The Short Answer: Yes for Marketing, No for Informational Messages

Yes — but only for marketing. The TCPA requires prior express written consent before a business sends marketing robocalls, robotexts, or fax advertisements. Informational messages — appointment confirmations, reminders, order updates — do not require it, according to legal analysis of the FCC's current rules.

This distinction matters more than most businesses realize. A text confirming tomorrow's HVAC appointment and a text pitching a seasonal maintenance deal live in two different legal categories — even if they go to the same customer from the same number.

The consent standard isn't vague. Under the currently effective version of 47 CFR § 64.1200(f)(9), valid consent requires a written agreement bearing the consumer's signature that clearly authorizes telemarketing via autodialer or prerecorded voice. Per Cooley's breakdown of the FCC's rules, a compliant consent captures all of the following:

• A written agreement — electronic signatures and web form checkboxes count
• The consumer's signature on that agreement
• The specific telephone number being authorized
• Clear authorization for marketing via autodialer or artificial/prerecorded voice
• A statement that consent is not a condition of purchase

Miss any one element, and the consent may not hold up. The burden of proving valid consent falls on the caller, not the consumer — and with the TCPA's four-year statute of limitations, compliance attorneys recommend retaining consent records for at least that long.

The stakes for getting this wrong are steep: statutory damages run $500 to $1,500 per violation, per class member, with no requirement to prove actual injury. A single non-compliant campaign can multiply into class-action exposure fast.

The practical takeaway is architectural. Your lead-response workflow should treat transactional messages and marketing messages as separate tracks. Appointment confirmations and reminders flow freely; nurture sequences and promotional follow-ups run only where written consent exists. This is exactly how CallMyLeads structures its done-for-you setup — the booking flow collects explicit consent, and opt-outs are honored immediately and automatically, which exceeds the FCC's 10-business-day revocation deadline that took effect April 11, 2025.

One more nuance: the FCC's stricter "one-to-one consent" rule was vacated by the Eleventh Circuit and formally abandoned by the FCC in September 2025. But the underlying consent requirement never wavered — consent must still be clear and unmistakable, and the FTC's Telemarketing Sales Rule separately requires signed written agreement for prerecorded marketing calls.

What a Violation Costs: $500–$1,500 Per Call or Text

A single text message sent without valid consent can cost more than most small businesses spend on marketing in a month. Multiply that by every person on a contact list, and the math gets frightening fast.

Under the TCPA's private right of action, statutory damages run $500 to $1,500 per violation, per class member — and plaintiffs don't need to prove they suffered any actual injury. According to BCLP's analysis of the TCPA's opt-out rules, the absence of an injury requirement is precisely what makes the statute so dangerous for businesses that skip consent verification.

That per-violation structure is what fuels class actions. If a business sends an automated marketing text to 10,000 people without proper consent, exposure can reach $5 million at the lower end — and $15 million if a court finds the violations willful. As Cooley notes, damages can reach up to $1,500 per violating call or text, turning routine campaigns into existential legal threats.

The statute of limitations makes things worse. Plaintiffs have four years to bring a claim, which means a single campaign from 2022 can still surface in a lawsuit today. That long tail is why legal counsel commonly recommends retaining consent documentation for at least four years — the full window during which a claim can be filed.

Why the TCPA attracts so much litigation comes down to a few structural features:

• Statutory damages with no need to prove actual harm or financial loss
• Per-call, per-text, per-person damages that scale into the millions in class actions
• A four-year statute of limitations that keeps old campaigns actionable
• Evolving rules — like the April 2025 revocation requirements — that create fresh compliance gaps to exploit

That last point deserves emphasis. Cooley warned that the TCPA "already is a major source of class action litigation," and that new rules "surely will provide new ammunition for an aggressive plaintiffs' bar that is constantly pressure testing the marketplace looking for new targets." Every regulatory change — opt-out keywords, cross-channel revocation, DNC protections extended to texts — opens new angles for plaintiffs to argue a business fell short.

Here's the part that surprises many businesses buying leads: the burden of proving valid consent falls on the business making the calls or texts — not the lead vendor. According to BCLP, if a lead generator collected consent improperly, the company that dials or texts that lead still owns the liability. "The vendor said consent was covered" is not a defense.

This is why consent practices belong inside your outreach system, not just your vendor contracts. At CallMyLeads, the booking flow collects explicit consent, and opt-outs are honored immediately and automatically — well ahead of the FCC's 10-business-day revocation deadline. When a single unwanted text can carry a $1,500 price tag, building compliance into the first response is the cheapest insurance a business can buy.

The 2025 Rule Shakeup: One-to-One Consent Is Dead, but Consent Is Not

If you blinked in 2025, you probably missed a regulatory plot twist. The FCC's "one-to-one consent" rule went from adopted, to litigated, to vacated, to formally abandoned — all in under two years.

In December 2023, the FCC adopted rules designed to close what regulators called the "lead generator loophole," requiring consumers to consent "one seller at a time" and restricting call content to be "logically and topically associated" with the website that prompted consent, according to compliance analysis from America's Credit Unions. The rule was originally set to take effect January 27, 2025, then postponed to January 26, 2026.

Then the Eleventh Circuit intervened. In Insurance Marketing Coalition Limited v. FCC, 127 F.4th 303 (11th Cir. 2025), the court held that the FCC exceeded its statutory authority and vacated the rule. In September 2025, the FCC issued a final rule formally eliminating the one-to-one requirement, declining to further challenge the decision.

Here's where businesses get into trouble. The vacatur killed one-to-one consent — it did not kill consent. The requirement for prior express written consent remains fully intact, and the Eleventh Circuit itself emphasized that consent must still be "clear and unmistakable," as industry compliance resources note. Only the scope of valid consent broadened: consumers can now authorize robocalls from multiple possible sellers, even where the consenting website has no logical relationship to the caller.

The stakes haven't softened either. Statutory damages run $500 to $1,500 per violation, per class member, with no requirement to prove actual injury, per legal analysis from BCLP. And a separate regime still applies:

• The FTC's Telemarketing Sales Rule still requires sellers to directly obtain a consumer's prior signed written agreement for prerecorded marketing calls
• New consent revocation rules took effect April 11, 2025, requiring opt-outs honored within 10 business days
• The National Do Not Call Registry now extends to marketing texts

Reading the vacatur as a green light for loose consent practices is exactly the mistake the plaintiffs' bar is waiting for. As Cooley observed, the TCPA already fuels major class action litigation, and shifting rules give aggressive plaintiffs' attorneys new targets.

The practical takeaway: keep consent disclosures clear, conspicuous, and documented — and retain records for at least the four-year statute of limitations. That's why CallMyLeads builds explicit consent collection directly into its booking flow and honors opt-outs immediately and automatically, rather than treating compliance as an afterthought.

New Opt-Out Rules: Revocation 'In Any Reasonable Manner'

Getting consent is only half the equation — as of April 11, 2025, the rules for losing consent just got much stricter for businesses. The FCC's new revocation rules give consumers broad power to opt out, and they put the compliance burden squarely on you.

Under the new framework, consumers may revoke consent in any reasonable manner. Businesses can no longer designate a single exclusive opt-out method and ignore everything else. According to BCLP's analysis of the new rules, the FCC-endorsed keywords include "STOP," "QUIT," "END," "REVOKE," "OPT-OUT," "CANCEL," and "UNSUBSCRIBE."

The rules go further than keywords. A consumer who revokes by voicemail, email, or even by telling a cashier carries a rebuttable presumption of reasonableness — meaning the burden falls on the business to prove the method was unreasonable, not on the consumer to prove it was valid.

Once a revocation lands, the clock starts. Key obligations include:

• Honor revocations within 10 business days — no more slow suppression-list updates.
• Apply the opt-out across both robocalls and robotexts, regardless of which channel the consumer used to revoke.
• Send at most one clarification message within 5 minutes of the opt-out, with no marketing content.
• Treat an opt-out from an informational message as stopping all future non-emergency communications — a much broader cutoff than an opt-out from a marketing message, which stops only marketing.

That last point surprises many businesses. If a customer replies STOP to an appointment reminder — an informational text — you cannot simply move them to a "marketing only" suppression list. Per the same legal analysis, every non-emergency call and text must stop.

The FCC's official Public Notice set the effective date at April 11, 2025, and industry groups representing banks, credit unions, and debt collectors pushed for a delay to April 2026, citing the difficulty of coordinating opt-outs across channels and vendors. That request tells you where the real risk lives: a lead opts out by text, but your calling vendor keeps dialing because the two systems never synced.

Separate from revocation, the FCC also extended National Do Not Call Registry protections to text messages, codifying that texts count as "calls." Marketers may still text DNC-registered numbers, but only with the consumer's prior express invitation or permission, as Cooley's regulatory summary explains.

The practical takeaway: consent management can no longer live in a spreadsheet. With statutory damages of $500 to $1,500 per violation and no requirement to prove actual injury, one missed opt-out repeated across a campaign gets expensive fast. This is why CallMyLeads builds opt-out handling directly into its lead response system — revocations are honored immediately and automatically across every channel, well inside the 10-business-day legal window, so a lead who says STOP actually stops hearing from you everywhere.

Building a Compliant Lead-Response Workflow: 5 Practical Steps

Knowing the rules is one thing. Building them into a workflow that still answers leads in seconds is where most businesses stumble. Here are five practical steps that keep speed-to-lead and TCPA compliance working together instead of against each other.

1. Collect explicit written consent at the point of booking or form submission.

The TCPA requires prior express written consent before any marketing robocall or robotext, and valid consent must be in writing, signed, tied to the consumer's phone number, and clear that consent isn't a condition of purchase, according to Cooley's analysis of the FCC rules. The cleanest moment to capture this is when the lead first raises their hand — your web form, chat, or booking flow. This is exactly why CallMyLeads builds consent collection directly into the booking flow rather than bolting it on afterward.

2. Separate transactional messages from marketing messages.

Informational communications — appointment confirmations, reminders, order updates — do not require prior express written consent, while marketing nurture messages do, per BCLP's breakdown of the TCPA's opt-out rules. Tag every message type in your system so a confirmation never accidentally carries promotional language.

3. Honor opt-outs instantly and automatically across every channel.

Since April 11, 2025, consumers can revoke consent "in any reasonable manner" — including keywords like STOP, QUIT, END, and UNSUBSCRIBE, or even voicemail and email — and businesses must honor revocations within 10 business days, according to the FCC's official notice. Key operational points:

• Process opt-outs immediately, not at the 10-day legal maximum
• Sync revocations across text, call, and email systems at once
• Remember that an opt-out from an informational message stops all non-emergency communications
• Send only one clarification message, within 5 minutes, with no marketing content

Automated opt-out handling — the kind CallMyLeads runs by default — removes the human delay that turns a revoked consent into a $500–$1,500 per-violation statutory damages claim, with no proof of injury required, as BCLP notes.

4. Keep consent records for at least four years.

The TCPA's statute of limitations runs four years, and the burden of proving valid consent falls on the caller — not the consumer. Store the consent text shown, the timestamp, the source, and the phone number for every lead.

5. Make lead-vendor agreements document consent.

Even though the FCC formally eliminated the one-to-one consent requirement in September 2025, per Consumer Finance Insights, consent must still be "clear and unmistakable," and the FTC's Telemarketing Sales Rule separately requires sellers to directly obtain signed written agreement for prerecorded marketing calls, as DNC.com explains. If you buy leads, your vendor contracts should specify exactly how consent was captured and require records to be transferable to you.

Build these five steps into your response workflow once, and speed never has to come at the cost of compliance.