If you buy or generate leads, you spent most of 2024 bracing for the FCC's one-to-one consent rule. Then, days before it took effect, a court threw it out. Here is where things actually stand in 2026, and why the reprieve is smaller than it looks.
In December 2023, the FCC adopted a rule aimed at closing what it called the lead generator loophole. It would have redefined prior express written consent so that a consumer had to consent to one specific seller at a time, and any resulting call or text had to be logically and topically related to the interaction that produced the consent. In practice, it would have killed the common setup where a single checkbox on a comparison site hands your number to dozens or hundreds of partner companies at once.
On January 24, 2025, just before the rule was set to take effect, the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC. The court held that the FCC had exceeded its authority, reasoning that because the TCPA does not define prior express consent, the phrase carries its ordinary meaning: a consumer only has to clearly and unmistakably say, before the call, that they are willing to receive it. The one-to-one and topically-related requirements went beyond that.
The FCC did not fight it. In April 2025 it said it would not challenge the ruling, and later in 2025 it issued a final rule formally deleting the vacated language and reinstating the earlier consent standard. So as of 2026, lead-generation consent reverts to the pre-2023 status quo: prior express written consent is still required, but without the one-to-one constraint.
It does not mean the loophole is safely reopened. Prior express written consent is still the law. To call or text a consumer with an autodialer or a prerecorded or artificial voice for marketing, you still need a written agreement, bearing the consumer's signature, with clear and conspicuous disclosures. The standard reverted. It did not disappear.
It also does not mean the risk went down. If anything, TCPA litigation is more aggressive than ever, because the fight has simply moved. With the one-to-one rule gone, the entire battleground is now consent quality. Plaintiffs probe whether your consent was genuine, specific, documented, and provable: Was the disclosure clear? Is there a dated record tying this exact consumer to this exact consent? Statutory damages are still $500 to $1,500 per call or text with no cap, which is how one campaign becomes an existential number.
Purchased leads are the danger zone. When you buy a lead, you inherit the consent defects of whoever captured it. If the original opt-in was vague, undocumented, or daisy-chained through a chain of partners, that is now your liability, not theirs. Two more pressures are worth knowing: major carriers enforce their own one-to-one style standards on marketing text traffic regardless of what the FCC requires, and the FCC has confirmed that AI-generated voice calls count as artificial voice under the TCPA, so AI calling agents fall squarely inside the consent rules.
Do not loosen your consent practices because the rule died. For every number you call or text for marketing, be able to produce a dated, specific record of consent. Treat purchased leads as inherited liability: diligence the consent capture of any source, get contractual indemnities, and keep the underlying consent evidence, not just the phone number.
Consent is one layer. The other is suppression. Even a perfectly consented list still has to be scrubbed, because consent does not override a Do Not Call registration or protect you from a known litigator who consented specifically so they could sue. Run your National DNC and litigator scrubs on every list, consented or not, and you cover both halves of the problem.
This article is general information, not legal advice. Consult qualified counsel about your consent practices.
National DNC, state, litigator, and mobile scrubbing in one pass. Test it on 10 numbers free.