In December 2023 the Federal Communications Commission adopted what the industry quickly called the "one-to-one consent" rule. It would have required that prior express written consent under the Telephone Consumer Protection Act cover a single named seller per consent, and that the calls be logically and topically related to the website where consent was collected. The rule was due to take effect in January 2025, but it never did. The FCC postponed it, and in January 2025 the Eleventh Circuit, in a challenge brought by insurance marketers, held that the FCC had gone beyond what the statute allowed and struck the one-to-one provisions down.
Some lead buyers took that as a sign that consent practices could relax. That is the wrong lesson. The underlying TCPA requirements did not change, courts still examine consent records closely, and the questions the rule raised about who a consumer actually agreed to hear from are the same questions plaintiffs' lawyers ask. This article sets out what the current baseline is and the specific questions a buyer should put to any publisher about consent.
What the TCPA still requires
For marketing calls or texts to a mobile number made using an automatic telephone dialing system, or an artificial or prerecorded voice, the TCPA and the FCC's rules require the consumer's prior express written consent. Under the FCC's definition, that is a written agreement, which can be signed electronically under the E-SIGN Act, that clearly authorises the seller to deliver such calls to the number provided. The agreement must make clear that the consumer is not required to sign it, or agree to enter into it, as a condition of buying any property, goods or services.
Two parts of that definition carry most of the weight in disputes. The first is "the seller": the consent must authorise the company actually making or benefiting from the call. A disclosure that refers vaguely to "partners" or "marketing companies", or links to a long list the consumer never sees, invites the argument that the consumer never agreed to hear from that particular buyer. The second is "clearly": the disclosure has to be visible, readable and close to the button the consumer presses, not buried in a footer or a separate page.
Why seller-specific consent still makes sense
Even without the one-to-one rule, naming the seller or a short list of sellers has practical benefits. It is easier to defend because it matches the statutory language. It is easier for consumers to understand, which tends to mean fewer complaints and fewer surprised, hostile conversations. Many carriers, lenders and networks now require it in their contracts regardless of what federal regulation says. And several state telemarketing laws impose their own consent, calling-hour and frequency requirements that a careful programme has to meet anyway.
Seller-specific consent does change the economics of shared leads. If a record can only be sold to the companies the consumer agreed to hear from, the number of possible buyers is limited by the disclosure. That is a feature, not a bug: it forces a decision about how many companies should be contacting each consumer.
Revocation has changed
A separate FCC order on revocation of consent, adopted in 2024, took effect in large part in April 2025. It confirms that consumers can revoke consent by any reasonable means, including replies such as "stop", "quit" or "unsubscribe" to a text, and it sets a deadline for honouring revocation requests. For lead buyers this means opt-outs captured by the publisher, or by any party in the chain, need to flow quickly to everyone who might contact the consumer. A consent record is only as good as the process that retires it.
Questions to ask any publisher
- Can we see the live page? Ask for the actual landing page URLs and screenshots on mobile, where most consent is given. Check where the disclosure sits relative to the submit button and whether it can be read without zooming.
- Whose names are in the disclosure? Your company name, or the brand you sell under, should appear. If the disclosure names a list, ask how long it is and how it is displayed.
- What exactly is stored per record? At minimum: the submission time, the visitor's IP and browser details, the page address, the exact disclosure text or version shown, and the phone number consented. Ask whether an independent third-party consent certificate is captured, and how long it is retained.
- Is the disclosure versioned? When wording changes, older records should still point to the wording that the consumer actually saw.
- Where does the traffic come from? Consent collected on a publisher's own funnel is easier to verify than consent passed through several sub-affiliates. Ask whether any traffic is incentivised, co-registration or sourced from third parties.
- How are opt-outs handled? Ask how revocations reach you and how quickly, and how you should send revocations back.
- What happens if a consent record is challenged? Agree in writing how records will be produced for a dispute, and how fast.
- Are texts covered? If you plan to text consumers, make sure the disclosure says so and covers the type of messages you will send.
Red flags
- A disclosure in small, low-contrast text below the fold, or behind a link.
- Consent that names a long "marketing partners" list the consumer cannot realistically read.
- A pre-ticked checkbox, or language implying consent is required to get a quote.
- Landing pages that imply government affiliation or offer unrelated incentives in exchange for submissions.
- No ability to produce consent evidence for an individual record on request.
- Reluctance to name traffic sources, or reliance on layers of sub-affiliates.
Where consent fits in your own process
Publisher evidence is only half of a defensible programme. Buyers still need to scrub against the National Do Not Call Registry and their own internal lists where required, observe federal and state calling hours, honour revocations, and keep their own records of calls and texts. Store the consent reference with the lead in your CRM so anyone reviewing a complaint can find it quickly, and review a sample of records against the live pages every so often to confirm nothing has drifted.
How Growth Box handles consent
Growth Box names the seller or sellers in every consent disclosure, places it beside the submit button, versions every disclosure and stores the full evidence set with each record. We capture independent certificates where buyers require them and share funnel screenshots before launch so your compliance team can review them. If you would like to see our consent flow for a particular vertical, get in touch.
This article is general information, not legal advice. TCPA law and FCC rules change frequently, and state laws add further requirements; confirm your obligations with qualified counsel.
