The Myth of Automatic Expiration: Why Consent Doesn't Just Disappear

The idea that TCPA consent automatically expires after a set period is one of the most persistent myths in compliance circles. Many businesses mistakenly assume they can stop worrying about consent after a year or two, only to find themselves exposed to significant legal risk. This misconception overlooks how consent actually functions under federal law.

Under the TCPA, express consent does not have a built-in expiration date. Instead, it remains valid indefinitely until the consumer takes action to revoke it. This fundamental principle means businesses cannot rely on time alone to determine when consent lapses. As highlighted by industry analysis, consent persists until revoked - there is no automatic expiration timeline under current federal law. The burden of proving valid consent always falls on the caller or texter, making ongoing consent management essential rather than optional.

The only exception to this rule applies specifically to Established Business Relationship (EBR) consent, which does have defined time limits. EBR based on a purchase or transaction expires 18 months after that transaction, while EBR based solely on an inquiry expires just 3 months after the inquiry. These are the only consent types with automatic expiration built into TCPA regulations. For all other forms of consent—particularly express written consent obtained directly from consumers—validity depends entirely on whether the consumer has revoked their permission.

Consumers can revoke consent at any time through any reasonable method, creating a dynamic compliance landscape that requires constant vigilance. Valid revocation methods include standardized text keywords like STOP or UNSUBSCRIBE, verbal requests during phone calls, email notices, written correspondence, or other clear indications of intent to stop communications. Effective April 11, 2025, businesses must honor these revocation requests within 10 business days—a significant reduction from the previous 30-day window. This accelerated timeline means delayed responses to opt-out requests could quickly result in violations carrying statutory damages of $500–$1,500 per incident.

For service businesses using platforms like CallMyCustomers to reactivate past clients, this reality transforms consent management from a one-time setup into an ongoing operational requirement. Rather than assuming consent expires on a calendar, successful reactivation campaigns depend on systems that immediately detect and process revocation requests while maintaining detailed consent records for at least four years to align with the TCPA statute of limitations. The focus shifts from counting months to monitoring active consumer preferences—a approach that not only ensures compliance but also respects the permission-based relationship at the heart of effective customer reactivation.

How Consent Actually Ends: Revocation Rules and the 10-Day Deadline

If a customer can end your permission to contact them with a single word, the real question isn't whether TCPA consent expires — it's how quickly you stop when they say so. Under federal law, consent remains valid until the consumer revokes it, and the rules around that revocation just got significantly stricter.

Effective April 11, 2025, businesses must honor revocation requests within 10 business days — a sharp reduction from the previous 30-day window. Michele Shuster, Managing Partner at the Michele Shuster Law Group and former Chief of the Ohio Attorney General's Consumer Protection Section, noted that under the new rule, consumers can revoke consent through any reasonable means, and businesses must act within that compressed timeframe. Tammy Glover Fowler, Legal & Compliance Director at Contact Center Compliance, put it plainly: "in the day and age we're in now, you can really do it in 10 business days."

What counts as a "reasonable method" is broader than many businesses assume. The FCC's updated rules, published on its own site, recognize that revocation can arrive through several channels:

• Standardized text keywords such as STOP, QUIT, CANCEL, UNSUBSCRIBE, REVOKE, OPT OUT, and END
• A verbal request made during a phone call
• Email or written notice
• Any other clear communication that expresses the consumer's intent to opt out

The scope of a single revocation matters just as much as its speed. Under the new framework, a revocation for calls automatically revokes consent for texts — and vice versa — unless the consumer specifies otherwise, creating a "revoke-all" default. The FCC's full revoke-all requirement, where one stop reply to any message type ends consent for all future communications, has been delayed to January 31, 2027, giving businesses roughly 22 additional months to prepare their systems, according to legal analysts tracking the change.

For service businesses running reactivation campaigns, the practical takeaway is that consent management is ongoing work, not a set-and-forget checkbox. A customer who replies STOP to a seasonal reminder must be suppressed across every channel within days — which is why CallMyCustomers honors opt-outs immediately and routes every reply back to the client rather than letting revocation requests slip through the cracks. The stakes are real: statutory damages run $500 to $1,500 per violation, and TCPA lawsuits can look back up to four years.

Puja Amin, Partner at Troutman Amin, LLP, warned that these revocation rules are "just massive" and not getting enough attention. Businesses that treat a STOP text as a low-priority flag are the ones most likely to learn that lesson the expensive way.

Two Regulatory Shifts That Change How You Collect and Track Consent

Two Regulatory Shifts That Change How You Collect and Track Consent

The way businesses collect and track consent is undergoing significant changes that will directly impact how service companies engage with their customers. Starting January 27, 2025, prior express written consent must be specific to each identified seller, eliminating the ability to use blanket consent for multiple parties under the new one-to-one consent rule. This shift places the burden of proof on the caller or texter to demonstrate valid consent, not on lead generators or third parties.

Simultaneously, the FCC's "revoke-all" requirement—which would allow a single opt-out to revoke consent across all communication channels—has been delayed to January 31, 2027 due to operational challenges. This delay provides businesses with additional time to prepare for a framework where one revocation applies universally unless the consumer specifies otherwise. For service businesses relying on multi-channel outreach, these shifts mean consent management can no longer be a set-and-forget process.

• Consent must now be tracked separately for each identified seller, requiring granular recordkeeping
• Revocation requests must be honored within 10 business days effective April 11, 2025
• The burden of proving valid consent falls entirely on the business initiating contact

For companies like CallMyCustomers that specialize in reactivating known customers through permission-based outreach, these changes underscore the importance of maintaining clear, auditable consent records tied to specific interactions and sellers. As regulatory expectations evolve, proactive consent management becomes not just a compliance necessity but a foundation for sustainable customer relationships.

Operationalizing Compliance: Recordkeeping, EBR Tracking, and System Readiness

Operationalizing Compliance: Recordkeeping, EBR Tracking, and System Readiness

For service businesses, translating TCPA consent requirements into daily operations means building systems that anticipate revocation and expiration before they disrupt outreach. Consent remains valid until revoked, but businesses must act fast when that happens—effective April 11, 2025, revocation requests must be honored within 10 business days, down from the previous 30-day window. This shift demands automated tracking across channels to avoid costly delays, especially when managing consent for multiple services or third-party partners.

To defend against TCPA’s four-year statute of limitations, consent records must be retained for at least 4+ years, including timestamp, consent language, proof of human interaction, and seller identification. This documentation burden falls squarely on the caller or texter, not lead generators, making centralized, auditable records essential for service businesses running reactivation campaigns. Without this foundation, even compliant outreach can become liability if a consumer later claims consent was never obtained or properly recorded.

Established Business Relationship (EBR) consent adds another layer of complexity, expiring automatically after 18 months from a purchase or transaction, or just 3 months from an inquiry. Smart systems should flag these EBR-based consents for expiration, triggering renewal outreach before the window closes. Meanwhile, the upcoming one-to-one consent rule effective January 27, 2025, requires separate documentation for each identified seller—eliminating blanket consent and increasing the need for seller-specific tracking in multi-service operations.

CallMyCustomers integrates these requirements into its done-for-you reactivation workflow by maintaining compliant lists, honoring opt-outs immediately, and routing responses back to the client’s booking process—all while preserving explicit consent at every touchpoint. Preparing now for the January 31, 2027 revoke-all deadline—where a single “stop” revokes all future communications—means investing in centralized consent management that can scale across voice, text, and email channels without fragmentation.

What This Means for Your Reactivation Campaigns: A Permission-First Checklist

Knowing the rules is one thing; running a reactivation campaign that survives them is another. The good news: a permission-first approach isn't just safer — it converts better, because you're contacting people who actually want to hear from you.

Start with provenance. Before any outreach begins, a free list review should verify where each contact's consent came from — an explicit opt-in, a past transaction, or an inquiry. This matters because EBR-based consent expires after 18 months from a purchase or just 3 months from an inquiry, according to TCPA compliance guidance on customer lists. A three-year-old invoice list isn't automatically fair game.

Next, segment by both consent type and recency. Customers who opted in explicitly can be approached differently than those whose consent rests on a lapsed business relationship. And remember that the burden of proving valid consent falls on the caller, not anyone else, as compliance analysis of the one-to-one consent rule makes clear.

Here's a practical checklist for any reactivation campaign:

• Verify consent provenance during the list review — before a single dollar is spent on outreach.
• Segment contacts by consent type (express vs. EBR) and recency, flagging anything past the 18-month EBR window.
• Approve every script, offer, and message before it goes out — no exceptions, no "we'll fix it later."
• Honor opt-outs immediately across all channels; the FCC now requires revocations to be processed within 10 business days.
• Document consent at booking and retain records for at least four years, matching the TCPA statute of limitations.

The documentation step deserves emphasis. TCPA lawsuits can reach back up to four years, so timestamp, consent language, and seller identification should live somewhere you can actually find them. A booking flow that collects explicit consent creates a fresh, defensible record every time a reactivated customer schedules work.

This is where CallMyCustomers' model aligns naturally with the rules: outreach runs only from lists of real customers, the owner signs off on every message, and replies route into the client's own booking process. Compliance isn't a bolt-on — it's the operating system.

Treat permission as a competitive advantage. With statutory damages of $500 to $1,500 per violation cited in legal analysis of the revocation rules, the businesses that win at reactivation will be the ones customers trust enough to keep saying yes.