TCPA consent explained: what counts, what does not, and how to prove it
Consent is the defence that actually removes items from a demand letter, and the one most businesses think they have until they go looking for the record. This page sets out what the FCC rules require and what a consent file has to contain to be worth anything.
Two different consents
The TCPA has two consent standards and businesses regularly mix them up.
| Call type | Consent required | Rule |
|---|---|---|
| Marketing call or text using an autodialer or artificial or prerecorded voice to a cell phone | Prior express written consent | 47 C.F.R. § 64.1200(a)(2), (f)(9) |
| Non-marketing autodialed or prerecorded call to a cell phone | Prior express consent (giving the number can be enough) | § 64.1200(a)(1) |
| Any telemarketing call to a number on the National Do Not Call Registry | Prior express written consent, or an established business relationship within the rule's limits | § 64.1200(c)(2) |
Most demand letters concern the first and third rows. For both, the written standard applies.
What written consent has to contain
- A signature. Electronic is fine under the E-SIGN Act: a checkbox, a typed name, a recorded verbal agreement, as long as it is attributable to the person.
- A clear and conspicuous disclosure that the person agrees to receive marketing calls or texts, made using an automatic telephone dialing system or an artificial or prerecorded voice, from the named seller, at the number provided.
- A statement that consent is not a condition of purchase.
- The number. Consent attaches to a number, not a person.
A record that has all four, with a timestamp and the exact page or script the person saw, is a defence. A record missing any one is an argument.
What fails
- A number typed into a "contact us" box with no automated-calls disclosure.
- Terms buried in a privacy policy the person never saw at the point of signature.
- Consent given to a different seller. Consent to "our partners" without naming them has been found insufficient in many courts, and the FCC's 2023 one-to-one rule, though vacated in January 2025, reflected where regulators were heading.
- Consent for a number that was later reassigned to someone else. The FCC's Reassigned Numbers Database gives a safe harbour only if it was checked before the call.
- Consent that was revoked. A STOP, an "unsubscribe", a verbal request on a call. Revocation can be by any reasonable means and must be honoured within ten business days under the 2024 rules.
Who holds the record
If a lead generator collected the consent, you need their record, not their assurance. Ask for the submission data: number, timestamp, the page as rendered with the disclosure text, IP address, user agent, and the TrustedForm or Jornaya certificate if one exists. See vendor liability.
Using consent in a response
Go number by number. For each one in the letter, attach the consent record or state that none exists. A response that shows consent for some numbers and concedes the rest is credible and reduces the count. A response that asserts "all our leads are opted in" with nothing attached is treated as no consent.
Quick answers
What is prior express written consent under the TCPA?
An agreement in writing, which can be electronic, that bears the signature of the person called and clearly authorises the seller to deliver marketing calls or texts using an autodialer or artificial or prerecorded voice to a specific telephone number. The disclosure must be clear and conspicuous and the person must be told that consent is not a condition of purchase. 47 C.F.R. § 64.1200(f).
Does filling in a web form count as consent?
Only if the form carried the required disclosure next to the signature or submit action, named the seller, and the submission is recorded with the number, timestamp, page content and, ideally, IP and user agent. A form that said nothing about automated calls or texts is not express written consent for them.
How is consent revoked?
By any reasonable means. STOP in a text, a verbal request on a call, an email, a form. Under the FCC's 2024 rules the business must honour a revocation within ten business days. Any contact after that is made without consent.