TCPA consent for calls and texts: what to collect, record and prove

The statute, at 47 U.S.C. 227, bars calls to wireless numbers made with an automatic telephone dialing system or an artificial or prerecorded voice unless the called party gave prior express consent or the call is an emergency. It also restricts artificial or prerecorded voice calls to residential lines.

The FCC's rules at 47 CFR 64.1200 add a higher tier for marketing. Autodialed or prerecorded calls that include advertising or amount to telemarketing require prior express written consent. The rule defines that as a signed written agreement that clearly and conspicuously discloses that the person authorizes telemarketing calls using an autodialer or an artificial or prerecorded voice to a specified number, and that agreeing is not a condition of purchase. Informational calls of that kind to a mobile number need prior express consent, which may be oral or written.

The statute gives people a private right to sue: 500 US dollars per violation, rising to 1,500 if the violation was willful or knowing, with no cap on the total in a class action.

The FCC's declaratory ruling 24-17, dated 8 February 2024, says that calls using AI technologies that generate human voices, including voice cloning, count as artificial or prerecorded voice calls. That places an AI voice agent under the same rules as a recorded message. A marketing call needs prior express written consent, and an informational call to a mobile number needs prior express consent.

The FCC's rules for artificial and prerecorded messages also apply. The message must state the caller's identity at the start and give a call-back number, and a telemarketing message must offer an automated way to opt out during the call.

A business that deploys an AI agent to call purchased leads therefore needs the same proof it would need for a recorded message: evidence that this person agreed to be called by this seller with this kind of technology. Whether a particular AI calling program meets the rules is a question for counsel.

The FCC's rules bar telephone solicitations to a residential subscriber whose number is on the National Do Not Call Registry. The exceptions are a signed, written invitation or permission, an established business relationship, and a personal relationship. An established business relationship lasts 18 months after the person's last transaction and three months after an inquiry.

The rules give a safe harbor to a seller that can show written procedures, staff training, records, and a calling list scrubbed against a version of the registry no more than 31 days old. Separately, each seller must keep a company-specific do-not-call list, identify itself on each call, and retain do-not-call requests for five years.

Federal calling hours run from 8 a.m. to 9 p.m. at the called party's location. The caller has to work out where the person is, which an area code alone does not always show. Some states set narrower windows, covered below.

Since 11 April 2025, a person may revoke consent by any reasonable method, and the caller must honor it within a reasonable time not to exceed 10 business days. A broader requirement, under which one opt-out would have ended every kind of automated message from a caller, was delayed twice and then rewritten.

According to a November 2026 alert from the law firm Nelson Mullins, the FCC adopted the rewrite on 30 September 2026 as order FCC 26-67, published it in the Federal Register on 26 October 2026, and set it to take effect on 25 November 2026. That date rests on law-firm alerts, so check the FCC's own notice before relying on it.

As Nelson Mullins describes the order, an opt-out sent in reply to a marketing call or text ends all future marketing robocalls and robotexts from that caller. An opt-out sent in reply to an informational message may be treated as covering only that category of message. Senders of informational messages may name exclusive opt-out methods if they disclose them clearly; marketing senders may not. Seven reply keywords must all be honored: stop, quit, end, revoke, opt out, cancel and unsubscribe. The 10-business-day limit stays.

In June 2025 the Supreme Court held in McLaughlin Chiropractic v. McKesson that district courts in civil cases are not bound by an agency's reading of a statute. Since then, courts have re-examined positions the FCC had taken on the TCPA.

On 14 July 2026 the Seventh Circuit held in Steidinger v. Blackstone Medical Services that marketing texts are not telephone calls under the private Do Not Call provision. A Holland & Knight summary notes that this removes private Do Not Call claims over texts in Illinois, Indiana and Wisconsin, and that it leaves untouched the separate provision on autodialed or prerecorded messages, the FCC's own enforcement power and state laws.

No other appeals court has ruled on the point. A court-by-court tracker kept by the plaintiff-side firm Darwich Legal, reviewed through 26 October 2026 and described by the firm as possibly incomplete, lists district courts in the Second, Third, Fifth and Ninth Circuits that still treat texts as calls, and district courts in several other states that do not. It also lists an appeal docketed on 22 October 2026 that would put the question before the Eleventh Circuit.

A business that texts people across the country cannot choose where it is sued. The cautious reading is to treat a text as covered by the Do Not Call rules everywhere.

State law is now the stricter layer for many senders. Texas amended its telemarketing law to cover text messages from 1 September 2025. Virginia's amendments covering texts took effect on 1 January 2026.

Pennsylvania's Act 47 of 2026 took effect on 18 October 2026. As the law firm Sheppard Mullin describes it, the definition of telephone solicitation now includes texts, voicemails and ringless voicemails, and solicitations are barred before 9 a.m., after 7 p.m., on Sundays and on legal holidays. That window is narrower than the federal one.

State details change often, and the research behind this guide found secondary sources that disagree with each other on points such as remedies. Read the statute text, or ask counsel, before building a calling schedule around any summary, including this one.

The one-to-one consent rule would have required a separate consent for each seller. The Eleventh Circuit vacated it on 24 January 2025 in Insurance Marketing Coalition v. FCC, as summarized by the consent vendor ActiveProspect, and it never took effect. A consent form that names several sellers is therefore not invalid for that reason alone under federal rules, though each seller still has to show the person agreed to be contacted by it.

In the Fifth Circuit, which covers Texas, Louisiana and Mississippi, a panel held in Bradford v. Sovereign Pest Control in February 2026 that the statute does not require consent to be written for prerecorded or autodialed telemarketing calls. A Duane Morris summary notes that state laws in that circuit may still require written consent. Elsewhere the FCC's written-consent rule remains on the books.

Federal class-action filings fell in mid-2026. TCPAWorld, a blog run by a defense law firm, reported that class filings were lower than a year earlier in June (191 against 202), July (108 against 198) and September (131 against 224), leaving the year-to-date count about 5 percent below 2025. A drop in filings does not change what the rules require.

The written-consent definition is itself a list of things to prove: a signed agreement, a clear and conspicuous disclosure, a specified number, and a statement that consent is not a condition of purchase. A record that cannot show each of those leaves a gap.

Consent bought with a lead needs particular care. The seller that places the call is the one that has to produce the proof, so the record should come with the lead instead of staying with the vendor that generated it.

Consentra's Contact Gate checks consent, do-not-call status, local time and opt-outs before each call or text and writes the reason to the record.

• The disclosure text exactly as shown or read, and the page address or call recording reference
• The action taken (box ticked, button pressed, keyword sent, verbal yes) and its date and time
• The phone number the consent specifies, and every seller named
• Whether the wording mentioned automated, prerecorded or AI-generated calls
• The source of the lead, if it was bought
• The registry version date used for each Do Not Call scrub
• The basis used for the recipient local time
• Every opt-out: when it arrived, by which channel, and when it took effect