A working map of what consent you actually need to dial purchased and web leads this year, from a team that runs outbound floors daily rather than reading about them.
What consent do you need to call purchased leads in 2026?
For marketing calls to US mobiles using a prerecorded or AI voice, you need prior express written consent naming your company. The FCC's one-to-one consent rule was vacated in January 2025, so multi-seller consent remains lawful federally, but the number must still be clear of the national Do Not Call registry, state mini-TCPAs, and any revocation, and you need records that prove all of it.
The technology you dial with decides the consent you need.
The TCPA splits outbound calling into two worlds. Marketing calls to US mobile numbers made with an artificial or prerecorded voice, or with an autodialer as the statute defines one, require prior express written consent. Everything else falls back to the Do Not Call rules, which are a different and looser test. Most of the consent arguments we see on client floors come from mixing those two worlds up.
The autodialer half of that trigger is narrower than most people assume. In Facebook v. Duguid (2021), the Supreme Court held that an autodialer must use a random or sequential number generator to store or produce numbers, and a dialer working through a curated lead list generally is not one. The prerecorded half went the other way: the FCC ruled in February 2024 that AI-generated voices are artificial voices under the statute, so an AI voice agent calling a purchased lead sits squarely inside the written-consent requirement.
The consent itself is defined at 47 CFR 64.1200(f): a signed written agreement (electronic signatures count) with a clear and conspicuous disclosure that the person agrees to receive telemarketing calls made with an autodialer or prerecorded voice from that seller, at a number they specify, and that signing is not a condition of buying anything. A pre-ticked box does not meet it, and neither does consent language buried in general terms.
Rules in this area moved repeatedly between 2024 and 2026 and will keep moving, so treat this article as an operator's map: check the current text before you build policy on it, and involve qualified counsel where the stakes justify it.
Vacated in January 2025, and what that leaves standing.
Through 2024 the lead generation industry rebuilt itself around the FCC's one-to-one consent rule, adopted in December 2023. It would have required consent to be given to one identified seller at a time, ending the multi-seller consent forms that power most comparison sites, and it limited calls to subjects logically and topically associated with the site where consent was captured. Compliance teams spent a year re-platforming for a January 27, 2025 start date.
It never arrived. On January 24, 2025, the Eleventh Circuit vacated the rule in IMC v. FCC, holding that the FCC had exceeded its authority: the statute requires prior express consent, and the agency could not bolt one-to-one and topicality conditions onto a phrase with a settled common law meaning. The FCC itself had paused the effective date earlier that same day, hours before the ruling landed. The court struck only that part of the 2023 order, so the rest of the TCPA regime, including the 2012 written-consent definition above, stands untouched.
The honest operator read is that the vacatur removed a cliff edge, not the cliff. Multi-seller consent is lawful again at the federal level, but disclosures still have to be clear and conspicuous, the sellers still have to be identifiable, and the plaintiffs' bar did not go home. The lead buyers we see attracting demand letters in 2026 are mostly the ones who treated January 2025 as permission to return to hyperlinked lists of hundreds of unnamed marketing partners. Several states also judge consent more strictly than the federal floor, which is where the mini-TCPA section below comes in.
Our free 17-question Five9 Health Check looks at campaign consent tiers, suppression hygiene, opt-out handling and pacing, scored by consultants who run outbound floors every day.
Most of the 2024 revocation order is live. One piece keeps slipping.
The FCC's 2024 revocation order changed how every outbound floor has to treat the word stop. Since April 11, 2025, consumers can revoke consent by any reasonable means, and callers cannot funnel them into a single designated channel. Seven reply keywords (stop, quit, end, revoke, opt out, cancel, unsubscribe) count as per se reasonable. The rule caps processing at a reasonable time not exceeding ten business days, and the same ten-business-day cap now applies to company-specific do-not-call requests, which previously allowed thirty days. One confirmation text is permitted, sent within five minutes, with no marketing content in it.
The piece that keeps slipping is the revoke-all scope rule at 47 CFR 64.1200(a)(10), which would treat a revocation given in response to one type of message as revoking consent for all future calls and texts from that caller on unrelated matters. The FCC waived it to April 2026 after banks and healthcare providers argued they could not untangle consent across business units in time, then extended the waiver again on January 6, 2026, this time to January 31, 2027.
| Provision | Status as of mid-2026 |
|---|---|
| Revocation by any reasonable means | In effect since April 11, 2025 |
| Seven standard opt-out keywords honored by reply text | In effect since April 11, 2025 |
| Processing window capped at 10 business days | In effect since April 11, 2025 |
| One confirmation text within 5 minutes, no marketing | In effect since April 11, 2025 |
| Revoke-all scope across unrelated message types, 64.1200(a)(10) | Waived to January 31, 2027 |
Ten business days is the legal ceiling, not a target. On the floors we run, revocations propagate to every campaign the same day, because the gap between received and processed is exactly where accidental redials and treble damages live. If your dialer and SMS platform hold separate suppression lists, reconcile them nightly at minimum.
Written consent is only half the federal picture. Telemarketing calls to numbers on the national Do Not Call registry are prohibited regardless of dialing technology unless one of two doors is open: signed written permission from the consumer naming your company, or an established business relationship, which lasts 18 months from a purchase or transaction and 3 months from an inquiry or application, and ends the moment the person asks you to stop calling. For purchased lists the fine print matters: a web form inquiry can open a 3-month window, but it opens it for the business the consumer actually inquired of, which is not automatically you as the lead buyer.
The registry rules come with a genuine safe harbor at 64.1200(c)(2)(i), and it is earned, not assumed. To claim a violation was an error, a caller needs written compliance procedures, trained personnel, maintained suppression lists, a registry version obtained no more than 31 days before the call, and records proving all of it. No paperwork, no safe harbor, however innocent the mistake.
Record-keeping got heavier on the FTC side too. The 2024 Telemarketing Sales Rule amendments extended retention from two years to five and widened what has to be kept: a copy of each consent as captured, including the webpage it was captured on, call detail records for each campaign, established business relationship evidence, the registry versions used, and the identities of service providers involved. Five years of consent artifacts for every lead you dial is the new baseline, and it is far cheaper to design storage around that now than to reconstruct it during discovery.
If you cannot produce the form, the language and the timestamp, you do not have consent, you have a rumor of it.
Every purchased lead should arrive with its consent story attached: the seller's name, the URL of the form, the verbatim consent language displayed, the timestamp, the IP address, and a certification token that ties them together. The two dominant certification systems are ActiveProspect's TrustedForm, which records a replayable snapshot of the session and the exact disclosure shown, and Jornaya's LeadiD token, which fingerprints and timestamps the lead event. A market shift to factor into contracts: ActiveProspect announced in January 2026 that it had acquired Verisk Marketing Solutions, Jornaya's home, so both certificate systems are converging under one owner.
In the setups we audit, the most common failure is not fabricated consent. It is real consent that nobody can produce eighteen months later, because the certificate was never claimed, the seller relationship ended, or the CRM kept a lead source code and discarded everything else. Chain of custody is the discipline that fixes this: the consent artifact travels with the lead from the seller's post into your CRM and stays pinned to the record through every dialer export.
Before signing with any lead seller, we ask for these, in writing:
Indemnities are paper, not protection; a judgment against you is not cured by a counterparty that has folded. Aged leads deserve their own paragraph of suspicion: consent captured last year for a partner list you were never on is not consent for you now, so re-permission old data through a compliant opt-in flow rather than dialing on hope. Fresh web leads are also simply better commercially; the contact-rate evidence is in our speed-to-lead write-up.
For years, a mortgage application set off a feeding frenzy. Credit bureaus sold the fact of the credit pull, as a trigger lead, to competing lenders, and applicants fielded calls from companies they had never heard of. Congress ended most of it. The Homebuyers Privacy Protection Act (H.R. 2808) was signed on September 5, 2025 and took effect on March 4, 2026, amending the Fair Credit Reporting Act.
Since that date, a consumer reporting agency may only furnish a trigger lead when the transaction involves a firm offer of credit or insurance and the requester either holds the consumer's documented authorization or already has a relationship with them: their current mortgage originator, their current servicer, or a bank or credit union holding their account. The open resale market in mortgage triggers is gone. A GAO study on text-message trigger leads is due in September 2026, so further attention to this corner of the market is plausible.
Two operator consequences follow. First, any vendor still offering fresh trigger data in mid-2026 without evidence of those certifications is describing a product that should not exist, and buying it puts the FCRA problem on your desk as well as theirs. Second, lenders who lived on triggers need a replacement volume strategy, which in our experience means working owned data and past applicants harder, with the consent plumbing above done properly. We cover the dialing side in our mortgage lead dialing strategy guide and the sector picture on our mortgage lending page.
Federal compliance is the entry ticket. Florida and Oklahoma grade harder.
State telemarketing statutes apply based on where the called person is, not where your dialer sits, and several are stricter than federal law with private rights of action attached. Florida and Oklahoma matter most for lead-driven outbound because both let individual consumers sue per call.
Florida's Telephone Solicitation Act requires prior express written consent for unsolicited telephonic sales calls made using an automated system for the selection and dialing of numbers. A 2023 amendment narrowed that trigger from selection or dialing, added carve-outs for calls made at the consumer's express request, calls on an existing debt or contract, and calls within a prior or existing business relationship, and gave texters a 15-day window to honor a STOP before liability attaches. Separately, Florida's Telemarketing Act (section 501.616) bans commercial solicitation calls before 8am or after 8pm in the called person's time zone and caps them at three per 24-hour period on the same subject matter.
Oklahoma copied Florida's original, pre-amendment statute into its Telephone Solicitation Act, in force since November 2022, and has not adopted Florida's narrowing. Its automated-system trigger still reads selection or dialing, which on a plain reading reaches most modern dialing modes.
| Federal TCPA | Florida | Oklahoma | |
|---|---|---|---|
| Written consent trigger | Prerecorded or AI voice, or statutory autodialer, marketing to mobiles | Automated selection and dialing, unsolicited sales calls | Automated selection or dialing, sales calls |
| Calling hours | 8am to 9pm local | 8am to 8pm local | 8am to 8pm local |
| Frequency cap | None generally | 3 per 24 hours, same subject | 3 per 24 hours, same subject |
| Private right of action | $500, up to $1,500 willful | $500, up to $1,500 willful | $500, up to $1,500 willful |
Statutes in this space get amended most legislative sessions and courts keep reinterpreting them, so confirm against the current statutory text and take advice from counsel qualified in the relevant state before hard-coding any of this into campaign logic.
The floor-level fix is unglamorous: state-aware suppression and pacing rules in the dialer, so Florida and Oklahoma numbers inherit the 8pm cutoff and the three-attempt cap automatically instead of relying on list managers remembering.
Everything above converges on one operational question: when a demand letter names a phone number and a date, how fast can you produce the consent, the DNC status at dial time, and the revocation history? On a well-built floor the answer is minutes. The structure that makes it minutes is not complicated, it just has to be deliberate.
| Artifact | Where it lives | Why |
|---|---|---|
| Consent record: seller, form URL, verbatim disclosure, timestamp, IP, certificate ID | CRM, pinned fields on the lead record | Written-consent proof; the TSR requires the consent copy kept for 5 years |
| Certificate archive (TrustedForm claims, LeadiD tokens) | Certification vendor account plus your own export | Unclaimed certificates age out; your export survives a vendor change |
| DNC scrub evidence: registry version date per campaign | Dialer campaign metadata or compliance log | The 31-day freshness condition of the safe harbor |
| Revocation log: channel, exact words, received and processed dates, scope | Suppression system of record, synced to every campaign | Evidences processing inside the ten-business-day cap |
| Consent tier per list | Dialer campaign configuration | Keeps prerecorded and AI treatments off lists without written consent |
In Five9 terms, we build this as consent-tiered campaigns: lists carrying verified written consent are eligible for the full toolkit, and everything else runs preview or manual with a live agent and tighter pacing. Campaign membership is driven by the CRM consent fields, not by a human copying lists about, because manual list handling is where good intentions go to die. The same structure feeds the pacing and abandonment disciplines in our predictive dialing abandonment guide, which is the other half of TCPA exposure for outbound teams.
None of this is exotic. It is fields, suppression jobs and campaign rules, configured once and audited quarterly. The teams that get hurt are rarely the ones with bad intentions; they are the ones who bought good leads, dialed them on a well-meaning setup, and cannot prove any of it two years later.
No. The Eleventh Circuit vacated it in IMC v. FCC on January 24, 2025, three days before its effective date, holding that the FCC could not add one-to-one and topicality conditions to the statutory phrase prior express consent. Multi-seller consent on lead forms remains lawful at the federal level, subject to the existing written-consent definition. Disclosures still have to be clear and conspicuous, and some state statutes judge consent more strictly than federal law does.
A signed written agreement, and an electronic signature counts, containing a clear and conspicuous disclosure that the person authorizes a specific seller to make telemarketing calls using an autodialer or an artificial or prerecorded voice to a number they designate. The disclosure has to state that consent is not a condition of purchase. Pre-ticked boxes and consent language hidden inside general terms do not satisfy the definition in 47 CFR 64.1200(f).
Within a reasonable time capped at ten business days, and the same cap applies to company-specific do-not-call requests. Reply texts using stop, quit, end, revoke, opt out, cancel or unsubscribe count as per se reasonable revocations, and callers cannot restrict consumers to one designated opt-out channel. In practice, well-run floors propagate revocations to every campaign the same day rather than using the full window, because redials inside the gap are where damages accrue.
Not as of mid-2026. The provision at 47 CFR 64.1200(a)(10), which would treat a revocation sent in response to one type of message as revoking consent for all calls and texts from that caller on unrelated matters, was waived to April 2026 and then extended by the FCC on January 6, 2026 to January 31, 2027. Every other part of the 2024 revocation order took effect on April 11, 2025.
Only inside narrow exceptions. Since March 4, 2026, the Homebuyers Privacy Protection Act permits consumer reporting agencies to furnish trigger leads only where the transaction involves a firm offer of credit or insurance and the requester either holds the consumer's documented authorization or is their current mortgage originator, current servicer, or a bank or credit union holding their account. The open resale market in mortgage trigger leads is effectively closed, and vendors still hawking it are a red flag.
Manual, live-agent calls avoid the federal written-consent trigger, which attaches to artificial or prerecorded voices and statutory autodialers. They do not avoid the Do Not Call rules: numbers on the national registry still need signed permission or an established business relationship. State statutes reach further, and Oklahoma's automated-system definition covers selection or dialing, which arguably captures most modern dialing modes. Manual dialing narrows the risk, it does not remove it.
The FTC's 2024 Telemarketing Sales Rule amendments set a five-year retention period and widened what has to be kept, including a copy of each consent as captured, the webpage it was captured on, campaign call detail records, established business relationship evidence, and the Do Not Call registry versions used. Company-specific do-not-call requests stay valid for five years. Designing CRM storage around these windows is far cheaper than reconstructing records during litigation.
Yes. The statute applies based on who is called, not where the caller operates, so a national campaign dialing Florida consumers is exposed regardless of where the dialer or the agents sit. It carries a private right of action at 500 dollars per violation, trebled up to 1,500 for willful conduct. Most operators segment Florida numbers into their own campaigns so the 8pm cutoff and the three-call cap apply automatically.
We implement and run Five9 estates for lead-driven outbound teams in the UK and US: consent-tiered campaigns, suppression that actually syncs, and records that surface in minutes, handled by a dedicated pod rather than a ticket queue.
Talk to us