Defenses / Consent

Consent as a TCPA defense: what counts, what does not, and how it is proven

Updated 2026-11-036 minute read

Consent is the defense most businesses think they have and fewest can prove. It is an affirmative defense, which means the caller has to prove it, number by number. A vendor’s assurance that the list was opted in is not proof. A general statement that customers agreed to hear from you is not proof. A record is proof, and this page is about what that record has to contain.

Two levels of consent

The federal rules at 47 C.F.R. § 64.1200 use two standards. Prior express consent is the lower one. It covers informational, non-marketing calls and texts to a cell phone made with an autodialer or a prerecorded voice: appointment reminders, delivery notices, account alerts. Giving your number to a business in connection with a transaction is usually enough for calls about that transaction.

Prior express written consent is the higher one, and it is the one that matters for a demand letter, because demand letters are almost always about marketing. Any call or text that advertises or sells, made to a cell phone with an autodialer or an artificial or prerecorded voice, needs it. So does a prerecorded marketing call to a landline. It has four elements and its own page: prior express written consent.

What the consent has to match

Consent is specific. It has to match four things, and a mismatch on any one of them is the same as no consent.

• The caller. The consumer agreed to hear from your business. Consent given to a different brand, to a lead site, or to an unnamed list of "partners" is the usual failure point. Whether a disclosure that did not name you can still reasonably cover you is a question courts decide on the words the consumer saw. The FCC's one-to-one consent rule, which would have required each seller to be named, was vacated by the Eleventh Circuit in January 2025 before it took effect, so the older standard applies and the question remains one of fact.
• The number. Consent attaches to the person, not the digits. If the number was later reassigned, the new holder never consented. See reassigned numbers.
• The method. Consent to be called is not consent to be called by an autodialer or a recording unless the disclosure said so.
• The purpose. Consent to service messages is not consent to marketing.

Revocation ends it

Consent that was good on day one is gone the moment the consumer revokes it. The FCC's rules allow revocation by any reasonable means: a STOP reply, an email, a request during a call, a message through any channel you use to reach them. The rules require the revocation to be honored within ten business days. A call made after a revocation is a call without consent, whatever the original record says. Your opt-out log is therefore part of the consent defense, not a separate compliance item.

What proof looks like

A consent record that will survive a dispute has the number, the date and time, the source (which form, which page, which call), the disclosure text as the consumer saw it, and the act of agreement: the checkbox state, the button press, the recorded "yes", the signature. For web forms, the session data (IP address, user agent, page URL) ties the record to a real event. For purchased leads, you need the same record from the originating site, plus the chain showing how the lead reached you.

Where consent defenses fail

• The disclosure said "you agree to receive calls" and never mentioned automated dialing or recorded messages.
• The consent was captured for a different brand or an affiliate.
• The consent was obtained after the first call, not before.
• The record exists for the campaign but not for the number.
• The number was reassigned between consent and call.
• The consumer said stop and the dialer kept going.

Each of these shows up in discovery because the plaintiff asks for the consent record and gets either a document or an explanation. Only the document works.