Prior express written consent is a signed written agreement that names the seller, states the number being called, authorizes autodialed or prerecorded marketing to it, and says the signer does not have to agree in order to buy anything. Collecting it is the easy part. What decides a TCPA case is whether you can reproduce the exact form the person saw, on the date they signed it.
In This Article
Most consent programs are inherited rather than designed. Someone wrote the form language at launch, someone else wired it to the CRM, and nobody now accountable for the campaign has seen those two things side by side. It becomes a problem the first time somebody asks you to produce, for one phone number, the exact screen that person saw on the day they agreed.
So this is about what survives contact with a subpoena, not what consent means in the abstract. If you would rather have that work done as an engagement than run it yourself, the TCPA compliance consulting service page sets out the audit, gap report, and remediation sequence, including the review of consent collection and documentation.
What does the TCPA actually require for prior express written consent?
Prior express written consent requires four things in one document: a signature, clear authorization to use an autodialer or prerecorded voice, the phone number being called, and a conspicuous notice that signing is not a condition of purchase.
The definition sits at 47 CFR 64.1200(f)(9): a written agreement bearing the signature of the person called, clearly authorizing the seller to deliver advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and stating the telephone number those messages may go to.
The fourth element is the one most forms get wrong. The agreement has to carry a clear and conspicuous disclosure telling the signer both that they are authorizing autodialed or prerecorded telemarketing, and that they are not required to sign, directly or indirectly, as a condition of buying anything. The rule defines clear and conspicuous as apparent to the reasonable consumer and separate and distinguishable from the advertising copy. Consent language in grey eight-point type beneath a Submit button, or folded into a terms-of-service link, is the precise thing that definition excludes.
Signature is the easy part: the rule accepts an electronic or digital signature wherever federal or state contract law would recognize one, so a checkbox plus a submit event is fine. A checkbox is not the weak link in anybody’s program. The weak link is that the checkbox is all that got stored.
Where does prior express written consent break down in a live campaign?
Almost never at the moment of collection. It breaks in the handoffs: form to CRM, CRM to dialer, and dialer to the record you would eventually hand a court.
Three failure modes account for most of it. The first is scope drift. Consent is collected under one brand and used by another, or collected for one product line and reused for a second. The Eleventh Circuit’s 2025 decision in Insurance Marketing Coalition v. FCC vacated the one-to-one consent rule, so a single form can still cover more than one named seller. What did not change is that the agreement must clearly authorize the seller doing the calling. A form naming two of your brands does not authorize the third one you added last quarter.
The second is channel drift: consent captured for phone calls, then used for texting. Under the TCPA a text is treated as a call, so the technology your disclosure names matters. If the form says calls and your program sends SMS, the disclosure does not cover what you are doing.
The third is revocation lag. Since April 2025 a consumer can revoke through any reasonable method, several of which the rule treats as reasonable per se: an automated opt-out on a call, a reply text using stop, quit, end, revoke, opt out, cancel or unsubscribe, or a website or phone line you designated for opt-outs. Other wording counts if a reasonable person would read it as a revocation. You have ten business days, and you may not designate an exclusive means of revoking. Operationally, an opt-out has to travel back up the chain to every list it touched, including the vendor’s, inside those ten days. A single confirmation text carrying no marketing is permitted, and is presumed fine if it goes out within five minutes.
All three are findable in an afternoon if you know the order to look in. The campaign compliance audit sequence on our TCPA compliance consulting page sets that order out: scripts and disclosures, then consent collection, then DNC, recording practice, calling windows, and training records.
2,588 TCPA lawsuits were filed in federal district court between January 1 and November 30, 2025, a 0.4% decrease from 2024.
How long do you have to keep TCPA consent records, and what has to be in them?
Five years from the date the record is produced, and the record is considerably more than the checkbox: it has to include the form exactly as the person saw it.
That period comes from the FTC’s Telemarketing Sales Rule recordkeeping section, 16 CFR 310.5, which binds sellers and telemarketers alike and, since the April 2024 amendment, spells out what a complete record of consent contains.
What the rule requires | What the rule requires |
|---|---|
The name and telephone number of the person providing consent | The name and telephone number of the person providing consent |
The name and telephone number of the person providing consent | A rendered capture of the page or script as the person actually encountered it. Not a description of it, and not the current version of the form. |
A copy of the consent provided | The response itself: the checkbox state, the submitted values, the recorded verbal agreement. |
The date consent was given | A timestamp you can tie to the form version in force that day. |
The second element is where most programs quietly fail. If you redesigned your form in March, a lead captured in February needs February’s form, not today’s. That is a versioning requirement dressed as a recordkeeping one: every material change to consent language creates a new version, and every lead record has to carry the version in force when it was captured. Teams that store a boolean and a date find the gap only when somebody asks what the person actually saw.
One provision matters before you assume your call center owns this. A seller and a telemarketer may allocate recordkeeping by written agreement, and those terms govern. Where the agreement is unclear, or there is none, both are responsible, and a seller who hands the job to a vendor must still retain access to the records it creates.
Not sure your consent records would reconstruct under pressure?
A campaign compliance audit takes 5-10 business days and covers consent collection, documentation, and retention alongside scripts and DNC procedures. The gap report is yours either way.
Sample prior express written consent language you can adapt
Compliant consent language has to do five jobs in about sixty words: name the seller, tie consent to the number provided, name the dialing technology, disclaim the purchase condition, and give a revocation path.
Here is a working starting point, and a starting point is what it is: bracketed fields change per seller, and some states require more.
Sample consent language
By checking this box and clicking Submit, I authorize [Seller legal name] to contact me at the telephone number I provided above, including by automatic telephone dialing system, prerecorded or artificial voice, and text message, about [specific product or service].
I understand that I am not required to give this consent as a condition of purchasing any property, goods, or services, and that I may revoke it at any time by replying STOP to any text or by calling [phone number].
Message and data rates may apply.
Every clause is doing a job. The legal name makes the authorization specific to you rather than to a category. The reference to the number provided above ties consent to a number instead of a person. Naming the dialing technology and the text channel keeps the disclosure aligned with what your program does. The non-condition sentence is required outright. The revocation path is not, but including it gives you a cleaner story about what the consumer was told.
What the sample does not carry is state overlays. Florida, Oklahoma, and Maryland impose requirements past the federal baseline, and Florida’s statute reaches automated calls and texts to Florida residents on its own terms. If your footprint crosses state lines, the state-by-state mini-TCPA reference guide maps which states add consent, timing, and registration requirements on top of the federal rule.
How do you verify prior express written consent on leads you bought?
By requiring the artifact, not the attestation. A vendor’s warranty that every lead carries valid consent is a contractual promise about the past, not evidence a court will weigh.
The court’s reasoning in Hall v. Schwartz, written up by the National Law Review, is the useful illustration. The defendant bought a third-party Medicare lead, opened with a prerecorded greeting, and argued at summary judgment that consent given on the lead vendor’s website covered the call. The court declined to resolve it in the defendant’s favor and sent the question to a jury. The buyer had a lead. What it did not have was an unambiguous record that this consumer, at this number, authorized this seller.
The safeguards are unglamorous and they work. Require the consent artifact to arrive with the lead rather than on request: the rendered form capture, the timestamp, the originating URL or source identifier, and the disclosure version. Sample purchased leads monthly and try to reconstruct consent from what you hold, because the time to find out a vendor’s records are thin is before a demand letter. Keep an inspection right and use it. Indemnity pays out after the suit, not instead of it.
Consent verification runs in parallel with suppression, not separately from it. Treat a purchased lead as unverified until both the consent artifact and the scrub have cleared.
Do recent court rulings mean you can stop collecting written consent?
No. A February 2026 Fifth Circuit ruling held that the TCPA itself requires only prior express consent, oral or written, but it binds three states and changes nothing about what you must prove.
The decision is Bradford v. Sovereign Pest Control of Texas, and the reasoning matters more than the headline. The court found the statute gives no basis for the FCC’s distinction between telemarketing and informational calls as to the form of consent. It is a real decision with real effect, and it is not permission to dismantle your consent program.
Three reasons. It binds Texas, Louisiana, and Mississippi; courts elsewhere remain free to defer to the FCC’s rule, which is still on the books. State law is untouched, and several mini-TCPA statutes require written consent on their own authority. And the problem is evidentiary rather than doctrinal: oral consent is harder to prove, not easier, so a ruling permitting it does not reduce what you need to document.
It is also not a one-off, which is the part worth planning around. In June 2025 the Supreme Court held in McLaughlin Chiropractic Associates v. McKesson that the Hobbs Act does not bind district courts to an agency’s reading of a statute in civil enforcement proceedings; courts must determine a law’s meaning independently. Bradford applied that. Expect further challenges to FCC TCPA rules, landing unevenly across circuits. Which argues for documentation rather than against it: when the rule you rely on is open to reinterpretation, the record of what you actually collected is the part that does not move.
One date belongs in your calendar. The FCC’s revoke-all provision, which would treat a single revocation as covering all future calls and texts from you on unrelated subjects, has been delayed twice. The Bureau order setting the new date of January 31, 2027 states the extension and the open rulemaking behind it. The rest of the revocation rule has been enforceable since April 2025. Teams that build cross-channel suppression now do the work once instead of twice.
A note on scope. This is operational compliance guidance, not legal advice, and AnswerNet is not a law firm. The rules above interact with state statutes and your own contracts in ways specific to your program. Run consent language and retention policy past qualified TCPA counsel first.
Frequently asked questions
What exactly has to be in a prior express written consent disclosure for it to hold up under the TCPA?
How long do we need to keep TCPA consent records, and what counts as proof if we get sued?
Five years from the date the record is produced, under the Telemarketing Sales Rule. For consent specifically, 16 CFR 310.5(a)(8) defines a complete record as the name and telephone number of the person consenting, a copy of the consent request in the same manner and format it was presented, the purpose consent was given for, a copy of the consent itself, and the date. In practice that means a rendered capture of the actual form version the person saw, not a description of it.
Do we need written consent to send marketing text messages, or is oral consent enough now?
Our consent is collected through a web form on a partner's website. Is that still valid for our calls?
It can be, but only if the disclosure clearly authorized your company by name and you hold the record proving it. The FCC’s one-to-one consent rule was vacated by the Eleventh Circuit in January 2025, so a single form can still cover multiple named sellers. What did not change is that the calling seller must be clearly authorized, and that you carry the burden of producing the record. Require the rendered form capture, timestamp, source identifier, and disclosure version with every purchased lead.
How quickly do we have to honor a request to revoke consent?
Within ten business days of receipt. A consumer may revoke through any reasonable method, and the rule treats several as reasonable per se: an automated opt-out on a call, a reply text using words like stop, quit, revoke, cancel or unsubscribe, or a website or phone number you designated for opt-outs. You may not designate an exclusive means. A single confirmation text with no marketing content is permitted, and is presumed acceptable if sent within five minutes.
Put numbers on it before you need to
The outreach and compliance risk calculator is un-gated and takes about a minute. Enter monthly call volume and an estimated non-compliance rate, and it returns TCPA statutory exposure and FTC civil penalty estimates side by side, with a toggle for willful violations.
