If you buy SMS marketing lists or telemarketing lists, the TCPA consent landscape has shifted three times in two years. One major rule was struck down before it took effect. A second set of rules is already being enforced. A third, the “revoke-all” rule, is being rewritten, with an FCC vote scheduled for September 30, 2026. Here is where each one stands and what to do about it.
Updated September 28, 2026. This article builds on our core guide to TCPA compliance for SMS marketing and our state-by-state SMS law map. It is general information, not legal advice.
Change 1: The One-to-One Consent Rule Is Gone
In December 2023, the FCC adopted a rule to close what it called the “lead generator loophole.” It would have required prior express written consent to name no more than one seller at a time, and it would have limited calls to topics “logically and topically associated” with the interaction that prompted the consent. The rule was scheduled to take effect on January 27, 2025.
On January 24, 2025, the U.S. Court of Appeals for the Eleventh Circuit vacated the rule in Insurance Marketing Coalition v. FCC (No. 24-10277). The court held that the FCC exceeded its statutory authority because the new requirements conflicted with the ordinary meaning of “prior express consent” in the TCPA. The FCC later deleted the vacated language and reinstated its prior definition of prior express written consent.
What it means for list buyers: The pre-2023 standard for prior express written consent still applies. That is not a loophole. Marketing texts and autodialed or prerecorded marketing calls still require prior express written consent, and courts still scrutinize vague, multi-seller consent forms. Buy SMS data only from providers who can show clear, documented consent. State laws may also impose stricter standards than federal law.
Change 2: Revocation Rules Already in Force Since April 11, 2025
In February 2024, the FCC adopted new rules that make it easier for consumers to revoke consent. Most of them took effect on April 11, 2025 and are enforceable today:
Any reasonable means. Consumers can revoke consent to robocalls and robotexts through any reasonable method. The FCC identified replies such as “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” and “unsubscribe” as reasonable ways to revoke consent by text.
10 business days. Callers must honor revocation requests within a reasonable time, not to exceed 10 business days from receipt.
Confirmation text. A one-time text confirming the opt-out is permitted if it is sent within five minutes and contains no marketing.
Clear disclosure. Opt-out methods must be clearly disclosed.
What it means for list buyers: If your SMS platform only recognizes “STOP,” or if your suppression file takes two weeks to sync across vendors, you are already out of compliance. Missed opt-outs and slow suppression are among the most common TCPA claims.
Change 3: The Revoke-All Rule Is Being Rewritten
One piece of the 2024 order was held back. The “revoke-all” rule says that when a consumer revokes consent in response to one type of robocall or robotext, that revocation applies to all future robocalls and robotexts from that caller on unrelated matters, unless an exemption applies.
The timeline has moved twice:
- Original effective date: April 11, 2025.
- First delay: On April 7, 2025, the FCC pushed it to April 11, 2026 after banks and financial institutions requested more time.
- Second delay: On January 6, 2026, the FCC’s Consumer and Governmental Affairs Bureau extended it to January 31, 2027, while the agency reviewed comments on whether to modify or replace the rule.
The September 2026 Draft Order
On September 9, 2026, the FCC released a draft Report and Order and Further Notice of Proposed Rulemaking for a vote at its September 30, 2026 open meeting. As circulated, the draft would:
- Narrow revoke-all for informational messages. A revocation made in response to one category of informational messages (such as payment reminders) could be treated as applying only to that category, so a consumer does not unintentionally lose fraud alerts or delivery notices.
- Keep marketing opt-outs broad. Revocations made in response to marketing or telemarketing messages would still stop all such messages from the sender.
- Allow an exclusive opt-out method. Businesses could designate an exclusive means for consumers to revoke consent, rather than honoring “any reasonable method,” as long as that method is clearly disclosed.
- Take effect 30 days after Federal Register publication, superseding the January 31, 2027 date.
The accompanying proposal would also seek comment on shortening the 10-business-day processing window, requiring senders to accept reply-text opt-outs, requiring a revoke-all option, and clarifying how opt-outs apply across affiliates and business lines.
This is a draft, not final agency action. The FCC notes the item remains subject to change. Until a final order takes effect, the current rules under 47 CFR 64.1200(a)(10) apply, including honoring any reasonable method of revocation.
What it means for list buyers: For marketing texts and calls, the direction is clear either way: a STOP in reply to a promotional message must stop all of your promotional robocalls and robotexts. Build one company-wide marketing suppression list that feeds every brand, platform, and vendor. If the draft is adopted, decide whether to designate an exclusive opt-out channel, and make sure it is disclosed in every message.
What Has Not Changed
- Marketing texts still require prior express written consent.
- Federal quiet hours remain 8:00 AM to 9:00 PM in the recipient’s local time, and several states are stricter.
- National Do Not Call Registry scrubbing is still required at least every 31 days for telemarketing.
- Statutory damages remain $500 per violation, up to $1,500 for willful or knowing violations.
- State mini-TCPA laws in Florida, Oklahoma, Connecticut, Texas, Virginia, and elsewhere still apply on top of federal rules.
A 2027 Readiness Checklist for List Buyers
- Audit consent provenance. For every SMS or autodialed calling list, confirm who collected consent, the exact disclosure language, and whether your company is named. Our guide on how to buy SMS marketing lists covers what to ask.
- Expand opt-out keyword handling. Recognize stop, quit, end, revoke, opt out, cancel, and unsubscribe, plus reasonable variations and replies in other languages.
- Measure suppression speed. Time how long an opt-out takes to reach every system and vendor. Target same day, and never exceed 10 business days.
- Centralize suppression. Build one company-wide marketing do-not-contact list that feeds every brand, platform, and agency, whatever the final revoke-all rule says.
- Watch the September 30, 2026 vote. If the draft order is adopted, review whether to designate an exclusive opt-out method and update your disclosures before the new rules take effect.
- Update vendor contracts. Require call centers, SMS platforms, and lead partners to honor your suppression list on a defined timeline.
- Keep records for four years. The TCPA’s statute of limitations is generally four years, so retain consent and opt-out records at least that long.
- Clean phone data before each campaign. Check for reassigned and disconnected numbers. See our list hygiene guide.
Where Appended Phone Numbers Fit
A cell phone append adds numbers to records you already own, but it does not create consent. Appended numbers can support manual-dial calls to numbers not on the Do Not Call Registry. They cannot be used for marketing texts or autodialed marketing calls without prior express written consent. For more, see how cell phone append powers multichannel campaigns.
Frequently Asked Questions
Is the FCC one-to-one consent rule in effect?
No. The Eleventh Circuit vacated it on January 24, 2025 in Insurance Marketing Coalition v. FCC, days before its January 27, 2025 effective date, and the FCC later removed the language from its rules. The prior definition of prior express written consent still applies.
What is the TCPA revoke-all rule?
It requires a caller to treat a consumer’s revocation of consent in response to one type of robocall or robotext as a revocation for all future robocalls and robotexts from that caller on unrelated matters, unless an exemption applies. It is scheduled for January 31, 2027, but the FCC votes on September 30, 2026 on a draft order that would narrow it for informational messages and take effect 30 days after Federal Register publication.
How quickly must I honor a text opt-out?
Within a reasonable time, not to exceed 10 business days from receipt. This requirement has been in effect since April 11, 2025.
Which words count as an opt-out?
The FCC identified stop, quit, end, revoke, opt out, cancel, and unsubscribe as per se reasonable ways to revoke consent by reply text. Under current rules, consumers can also revoke through any other reasonable means, so plain-language replies should be honored too.
Can I text numbers from a cell phone append?
Not for marketing without prior express written consent. Appended numbers can support compliant manual-dial calls to numbers not on the Do Not Call Registry, and SMS consent can be requested during that conversation.
Start 2027 with Compliant Data
At ProMarketing Leads, our SMS and telemarketing lists are DNC-scrubbed before delivery, and we will walk you through consent provenance before you buy.
Contact us today for a free consultation. Call (866) 397-2772 to speak with a list expert.