Recent judicial and regulatory activity has significantly shifted the Telephone Consumer Protection Act (“TCPA”) compliance landscape. Below is a summary of where things stand following two key events earlier this year—and what businesses should do about it.

Revocation of Consent Rules: Now in Effect

A set of TCPA regulations that apply to all businesses engaged in telemarketing, lead generation, or automated outreach went into effect on April 11, 2025—specifically, rules governing revocation of consent. These new requirements have immediate implications for how businesses manage consumer opt-outs. Key features of the revocation rules include:

1. No Exclusive Mechanisms: Businesses may no longer require consumers to revoke consent through a specific method (for example, replying “STOP” only). Consumers may use any reasonable means to communicate their intent to opt out.
2. Prompt Compliance: Revocations must be processed and honored within 10 business days, requiring timely updates to suppression lists and internal systems.

One-to-One Consent Rule: Out for Now

In late January 2025, the U.S. Court of Appeals for the Eleventh Circuit effectively ended the Federal Communications Commission’s (“FCC”) “one-to-one consent” rule, holding that the FCC had exceeded its statutory authority. The rule would have required businesses to obtain separate, individualized consent from consumers on online webforms for each company. The court reasoned that the rule was not a mere interpretation of the TCPA but a substantive expansion of the law, which the FCC lacked the power to impose without congressional authorization.

As a result, the one-to-one consent rule is not currently in effect.  While the FCC has signaled that it may consider proposing a revised version, it has not done so yet.

What Businesses Should Do

Although the one-to-one consent rule is off the table for now, the risk landscape under the TCPA remains active and nuanced. Businesses should ensure they understand and implement proper revocation practices, especially if they use text or voice messaging to communicate with customers. It is also advisable to audit communication policies and scripts to confirm they allow for multiple methods of revoking consent. In addition to the TCPA, it is important to keep in mind that state law also regulate these practices, and failure to comply with their requirements carries real enforcement risk, including higher penalty.