The Consent Foundation: Why Prior Express Written Consent Is Non-Negotiable

Every cold call a business makes rests on a single legal foundation: consent. Get that wrong, and it doesn't matter how polished your script is or how good your offer is — you're building on sand.

Under the Telephone Consumer Protection Act, businesses must obtain prior express written consent before making marketing robocalls, sending marketing texts, or delivering fax advertisements, according to legal analysis from BCLP. The TCPA recognizes two consent tiers: express written consent, which must be voluntary, and ordinary express consent, obtainable orally or in writing, as outlined in this overview of telemarketing rules. For anything resembling a marketing call using automated technology, the written standard applies.

The stakes climbed higher for AI-powered calling in March 2024. That's when the FCC issued a declaratory ruling confirming that voice cloning technologies fall squarely within the TCPA's scope and require prior express written consent, as Reuters Legal reports. If your campaign uses a synthetic or AI-generated voice, the law treats it as an artificial voice — full stop. There is no gray zone to exploit.

The financial exposure explains why compliance teams treat this so seriously. TCPA statutory damages run $500 to $1,500 per violation, per class member, with no requirement to prove actual injury. Plaintiffs' attorneys are actively expanding the definitions of "artificial voice" and "autodialer" to capture AI-driven campaigns, and courts may treat undisclosed voice cloning as deceptive. As Marc Jacobs, a class-action defense partner, puts it: "Get it. Document it. Store it."

What solid consent documentation looks like in practice:

• Verifiable written consent records, obtained before any call is placed — implied opt-ins don't count.
• Clear disclosure when AI or synthetic voices are used on a call, with instant opt-out mechanisms that work on the first try.
• Consent records retained for at least 4 years, matching the TCPA's statute of limitations.
• Verification of where your phone numbers came from and what consent type attaches to each.

This is why list discipline matters more than dialing volume. Services like My AI Call Center review list source and consent records before any campaign launches, and decline bought lists without clear permission records — because a list that can't prove consent is a liability, not an asset. One misstep — a missing opt-out, a failure to disclose voice synthesis, a bad number — can spark a lawsuit that scales per call, per class member.

Before any campaign touches the phones, the consent foundation has to hold. Everything else in TCPA compliance is built on top of it.

The New Opt-Out Reality: Honoring Revocations 'In Any Reasonable Manner' Within 10 Days

For decades, businesses could funnel opt-out requests into a single channel — a phone menu, a reply keyword, a web form. As of April 11, 2025, that era ended. The FCC's new opt-out rule, adopted in February 2024, fundamentally reshapes how companies must handle consent revocations, and the stakes are high: TCPA statutory damages run $500 to $1,500 per violation, with no need for consumers to prove actual injury.

Under the new rule, consumers may revoke consent "in any reasonable manner". That includes text keywords like STOP, REVOKE, or UNSUBSCRIBE, automated key presses, websites, voicemail, email, telling a cashier, or calling headquarters. There is a rebuttable presumption that any method is reasonable — and the burden falls on the business to prove otherwise. Companies can no longer designate an exclusive opt-out channel.

The compliance clock is tight. Businesses must honor revocations as soon as practicable, and no later than 10 business days after receiving the request. Financial industry groups — including the ABA, America's Credit Unions, and AFSA — met with the FCC on March 7, 2025 to request a one-year delay, citing the burden of processing revocations across channels, departments, and third-party vendors. The delay did not materialize, and unlike the vacated One-to-One Consent Rule, this rule has faced no successful legal challenges.

The rule also creates an asymmetric impact depending on call type:

• Opting out of marketing messages stops only marketing — informational calls may continue.
• Opting out of informational messages stops ALL future non-emergency calls and texts.
• Businesses may send ONE clarification text (no marketing content) within 5 minutes of a revocation to determine its scope — but without an affirmative response, everything must stop.

This asymmetry matters for campaign design. A reminder call, a renewal outreach, and an upsell pitch sit in different regulatory buckets, and misclassifying a campaign can turn a routine opt-out into a full communication blackout. That is why managed calling services like My AI Call Center classify every campaign by purpose before launch and log opt-outs immediately, carrying them into DNC records across all campaigns.

Documentation deserves equal attention. The TCPA carries a four-year statute of limitations, so opt-out records should be retained at least that long. As one class-action defense partner puts it: "Get it. Document it. Store it."

DNC Compliance and AI-Specific Risks: Scrubbing, Disclosure, and Campaign Design

A number on the Do Not Call Registry isn't a one-time problem you solve — it's a recurring obligation, and the calendar matters more than most callers realize. Every 31 days, your calling lists must be scrubbed against the Registry, which now holds more than 221 million numbers, and that duty applies even when you hold valid TCPA consent for a given contact.

The Registry itself is straightforward: it stores only phone numbers, no other personal data, and the FTC frames it as a tool that helps telemarketers operate more efficiently by screening out people who don't want contact. What catches businesses off guard is the existing business relationship exemption. You may call a customer for up to 18 months after their last transaction — but that clock runs from the last purchase, not from when they became a customer. Win-back and reactivation campaigns targeting 12-to-24-month dormant contacts sit squarely in the danger zone here, since the older end of that range falls outside the exemption window.

AI calling adds a second layer of risk. The FCC's March 2024 declaratory ruling confirmed that voice cloning falls within the TCPA, requiring prior express written consent. Plaintiffs' attorneys are actively pushing the definitions of "artificial voice" and "autodialer" to capture AI-driven campaigns, and courts may treat undisclosed voice cloning as deceptive. A missing disclosure or a broken opt-out mechanism risks statutory damages of $500 to $1,500 per violation — with no need for anyone to prove actual injury.

Practical AI campaign design should therefore cover:

• Disclose the AI voice on every call, and make opt-outs work on the first try — keyword opt-outs like STOP and REVOKE must be honored within 10 business days under the FCC rule effective April 11, 2025.
• Classify campaigns as marketing or informational, because a revocation triggered by an informational call stops all future non-emergency contact, while a marketing opt-out stops only marketing.
• Verify number sources and consent types before launch, and throttle outreach rather than blasting.
• Retain consent, opt-out, and call documentation for at least 4 years — the TCPA's statute of limitations.

This is why list discipline beats volume. At My AI Call Center, campaigns launch only against approved, permissioned, or reviewed lists, with consent records checked before the first call is placed — and opt-outs logged and honored immediately rather than batched. As one class-action defense partner puts it: get the consent, document it, store it, and never rely on implied opt-ins. In the current enforcement climate, that advice isn't conservative — it's the baseline.