The Big 2026 Story: A Rule That Died, Not a Rule That Landed

Here's the twist most 2026 TCPA guides bury: the biggest rule change of the year is a rule that no longer exists. The FCC's one-to-one consent rule — the one businesses spent two years bracing for — is dead, and understanding why matters more than memorizing what it would have required.

The rule, adopted in December 2023, would have forced lead generators to get consent naming "no more than one identified seller" and required calls to be "logically and topically associated" with the original consent interaction. After a postponement to January 26, 2026, the Eleventh Circuit struck it down in Insurance Marketing Coalition Ltd. v. FCC, ruling the FCC exceeded its authority in redefining prior express written consent. The FCC then formally repealed the rule on July 14, 2025, reinstating the pre-2023 standard.

So what actually governs your outreach in 2026? The pre-2023 prior express written consent standard under 47 C.F.R. § 64.1200(f)(9). That's not a weaker standard — it's the same robust framework businesses lived under for a decade.

Three things keep the old rule from being a free pass:

• Consent must still be "clear and unmistakable." The Eleventh Circuit said so explicitly when it vacated the one-to-one rule, according to coverage of the ruling. Sloppy consent language didn't get safer.
• The FTC's Telemarketing Sales Rule stands independently. It requires sellers to directly obtain a consumer's signed written agreement before making prerecorded marketing calls — no matter what the FCC does, per the same analysis.
• Damages haven't moved. The TCPA still carries $500 per negligent violation and $1,500 per willful violation, with each call or text counted separately and no cap on aggregate damages.

This is where the real 2026 problem lives: confusion about what's real versus what's dead. Some businesses are still rebuilding their lead forms for one-to-one consent — including carriers that added one-to-one verification to SMS campaign registration and now have to revert those changes. Others heard "rule repealed" and assumed consent rules loosened. Neither reaction is right.

The practical takeaway is unglamorous: keep collecting explicit, documented consent at every lead capture point, because that's the federal baseline — not an extra. It's why services like CallMyLeads build explicit consent collection directly into the booking flow rather than bolting it on later. When the rules keep shifting, a consent record for every lead is the one thing that survives every version of the law.

And the stakes for getting this wrong remain concrete: documented TCPA settlements from late 2024 through 2026 range from $320,000 to as much as $30 million. A dead rule doesn't mean dead risk — it means you need to know exactly which standard applies before you dial.

Deregulation Isn't Safety: The Rules That Are Live, Moving, or Proposed for Deletion

The biggest story in TCPA compliance for 2026 isn't a new rule taking effect — it's a rule that won't. The FCC's one-to-one consent mandate, originally set for January 26, 2026, was vacated by the Eleventh Circuit and formally repealed in July 2025, restoring the pre-2023 prior express written consent standard as the federal baseline. The FCC confirmed the older standard remains "clear and unmistakable," and the FTC's Telemarketing Sales Rule independently requires direct signed consent for prerecorded marketing calls. Meanwhile, the revocation rule that took effect April 11, 2025 is live: businesses must honor opt-outs by any reasonable means — STOP replies, verbal requests, email — within 10 business days.

• The April 11, 2026 "global opt-out" requirement (revoke-all across every channel and purpose) is proposed for deletion under the FCC's "Delete, Delete, Delete" NPRM and may never take effect
• The separate revoke-all component has already been delayed to January 31, 2027 while the FCC reviews comments
• Internal company-specific DNC list requirements and call abandonment rules (15-second minimum, 3% cap) are also proposed for elimination

Two major new rulemakings are underway in 2026: enhanced KYC requirements for voice providers (comments due June 25, 2026) and call center onshoring with English proficiency standards. The FCC also confirmed AI-generated voices are "artificial" under the TCPA, bringing them under existing consent rules — a point CallMyLeads already addresses with honest-AI disclosure on every call. Litigation risk remains severe: 40+ TCPA settlements from October 2024 through October 2026 ranged from $320,000 to $30 million, with opt-out violations and DNC Registry breaches among the top drivers. Statutory damages still run $500–$1,500 per violation with no aggregate cap. Deregulation proposals don't erase exposure — they just shift the compliance frontier toward state mini-TCPA laws and operational discipline that still matter.

The Real Risk: $500-$1,500 Per Call, No Cap, and State Laws That Go Further

Here's the uncomfortable truth about 2026: the federal government is deleting TCPA rules, but the cost of getting caught breaking the ones that remain hasn't moved an inch. Statutory damages stay at $500 per call or text for negligent violations and $1,500 for willful ones — and each message counts separately, with no aggregate cap on total damages. One bad campaign can snowball into six or seven figures fast.

The courtroom record proves it. ClassAction.org documented more than 40 TCPA settlements and lawsuits between October 2024 and October 2026, with payouts ranging from $320,000 to $30 million. Sirius XM settled for $28 million, Realogy for $20 million, and O'Reilly Automotive for over $18.8 million. But you don't have to be a national brand to get hit — Jefferson Dental paid $1 million and NexGen settled for $3.8 million, both in industries (dental, home services) where small businesses live and die by fast lead response.

That last point matters more than most owners realize. Legal observers note that TCPA lawsuits are on the rise and small businesses are frequent targets — and most violations come not from bad intent, but from overlooked details or outdated systems. A stale DNC list, a text sent at 9:15 p.m. in the wrong time zone, a follow-up call after a customer replied STOP. Any one of these can trigger per-message damages that stack without limit.

And here's the trap: federal deregulation does not set your ceiling. State mini-TCPA laws override the federal baseline, and several go much harder:

• Florida enforces an 8 a.m.–8 p.m. calling window and allows damages up to $10,000 per willful violation under its FTSA.
• Oregon caps solicitations at three per 24-hour period, on top of its own quiet-hours rules.
• Oklahoma imposes civil penalties up to $25,000 per violation under its OTSA.

For a home services or dental business running speed-to-lead follow-up across state lines, the strictest applicable rule wins — not the loosest. That's why compliance has to be built into the response system itself, not bolted on after the fact. At CallMyLeads, every lead response runs with consent capture, immediate automatic opt-out honoring, and quiet-hours enforcement, so speed never comes at the cost of exposure.

The stakes aren't going down in 2026. They're just getting easier to underestimate.

Your 2026 Compliance Playbook: Five Moves That Matter

Deregulation doesn't mean dial it down — the fines didn't shrink when the rules changed. TCPA damages still run $500 to $1,500 per violation with no cap, and documented settlements from October 2024 through 2026 range from $320,000 to $30 million. Here are five moves that keep you safe while the rules shift under your feet.

First: keep collecting clear, unmistakable written consent. The Eleventh Circuit struck down the one-to-one consent rule but stressed that consent must still be "clear and unmistakable." That pre-2023 standard is now the federal baseline, not a bonus — and the FTC's Telemarketing Sales Rule independently requires signed written consent for prerecorded marketing calls anyway. Treat every booking form and lead capture as a consent event.

Second: honor opt-outs immediately, by any reasonable means. The revocation rule in effect since April 11, 2025 requires you to honor opt-outs made by text, verbal request, or email within 10 business days. Calling after revocation can be treated as a willful violation with treble damages — $1,500 per call instead of $500. Build opt-out handling into your systems so it happens automatically, not when someone gets around to it.

Third: scrub the National DNC Registry in real time and use recipient-local quiet hours. The registry now holds over 246 million numbers, and DNC violations are among the top litigation drivers. The FTC requires scrubbing within 31 calendar days, but batch scrubbing leaves a violation window — checking before every dial closes it. And never trust area codes for quiet hours: a 212 number may live in Los Angeles. Federal quiet hours are 8 a.m. to 9 p.m. in the recipient's local time; Florida and Oregon run 8 a.m. to 8 p.m.

Fourth: vet every third-party sender. You're legally responsible for messages sent on your behalf — including those from CRM platforms, marketing agencies, and lead generation services, according to small-business compliance guidance. That extends to AI: the FCC has confirmed AI-generated voices count as "artificial" under the TCPA, so automated outreach needs the same consent framework as anything else. This is why we built CallMyLeads so callers always know they're talking to AI and can reach a human, text, or book online — disclosure is a compliance feature, not a nice-to-have.

Fifth: watch the moving pieces. The FCC's "Delete, Delete, Delete" rulemaking proposes eliminating internal DNC lists, call abandonment rules, and the global opt-out requirement scheduled for April 11, 2026 — per legal analysis of the proposal, it could "change the face of TCPA litigation." Meanwhile, two new rulemakings are live: enhanced KYC requirements for voice providers (comments due June 25, 2026) and call center onshoring rules. State laws are tightening too — Florida allows up to $10,000 per willful violation, Oklahoma up to $25,000, and Oregon caps solicitations at three per 24 hours.

The playbook is simple: consent, instant opt-outs, real-time scrubbing, local quiet hours, and vendor accountability. Most violations come from overlooked details or outdated systems, not bad intent — so fix the details before a plaintiff's lawyer finds them.

Compliance That Runs Itself: Fast Lead Response Without the Legal Exposure

Speed wins jobs, but speed without compliance is how a $500 lead becomes a $500-per-text lawsuit. TCPA statutory damages run $500–$1,500 per violation with no aggregate cap, and 40+ documented settlements from late 2024 through 2026 ranged from $320,000 to $30 million — including home services and dental companies just like the ones that live and die on fast lead response.

The trap is that manual follow-up creates risk at every step. A rep texting a lead at 8:30 p.m. their time (not yours), calling a number on the National DNC Registry — which held over 246 million phone numbers as of 2026 — or missing a STOP reply can each count as a separate violation. Most violations happen "not out of bad intent, but because of overlooked details or outdated systems," as small-business legal analysts put it. And remember: you're legally responsible for messages sent on your behalf by any third party, including lead services.

CallMyLeads was built so speed and compliance run on the same track, not in tension. Here's what that looks like:

• Explicit consent collected in the booking flow — the "clear and unmistakable" prior express written consent standard the Eleventh Circuit reaffirmed is the federal baseline, not an extra.
• Opt-outs honored immediately and automatically — well inside the 10-business-day deadline, and far ahead of the willful-violation trebling exposure that follows calling after revocation.
• Quiet hours respected by the recipient's local time zone, not the area code — a 212 number may live in Los Angeles, so area-code guessing fails.
• Known spam numbers screened before they ever reach your line — screened robocalls never waste your minutes or your team's time.
• Honest AI disclosure on every call — callers always know they're talking to AI, aligned with the FCC's proposed rules requiring disclosure on AI-generated calls, since AI voices are already "artificial" under the TCPA.

This matters because the rules keep moving. The one-to-one consent rule was vacated and repealed in July 2025, the broader "revoke-all" requirement is delayed and proposed for deletion, and state laws like Florida's tighter 8 a.m.–8 p.m. window and $10,000 willful damages can override federal baselines. Chasing that by hand — while also trying to answer every lead in under 10 seconds — is a losing bet.

CallMyLeads handles it done-for-you: consent captured at the source, opt-outs honored instantly, quiet hours enforced by local time, spam screened out, and every lead still gets a first reply in seconds, 24/7/365. Your leads, your data, and your calendar stay yours — just without the legal exposure.

Not sure where your current follow-up stands? Book a free ~15-minute scoping call and we'll map your lead sources, response rules, and compliance posture — no commitment, no pressure.