The Consent Challenge: Why 'I Agree' Isn't Enough Anymore

For a service business texting a past customer about a seasonal tune-up, "they gave me their number years ago" no longer counts as consent — and the courts are making that distinction expensive to get wrong.

The core problem is that consent rules now depend on where you operate. The Fifth Circuit ruled in Bradford v. Sovereign Pest Control of TX that the TCPA does not require prior express written consent for automated telemarketing calls, holding that "express consent" may be given orally or in writing. Meanwhile, the Eleventh Circuit has invalidated the FCC's prior express written consent rule for certain telemarketing calls in its own jurisdiction. The result is a fragmented legal landscape where federal appellate courts interpret the same statute differently — a serious complication for businesses calling customers across state lines.

Even where oral consent is permitted, the bar remains high. Companies must still demonstrate that the called party provided clear, direct, and unequivocal consent, and oral consent "should be carefully documented and independently verifiable to withstand future scrutiny." That documentation burden matters because TCPA violations carry penalties of $500–$1,500 per violation with no cap on total liability — and the largest damages award ever reached $925 million (Drips). DSW alone paid $4.42 million in March 2025 for unwanted marketing texts (MoEngage).

Opt-out rules add another layer. Since April 11, 2025, consumers can revoke consent "in any reasonable manner" — not just by texting STOP. A reply like "no more texts!" or even "I'm not Mary" must be treated as a valid opt-out, and the business bears the burden of proving why a request wasn't reasonable.

For businesses running reactivation outreach, the practical requirements now include:

• Honoring opt-out requests within 10 business days, with a one-time clarification text sent within 5 minutes and containing zero promotional content
• Documenting consent through recognized formats — keyword responses, form submissions, or checkboxes that are never pre-checked
• Retaining consent and opt-out records for at least four years to match the TCPA's statute of limitations

This is why reactivation specialists like CallMyCustomers work only from lists of real customers, treat every opt-out as immediate and final, and route every message through owner approval before it goes out. When one misread text can cost four figures, permission isn't a legal footnote — it's the campaign strategy.

What Valid Consent Actually Looks Like: Formats That Hold Up

Consent that can't be proven is, legally speaking, consent that doesn't exist. Under the TCPA, businesses must obtain prior express written consent before sending marketing texts or making marketing robocalls — and once obtained, it must be documented in a format that holds up under scrutiny.

Three opt-in formats are legally recognized: keyword responses, form submissions, and checkboxes. Each works only when the language and record-keeping behind it are airtight.

Keyword responses — such as a customer replying "SUMMER25" to a campaign offer — create a timestamped, verifiable record. The confirmation message that follows must include your business name, the purpose of the messages, expected frequency, data rates, terms, and opt-out instructions, per TCPA guidance on consent documentation.

Form submissions — a customer typing their number into a web form — work when the form discloses exactly who is texting and why. Consumers must provide "clearly and conspicuously" written consent for communications from each individual marketer or seller, so vague language like "I agree to receive communications from partners" invites litigation.

Checkboxes remain valid, but only when left unchecked by default. Pre-checked boxes are explicitly rejected as valid consent formats under TCPA rules.

Whatever format you use, the documentation itself must meet these standards:

• Disclose business name, message purpose, frequency, data rates, terms, and opt-out instructions
• Retain records for at least four years, matching the TCPA's statute of limitations
• Capture consent that is clear, direct, and unequivocal — the standard courts apply even where oral consent is now permitted

That last point matters more than ever. The Fifth Circuit's recent ruling in Bradford v. Sovereign Pest Control held that express consent may be given orally or in writing — but oral consent "should be carefully documented and independently verifiable to withstand future scrutiny." Meanwhile, the Eleventh Circuit has invalidated the FCC's written-consent rule in its jurisdiction, leaving businesses to navigate a fragmented legal landscape.

The stakes justify the paperwork. TCPA violations carry penalties of $500 to $1,500 per violation, with no cap on total liability — and the largest damages award ever reached $925 million. DSW paid $4.42 million in March 2025 alone for unwanted marketing texts.

This is why permission-first outreach matters. At CallMyCustomers, every reactivation campaign works from lists of real customers whose consent and opt-outs are documented and honored immediately — because a documented "yes" is the only kind that protects your business.

Honoring Opt-Outs in the Real World: Beyond 'STOP' Keywords

Honoring Opt-Outs in the Real World: Beyond 'STOP' Keywords

Starting April 11, 2025, businesses must accept opt-out requests in "any reasonable manner," moving far beyond traditional keywords like STOP or QUIT. This means phrases such as "no more texts!" or "I'm not Mary" now carry the same legal weight as formal opt-outs and must be honored immediately. The FCC’s updated TCPA rules require businesses to process these revocations within 10 business days, a significant reduction from the previous 30-day window. For service businesses relying on repeat customer engagement, this shift demands smarter, more adaptive communication systems that recognize real-world language.

To support compliance, businesses must send a one-time clarification message within 5 minutes of receiving an opt-out request. This message cannot contain any promotional content and is intended solely to confirm or clarify the scope of the revocation—such as whether the consumer wishes to stop all communication or just specific campaigns. Industry experts note that the burden now falls on businesses to justify why an opt-out request was not reasonable, making accurate interpretation critical. Failure to comply risks penalties of $500 to $1,500 per violation, with potential costs escalating quickly across large customer lists.

• Accept variations like "wrong number," "stop messaging me," or "don't text again" as valid opt-outs
• Route opt-out language recognition through AI or keyword-flexible systems
• Document all opt-out requests and responses for at least four years
• Train staff to identify indirect revocation attempts in customer replies
• Send the required 5-minute clarification message without any marketing content

For companies like CallMyCustomers, which manages outreach on behalf of US service businesses, this means building opt-out handling into every campaign from the start. By approving scripts and messages in advance, clients retain control while ensuring compliance is baked into the process. Honoring opt-outs isn’t just about avoiding fines—it’s about respecting customer preferences and maintaining the trust that drives repeat revenue. When businesses respond promptly and correctly to opt-outs in any form, they reinforce a permission-based approach that aligns with both regulatory expectations and long-term relationship building.

Building a Consent Workflow That Fits Your Reactivation Campaigns

Consent isn't a document you file away — it's a workflow that has to live inside every campaign you run. With TCPA violations carrying penalties of $500 to $1,500 per violation and no cap on total liability, the way you capture, honor, and retain consent matters as much as the offer itself.

The good news: if you're reactivating existing customers from your own CRM or point-of-sale list, you already hold the relationship. The workflow below shows how to turn that relationship into documented, defensible consent — without buying new software.

Document consent during list review and setup

Consent documentation starts before the first message goes out. During a free list review, segment your customers by recency and relationship — recent jobs, old quotes, expiring memberships — and confirm where each record's consent came from. A TCPA compliance overview identifies three accepted opt-in formats: keyword responses, form submissions, and checkboxes (which must never be pre-checked). After consent is obtained, "it must be documented."

Even where courts have relaxed the written requirement — the Fifth Circuit's 2026 Bradford ruling allows oral consent — that consent must still be "clear, direct and unequivocal" and carefully documented to withstand scrutiny. Your list review is where that verification happens.

Build opt-out handling into response routing

Since April 11, 2025, consumers can revoke consent in any reasonable manner — senders can't designate an exclusive opt-out method. Phrases like "no more texts!" or "I'm not Mary" count. Your workflow should:

• Recognize real-world opt-out language, not just "STOP" keywords, across every reply channel
• Send a one-time confirmation text within five minutes of the request — with zero promotional content
• Honor the revocation within 10 business days, across all channels
• Route every other reply straight into your booking process

This is where a done-for-you model earns its keep: because replies route through real humans applying real judgment, an ambiguous "please stop calling me" gets treated as an opt-out, not a missed signal.

Retain records for four years

The TCPA's statute of limitations runs four years, so documentation must be retained for at least that long — consent records, opt-out requests, and confirmation messages alike. CallMyCustomers builds this retention into campaign management, so the paper trail exists whether the list came from a spreadsheet or a full CRM.

The result is a consent workflow that fits the campaigns you already run — win-backs, renewal reminders, old-quote follow-ups — without adding tools, complexity, or risk.