TCPA consent

What does the TCPA require?

The Telephone Consumer Protection Act limits calls made with an autodialer or an artificial or prerecorded voice, and the FCC treats texts as calls. For marketing calls and texts sent that way, FCC rules require prior express written consent: a signed agreement that authorizes the business to send them and names the phone number.

Electronic signatures recognized under the ESIGN Act or state law count, so a website form can collect it. The agreement has to say clearly that the person is agreeing to automated marketing calls or texts, and that agreeing isn’t a condition of buying anything.

Other rules sit alongside consent. Telephone solicitations are limited to 8 a.m. to 9 p.m. in the recipient’s time zone, and numbers on the National Do Not Call Registry can’t receive them unless an exception, like the person’s written permission, applies.

What should a texting consent line on a form say?

Name who will contact them, say how (calls and texts, including automated ones), say what about, and say that consent isn’t required to buy anything. Put it next to the phone field or the submit button, not inside a linked policy, and keep a record of the exact wording each person saw and when they agreed.

Many businesses also add that message and data rates may apply and that replying STOP opts out. That matches what you describe when you register for A2P 10DLC.

Can someone take back their consent?

Yes, in any reasonable way: replying STOP, saying so on a call, or answering an email. FCC rules require businesses to honor a request to revoke consent within a reasonable time, no later than 10 business days after they receive it.

Your CRM should mark the contact as opted out and stop every automated text to that number, including any drip campaign they’re in.

What happened to the FCC’s one-to-one consent rule?

In 2023 the FCC adopted a rule that would have required consent to cover one seller at a time, with calls limited to subjects logically and topically related to where the consent was given. It was aimed at lead generators collecting one consent on behalf of many companies.

On January 24, 2025, the U.S. Court of Appeals for the Eleventh Circuit vacated that part of the order, finding that the FCC had gone beyond what the TCPA allows, and the federal rule text today doesn’t include it. Consent given on your own site, naming your business, is still the cleanest kind to have, especially compared with consent that came with a purchased lead.

What happens if you get it wrong?

The TCPA lets people sue for $500 per violation, and a court can raise that to as much as $1,500 when the violation was willful or knowing. Each call or text can be its own violation, so a campaign to a few hundred people adds up fast. Email follows separate rules under the CAN-SPAM Act.

This is a general overview, not legal advice. Have an attorney review your consent language and texting practices.

Common mistakes

• Hiding the consent language in a terms page instead of next to the phone field.
• Treating a phone number on a form as permission for automated marketing texts.
• Missing opt-outs that arrive as “please stop texting me” instead of the word STOP.
• Assuming purchased leads came with consent that covers your business.

Questions