What does the TCPA require him to disclose?

The Consent Disclosure Gap: What Most Lead Sellers Miss

Most lead sellers think consent is a checkbox. The FCC disagrees — and the gap between those two views is where TCPA lawsuits are born.

Under the FCC's December 2023 order, consent must follow a "clear and conspicuous" disclosure telling the consumer they will receive robocalls or robotexts from a specifically named seller, according to Cooley's analysis of the new rules. That disclosure can't be buried in fine print or bundled into a single consent covering dozens of unknown "marketing partners" — the model most lead marketplaces have run on for years.

The one-to-one consent standard closed what regulators called the "lead generator loophole." Consent must be obtained separately for each identified seller, and it must be "logically and topically" related to the interaction where it was given — a consumer filling out a car loan comparison form has not consented to calls about loan consolidation. The FCC even suggested a check-box list as a compliant way for consumers to select each seller individually.

Why generic and bundled disclosures fail

Legal guidance on what proper consent must contain is more demanding than most sellers realize. A detailed breakdown from M&S Law Group identifies the core elements:

• The specific telephone number authorized to be called
• The named entities permitted to call that number
• The purpose and expected frequency of the calls
• Clear authorization for autodialer or prerecorded voice contact, in writing and signed

A disclosure that says "you agree to receive calls from our partners and affiliates" fails on nearly every element. The consumer hasn't been told who will call, why, or how — and courts have held that consent must be "clear and unmistakable," as the Eleventh Circuit affirmed.

The stakes are not theoretical. The FCC's largest-ever TCPA penalty — $299,997,000 against ten companies for over five billion illegal robocalls — cited both the absence of prior express written consent and failing to include the disclosures required by law. Statutory damages run $500 to $1,500 per violation, with no need for the consumer to prove actual injury.

The rule is in flux: the Eleventh Circuit vacated the one-to-one consent requirement, with its effective date postponed to January 26, 2026, per compliance tracking of the 2025 TCPA changes. But vacatur is not a green light — the underlying "clear and conspicuous" disclosure standard and the "clear and unmistakable" consent bar remain intact. This is why GrowthPros attaches a full consent record — disclosure text, timestamp, IP address, and the named contacting party — to every lead delivered, rather than promising any lead is inherently "TCPA-compliant." As one former state consumer protection chief put it, the "TCPA-compliant lead" is only a myth; the documentation trail is what actually protects buyers and sellers alike.

What Proper TCPA Consent Must Actually Include

A "yes" checkbox and a phone number field do not add up to TCPA consent. Courts and the FCC have made clear that valid prior express written consent has real substance — and when it's missing, the consequences are severe. The largest TCPA penalty in history, $299,997,000, was driven partly by companies failing to include the disclosures required by law.

According to M&S Law Group's guidance, proper consent must specify four things, all in writing and signed by the consumer:

• The specific phone number the consumer authorizes to be called
• The named entities — not a vague category — that are permitted to call
• The purpose and frequency of the calls
• Clear, explicit authorization to contact using an autodialer or prerecorded voice

The FCC's framework reinforces the second element. Its December 2023 order required a "clear and conspicuous" disclosure stating that the consumer will receive robocalls or robotexts from a designated seller, with consent obtained separately per seller — the "one-to-one consent" rule. The FCC even suggested a checkbox list so consumers could select each seller individually.

That rule was vacated by the Eleventh Circuit and postponed to January 26, 2026, but the underlying standard survives: consent must be "clear and unmistakable." And a Fifth Circuit ruling permitting oral consent applies only in Texas, Louisiana, and Mississippi — most businesses should still treat written, signed, seller-specific consent as the operational floor.

This is why the phrase "TCPA-compliant lead" deserves skepticism. As Michele Shuster of M&S Law Group puts it, the compliant lead "is only a myth" — no lead can be guaranteed compliant, and buyers and sellers face vicarious liability for each other's actions. What a lead buyer can demand instead is documentation: the disclosure text shown, the timestamp, the IP address, and the named party authorized to contact. GrowthPros attaches exactly that consent trail to every lead it delivers, because documentation — not promises — is what holds up when a call is challenged.

With statutory damages running $500 to $1,500 per violating call or text, an undocumented consent is not a lead. It is a liability with a phone number attached.

Opt-Out Rules That Take Effect April 11, 2025 (and How to Comply)

Starting April 11, 2025, businesses must honor consumer revocation requests within 10 business days and accept opt-outs through any reasonable method—including voicemail, email, or automated systems—without requiring a specific channel or format. This shift eliminates the ability to dictate how consumers withdraw consent, placing the burden on companies to recognize and act on revocations wherever they occur. Failure to comply risks statutory damages of $500 to $1,500 per violation, per class member, with willful violations reaching the higher end of that range.

Upon receiving an opt-out, businesses may send only one non-marketing clarification message within five minutes to confirm the scope of revocation—such as whether the consumer wishes to stop all communications or just marketing texts—provided it contains no promotional content. If no affirmative response is received, all future robotexts and robocalls must cease immediately. Additionally, opt-out records must be retained for at least four years to align with the TCPA’s statute of limitations, ensuring defensibility in potential disputes or audits.

For GrowthPros, these rules directly impact dead lead reactivation and AI follow-up systems, which rely on multi-channel sequences to re-engage dormant, opted-in lists. Any revocation during such campaigns must be honored across SMS, voice, and email within the 10-business-day window, and clarification messages must be strictly limited to one non-marketing touchpoint within five minutes. Maintaining detailed opt-out documentation—including timestamp, method, and scope—is not just compliant but essential for protecting both the lead seller and buyer from vicarious liability under evolving TCPA interpretations.

• Honor revocation requests within 10 business days
• Accept opt-outs via any reasonable method (voicemail, email, etc.)
• Send only one non-marketing clarification message within five minutes
• Retain opt-out records for at least four years

Why Disclosure Failures Trigger Massive TCPA Penalties (and How to Avoid Them)

A single missing disclosure can cost $1,500 — and multiply that across a call campaign, and you're looking at numbers that end businesses. The FCC's record TCPA penalty makes that abstract math painfully concrete.

The agency hit ten companies with a $299,997,000 fine — the largest in TCPA history — for more than five billion illegal robocalls, citing both the absence of prior express written consent and, critically, failing to include the disclosures required by law. The penalty was calculated at $4,500 per verified unlawful robocall, doubled for DNC Registry and Truth in Caller ID Act violations. The lesson: regulators treat missing disclosures not as paperwork errors, but as core violations.

Private litigation is just as dangerous. The TCPA imposes statutory damages of $500 to $1,500 per violation, with no requirement for plaintiffs to prove actual injury. Cooley LLP notes the TCPA "already is a major source of class action litigation," and new rules "surely will provide new ammunition for an aggressive plaintiffs' bar."

Here's the part most lead buyers miss: the "TCPA-compliant lead" is, in the words of attorney Michele Shuster, "only a myth". Courts have held lead buyers and sellers vicariously liable for each other's actions. Buying a lead with no proof of what the consumer actually agreed to puts your business on the hook for someone else's disclosure failure.

So what should a defensible consent trail include?

• The exact disclosure text the consumer saw before consenting
• A timestamp and IP address proving when and where consent was captured
• The named contacting party authorized to call, matching the seller-specific consent standard
• Opt-out records retained for at least four years, aligned with the TCPA's statute of limitations

Collecting consent isn't enough — you must be able to produce it. When a plaintiff's attorney demands proof, "the lead generator said it was fine" is not a defense. That's why GrowthPros attaches a consent record — disclosure text, timestamp, IP, and named contacting party — to every lead it delivers, and honors opt-outs immediately and permanently rather than waiting out the 10-business-day window the FCC's Opt-Out Rule permits.

Even in a shifting legal landscape — the Fifth Circuit's Bradford ruling relaxed written-consent requirements in Texas, Louisiana, and Mississippi — companies must still demonstrate "clear, direct and unequivocal consent." The safest standard everywhere remains documented, written, seller-specific consent. Build your paper trail before you need it, because after the subpoena arrives, it's too late.