Express Written Consent Under the TCPA: Rules, Examples and Proof

At its core, express written consent is a clear, documented "yes" from a customer agreeing to get marketing messages from you. Think of it as the gold standard for communicating through SMS, voice calls, and even ringless voicemail. It's what keeps your outreach legal, welcomed, and effective.

What Express Written Consent Actually Means

Imagine you're at a friend's house. Just because the door is unlocked doesn't mean you can just walk right in. You wait for them to give you an enthusiastic, "Come on in!" That's the perfect way to think about express written consent: it’s the huge difference between assuming you have permission and getting an explicit, unambiguous welcome.

In the world of business communication, this isn't just a nice-to-have; it's a legal cornerstone, especially under the Telephone Consumer Protection Act (TCPA). It represents a direct agreement where a consumer gives you the green light to contact them with promotional messages. Without that clear permission, your marketing campaign could easily be flagged as spam, landing you in some serious legal hot water.

But this goes beyond just ticking a regulatory box. It’s about building trust. When someone gives you their consent, they are inviting you into their most personal space: their phone. If you honor that trust, your messages are seen as valuable updates, not intrusive junk.

The Core Components of Valid Consent

To make sure your consent is legally sound, you need to break it down. It's not as complicated as it sounds, but getting each piece right is non-negotiable for compliance.

Here's a quick table that lays out what's required for consent to be considered valid for your marketing communications.

Getting these three components right is the foundation of a compliant and successful messaging strategy.

The Legal Definition, Part by Part

Those three ideas are the plain-language version. The FCC rule is more specific. It defines prior express written consent as "an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller" to send advertisements or telemarketing messages by autodialer or artificial or prerecorded voice, "and the telephone number to which the signatory authorizes" them (47 CFR 64.1200(f)(9)). Here is what each part means in practice.

The entire industry is shifting toward more stringent consent documentation. Companies now buy dedicated consent management platforms (most of them built for privacy consent, such as cookies and personal data), and analysts expect that market to roughly double over the next five years (figures below). For texting and calling, though, the rule that matters is the TCPA definition itself.

Why Consent Is Non-Negotiable Under the TCPA

The big reason "express written consent" has become such a critical part of doing business is a federal law called the Telephone Consumer Protection Act, or TCPA. Think of it as a shield for consumers, designed to stop the endless stream of unwanted robocalls and automated texts that hijack our phones.

But if you're a business, the TCPA isn't just some friendly guideline. It's a book of strict rules with some seriously painful financial penalties if you ignore them. Getting your head around this isn't optional; it's a core piece of modern marketing that directly protects your bank account.

The High Stakes of Non-Compliance

The TCPA rule is clear: you must get express written consent before you send marketing calls or texts to a cell phone using an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice (47 CFR 64.1200(a)(2)). Texts count as calls (Campbell-Ewald v. Gomez, 2016). Since Facebook v. Duguid (2021), an ATDS is narrowly defined as equipment that stores or produces numbers "using a random or sequential number generator", so not every texting platform is one. That does not make consent optional: prerecorded and AI voices (voice broadcasts and ringless voicemail drops) are covered whatever the dialer, carriers expect express written consent for promotional texts (CTIA), and some states have their own rules.

The penalties for breaking these rules are no joke. They're designed to hurt.

• Costly Damages: People who receive unlawful calls or texts can sue for $500 per violation, and a court can raise that to as much as $1,500 if the violation was willful or knowing (47 U.S.C. 227(b)(3)). That’s not per campaign; it’s per text or call you send without the right permission.
• Business-Ending Expenses: Imagine sending one non-compliant text to a list of just 2,000 people. At $500 each, that is $1,000,000 in potential damages before any multiplier, an amount that would sink most small or mid-sized businesses.

These massive penalties have created a cottage industry of class-action lawsuits targeting companies that mess up their consent documentation. There are literally professional plaintiffs and law firms that hunt for businesses with sloppy practices, making TCPA violations a huge legal and financial risk.

When Express Written Consent Is Required

The level of consent depends on what the message does and how it is sent. Under federal rules and carrier guidance, it breaks down like this.

More detail on the whole law is in this guide to TCPA compliance.

What Changed, 2021 to 2026

• April 2021: the Supreme Court narrowed the autodialer definition (Facebook v. Duguid).
• November 2022: the FCC ruled that ringless voicemail is a call that needs consent (FCC 22-85).
• February 2024: the FCC confirmed AI-generated voices count as artificial voices (FCC 24-17).
• January 24, 2025: the 11th Circuit vacated the FCC's "one-to-one consent" rule, which would have limited each consent to a single seller (Insurance Marketing Coalition v. FCC).
• Current rule: consumers can revoke consent by any reasonable means, including replies like STOP, and you must honor it within 10 business days (47 CFR 64.1200(a)(10)).
• September 30, 2026: the FCC revised parts of the revocation rules, including revoking by category of calls (FCC 26-67). Check the current text for the effective date.

Market Growth Reflects Legal Pressure

The financial dangers tied to the TCPA, along with privacy laws, have helped build a whole industry just for managing consent. The consent management market is expected to hit $1.07 billion in 2026 and grow to $2.34 billion by 2031, and North America is the largest region, with 36.2% of revenue in 2025 (Mordor Intelligence, updated September 2026).

Most of those platforms handle privacy consent rather than texting, but the pressure is the same: regulators and courts expect you to show a clear, recorded yes before you hit send.

At the end of the day, treating express written consent as a non-negotiable part of your process is the only safe way to operate. It protects your business, it shows respect for your customers, and it ensures your marketing builds valuable relationships instead of dangerous legal liabilities.

Practical Ways to Collect and Document Consent

Alright, let's move from theory to action. Getting express written consent is all about making the sign-up process crystal clear, totally transparent, and dead simple for your customers. There are a handful of proven ways to capture this permission, and every single one hinges on explicit language and bulletproof documentation.

The most popular methods are probably ones you've seen before: web forms, text-to-join keywords, and maybe even a sign-up sheet at a point-of-sale. For a web form, you need a checkbox that someone has to actively click. The words next to it can't be wishy-washy. Think something direct like, "I agree to receive recurring automated marketing messages from [Your Brand] at the number provided. Consent is not a condition of purchase. Reply STOP to cancel."

Sample Express Written Consent Language

Here is a fuller version you can adapt for a web form or a paper sign-up. Each sentence maps to a part of the rule or to carrier guidance; change the brackets and the frequency to match your program.

• "[Your Brand]": names the seller (47 CFR 64.1200(f)(9)).
• "automated marketing text messages and prerecorded calls": says what is authorized ((f)(9)(i)(A)).
• "at the mobile number provided": ties consent to the number ((f)(9)).
• "Consent is not a condition of purchase": the required disclosure ((f)(9)(i)(B)).
• Frequency, rates, HELP and STOP: what carriers expect in a call to action (CTIA 5.1).

Mastering the Documentation Process

Here’s the thing: just getting someone to say "yes" isn't enough. You have to be able to prove they said yes. Meticulous record-keeping is your single best defense if you ever face a TCPA complaint. If a customer challenges your right to contact them, the burden of proof falls squarely on your shoulders to produce a clear, undeniable trail of their consent.

Think of it as keeping a receipt for every permission slip you get. For every single person on your list, your records have to show:

• Who: The phone number of the person who gave you the green light.
• What: The exact disclosure language they saw and agreed to.
• When: The precise date and timestamp of their opt-in.
• How: The source of the consent: was it a specific web form? What was the IP address?
• Which version: A copy or screenshot of the form or keyword flow as it looked that day.
• Changes: Every opt-out, with its date, so you can show you stopped. Do-not-call requests must be honored for 5 years (47 CFR 64.1200(d)).

This infographic shows the five parts the legal definition asks for, and where each one sits on a simple sign-up form.

As you can see, skipping any one of these parts weakens your proof, and texting without consent at all puts your business directly in the path of serious damages under the TCPA.

Automating for Ironclad Compliance

Trying to track all these details by hand is a recipe for disaster. It's nearly impossible and just asking for human error. This is why using a platform that automates the whole documentation process is so critical. When someone opts in, the system should instantly log all those crucial data points, creating a secure, reliable record for every subscriber. For a deeper dive, check out our guide on effective opt-in strategies for text marketing.

This level of detail is non-negotiable, whether you're sending SMS, making calls, or dropping ringless voicemail messages. Store the records somewhere you can search by phone number and export quickly, because the rule puts the burden on the caller to show consent was given and that opt-outs were honored (47 CFR 64.1200). Run through this SMS compliance checklist before you launch.

At the end of the day, a proactive and organized approach to documenting express written consent is the only way to shield your business while building a list of people who are genuinely excited to hear from you.

Navigating Consent for Ringless Voicemail and Voice Calls

Voice communications can sometimes feel like the Wild West compared to SMS, but when you look at the actual rules, the lines are drawn pretty clearly. A lot of marketers fall into a dangerous trap: they figure since a ringless voicemail doesn't actually make a phone ring, it's less intrusive. From there, they assume it must be exempt from the tough consent rules.

That assumption could cost you dearly.

Regulators have been clear on this point: a ringless voicemail is treated as a "call" under the TCPA. The FCC said so in November 2022 (FCC 22-85). So, for any promotional message you drop straight into someone’s voicemail, you need the exact same level of express written consent required for automated texts and calls. The delivery method doesn't give you a free pass. This guide to ringless voicemail compliance covers the rest.

The Rules for Automated Voice Broadcasts

That same non-negotiable requirement for express written consent applies to your automated voice broadcasts, too. Before your pre-recorded message ever hits a contact’s phone, you need a clear, documented record showing they agreed to get those calls from you.

The same goes for AI-generated voices. In February 2024 the FCC confirmed that voices made with AI count as "artificial" voices under the TCPA, so those calls need the same consent (FCC 24-17).

Without that proof, every single call you send is a potential TCPA violation, putting you at serious financial risk.

To keep your campaigns compliant and build trust with your audience, there are a few rules and best practices you need to bake into your strategy (the first three come from 47 CFR 64.1200(b)). These aren't just helpful tips; they're the bedrock of a lawful and effective voice campaign.

• Always Identify Yourself: Your message must start by clearly stating the name of your business or who you're calling on behalf of. No mystery callers.
• Give a Callback Number: During or after the message, state a phone number people can call, and not the number of the autodialer itself (47 CFR 64.1200(b)(2)).
• Provide a Simple Opt-Out: You have to offer a dead-simple, automated way for people to opt out of future calls. The classic "press 1 to be added to our Do-Not-Call list" is a perfect example.
• Honor Opt-Outs Fast: That opt-out can't be for show. It has to add the number to your internal Do-Not-Call list, and the request must be honored for 5 years. Learn more about do-not-call list compliance.

The big takeaway here is that even though the technology is designed to bypass a direct ring, regulators don't care about the how. They care about the what: an unsolicited marketing message ending up on a consumer's device, which they see as the same thing as a call.

Building Compliant Voice Campaigns

Platforms like Broadcast are built from the ground up with these rules in mind, giving you the tools to manage consent and run compliant campaigns right from the start. For instance, our system makes it easy to upload or record your audio messages and ensure they include the necessary identification and opt-out instructions.

You can learn more about getting this all set up in our guide on automatic voice messaging.

Managing Consent and Compliance with Broadcast

Theory is one thing, but putting it into practice is where the rubber meets the road. For anyone using Broadcast, managing express written consent isn't some extra chore; it’s baked right into the platform. This is your playbook for using our tools to build a compliant, effective, and trustworthy communication strategy from the get-go.

There’s a reason the market for consent management tools keeps growing: smart businesses are investing in getting compliance right. Brands that collect clear, express consent build lists of people who actually asked to hear from them, which tends to mean fewer complaints and opt-outs.

With features like double opt-in, Broadcast’s 45,000+ users are already ahead of the curve. This matters even more in sensitive fields like healthcare, where HIPAA privacy rules apply on top of the TCPA (the TCPA rule has a separate exception for health care messages from covered entities). See this guide to HIPAA-compliant texting platforms.

Implementing Double Opt-In for Ironclad Proof

The single most powerful tool you have for documenting consent is the double opt-in. Think of it as a two-step handshake to confirm permission. First, a user signs up on your form. Then, they have to reply "YES" to a confirmation text message. Simple as that.

This process creates a clear, undeniable, timestamped record of their intent. It wipes out any gray areas and gives you the strongest possible proof that a subscriber knowingly and willingly wanted to hear from you. The best part? Broadcast automates this whole sequence, locking in that ironclad proof for every single contact.

Double opt-in is not required by law or by carriers: CTIA's Short Code Monitoring Handbook says recurring programs must send one opt-in confirmation and that "double opt-in is optional." It is still the strongest proof you can collect, especially for web forms where a typo can add someone else's number.

Using Segmentation to Target the Right Audience

Let's be real: not all consent is the same. A customer might be perfectly fine getting appointment reminders but have zero interest in promotional offers for your ringless voicemail campaigns. Sending the wrong message to the right person at the wrong time isn't just annoying; it's a compliance risk.

This is where contact segmentation becomes your best friend. Broadcast makes it easy to create separate groups based on the specific type of consent each contact gave you.

• Promotional Lists: For contacts who explicitly said "yes" to your marketing messages.
• Transactional Lists: For users expecting things like order updates or appointment reminders.
• Campaign-Specific Groups: For people who opted in for a particular event, webinar, or one-off offer.

By segmenting your audience, you make sure every message you send is relevant and, more importantly, lines up perfectly with the permission you were given.

Honoring Opt-Outs Instantly and Automatically

The final piece of the compliance puzzle is respecting someone's right to change their mind. The FCC rule says people can revoke consent by any reasonable means, including replies like "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe," and you must honor it within a reasonable time, no more than 10 business days (47 CFR 64.1200(a)(10)). In practice, stopping right away is the safer standard: when a subscriber texts "STOP," remove them with no delays or manual steps.

Broadcast’s platform handles this on autopilot. The second an opt-out keyword like "STOP" comes in, the contact is flagged in the system, and no more messages will be sent to them. This automated process saves you from accidental violations, keeps your contact lists clean, and shows respect for your subscribers' choices, which is the ultimate key to a healthy and engaged audience.

Common Questions About Express Written Consent

Even after you've got a handle on the rules, certain situations can still feel a bit fuzzy. Getting clear on the gray areas of express written consent is what separates a confident, compliant outreach strategy from a risky one. Let's walk through some of the most common questions we see.

Does Buying a Contact List Count as Consent?

Let's clear this one up right away, because it's one of the most common and dangerous mistakes a business can make. The answer is an absolute, unequivocal no.

Buying a list of phone numbers never, ever grants you express written consent under the TCPA. The consent has to clearly authorize your business (the "seller") to send automated marketing to that number, for a purpose you’ve clearly spelled out (47 CFR 64.1200(f)(9)). Carriers also prohibit sending to rented, sold or shared lists (CTIA).

Using purchased or rented lists to send automated SMS, voice calls, or ringless voicemail campaigns is a fast-track to consumer complaints and potentially crippling class-action lawsuits. The only safe way forward is to build your contact list organically through direct, documented opt-ins.

What Is the Difference Between Express and Implied Consent?

This distinction is at the very core of TCPA compliance. Implied consent (the rule calls it "prior express consent") is what you might get when a customer gives you their number while doing business with you, like when they're placing an order. It does not have to be written, and it generally covers non-marketing, informational messages: think shipping updates or appointment reminders (47 U.S.C. 227(b)(1)(A), CTIA 5.1).

Express written consent is the much higher bar you have to clear for any message that could be considered promotional or marketing. It requires a clear, positive action from the consumer, like checking a specific box or texting a keyword, where they explicitly agree to get marketing messages from you. If your message is designed to encourage a purchase, this is the level of consent you need.

When Is Express Written Consent Required Under the TCPA?

Before any call or text that advertises or sells something and is sent to a cell phone by autodialer or by an artificial or prerecorded voice, including ringless voicemail and AI voices (47 CFR 64.1200(a)(2)). Prerecorded marketing calls to residential landlines need it too ((a)(3)).

Is a Checkbox Required for TCPA Consent?

No. The rule asks for a signature, and an electronic or digital signature counts if it is valid under federal or state law (47 CFR 64.1200(f)(9)(ii)). An unchecked box the person ticks is the most common way to collect it online, but a signed paper form or another valid e-signature works too. A pre-checked box is not a clear, affirmative yes.

What Is TCPA Global Consent?

"Global consent" is not a term in the FCC rule. People usually mean one consent that covers many companies, such as a lead form listing many partners. In 2023 the FCC adopted a "one-to-one" rule that would have limited each consent to a single seller, but the 11th Circuit vacated it on January 24, 2025 (Insurance Marketing Coalition v. FCC). The current definition still requires that the agreement clearly authorizes the seller, so check that your business is actually named before relying on a lead's consent.

Can Someone Revoke Express Written Consent?

Yes, at any time and by any reasonable means; you cannot force them to use one method. Honor it within 10 business days at most (47 CFR 64.1200(a)(10)). The FCC changed parts of these rules on September 30, 2026 (FCC 26-67), so check the current text.

How Long Does Express Written Consent Last?

The TCPA doesn't actually put an expiration date on express written consent. From a purely legal standpoint, it's valid until the person revokes it. But that definitely doesn't mean you can just set it and forget it.

As a best practice, you must always give people a simple and obvious way to opt-out, like replying "STOP" to a text. Even more importantly, you have to honor those requests immediately and automatically. A robust system that handles opt-outs is non-negotiable for staying on the right side of the law.

It’s also a smart move to periodically re-engage your list to make sure they still want to hear from you. This helps keep your database clean, your engagement high, and your compliance solid. For a deeper look at the best way to get that initial, provable permission, you can learn more about what double opt-in is and why it matters.