Does the TCPA require consent to make calls?

The Consent Trap: Why Telemarketing Calls Without Proper Consent Cost Millions

Every telemarketing call or text you send without proper consent is a ticking liability — and under the TCPA, the question isn't whether you need consent, but whether you can prove you had it. The law is unambiguous: any call or text made using an automatic telephone dialing system or an artificial/prerecorded voice that contains advertising or constitutes telemarketing requires prior express written consent, according to FCC rules. The FCC even clarified in February 2024 that AI-generated voices count as artificial voices, pulling automated voice follow-up squarely into the consent framework.

The financial stakes are staggering. Each violation carries a penalty of $500 to $1,500 per message, with no cap on total damages in class actions, as compliance analyses note. The settlements prove this isn't theoretical:

• Steve Madden paid $10 million over 200,000+ unsolicited promotional texts sent without proper consent.
• Pizza Hut franchisees settled for $6 million over 13,000+ unsolicited texts, with class members eligible for up to $400 each.
• Company executives face potential personal liability for TCPA violations — the corporate shield doesn't fully protect leadership.

Here's the part that catches most businesses off guard: the real challenge isn't obtaining consent — it's proving it. The FCC has clarified that the caller bears the burden of proof for demonstrating valid consent. If a consumer disputes your call, "they filled out a form somewhere" doesn't hold up in court.

That's why consent documentation matters as much as consent itself. As ActiveProspect puts it, "compliant" isn't a claim — it's a record. A defensible consent trail includes the timestamp, the URL where consent was captured, the IP or device context, and the exact disclosure language the consumer saw.

This is precisely why GrowthPros attaches a full consent record to every lead it delivers — disclosure text, timestamp, IP address, and the named contacting party — so buyers aren't left reconstructing evidence after a complaint lands. If your lead sources can't produce that documentation on demand, you're absorbing their compliance risk at your own expense.

The takeaway is simple: treat the consent trail as part of the product you're buying, not a nice-to-have. Your next class action may hinge on it.

What Valid Consent Actually Looks Like Under the TCPA

Valid consent under the TCPA isn't a checkbox — it's a documented chain of evidence. The FCC's rules at 47 C.F.R. § 64.1200(f) require prior express written consent for any telemarketing call or text made using an autodialer or artificial voice, and the burden of proving that consent rests entirely on the caller. That means every lead must carry its own consent trail: a written agreement bearing the consumer's signature, clear and conspicuous disclosure that they'll receive robocalls or robotexts, authorization for no more than one identified seller, topical association with the interaction that prompted consent, and the specific phone number authorized.

• Signature — electronic or physical, but attributable to the consumer
• Clear disclosure — the consumer knows they're authorizing automated marketing contact
• One identified seller — consent names a single business, not a list of "partners"
• Topical match — a car-loan inquiry doesn't authorize debt-consolidation texts
• Specific phone number — the exact line authorized for contact

The FCC's December 2023 one-to-one consent rule codified that last point, closing the lead-generator loophole by a 4–1 vote. Consent is not transferrable or subject to sale to another seller. Sources conflict on enforcement: the rule was set to take effect January 27, 2025, but executive orders pausing new regulations have led some compliance vendors to state it's "no longer in effect." Others note industry service providers are already requiring compliance ahead of the deadline. Regardless of the current pause, one-to-one consent remains the recommended best practice — and it's how GrowthPros structures every lead delivery.

Two more developments shape the compliance floor. In February 2024, the FCC unanimously classified AI-generated voices as "an artificial or pre-recorded voice" under the TCPA, meaning AI voice follow-up falls squarely under written-consent requirements. And DNC Registry protections now explicitly cover text messages — marketing texts cannot be sent to numbers on the registry. Opt-out requests via "STOP" must be honored within 10 business days, with one confirmation message allowed. Violations carry fines of $500–$1,500 per message with no cap on total damages in class actions — Steve Madden paid $10 million over 200,000+ unsolicited texts, and Pizza Hut franchisees settled for $6 million over 13,000+ texts.

Consent Documentation: Why 'Compliant' Is a Record, Not a Claim

The caller carries the burden of proving valid consent — not the lead generator, not the marketplace, the caller. That single fact makes consent documentation the product, not an afterthought. A compliance vendor analysis puts it bluntly: "Compliant isn't a claim, it's a record," meaning you must be able to answer who is authorized to contact the consumer, how they can be contacted, what the consumer agreed to, when and where consent happened, and how to audit the consent event.

Buying leads from marketplaces that dump consent-free contacts into shared inboxes transfers that liability directly to the buyer. The FCC's December 2023 one-to-one consent rule — adopted by a 4-1 vote — requires consent to name no more than one identified seller at a time, and consent is not transferrable or subject to sale to another seller. For a capped-shared model with a hard maximum of two buyers, each buyer needs their own consent trail tied to the specific interaction that prompted it. A Consumer Finance Monitor breakdown notes the FCC's example: a consumer giving consent on a car loan comparison site does not consent to robotexts about loan consolidation.

• Scrub every number against the DNC Registry before any outbound contact — DNC protections now explicitly apply to text messaging
• Match disclosure language to actual contact methods, including AI voice calls, which the FCC classified as "an artificial or pre-recorded voice" under the TCPA
• Honor opt-outs immediately and permanently across SMS, voice, and email — the FCC requires reasonable opt-out requests be honored within 10 business days
• Capture the full consent trail: timestamp, URL, IP/device context, and the exact disclosure shown to the consumer

GrowthPros builds this trail into every lead delivered — exclusive or capped-shared — so the record travels with the contact. Reactivation campaigns apply the same standard to opted-in databases clients already own. The difference between a lead that converts and a lawsuit that settles for $500–$1,500 per message is the documentation you can produce when asked.

How to Buy TCPA-Compliant Leads: A Practical Vetting Checklist

"Compliant" isn't a claim — it's a record. That's how one compliance expert frames it: a genuinely TCPA-compliant lead is one you can defend with evidence showing who was authorized to contact the consumer, when consent happened, and what the consumer actually agreed to (ActiveProspect). Since the caller bears the burden of proving valid consent (the FCC has made clear), your lead vendor's paperwork is your paperwork.

Before your next lead purchase or reactivation campaign, put any vendor through four questions:

• Can you produce consent records on demand? Each lead should carry a timestamp, IP/device context, and the exact disclosure text shown to the consumer (per consent documentation standards).
• Is consent seller-specific? The FCC's December 2023 one-to-one consent rule requires consent to name no more than one identified seller, and consent is not transferrable or salable (per the FCC order). Its enforcement status is contested — one source says it is "no longer in effect" after regulatory pauses, while others treat it as effective January 27, 2025 (Gryphon.ai; MakeForms). Either way, seller-specific consent is the safe standard.
• Are lists DNC-scrubbed? DNC protections now explicitly cover text messaging, so scrub before any outbound contact (per the FCC's expanded rules).
• How fast are opt-outs honored? The FCC requires reasonable opt-out requests be honored within 10 business days (Kelley Drye's 2024 review). Anything slower is a red flag.

Watch state-level tightening, too. Maryland now requires prior express written consent for automated dialing; Maine mandates reassigned-number database scrubbing; Georgia eliminates the "knowing" violation requirement and allows uncapped class-action damages; and Mississippi restricts telemarketing around Medicare products (all per Kelley Drye). Remember also that the FTC's Telemarketing Sales Rule applies alongside the TCPA — the FTC updated the TSR in March 2024 to cover B2B calls and impose recordkeeping obligations, so campaigns must satisfy both regimes (Kelley Drye notes).

This is the standard GrowthPros builds to: every lead carries a consent record — disclosure text, timestamp, IP address, and the named contacting party — lists are DNC-scrubbed before contact, opt-outs are honored immediately and permanently, and reactivation campaigns target only pre-existing, opted-in relationships, never cold lists.

If you want leads that pass this checklist without the audit anxiety, book a 15-minute qualification call. It's free, honest about fit, and commits you to nothing.