Why 'We Have Their Consent' Isn't Enough Anymore

Why 'We Have Their Consent' Isn't Enough Anymore

TCPA damages run $500–$1,500 per call with no cap, and filings have surged 95% year over year, leaving businesses exposed to costly litigation. Recent settlements like Gen Digital’s $9.95M and QuoteWizard’s $19M highlight the financial risk of relying on vague or outdated consent records. Even when businesses believe they have permission, general or blanket consent — such as a single checkbox covering "marketing partners" — fails to meet current legal standards for calls using AI or prerecorded voices.

Express written approval, defined under the TCPA as prior express written consent (PEWC), requires an affirmative, written agreement that clearly authorizes one specific seller to deliver telemarketing messages using automatic dialing systems or artificial/prerecorded voices. This means the consent must name the exact business making the call, disclose the authorized phone number, state that consent is not a condition of purchase, and include a verifiable signature — whether ink or electronic. General consent, by contrast, often authorizes multiple sellers or describes a vague partnership list, which courts and regulators now scrutinize closely.

The FCC’s one-to-one consent rule, though vacated by the Eleventh Circuit in January 2025, reinforced that consent must be specific to one identified seller, and judicial decisions continue to evaluate whether disclosure text actually named the seller or merely referenced a partner list. As a result, express written approval remains the cleanest, most defensible standard for telemarketing, especially when AI-generated voices are involved, which the FCC confirms fall under TCPA’s "artificial or prerecorded voice" definition.

• Express written approval requires specificity to one seller, not blanket authorization for multiple parties
• It must include an affirmative signature, clear phone number disclosure, and statement that consent is not a condition of purchase
• General consent for 'marketing partners' lists no longer satisfies TCPA requirements for autodialed or AI voice calls

For businesses using managed outbound calling services like My AI Call Center, this distinction is critical. Campaigns can only launch when list sources and consent records are verified to meet express written approval standards — ensuring every call is legally grounded and reducing exposure to costly TCPA violations. Without this precision, even well-intentioned outreach becomes a compliance liability.

Express Written Approval vs. General Consent: The Real Difference

Two checkboxes on a web form can look identical and mean completely different things under the TCPA. The difference between "general consent" and "express written approval" is where most consent records either hold up in court or fall apart.

The FCC defines prior express written consent (PEWC) as "an agreement, in writing, that bears the signature of the person called that clearly and conspicuously authorizes no more than one identified seller" to deliver telemarketing messages using an autodialer or an artificial or prerecorded voice, according to the agency's rule language and official FAQ. In practice, that means the record must do three things:

• Name one identified seller — not a "marketing partners" list
• Identify the specific phone number authorized to receive the calls
• State clearly that consent is not a condition of purchase

Prior express consent (PEC) is a much lighter standard. It applies to informational and transactional calls — appointment confirmations, payment reminders, account updates — and generally, a person voluntarily providing their number in a transactional context is enough, per compliance guidance. No signed writing is required. That's why a dual opt-in approach, with separate unchecked boxes for transactional follow-up and marketing, creates the cleanest records.

The one-to-one consent rule added a plot twist. Adopted by the FCC in December 2023, it was vacated by the Eleventh Circuit in January 2025 before ever taking practical effect, on the grounds that the FCC overstepped its authority. But the vacatur didn't erase the baseline: express written consent requirements for telemarketing with autodialers or prerecorded voices "have always applied." Courts and the FTC still evaluate consent scope by reading the actual disclosure text presented to consumers — whether it named a specific seller or a partner list.

The stakes are real. TCPA statutory damages run $500 to $1,500 per call with no aggregate cap, and industry trackers report TCPA filings up 95% year over year, according to recent analysis. Even a 2026 Fifth Circuit ruling questioning whether consent must be in writing hasn't changed the advice: legal commentators warn brands not to change opt-in practices based on a single appellate decision, and clear documentation remains one of the strongest defenses in TCPA litigation.

That's why My AI Call Center checks list source and consent records before any campaign launches, and why written, seller-specific consent remains the safest baseline regardless of which way the courts swing next.

What a Defensible Consent Record Actually Contains

A consent record is only as strong as what it can prove years after the fact — and TCPA plaintiffs have up to four years to challenge it. That's why the five fields below matter more than the checkbox itself.

The five fields of a defensible record

• Source: exactly where the consent came from — a web form, a signed agreement, a recorded call — not just "the lead came in."
• Timestamp: when consent was captured, stored in a way that can't be edited after the fact.
• Scope: what the consumer actually agreed to — informational calls only, or ongoing marketing including AI voice.
• Language version: which version of the disclosure the consumer saw, since courts evaluate the disclosure text actually presented.
• Seller identity: the specific business authorized to call — the cleanest scope fact a record can carry.

That last field carries extra weight. Even after the Eleventh Circuit vacated the FCC's one-to-one consent rule in January 2025, courts and the FTC continue to evaluate whether a disclosure named the seller specifically or merely described a "partner list." A single checkbox covering a marketing-partners list is the kind of blanket consent that invites a lawsuit.

Why documentation wins in litigation

Statutory damages run $500 to $1,500 per call with no aggregate cap, and aggregate TCPA class-action verdicts exceed $925 million. With filings up 95% year over year, the question isn't whether someone will ask how you got a number — it's whether you can answer. Defense counsel recommend retaining consent records for seven years, well beyond the four-year statute of limitations.

The Fifth Circuit's February 2026 ruling in Bradford v. Sovereign Pest Control held that the TCPA requires prior express consent but doesn't explicitly mandate writing. That sounds like relief, but it only binds Texas, Louisiana, and Mississippi — it does not change nationwide practice. Experts advise that written consent remains the safest approach and that clear records showing how and when consent was obtained remain one of the most important defenses in TCPA litigation.

Follow the strictest applicable standard

State law can be stricter than federal rules. Florida still requires AI-specific written consent regardless of federal interpretation — so a Texas company calling a Florida resident must meet Florida's standard. Multi-state callers should simply build to the strictest rule that applies.

This is the standard we apply at My AI Call Center. Before any campaign launches, we review list source and consent records, and bought lists without clear permission records are flagged — in most cases, declined. If the list won't support the campaign, we tell you plainly before you spend anything.

How to Verify Express Written Approval Before Any Campaign Launches

Before a single call leaves the platform, the list behind it must prove it can support the campaign. My AI Call Center starts every engagement with a list and consent review — bought lists without clear permission records are flagged or declined before the client spends anything. The FCC defines prior express written consent as a written agreement bearing the signature of the person called that "clearly and conspicuously authorizes no more than one identified seller" to deliver telemarketing messages using an autodialer or artificial voice (FCC rule summary). Statutory damages range from $500 to $1,500 per call with no aggregate cap, and aggregate class-action verdicts across the docket exceed $925 million (TCPA playbook).

A practical verification workflow begins with auditing list sources and consent records before dialing. For inbound leads, use dual opt-in checkboxes — one for transactional follow-up (covered by prior express consent) and a separate, unchecked box for ongoing marketing that includes AI voice outreach (requiring prior express written consent). Consent disclosures should increasingly reference AI-generated voice use, since the FCC confirmed that TCPA restrictions on artificial or prerecorded voice apply to current AI technologies that generate human voices (FCC declaratory ruling). State laws can impose stricter standards; Florida, for example, still requires AI-specific written consent regardless of federal interpretation (TCPA playbook).

• Audit list source, consent records, and calling windows before any campaign launches
• Deploy dual opt-in checkboxes (transactional vs. marketing, both unchecked by default) for inbound leads
• Include AI voice references in consent disclosures and call scripts
• Decline lists that lack clear, seller-specific permission records

Courts continue to evaluate consent scope based on the disclosure text actually presented to consumers — whether it named the seller specifically or described a partner list (Eleventh Circuit vacatur analysis). Written consent remains the safest approach across jurisdictions, and clear records showing how and when consent was obtained remain one of the most important defenses in TCPA litigation (Fifth Circuit decision analysis).

Running AI Calls on Approved, Permissioned Lists — What Good Looks Like

Consent discipline is what separates a campaign that scales from one that generates $500-per-call statutory damages. The working model is simple to state and demanding to run: treat every AI-generated voice as an artificial voice, get prior express consent, disclose the AI on every call, and honor opt-outs the moment they happen.

The FCC has confirmed that TCPA restrictions on artificial and prerecorded voices apply to AI technologies that generate human-sounding speech. That means an AI calling campaign is not a gray area — it sits squarely inside rules that carry $500 to $1,500 in statutory damages per call with no aggregate cap. With TCPA filings up 95% year over year, the record you keep matters as much as the calls you make. Documentation is one of the most important defenses in TCPA litigation, which is why every campaign should log source, timestamp, scope, language version, and seller identity for each consent record.

A managed campaign structure keeps that discipline intact across every campaign type — appointment reminders, renewal calls run 30 to 60 days before the renewal date, win-back outreach to 12-to-24-month dormants. The structure looks the same whether the goal is confirming, qualifying, or retaining:

• One clear goal per campaign, scoped and quoted before anything launches.
• Approved calling windows, with state-specific quiet hours and day restrictions honored.
• Disposition codes on every contact — confirmed, qualified, renewed, opted out, no answer.
• Opt-out and DNC logs that carry across all campaigns and into client DNC records.

Keyword opt-outs like STOP and REVOKE are honored immediately, and AI disclosure happens on every call — recipients can ask whether the call is AI-assisted, request a human, or opt out on the spot. My AI Call Center applies this model to approved, permissioned, or reviewed lists only; list source and consent records are checked before launch, and lists without clear permission records are flagged or declined.

One more caution: requirements vary by location, industry, contact type, consent status, and technology. State laws can be stricter than federal standards — Florida, for example, still requires AI-specific written consent regardless of federal interpretation. Clients are responsible for obtaining appropriate legal guidance before launch, because the strictest applicable standard is the one that governs the call.