Where TCPA actually stands

01What was supposed to happen

In December 2023 the FCC adopted a rule aimed at what it called the lead generator loophole. Under it, written consent would have had to name a single seller at a time, so one form on one comparison site could no longer authorise calls from dozens of companies at once. Lead buyers across every vertical spent a year preparing for it. It was due to take effect on 27 January 2025.

02What actually happened

On 24 January 2025 — three days before the effective date — the Eleventh Circuit vacated the rule in Insurance Marketing Coalition v. FCC. The court held the agency had exceeded its statutory authority: because the TCPA does not define prior express consent, the phrase carries its ordinary meaning, and the FCC could not narrow it by regulation.

The FCC subsequently removed the vacated language and reinstated the previous version of the rules. The federal consent standard reverted to where it stood before 2023.

03What the standard is now

For autodialed or prerecorded marketing calls to a mobile number, you need prior express written consent. In practice that means a written agreement, signed by the consumer, that:

• clearly authorises calls or texts using an autodialer or prerecorded voice;
• discloses that agreeing is not a condition of any purchase;
• identifies the number the consumer is authorising you to call.

Electronic signatures count. There is no one-to-one requirement at federal level, so a single form can still authorise more than one company.

The exposure has not moved: statutory damages run from $500 to $1,500 per violation with no cap, which is what makes a single non-compliant campaign against a large file an existential rather than an administrative problem.

04One rule still on the way

Separately from the consent question, the FCC's 2024 order on revocation of consent included a provision — usually called the revoke-all or global revocation rule — requiring that when a consumer revokes consent on one channel, the revocation applies to all future robocalls and robotexts from that caller, including on unrelated matters.

Most of that order took effect in April 2025 and is in force now. This specific provision has been waived repeatedly. In January 2026 the FCC extended it again, to 31 January 2027, while it considers whether to modify or drop the requirement altogether.

Two practical conclusions. First, the other revocation rules already apply, so opt-out handling is not something to defer. Second, opt-out plumbing that works across voice and SMS together is worth building now, because the deadline has moved three times and could stop moving.

05Why one-to-one discipline is still worth keeping

The mandate is gone. The reasoning behind it was never really about the regulation.

Consent that names one company produces better contact rates, because the merchant recognises who is calling. It produces a cleaner record if a claim ever lands, because there is no argument about which of forty marketing partners was authorised. And it attracts less carrier spam-labelling, because the calling patterns look less like a list being blasted.

A lead whose consent language authorises unnamed marketing partners is legal to buy and weak to hold. If a dispute arrives, that is the document you will be relying on.

06What DNC scrubbing does and does not cover

Scrubbing against the National Do Not Call Registry addresses one specific risk. It is a floor, not a compliance programme. It does not handle:

• your own internal do-not-call list, which you are obliged to maintain;
• state registries, which several states run separately;
• calling-hour restrictions, which follow the number's location rather than yours;
• consent that has since been revoked;
• mobile numbers, where consent obligations apply regardless of registry status.

A vendor telling you a file is scrubbed has told you one useful thing. They have not told you the file is safe to dial however you like.

07State law diverges, and it matters more than it used to

Several states run their own mini-TCPA statutes that are stricter than federal law on consent, permitted calling hours, or private rights of action. When you dial into a state you are subject to that state's rules, not the ones where your floor sits.

If you call nationally, this is worth a genuine review with counsel rather than a checklist. The federal standard loosened; several state standards did not, and the gap between them is now wider than it was.

08What to keep, and for how long

If a claim arrives, the file you can produce is the whole defence. Keep, per lead:

1. the consent record — the exact disclosure text, the URL, the timestamp, and the IP address;
2. the delivered file itself, unaltered, with opt-in dates intact;
3. your DNC scrub records, with the dates you ran them;
4. every opt-out request and when you honoured it.

Retention periods should be set with your counsel, but the instinct to keep these longer than feels necessary is a good one. TCPA claims do not arrive promptly.

09Common questions