The Consent Gap Most Service Businesses Overlook

Many service businesses assume that an existing customer relationship grants them free rein to send marketing messages. This misconception creates significant legal exposure under the TCPA, where prior express written consent is required for promotional outreach—even to past clients. Informational communications like appointment reminders or service notifications may be exempt, but marketing campaigns demand strict compliance with the four-element consent standard.

The financial risks of non-compliance are substantial. Each TCPA violation carries statutory damages of $500 to $1,500 per class member, and Texas SB 140 allows direct consumer lawsuits with penalties up to $1,500 per violation for texts classified as telephone solicitations. Virginia SB 1339 further complicates compliance by requiring businesses to honor opt-out requests for at least 10 years, with fines ranging from $500 to $5,000 per violation for failure to do so. These layered federal and state requirements mean that a single misstep can trigger cascading liabilities across multiple jurisdictions.

The surge in litigation underscores the urgency of proper consent management. TCPA class action filings reached 224 in September 2025 alone—a 283% increase over the prior period—highlighting how aggressively plaintiffs are pursuing violations. For service businesses relying on customer reactivation, this regulatory environment makes consent documentation not just a legal formality but a critical revenue protection strategy. CallMyCustomers helps clients navigate this complexity by distinguishing between exempt informational messages and marketing campaigns requiring verifiable prior express written consent, ensuring outreach remains both effective and compliant.

• Maintain written agreements bearing consumer signatures for all marketing messages
• Ensure calls/texts are logically and topically associated with the interaction that prompted consent
• Document and verify consent for at least four years to cover the TCPA statute of limitations
• Honor opt-out requests within ten business days using all endorsed keywords (STOP, QUIT, END, etc.)
• Implement state-specific protocols for Virginia (10-year opt-out honor) and Texas (texts as telephone solicitations)

What Valid Express Consent Actually Requires Under Current Law

"Prior express written consent" sounds simple — until you realize the FCC defines it with four specific elements, and a single missing piece can invalidate every message you've sent. Under the amended definition effective January 27, 2025, the FCC's amended TCPA regulations spell out exactly what a valid consent must contain, and the burden of proving it falls squarely on the caller or texter.

The four mandatory elements are:

• A written agreement bearing the consumer's signature — an actual signed authorization, not an implied or assumed one.
• Authorization for no more than one identified seller — the consumer must know exactly whose messages they're agreeing to receive.
• Content that is logically and topically associated with the interaction that prompted the consent — a lead form about HVAC service can't justify a message about a unrelated product.
• Identification of the specific telephone number the consumer authorizes messages to be delivered to.

As Nelson Mullins explains, consent must also be obtained through a clear and conspicuous disclosure — meaning the consumer can't be tricked or buried in fine print. The distinction matters: BCLP Law notes that prior express written consent is required for marketing communications, but informational messages like appointment reminders fall outside this standard.

Here's where it gets complicated. The FCC's one-to-one consent rule — the requirement that consent be specific to a single seller — was vacated by the 11th Circuit in September 2025, creating genuine regulatory uncertainty about whether that element currently binds. But don't treat the vacatur as a green light for loose consent practices.

Carriers now enforce strict consent standards through the 10DLC framework regardless of what courts decide. Carrier requirements under 10DLC demand explicit, documented, and verifiable consent, and carriers block unregistered traffic entirely while applying surcharges of $0.006–$0.017 per message segment to non-compliant senders. T-Mobile fines reach up to $10,000 per content violation.

The practical takeaway: the vacated rule didn't lower the bar, because the bar moved to the carriers. TCPA class actions surged to 224 filings in September 2025 alone — a 283% increase — so treating every consent as if the one-to-one standard applies remains the safest operating posture. For a service like CallMyCustomers, whose reactivation outreach runs on lists of real customers with documented consent, that conservative approach is simply how compliant campaigns are built.

Building a Dual-Track Consent System for Your Campaign Mix

Not every message your business sends carries the same legal weight — and treating them all the same way either wastes consent opportunities or exposes you to unnecessary risk. The TCPA draws a bright line between informational and marketing communications, and that line should shape how you structure consent across your entire campaign mix.

Under the TCPA, prior express written consent is not required for informational communications — only marketing and promotional messages trigger that standard, according to legal analysis from BCLP. That distinction matters enormously for service businesses running multiple outreach types simultaneously.

The informational track. Campaigns tied to an existing transaction — appointment reminders, seasonal service notifications, missed-appointment recovery, post-service follow-ups, and treatment plan follow-ups for clinics — generally operate as informational communications. These keep you connected to active customers without requiring the full four-element written consent standard. CallMyCustomers structures its 16 campaign types around exactly this logic, so a renewal reminder before a membership lapses reads differently, legally, than a discount offer.

The marketing track. Win-back offers, referral requests, birthday promotions, price-match campaigns, and survey-to-offer sequences are promotional by nature. These require consent meeting the FCC's amended definition: a written agreement bearing the consumer's signature, clear authorization, and identification of the telephone number for delivery, as described by Americas Credit Unions. Content must also be logically and topically associated with the interaction that prompted consent, per Nelson Mullins.

Acceptable consent capture methods for the marketing track include:

• Website form opt-ins with clear, conspicuous disclosure language
• SMS keyword opt-ins (e.g., texting a keyword to a short code)
• Verbal consent, provided it is documented and verifiable after the fact
• Point-of-sale signups captured during checkout
• Terms of service pages that clearly disclose marketing communications

Whatever method you use, consent must be documented and verifiable — carriers enforcing 10DLC standards require proof of opt-in for all recipients, and compliance guidance recommends retaining records for at least four years, matching the TCPA statute of limitations. With TCPA class action filings reaching 224 in September 2025 alone — a 283% increase — documentation is your first line of defense.

The practical takeaway: segment your list by campaign type before outreach begins. Informational campaigns can run on transactional relationships; promotional campaigns need consent captured through one of the accepted channels above. Build both tracks, document everything, and your campaign mix stays productive and defensible.

Operationalizing Opt-Out Compliance Across Channels and States

Getting consent right is only half the equation — how quickly and completely you honor opt-outs is where most compliance programs actually fail. The TCPA's updated opt-out rules, effective April 11, 2025, impose precise operational deadlines that leave little room for error.

Under the new rules, businesses must honor opt-out requests within ten business days, and revocation is accepted "in any reasonable manner" — a customer can reply, call, or email, and the request still counts, according to BCLP Law's analysis. There's one narrow allowance: senders may deliver a single clarification message within a five-minute window after revocation, and nothing more. Systems should also recognize all seven endorsed opt-out keywords:

• STOP, QUIT, and END
• REVOKE and OPT-OUT
• CANCEL and UNSUBSCRIBE

State laws layer additional obligations on top. Virginia SB 1339 requires honoring STOP and UNSUBSCRIBE requests for at least 10 years, with fines of $500 to $5,000 per violation for failures, as TextBolt's regulatory analysis details. Texas SB 140, effective September 2025, classifies text messages as telephone solicitations — opening the door to direct consumer lawsuits with statutory penalties up to $1,500 per violation and treble damages for willful violations.

Documentation matters just as much as timing. Because the TCPA carries a four-year statute of limitations, opt-out records should be retained at least that long, per BCLP's guidance. The stakes are rising: recent litigation data shows 224 TCPA class actions filed in September 2025 alone — a 283% increase over the prior period.

For service businesses running reactivation outreach, this is why operational discipline beats good intentions. CallMyCustomers treats opt-out handling as a core campaign requirement — every script, text, and follow-up sequence is built so revocations are honored immediately across all channels, and the owner approves every message before it goes out. When a win-back campaign reaches thousands of past customers across multiple states, the systems behind it must assume the strictest applicable rule, not the average one.

Consent that can't be proven is consent that doesn't exist. Build your opt-out workflow — recognition, honoring, and documentation — before the first message is ever sent.

10DLC Registration and Consent Verification as Delivery Insurance

Getting consent right means nothing if your messages never arrive. Even with airtight opt-in records, US carriers now block 100% of unregistered A2P text traffic — meaning every message you send from an unregistered business number simply disappears before it reaches the customer.

This is why 10DLC registration has become non-negotiable delivery insurance. The process involves two stages: brand registration, which typically takes 2–5 business days, and full campaign approval through The Campaign Registry, which takes 1–4 weeks. According to compliance analysis of the 10DLC framework, costs are modest — $4–$15 in upfront brand fees and roughly $10 per month per campaign — but skipping registration is not an option carriers negotiate on.

The financial downside of non-compliance compounds quickly. Carriers apply surcharges of $0.006–$0.017 per message segment to non-compliant senders, and T-Mobile fines reach up to $10,000 per content violation plus $1,000 per incident for 10DLC evasion. Those penalties arrive alongside, not instead of, TCPA exposure — and with 224 TCPA class actions filed in September 2025 alone, the litigation environment remains aggressive even as federal rules shift.

Here is what proper 10DLC registration requires:

• Accurate use-case descriptions that match your actual messaging content — a win-back campaign registered as "customer care" invites content violations
• Documented, verifiable opt-in consent for every recipient on the list, as carrier guidelines require
• Required STOP and HELP keyword handling built into every campaign
• Consent records retained at least four years, matching the TCPA statute of limitations

The connection between consent logging and registry accuracy matters more than most businesses realize. When you register a campaign use case, you are telling carriers what kind of messages you will send — and CTIA carrier guidelines require the right consent model for both marketing and transactional messaging. If your consent records show customers opted in for appointment reminders but your campaign sends promotional win-back offers, your logged consent and your registered use case no longer match. That mismatch is exactly what triggers content filtering and fines.

This is why done-for-you services like CallMyCustomers treat consent documentation and 10DLC registration as one workflow, not two. A reactivation campaign built from a list of real past customers — with opt-ins logged at the point of collection and use cases registered honestly — delivers cleanly because every layer of verification tells the same story.

The practical takeaway: budget the two to four weeks for registration before your first campaign, and make sure every consent record you keep maps directly to the use case you registered. Your delivery rates, and your legal exposure, depend on both.