TCPA and State Consent Laws: What Just Changed

The federal picture, in two sentences

The FCC’s TCPA “revoke-all” provision, the one that would force a caller to treat a revocation of consent on one topic as applying to every future call and text on every unrelated matter, has been pushed back again. The agency’s January 6, 2026 Second Extension Order moved the effective date to January 31, 2027, and the October 29, 2025 Further Notice of Proposed Rulemaking signals the rule will not take effect in its current form. The FCC’s one-to-one consent rule, which would have required separate consent for each individual seller, was vacated by the Eleventh Circuit in January 2025 in Insurance Marketing Coalition v. FCC and never took effect at all.

What is still in force at the federal level: every other TCPA rule, including prior express written consent for marketing autodialed calls and texts, the existing reasonable-method revocation requirement, the National Do Not Call Registry, and the 10-business-day window to honor revocations. None of that changed. The federal vacuum is on the rule expansions, not the existing baseline.

The five state laws actually driving lawsuits

While the federal layer reshuffles, five states have built their own consent regimes with stricter rules and active plaintiff bars. A single South Florida law firm filed more than 100 FTSA suits in March 2025, almost all of them over text messages sent outside permitted hours. This is the binding regime for any operator that calls, texts, or buys leads into these states:

A calling or texting practice that is perfectly compliant with the federal TCPA can still violate one or more of these state laws. Lead generators, lead buyers, debt collectors, mortgage lenders, insurance agencies, and solar aggregators are the most frequently named defendants. Insurance leads alone account for roughly 28 percent of TCPA cases, debt collection 22 percent, and legal services 18 percent.

The federal layer keeps moving. The state layer keeps litigating. The thing courts ask for has not changed in either layer.

The proof a defense actually needs

Every consent regime, federal or state, eventually asks the same question. Did this consumer see this disclosure, click this button, on this page, on this date, on this device? Most operators answer with a database row that says “opted in.” That is not the question being asked. The question is which version of the disclosure was on the page the consumer actually saw, and whether the click was affirmative and contemporaneous.

For a deeper read on what counts as proof of consent on a lead form after the Eleventh Circuit ruling, or on the specific risks of buying leads in 2026, the underlying point is the same: the operator who can produce the rendered page wins. The operator who can produce only a CRM flag and a generic completion record usually settles. The Consent API approach for pre-screening leads covers the buy-side; this article is about the capture side, which is the part most often missing.

This is where Evidora quietly sits in the background. One line of code on a lead form, a checkout, an enrollment page, or any consent surface. The page as rendered to the specific consumer, the click, the device, the IP, the timestamp. Retained for as long as the relevant statute requires, expired automatically when it does not. No interruption to the consumer’s flow, no UX change, no disclosure burden beyond what the operator already needs to make. When a complaint arrives, the file is already there. That is the entire pitch.

Frequently asked questions

Is the FCC’s TCPA one-to-one consent rule still in effect?

No. The Eleventh Circuit vacated the FCC’s one-to-one consent rule in January 2025 in Insurance Marketing Coalition v. FCC. The rule never took effect. Existing TCPA prior express written consent rules continue to apply.

When does the FCC’s TCPA revoke-all rule take effect?

The provision requiring callers to treat a revocation of consent for one type of message as applying to all future calls and texts on unrelated matters has been delayed to January 31, 2027 by the FCC’s January 6, 2026 Second Extension Order. Other parts of the revocation rule are already in force.

Which states have their own TCPA-style consent laws?

Florida (FTSA), Oklahoma (OTSA), Washington (Commercial Electronic Message Act), Maryland (Stop the Spam Calls Act), and Texas (SB 140, effective September 1, 2025) all impose stricter consent requirements than federal TCPA. Each has its own per-violation penalty and private right of action.

What proof do you need to defend a TCPA or state mini-TCPA claim?

You need the rendered consent surface the consumer saw, the affirmative click, a tamper-evident timestamp, the device and IP signal, and the specific version of the disclosures in force on the date of the opt-in. Most operators capture a database flag, which is not the same as captured proof.

Does Evidora change my form or the consumer’s experience?

No. Evidora runs in the background with one line of code. It does not change the form, add disclosures, slow the page, or interrupt the consumer’s flow. Capture happens passively at the moment of opt-in. The evidence record is produced only when you need it.