsuit lands, general recollection is not a defense. A solid consent record typically includes:

The exact date and time the consumer submitted the consent.
The specific disclosure and authorization text the consumer saw at that moment.
The consumer’s identity and the phone number or email address covered.
The method of consent, such as a web form, signed document, or recorded verbal authorization.
For online forms, the IP address and browser information tied to the submission.

The Telemarketing Sales Rule requires sellers and telemarketers to retain records of their telemarketing activities for five years from the date each record is produced.⁹ Businesses must also log opt-out requests and document that each one was honored within the required timeframe.

Liability for Vendors and Third Parties

Hiring a third-party telemarketer or buying leads from an outside vendor does not insulate a business from TCPA liability. Courts have held that a company can be responsible for unauthorized calls made on its behalf, even if it never directly placed them. The analysis turns on whether the third party acted with the company’s consent, authority, or apparent authority.

Courts look at factors like whether the company supplied call lists or scripts, how closely the third party’s marketing was tied to the company’s operations, and whether the company benefited from the calls. Handing a vendor your brand and a target list, then claiming ignorance about their robocalls, does not work. Review how your marketing partners obtain consent, audit their calling practices, and put TCPA compliance requirements in your contracts.

State Laws Can Go Further

Federal law sets a floor. Many states have enacted their own telemarketing and electronic communications statutes with stricter requirements or higher penalties. Per-violation damages under state laws can reach $5,000 or more in some jurisdictions, and a few states require consent for commercial emails that CAN-SPAM would allow without it. Businesses operating across state lines should account for the strictest rules that apply to their audience, not only the federal baseline.

1
Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
2
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
3
Federal Trade Commission. Complying with the Telemarketing Sales Rule
4
Federal Register. Strengthening the Ability of Consumers To Stop Robocalls
5
Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991
6
Federal Communications Commission. Stop Unwanted Robocalls and Texts
7
Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991
8
Federal Trade Commission. Telemarketer Fees to Access the FTC’s National Do Not Call Registry to Increase in 2026
9
eCFR. 16 CFR 310.5 – Recordkeeping Requirements