Avoid $1,500 Per Call Penalties: U.S. Express Written Consent Playbook
Prior express written consent is the signed agreement, electronic signatures included, that authorizes a specific seller to send autodialed or prerecorded marketing calls and texts. You need it before any telemarketing campaign touches an automated dialer, artificial voice, or prerecorded message aimed at a wireless or residential number. Consumers can revoke it whenever they want, through virtually any method they choose, and you’re on the clock to honor that revocation fast.
TL;DR:
- Prior express written consent is required before sending autodialed or prerecorded marketing messages to wireless numbers or landlines, with consent linked to a specific seller.
- Consent must include a clear identification of the seller, disclosure of ATDS or prerecorded voice use, and an affirmative, unbundled action from the consumer; pre-checked boxes and vague disclosures are invalid.
- Consent records must document the exact language shown, timestamp, channel used, and be stored securely for at least four years to withstand litigation.
- Consumers can revoke consent anytime using any reasonable method, and revocations must be processed within 10 business days, with all actions thoroughly documented.
- Using broad, multi-brand consent disclosures or sharing consent across affiliates increases litigation risk, requiring adherence to strict, seller-specific consent standards.
Table of Contents
- What Express Written Consent Means Under the TCPA
- When You Actually Need Prior Express Written Consent
- Disclosure Language and Signature Requirements That Hold Up
- How to Collect and Document Consent Across Every Channel
- Revocation of Consent: Rules Marketers Can’t Ignore
- Recordkeeping and Audit Trails That Survive Litigation
- Common Pitfalls That Lead to TCPA Enforcement Action
- Consent Checklist and Sample Disclosure Language
- Recent FCC Rule Changes and Court Rulings Reshaping Consent Requirements
- Express Written Consent vs. Implied and Oral Consent
- Real Examples of Valid and Invalid Consent
- Handling Consent Beyond Federal TCPA Rules
- How Platforms Like RevRing Support Defensible Consent Capture
- Sources
What Express Written Consent Means Under the TCPA
The Telephone Consumer Protection Act, codified at 47 U.S.C. § 227, and its implementing regulation at 47 CFR § 64.1200, require a signed agreement before a seller can send telemarketing calls or texts using an automatic telephone dialing system (ATDS) or a prerecorded or artificial voice. “Written” doesn’t mean ink on paper. The E-SIGN Act treats electronic signatures, typed names, and clicked checkboxes as legally binding, provided the consumer took a clear, affirmative action to give them.
The FCC’s 2024 order sharpened this further by locking in a “one-to-one” consent standard: consent authorizes the specific seller named in the disclosure, not a network of undefined marketing partners.
A few things every consent record needs to hold up:
- A clear statement that the consumer is agreeing to receive autodialed or prerecorded marketing communications.
- Identification of the specific seller obtaining consent, not a vague category of “partners” or “advertisers.”
- An affirmative act, a signature, a checked box, a typed name, that shows the consumer said yes on purpose.
- No bundling of consent for multiple unrelated companies under one broad disclosure.
That one-to-one requirement is where most lead-buying operations get exposed. If you’re purchasing leads from a marketplace or affiliate network, the consent language matters more than the lead volume.
When You Actually Need Prior Express Written Consent
Not every outbound call or text triggers this requirement, but more scenarios qualify than most teams assume.
You need prior express written consent for:
- Marketing texts or calls sent via ATDS to wireless numbers. Any automated or bulk-dialed promotional message to a cell phone falls squarely under the rule.
- Prerecorded or artificial-voice telemarketing to residential landlines. A recorded sales pitch played to a home phone requires the same signed authorization as a wireless robotext.
- Marketing calls to numbers on the National Do Not Call Registry, unless you can document an established business relationship or the call is purely informational.
You’re generally exempt when the communication is transactional or informational rather than promotional, think appointment reminders, fraud alerts, or delivery notifications, though these still need to comply with other TCPA consent tiers. The line between “informational” and “telemarketing” gets litigated constantly, and courts tend to look at the actual content of the message, not how you labeled the campaign internally. A text that starts with an appointment reminder and ends with a discount code reads as marketing.
Disclosure Language and Signature Requirements That Hold Up
Regulators and courts scrutinize the exact wording consumers saw before they clicked or signed. A vague “we may contact you” checkbox will not survive a TCPA class action.
Your disclosure needs to include:
- The identity of the seller who will be placing the calls or sending the texts.
- A statement that messages or calls may be sent using an automatic telephone dialing system or prerecorded/artificial voice.
- Explicit language stating that consent is not a condition of any purchase, membership, or service.
- A visible, unambiguous mechanism for the consumer to say yes, not a pre-checked box.
Statistic Callout: Industry compliance guidance from ActiveProspect identifies seller identification, ATDS disclosure, and the “not a condition of purchase” statement as the three most commonly missing elements in consent records challenged in litigation.
Acceptable signature formats include e-signatures collected through a compliant web form, checked boxes that default to unchecked, typed full names paired with a timestamp, and voice recordings that capture an affirmative verbal agreement matched to written disclosure. What doesn’t count: pre-checked boxes, buried disclosures in a wall of terms and conditions, or consent language that never mentions autodialers at all.
How to Collect and Document Consent Across Every Channel
Capturing consent is only half the job. Documenting it so it survives a subpoena three years later is the part most teams skip.
- Web forms. Place the disclosure directly above or adjacent to the submit button, never buried in a footer link. Require an unchecked opt-in box, log the exact HTML rendered at the moment of submission, and timestamp the capture with the consumer’s IP address.
- SMS keyword opt-ins. When a consumer texts a keyword to join, send a confirmation message repeating the disclosure and store the inbound message metadata, phone number, carrier, and timestamp, tied directly to the CRM record.
- Point-of-sale and paper forms. Use conspicuous, unbundled language on printed forms and retain either the signed original or a digitized scan with a retrievable index.
- E-signature and API integrations. Link every consent artifact, whether it’s a DocuSign record or an API payload, to the specific contact record it authorizes, and make sure that record is retrievable by phone number or email on demand.
Pro Tip: Store the exact disclosure text shown to the consumer, not just a reference to “version 3 of our consent form.” Disclosure language changes over time, and courts want to see what the specific person actually read.
Every capture event should log four things at minimum: timestamp, IP or device identifier, channel, and the verbatim disclosure text. A tool like RevRing’s AI automation can help timestamp and archive these records automatically as leads move from capture to CRM.
Revocation of Consent: Rules Marketers Can’t Ignore
Consumers can revoke consent at any time, by any reasonable means, and the FCC has made clear that companies can’t force people through a proprietary portal or a specific channel to make it happen.
- Common revocation keywords include STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE, but a plain-English request like “please stop calling me” counts too.
- The FCC permits a single confirmatory text after a revocation request, and that message cannot contain marketing content of any kind.
- If a consumer doesn’t respond to your confirmatory message, treat that silence as a completed revocation, not an open question.
- FCC guidance sets a maximum processing window of 10 business days, though immediate processing is the better practice given litigation exposure.
- Revocation should be treated as global across all campaigns unless the consumer specifically limits it to one program or number, a standard practitioner analysis from Hunton Andrews Kurth flags as a frequent source of litigation when companies narrow it themselves.
Document every revocation with the same rigor as the original consent capture, timestamp, channel, exact wording, and whether it was scoped or global.
Recordkeeping and Audit Trails That Survive Litigation
If you can’t produce the consent record, the consent effectively didn’t happen, at least from a courtroom’s perspective.
Keep these fields for every consent event:
- A copy of the actual capture artifact, the rendered form, the SMS thread, or the signed document.
- Date and time of capture, down to the second where possible.
- The channel used, web, SMS, point-of-sale, or API.
- The exact disclosure text the consumer saw or heard.
- Signer identity and, where applicable, IP address or device fingerprint.
Link each consent record to the specific outbound message logs and call IDs it authorized, so you can show an unbroken chain from signature to dial. Store everything in immutable, backed-up logs with a retention policy that matches your litigation risk window, most compliance teams keep records for at least four years given TCPA’s statute of limitations.
Common Pitfalls That Lead to TCPA Enforcement Action
Statutory damages run $500 per violation and up to $1,500 per knowing or willful violation, and class actions multiply that math across thousands of calls fast.
- Daisy-chaining consent. Assuming one lead partner’s consent covers your brand is one of the most litigated theories in TCPA class actions right now.
- Pre-checked boxes. Regulators treat these as functionally invalid because they don’t reflect an affirmative choice.
- Vague partner language. Disclosures that name “our marketing partners” instead of a specific seller fail the one-to-one standard.
- Slow revocation processing. Waiting the full 10 business days when you could process instantly is a common source of plaintiff-friendly fact patterns.
Statistic Callout: Legal analysts increasingly flag consent-sharing arrangements as high risk, warning marketers to assume one-to-one consent applies unless they hold brand-specific disclosures naming their company directly.
Remediation, once a gap surfaces, means pausing the affected campaign immediately, running a consent-verification cleanup against your CRM, and tightening capture controls before resuming outbound activity.
Consent Checklist and Sample Disclosure Language
Before any campaign goes live, run through this list:
- Disclosure names the specific seller.
- Language discloses ATDS or prerecorded/artificial voice use.
- Consent is explicitly not a condition of purchase.
- Signature or affirmative action is captured and timestamped.
- Record is stored and linked to the contact record.
- You’ve tested retrieval of a sample consent record end to end.
Sample SMS opt-in language:
Sample web checkbox disclosure:
Customize the seller name and channel details for each campaign, and store the exact rendered version alongside the timestamped capture event.
Recent FCC Rule Changes and Court Rulings Reshaping Consent Requirements
The FCC’s 2024 report and order marked the most significant shift in PEWC enforcement in years, formally adopting the one-to-one consent standard and clarifying that revocation can happen through any reasonable method, not just a channel the company designates. That order also confirmed the 10-business-day outer limit for processing revocation requests, giving companies a concrete benchmark instead of the ambiguous “reasonable time” standard that previously invited litigation over what counted as timely.
Separately, global revocation rules tied to this rulemaking took effect in January 2027, requiring that an opt-out on one campaign generally extends across all of a company’s outreach unless the consumer says otherwise. This closes a loophole many marketers had relied on, treating each product line or campaign as a separate consent silo that required its own revocation.
Court decisions interpreting these changes have generally sided with consumers on ambiguity. When a disclosure could plausibly be read as bundling consent for multiple brands, judges have increasingly ruled against the marketer rather than giving the benefit of the doubt. The practical result: broad, multi-brand disclosures that were common practice five years ago now carry meaningfully higher litigation risk, and companies relying on shared consent language across affiliate networks should revisit those agreements against the one-to-one standard.
Express Written Consent vs. Implied and Oral Consent
Not all consent is created equal, and confusing the tiers is one of the fastest ways to end up in a class action.
Express written consent is the strictest tier, a signed, affirmative agreement authorizing a specific seller to use ATDS or prerecorded voice. It’s required for marketing calls and texts to wireless numbers and prerecorded marketing calls to residential lines.
Oral consent can satisfy some lower-tier TCPA requirements, informational calls, for instance, but it does not satisfy the written requirement for autodialed or prerecorded marketing communications. A verbal “yes, you can text me” during a sales call does not create a defensible record if a dispute arises later, because there’s no artifact to produce.
Implied consent arises from an existing relationship, such as when a consumer provides their number during a transaction, and it can support certain informational or transactional communications. It does not authorize autodialed or prerecorded marketing outreach. Companies sometimes conflate an established business relationship with blanket marketing permission, but the EBR exception applies narrowly to Do Not Call Registry considerations, not to the ATDS/prerecorded consent requirement itself.
The practical takeaway: if your campaign involves an autodialer or a prerecorded voice message and the goal is selling something, only the written, signed, one-to-one tier will protect you. Everything else leaves you exposed.
Real Examples of Valid and Invalid Consent
Valid: A web form with an unchecked box reading, “I agree to receive marketing texts from Acme Insurance at this number using automated technology. Consent is not a condition of purchase.” The consumer checks the box, clicks submit, and the system logs the timestamp, IP address, and the exact rendered disclosure.
Invalid: A form with a box that’s checked by default, buried below a lengthy terms-of-service block, reading only “I agree to be contacted by our partners.” This fails on three fronts: it’s pre-checked, it doesn’t name a specific seller, and it doesn’t disclose ATDS or prerecorded voice use.
Valid: An SMS keyword opt-in where a consumer texts “JOIN” to a published number, receives a confirmation message repeating the disclosure, and the exchange is logged with carrier metadata and timestamp.
Invalid: A verbal agreement during a call center conversation with no follow-up written confirmation, no signature, and no stored disclosure text. Even if the consumer genuinely agreed, there’s nothing to produce if challenged.
The pattern across every invalid example is the same: something that should have been explicit was implied, assumed, or buried instead.
Handling Consent Beyond Federal TCPA Rules
Federal TCPA compliance is the floor, not the ceiling. Several states layer additional requirements on top of the federal framework, and marketers running multi-state campaigns need to check both.
Florida’s Telephone Solicitation Act and Washington’s telemarketing statutes, for example, have historically imposed stricter consent or disclosure requirements than federal law alone, and some states apply private rights of action with different damages structures. A campaign that’s fully TCPA-compliant at the federal level can still create state-law exposure if you’re not checking the specific rules in the states where your leads live.
The safest operational approach is to build consent capture around the strictest applicable standard rather than maintaining separate disclosure language per state, which multiplies the chance of a gap. If your lead volume concentrates in a handful of states, review those states’ telemarketing statutes directly rather than relying on federal guidance alone. Consult counsel licensed in the relevant states before scaling a multi-state campaign, since state attorneys general have shown a willingness to enforce independently of federal TCPA actions.
How Platforms Like RevRing Support Defensible Consent Capture
Manually tracking consent artifacts across web forms, SMS threads, and point-of-sale scans gets unwieldy fast once you’re running multiple campaigns across states. RevRing’s compliance infrastructure is built for regulated industries like insurance, real estate, and healthcare, connecting communication tools, CRM systems, and AI automation so consent records stay tied to the specific calls and texts they authorize. Its tailored playbooks integrate into existing workflows rather than forcing teams to rebuild their process from scratch, which matters most when you’re trying to close consent gaps without pausing revenue-generating outreach entirely.
Sources
Consult the FCC’s 2024 report and order, 47 CFR § 64.1200, and the FCC’s consumer guidance on robocalls directly. Talk to counsel for questions specific to your campaigns and states.