TCPA and consent, in plain language

This is an operational explainer, not legal advice. The Telephone Consumer Protection Act is federal law interpreted by an active regulator and an even more active plaintiffs' bar; the rules move, and several important ones have moved recently. Treat what follows as the vocabulary you need to have a useful conversation with your counsel, not as a substitute for that conversation.

With that said, most TCPA trouble is not caused by a subtle legal question. It is caused by an operation that cannot produce evidence of something it genuinely did.

The two kinds of consent

The Act treats calls differently depending on how they are placed and what they are for. The distinction that matters most in practice:

• Informational or transactional calls to a mobile — appointment reminders, delivery updates, fraud alerts — generally need prior express consent. Being given the number for that purpose usually supplies it.
• Marketing calls and texts placed with regulated automated technology, or using an artificial or prerecorded voice, generally need prior express written consent: a signed agreement, clear disclosure that the consumer will receive such calls, and a statement that agreeing is not a condition of purchase.

"Written" includes electronic signature. A checkbox on a form is capable of satisfying it — an unchecked box, a pre-checked box, or consent buried in linked terms typically is not.

The two do-not-call lists

There are two, and confusing them is a common operational failure.

• The National Do Not Call Registry, which applies to marketing calls to residential subscribers unless an exemption applies. Scrubbing must be current; a list downloaded months ago is not.
• Your own internal do-not-call list, which you are required to maintain and honour. This one is entirely within your control, which is exactly why regulators and plaintiffs look at it first. An internal suppression that is not honoured across every campaign, dialler, and vendor is the single most common finding.

What actually gets operations into trouble

• Consent that exists but cannot be produced. If you cannot retrieve, for a specific number, the form, timestamp, IP address and disclosure text as the consumer saw it, you effectively do not have consent when it is challenged.
• Purchased lists treated as consented. Consent given to a lead vendor's "marketing partners" is not consent to be called by you unless you were identified. If your name was not in front of the consumer, assume you do not have it.
• Revocation handled inconsistently. A consumer may revoke consent through any reasonable means — verbally on a call, by replying STOP, by email. Regulators have pushed hard on honouring revocation promptly and across all channels, so a stop request captured in the dialler but not in the SMS platform is a live exposure.
• Reassigned numbers. Numbers change hands constantly. Consent belongs to the person who gave it, not to the digits. There is an industry database for checking reassignment, and using it matters more than most operations assume.
• Calling-hours rules applied in the wrong time zone. The consumer's local time is what governs, and the area code is not a reliable proxy for where someone actually is.

The state layer

Several states have their own mini-TCPA statutes that are stricter than the federal baseline — narrower calling windows, broader definitions of regulated equipment, and their own private rights of action. Florida, Oklahoma and Washington are the ones most often cited. If you call nationally, your compliance floor is the strictest state you dial into, not the federal rule.

The operational habits that keep you out of trouble

• Store proof of consent with the record, not in a separate system, and make it retrievable by phone number in seconds.
• Keep consent evidence for longer than you think you need to. The federal limitations period is four years; retention practice is usually set beyond that.
• Make suppression global and immediate. One list, honoured by every channel and every vendor, applied the same day.
• Scrub before every campaign, not on a schedule.
• Re-read your own consent language annually as a consumer would. If the disclosure would surprise the person who signed it, it will not help you.
• Record calls where lawfully permitted, and know which of your states require all-party consent to that recording — the recording rules are separate law from the calling rules.

If a vendor tells you their list is "TCPA compliant", ask them to show you the consent record for three numbers you pick at random. The answer to that request tells you more than any certificate.