Why Consumer Rights Under the TCPA Just Got a Lot Stronger

The Telephone Consumer Protection Act (TCPA), enacted in 1991, was designed to protect consumers from unwanted telemarketing calls, robocalls, and unsolicited messages. For decades, it set boundaries around how businesses could contact individuals, requiring prior express consent for automated communications and establishing baseline penalties for violations. However, the regulatory landscape has shifted dramatically in 2024–2025, with two pivotal FCC rules strengthening consumer rights in ways that directly impact how businesses like CallMyCustomers engage past customers.

Effective January 27, 2025, the one-to-one consent rule closed the "lead generator loophole," mandating that businesses obtain written consent from consumers for each specific marketer sending robocalls or texts. This means consent cannot be shared or transferred across unrelated entities, significantly tightening requirements for lead-based outreach. Then, on April 11, 2025, the FCC's Opt-Out Rule took effect, fundamentally expanding how consumers can revoke consent. Under this rule, consumers may now withdraw permission through any reasonable method—such as voicemail, email, or in-person communication—and businesses must honor these requests within 10 business days. Crucially, there is a rebuttable presumption that such methods are reasonable, placing the burden on businesses to prove otherwise if they wish to challenge a revocation.

These changes eliminate the outdated assumption that opt-outs must be limited to specific keywords like "STOP." Instead, businesses must now track and respond to a far broader range of consumer signals, distinguishing between marketing and informational messages to determine the appropriate scope of cessation. For example, revoking consent in response to a marketing message stops only marketing communications, while revocation tied to an informational message requires halting all non-emergency calls and texts. Additionally, businesses may send only one clarification message within five minutes of a revocation request, and it must contain no marketing content.

The stakes for non-compliance are severe. Penalties under the TCPA can reach $500 per violation, or $1,500 for willful violations, with liability calculated on a per-message basis. A single unsolicited message sent to 10,000 recipients equals 10,000 violations, exposing businesses to potentially catastrophic financial exposure. This per-message liability framework means even small errors in opt-out processing can scale rapidly into significant legal and financial risk. For companies relying on customer reactivation—where lists often include individuals who may have disengaged years ago—respecting these updated rights isn’t just about avoiding fines; it’s foundational to maintaining trust and operating within increasingly sophisticated privacy expectations. As state-level mini-TCPA laws continue to expand—such as Texas’s $5,000 per violation statutory damages—the federal baseline is no longer the ceiling for compliance, but the floor.

The Right to Revocate Consent: Any Reasonable Method, Honored in 10 Days

Consumers can now revoke consent through any reasonable method—including voicemail, email, or in-person communication—with a rebuttable presumption that such methods are valid, placing the burden on businesses to prove otherwise. This expansion of rights means businesses like CallMyCustomers must accept diverse opt-out requests, whether a customer replies "STOP" to a text, leaves a voicemail requesting no further contact, or communicates their preference face-to-face during a service visit. The FCC's Opt-Out Rule, effective April 11, 2025, formalizes this shift, requiring businesses to honor revocations within 10 business days regardless of the channel used, as long as the method is deemed reasonable under the circumstances.

Businesses are permitted only one clarification message within five minutes of receiving an opt-out request, and it must contain no marketing content while seeking an affirmative response to avoid further violations. This narrow allowance ensures companies can confirm the intent behind ambiguous requests—such as a customer asking to "pause" messages—without overstepping into promotional territory. Crucially, the scope of cessation depends on whether the original message was marketing or informational: revoking consent in response to a marketing message stops only future marketing communications, while revoking consent after an informational message requires halting all non-emergency calls and texts. For CallMyCustomers, this distinction is vital when managing campaigns that blend service reminders (informational) with promotional offers (marketing), as opt-out processing must align with the message type that triggered the request.

• TCPA lawsuit volume remained stable in 2025 with 2,588 filings Jan–Nov, a 0.4% decrease from 2024.
• Texas Senate Bill 140 allows statutory damages up to $5,000 per violation, effective September 1, 2025.
• Opt-out processing time was reduced from 30 days to 10 days under the 2025 telemarketing rule update.

These protections empower consumers to control their communications through flexible, accessible means while holding businesses accountable for timely, accurate compliance—especially critical for services relying on customer reactivation where trust and permission are foundational.

The Shifting Legal Landscape: Federal Rollback, State-Level Expansion

The legal environment governing consumer communications is becoming increasingly fragmented, creating a complex compliance landscape for businesses. While federal TCPA litigation volume held steady at 2,5888 suits filed through November 2025 — reflecting only a 0.4% decrease from the prior year — this stability masks a growing divergence in enforcement priorities and legal interpretations across jurisdictions.

The Supreme Court’s McLaughlin Chiropractic Associates decision fundamentally altered the federal playing field by ruling that lower courts are no longer bound by FCC interpretations of the TCPA, requiring independent statutory analysis instead of agency deference. This shift has coincided with Florida district court rulings in Jones v. Blackstone Medical Services and Davis v. CVS Pharmacy that questioned whether text messages constitute "telephone calls" under the TCPA’s original definition, further complicating federal consistency. As a result, businesses like CallMyCustomers face uncertainty in how federal courts will apply core protections, even as the FCC’s new Opt-Out Rule — effective April 11, 2025 — mandates honoring consumer revocation through any reasonable method within ten business days.

Meanwhile, states are rapidly filling the perceived enforcement gap with their own mini-TCPA statutes, creating a patchwork of stricter requirements that often exceed federal standards. Texas Senate Bill 140, effective September 2025, authorizes private rights of action with statutory damages up to $5,000 per violation, significantly amplifying financial exposure. Oregon House Bill 3865, taking effect January 2026, restricts outreach to 8 a.m.–8 p.m. and limits contact to three calls per consumer daily. These developments mean that while federal litigation volume appears stable, state-level risk is intensifying, particularly for businesses engaging in multi-channel outreach where consent revocation rules and contact restrictions vary widely. Navigating this bifurcated landscape demands compliance systems capable of adapting to both evolving federal expectations and divergent state mandates.

What Honoring Consumer Rights Looks Like in Practice

Knowing what consumer rights exist is one thing; building operations that honor them every day is where most service businesses stumble. The FCC's Opt-Out Rule, effective April 11, 2025, requires businesses to honor consent revocation through any reasonable method — voicemail, email, even in-person — within 10 business days. That means opt-out tracking can't live in one inbox; it has to span every channel a customer might use.

The burden of proof sits with the business. As BCLP's legal analysis explains, non-prescribed opt-out methods carry a rebuttable presumption of reasonableness, so the business must demonstrate why a request wasn't reasonable. Tracking message type matters too: revoking consent on a marketing message stops marketing only, while revocation on an informational message halts all non-emergency calls and texts.

Documentation is the second pillar. Because the TCPA's statute of limitations runs four years, opt-out records should be retained for at least four years to withstand later litigation. That's not bureaucratic overhead — penalties reach $500 per violation, or $1,500 for willful violations, and liability is counted per message. One unsolicited text to 10,000 recipients equals 10,000 violations.

The third pillar is geographic. State-level "mini-TCPA" laws are expanding rapidly, with Goodwin Law's year in review noting that states now mirror and sometimes exceed federal protections. A business that only knows the federal rules is exposed.

• Texas SB 140 (effective September 1, 2025) allows statutory damages up to $5,000 per violation, with full recovery for each separate violation.
• Oregon HB 3865 restricts contact hours to 8 am–8 pm and caps calls at three per consumer per day starting January 1, 2026.
• The 2025 telemarketing update cut opt-out processing time from 30 days to 10 and broadened what counts as a "reasonable" revocation request.

In practice, honoring these rights starts before any message is sent. CallMyCustomers works only from lists of real customers, collects explicit consent in the booking flow, and honors opt-outs immediately — with the owner approving every script and offer first. For dental and med spa clients, outreach also operates under the required privacy agreements, including BAA/HIPAA and TCPA frameworks.

The result is a permission-based reactivation model rather than a volume game. When a customer says stop, the outreach stops — and the relationship stays intact for the day they're ready to book again.

Compliance as a Competitive Advantage in Customer Reactivation

Most businesses treat TCPA rules as a cost center. The smartest ones have figured out the opposite: when you only contact customers who already know you — with permission — compliance stops being a legal expense and becomes a revenue strategy.

The economics make the case plainly. Industry averages show that reactivating an existing customer costs roughly 5x less than acquiring a new one, and about 60% of revenue typically comes from repeat customers. Meanwhile, most customers forget a business within about 12 months — which means the safest, most profitable outreach in your pipeline is sitting quietly in your existing list.

Compare that to cold outreach, where the regulatory math is brutal. According to risk analysis, TCPA liability is counted per message — a single unsolicited blast to 10,000 recipients equals 10,000 violations, at $500 to $1,500 each. And the rules keep tightening: the FCC's Opt-Out Rule, effective April 11, 2025, requires businesses to honor consent revocation through any reasonable method — voicemail, email, even in-person — within 10 business days, with the burden on the business to prove a method unreasonable.

Permission-based reactivation flips that risk profile. You are not fighting for a stranger's attention with urgency tactics; you are reminding a former customer of work you already did well. That trust gap is the whole game — and it cannot be manufactured by a cold call.

The practical requirements still demand real systems:

• Honor opt-outs immediately, across every channel — the 2025 rules cut processing windows from 30 days to 10 business days.
• Track whether a revocation responds to a marketing or informational message, since the scope of cessation differs.
• Retain opt-out documentation for at least four years to align with the TCPA's statute of limitations.
• Watch state-level "mini-TCPA" laws — Texas now allows statutory damages up to $5,000 per violation, per legal analysis.

This is where a done-for-you partner earns its keep. CallMyCustomers works only from lists of real customers, honors opt-outs immediately, and follows all calling and texting regulations — including BAA/HIPAA and A2P 10DLC requirements for clinics. Every script and offer is approved by the owner before anything is sent, and a free list review shows what your list can produce before you spend a dollar.

Your next booked customer already knows your business. The regulatory burden of reaching them safely is real — but you don't have to carry it yourself.