TCPA Consent Requirements: Rules, Revocation, and Penalties

Under the Telephone Consumer Protection Act, TCPA consent requirements split into two levels: informational automated calls and texts need prior express consent, which a consumer typically gives by voluntarily providing their phone number, while marketing calls and texts need prior express written consent with specific disclosures and a signature. Since January 27, 2025, that written consent must also name a single seller rather than covering a list of companies, and businesses must honor revocation requests within 10 business days. Violations carry $500 per call in statutory damages, tripled to $1,500 for willful conduct.¹

The Two Levels of Consent

The TCPA draws a hard line between calls that share information and calls that try to sell something. The consent standard is different for each.

Prior Express Consent for Informational Calls

Non-marketing automated calls and texts, such as appointment reminders, fraud alerts, delivery notifications, and debt collection messages, require prior express consent. You generally provide this when you voluntarily give your phone number to a business during a transaction or account signup. No written agreement is needed. Handing your cell number to a doctor’s office or typing it into an online order form is usually enough consent for that business to send you non-promotional automated messages tied to that interaction.²

Wireless numbers get extra protection. Any automated or prerecorded call to a cell phone requires at least prior express consent regardless of the message content, while the same call to a residential landline without a marketing pitch may not need consent at all in certain circumstances.²

Prior Express Written Consent for Marketing Calls

The moment a call or text contains advertising or telemarketing content, the bar jumps to prior express written consent. This requires a signed written agreement, on paper or digital, that specifically authorizes the seller to send marketing messages using automated technology. Having a customer’s phone number on file is not enough. The agreement must identify the specific phone number being authorized and include the disclosures described below.³

Misclassifying a marketing message as informational is one of the fastest ways businesses get into trouble. A “courtesy call” that mentions a limited-time offer is telemarketing. A health reminder that promotes a supplement is telemarketing. If the message nudges the recipient toward buying something, written consent is required.

One Seller Per Consent

Before January 27, 2025, a single consent form on a comparison-shopping website could authorize robocalls from dozens of different sellers at once. A consumer checking one box might unknowingly invite calls from every company that bought their lead. The FCC’s one-to-one consent rule ended that practice.⁴

Written consent for marketing robocalls and robotexts now applies to only one identified seller at a time. If a lead-generation website works with multiple companies, the consumer must separately select each seller they want to hear from, such as checking individual boxes next to each company name. Blanket consent covering a list of sellers no longer qualifies.²

The content of the resulting calls and texts must also be “logically and topically related” to the website where the consumer gave consent. A person researching auto insurance quotes cannot be called about home security systems, even if the same lead generator collected the number.²

What Valid Written Consent Must Contain

A consent agreement that lacks the right disclosures is legally worthless, no matter how clearly the consumer clicked “I agree.” The FCC mandates two specific disclosures, and both must be “clear and conspicuous,” meaning visible and easy to understand rather than buried in a wall of terms and conditions.³

The first is a technology disclosure. The agreement must tell the consumer that by signing, they are authorizing the seller to contact them using automated dialing, prerecorded voice messages, or artificial voice technology. The second is a voluntariness disclosure: the agreement must state that the consumer is not required to sign it as a condition of buying any product or service. A business cannot make “agree to robocalls” a prerequisite for completing a purchase.⁵

The agreement must also identify the specific phone number being authorized and, under the one-to-one rule, name the single seller authorized to make the calls. Formatting matters. Placing these disclosures in tiny font at the bottom of a scrollable page, or embedding them inside an unrelated privacy policy, risks a court finding that the consent was not clear and conspicuous enough to be valid.³

How to Capture a Valid Signature

The TCPA requires a “signature,” but that doesn’t mean ink on paper. Under the E-SIGN Act, an electronic signature is any electronic sound, symbol, or process a person uses with the intent to sign an agreement.⁶ Common methods include a checked box or clicked button on a website form next to the required disclosure language, a keyword reply like “YES” texted to a short code after receiving a disclosure message, or a handwritten signature on a paper form containing the disclosures.

One caution applies to phone-based consent. The E-SIGN Act explicitly states that oral communications do not qualify as electronic records.⁶ A verbal “yes” during an IVR call can establish prior express consent for informational messages, but relying on it to satisfy the written consent requirement for marketing calls is legally risky. Businesses that use IVR systems for marketing opt-ins should pair them with a follow-up written confirmation.

When the Autodialer Rules Apply

The scope of the consent requirements depends on how “automatic telephone dialing system” is defined. In Facebook, Inc. v. Duguid, the Supreme Court held that a device qualifies as an autodialer only if it can store or produce phone numbers using a random or sequential number generator.⁷ A system that dials from a preloaded customer list, without generating those numbers randomly or sequentially, does not meet the definition.

The practical effect is narrower TCPA reach for many modern marketing platforms, which dial from targeted contact lists rather than randomly generated numbers. But calls using prerecorded or artificial voices still require consent regardless of the dialing technology, and many state laws define autodialers more broadly than the federal statute. Duguid does not eliminate consent obligations across the board.

AI Voices Are Treated as Artificial Voices

In February 2024, the FCC confirmed that calls using AI-generated or cloned voices fall under the TCPA’s restrictions on “artificial or prerecorded voice” technology. Any robocall that uses AI to simulate a human voice needs the same level of consent that a traditional prerecorded message would.⁸

The ruling covers AI tools that fully generate a synthetic voice as well as technology that clones a real person’s voice from an audio sample. Both are treated as artificial voices. Marketing calls using these technologies require prior express written consent; informational calls require prior express consent.⁹

Revoking Consent

Consumers can withdraw consent at any time, using any reasonable method. The FCC has been explicit that businesses cannot force consumers into a single opt-out channel, such as requiring a certified letter or a convoluted phone tree.¹⁰

Several methods automatically qualify. Replying “STOP,” “QUIT,” “END,” “REVOKE,” “OPT OUT,” “CANCEL,” or “UNSUBSCRIBE” to an incoming text works, and so does any other word a reasonable person would understand as a stop request. Using an automated interactive voice or key press opt-out mechanism during a call works. So does using a website link or phone number the caller provided for processing opt-out requests.⁵ A verbal request to a live agent, an email to customer service, or any other method that clearly expresses the desire to stop also counts.

The 10-Business-Day Rule

As of April 2025, businesses must honor revocation requests within a reasonable time not to exceed 10 business days. This replaced the older 30-day window that had applied to telemarketing calls to residential lines and now applies broadly to all robocalls and robotexts requiring consent.⁵

After receiving an opt-out text, a business may send one confirmation text acknowledging the request, but only if it contains no marketing content. If that confirmation goes out within five minutes, it is presumed to fall within the consumer’s prior consent. Anything longer, and the business must be prepared to justify the delay.⁵

Exemptions to Know About

A few categories of calls are partially or fully exempt from the standard consent rules. Emergency calls affecting public health and safety, such as weather closures, imminent threats, and public health alerts, do not require prior consent. Calls containing advertising are never treated as emergencies, even if the underlying topic is health-related.¹¹

Healthcare providers can send automated calls and texts to patients’ cell phones without prior express written consent for specific non-marketing purposes, including appointment reminders, lab results, prescription notifications, and discharge follow-up. Those calls must comply with HIPAA and are limited to one message per day and three per week per patient. Billing, debt collection, and marketing content fall outside the exemption.¹²

Tax-exempt nonprofits may make prerecorded calls to residential landlines without consent, capped at three calls per line within any 30-day period, with an opt-out method in each message and do-not-call recordkeeping. The exemption does not extend to wireless numbers.¹³ Under the FTC’s Telemarketing Sales Rule, an established business relationship lets a company call a consumer whose number is on the National Do Not Call Registry for 18 months after the last purchase or transaction, or 3 months after an inquiry or application. It disappears the moment the consumer asks the company to stop calling.¹⁴

The Reassigned Numbers Problem

Phone numbers get recycled. A number that gave consent three years ago may now belong to a stranger who never agreed to anything. Calling that new owner with an autodialer or prerecorded message is a TCPA violation regardless of the caller’s good-faith belief that consent existed.

The FCC launched the Reassigned Numbers Database in November 2021 to address this. Callers can query the database before dialing to check whether a number has been permanently disconnected or reassigned since the date they originally obtained consent. Using it is voluntary, but it creates a safe harbor: if you query the database, get a “no” response indicating the number hasn’t been reassigned, and that response turns out to be wrong, you are shielded from TCPA liability for that call.¹⁵ Skipping the query means accepting full liability if the number was reassigned.

Proving Consent Later

When a consumer sues claiming they never consented, the business carries the burden of proving otherwise. Vague assertions that “the customer must have opted in” do not hold up. A defensible consent record includes the specific phone number, the identity of the person who consented, the date and time of the capture, the exact disclosure language shown or heard, and the method used to capture the signature.

For website forms, that means logging the IP address, a timestamp, the version of the consent language displayed, and ideally a screenshot or archived copy of the page. For text keyword opt-ins, retain the inbound message with its timestamp. For paper forms, keep the signed original or a high-quality scan.

The statute of limitations for private TCPA lawsuits is four years.¹ Consent records should be retained at least that long. A claim filed in year three about a call made in year one requires documentation going back to the original opt-in. Companies that purge earlier are choosing to fight future lawsuits without evidence.

What Noncompliance Costs

Statutory damages run $500 per violation, tripled to $1,500 per call for willful or knowing violations.¹ Those numbers sound modest until they are multiplied across a calling campaign. A business that sends 10,000 unauthorized marketing texts faces minimum exposure of $5 million at the base rate, or $15 million if a court finds the violations willful. Class actions amplify this. One-off compliance failures affecting large contact lists have produced settlements in the hundreds of millions.

For do-not-call violations specifically, consumers must show they received more than one offending call within a 12-month period before suing. Companies have an affirmative defense if they can show they established and implemented reasonable practices and procedures to prevent violations, which comes back to recordkeeping and list maintenance.¹ Businesses that rely on the National Do Not Call Registry must scrub their lists against an updated version at least every 31 days.¹⁴ Falling behind on that scrub cycle means every call to a registered number during the gap is a potential violation, with no basic defense left to raise.

1
Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
2
Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent Frequently Asked Questions
3
Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991
4
Federal Communications Commission. CGB Announces Effective Date Rule of One-to-One Consent Rule
5
eCFR. 47 CFR 64.1200 – Delivery Restrictions
6
Federal Deposit Insurance Corporation. X-3 The Electronic Signatures in Global and National Commerce Act (E-Sign Act)
7
Supreme Court of the United States. Facebook Inc. v. Duguid, 592 U.S. 395 (2021)
8
Federal Communications Commission. FCC Confirms that TCPA Applies to AI Technologies that Generate Human Voices
9
Federal Communications Commission. Declaratory Ruling – Implications of Artificial Intelligence Technologies on Protecting Consumers from Unwanted Robocalls and Robotexts
10
Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991 (FCC 24-24)
11
Federal Communications Commission. Declaratory Ruling – Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991
12
Federal Register. Limits on Exempted Calls Under the Telephone Consumer Protection Act of 1991
13
Federal Communications Commission. Small Entity Compliance Guide – Limits on TCPA Robocall Exemptions
14
Federal Trade Commission. Q&A for Telemarketers and Sellers About DNC Provisions in TSR
15
Federal Communications Commission. Reassigned Numbers Database