This article previously reported that the FCC had delayed its one-to-one consent rule. That is no longer what happened. The rule was struck down in court and then repealed, and it never took effect. This piece has been rewritten to reflect where the law actually stands as of August 2026.
If you buy leads, run a call center, or send marketing texts, that correction matters — because a lot of the compliance advice still circulating online was written during the brief window when everyone expected that rule to govern the industry.
What happened
In December 2023 the FCC adopted a rule that would have significantly restructured lead generation. It required that prior express written consent be given to one identified seller at a time, rather than to a list of affiliated or associated parties. It also required that any resulting call or text be “logically and topically associated” with the interaction that produced the consent.
That would have ended the comparison-shopping-site model where a single form submission generates consent for dozens of buyers.
It never took effect.
The rule was scheduled to become effective January 27, 2025. In January 2025, the Eleventh Circuit decided Insurance Marketing Coalition v. FCC and vacated it, holding that the FCC’s requirements “altered the ordinary meaning of prior express written consent beyond the FCC’s authority.” The FCC subsequently repealed the vacated rule and reinstated the prior version.
So: one-to-one consent is not delayed, not pending, not coming back on a new timeline. It was struck down and removed.
What actually governs you now
This is where a lot of firms went wrong. “The restrictive rule was struck down” got heard as “the rules got easier.” They did not. The pre-existing TCPA framework snapped back into place, and a separate set of FCC rules — the ones nobody was watching, because everyone was watching the litigation — got stricter on a parallel track.
1. Prior express written consent still applies
The reverted standard still requires prior express written consent for marketing calls and texts to wireless numbers using an autodialer or prerecorded/artificial voice. What changed is that consent no longer has to be seller-by-seller. What did not change is that you need it, it has to be documented, and you have to be able to produce the record — the disclosure language, the timestamp, the IP address, the specific page the consumer saw.
If you buy leads, the practical question is unchanged: can your vendor produce that evidence for any given lead, on demand, in a form that survives a motion? If the answer is “they say they have it,” you are the one carrying the risk. TCPA liability runs to the caller.
2. The revocation rules got materially tighter — and the grace period has expired
Effective April 11, 2025, the FCC’s revocation-of-consent rules require:
•
Revocation honored within 10 business days of receipt, down from the prior 30-day maximum.
•
Seven keywords must be honored at minimum: stop, quit, revoke, opt out, cancel, unsubscribe, end. Other reasonable words and phrases also count.
•
Consumers may revoke in their original language, and opt-outs submitted through automated systems are presumed valid unless you can prove otherwise.
•
Revocation may be made by any reasonable means — you cannot require a specific method or channel.
There was one carve-out. The requirement that a revocation for one message type applies to all message types from that sender was waived for a year, until April 11, 2026, so companies could rework their systems.
That waiver expired four months ago. If a consumer texts STOP to your appointment-reminder line, that revocation now reaches your marketing messages too, unless they fall outside the rule’s scope. Firms that built a workaround during the waiver window and never revisited it are now out of compliance and generally do not know it.
3. States did not wait for the FCC
While the federal rule was being litigated, states kept legislating. This is now the larger practical exposure for most multi-state operators, because several state statutes are stricter than the TCPA and carry their own private rights of action:
•
Florida — the Telephone Solicitation Act, the model the others followed.
•
Oklahoma — effective November 1, 2022. Requires prior express written consent for automated calls, caps calls at three per 24-hour period, restricts calling hours, and provides $500 per violation, trebled for willful or knowing conduct, with an express private right of action.
•
Washington — effective June 9, 2022. Calls must stop when a consumer says they do not wish to be called, with only ten seconds to disconnect. Caller ID required within 30 seconds. $100 per violation plus attorneys’ fees, though the private right of action requires “repeated” violations.
A national campaign compliant with federal law can still generate per-violation state liability at volume. If you dial or text into multiple states, your consent and suppression logic has to be state-aware. Most lead-buying operations I have looked at are not.
What a marketing leader should actually do
Five things, in order of how much exposure they remove per hour spent.
1. Audit your revocation handling against the April 2026 state of the rules. Confirm the seven keywords are honored, that the window is 10 business days or better, that revocation through any reasonable channel is captured, and — the one most firms have not fixed — that a revocation on one message stream propagates across all of them. This is the highest-probability current violation.
2. Make your lead vendors prove consent, contractually and operationally. Require the full consent record per lead: disclosure text shown, timestamp, IP, source URL. Put audit rights in the contract. Test it — request records on a random sample and see what actually comes back. Indemnification is worth something only if the counterparty is still solvent when you need it.
3. Map your calling and texting footprint to state law. Identify every state you contact and apply the strictest applicable standard for consent, frequency caps, and calling hours. Build the suppression logic once; the alternative is discovering the gap through a demand letter.
4. Keep the records where you can find them. TCPA defense is a documentation exercise. Consent records need to survive vendor changes, CRM migrations, and staff turnover, and be retrievable years later. Storage is cheap relative to statutory damages.
5. Stop treating “we’re compliant” as a status. It is a process. The rule everyone was watching died in court; the rule nobody was watching tightened on schedule and its grace period quietly expired. That is the normal shape of this. Someone needs standing responsibility for tracking it.
The strategic read
There is a version of this where the death of one-to-one consent is good news for lead buyers — the compliance burden that was coming did not arrive.
I would not read it that way.
What actually happened is that a single clear federal standard was replaced by a patchwork: a reverted federal rule, a tightened revocation regime, and a growing set of state statutes with private rights of action and per-violation damages. That is harder to manage than one rule would have been, not easier. And the plaintiffs’ bar has not gotten less interested.
The firms that will be fine are the ones that built consent and suppression as infrastructure rather than as a policy document — the ones who can answer “show me the consent for this lead” in under a minute, for any lead, from any source, in any state.
If you are buying leads at volume and cannot do that today, that is the gap worth closing before it gets expensive.
I am a marketer, not an attorney, and this is not legal advice. TCPA exposure is fact-specific and the state landscape changes frequently — validate anything here with counsel before changing how you contact consumers.