TCPA in 2026: What Actually Changed and What It Means for Your Campaigns

If you run a performance marketing operation, you have probably heard three different versions of what happened with the TCPA in the last 18 months. The one-to-one consent rule was coming. Then it was delayed. Then it was struck down. Then states started passing their own versions. The result is a compliance landscape that is more complicated than it was two years ago, even though the headline federal rule never took effect.

Here is what actually changed, what did not, and what it means for how you run campaigns in 2026.

The one-to-one consent rule is dead

In December 2023, the FCC adopted a rule that would have required consumers to give separate consent to each individual seller before receiving telemarketing calls or texts. It was designed to close the lead generator loophole, where a single form submission could authorize dozens of companies to call.

The rule was set to take effect January 27, 2025. The FCC postponed it by a year. Then, on January 25, 2025, the 11th Circuit Court of Appeals struck it down entirely in Insurance Marketing Coalition v. FCC. By September 2025, the FCC formally eliminated the rule.

Multi-seller consent is still legal. If a consumer fills out a form that lists multiple sellers and gives prior express written consent, those sellers can call. The loophole the FCC tried to close remains open at the federal level.

The revocation rules are real

While the one-to-one consent rule died, new revocation of consent rules went into effect on April 11, 2025. These are the changes that actually matter for campaign operations.

Consumers can now revoke consent through any reasonable method. A reply text, a voicemail, a social media message, an email. If the intent to opt out is clear, it counts. You have 10 business days to honor the request across all channels.

Every marketing text must now include clear opt-out instructions. And Do Not Call registry requirements, which previously applied only to voice calls, now cover text messages. If you are running SMS campaigns, you need to scrub against the DNC registry the same way you would for outbound calling.

The penalties have not changed, but the enforcement surface has expanded. Each non-compliant call or text is a separate violation at $500 to $1,500 per incident. A single bad campaign run can generate tens of thousands of dollars in liability.

The state patchwork is the real problem

Here is what most operators underestimate. At least 12 states have enacted their own mini-TCPA laws since 2021, and several of them are stricter than anything at the federal level.

Florida's Telephone Solicitation Act restricts automated calls and texts to Florida residents between 8am and 9pm, requires prior express written consent for any automated communication, and carries its own statutory damages. Oklahoma has similar restrictions. More states are expected to follow.

If you are running national campaigns, you are not just complying with the federal TCPA. You are complying with a patchwork of state laws that vary in consent requirements, calling hours, frequency caps, and penalties. A campaign that is fully compliant in one state can generate violations in another.

This is not a problem you can solve with a quarterly compliance review. It requires real-time, per-call awareness of what rules apply to each contact based on their location.

What this means for campaign operations

The practical impact comes down to three things.

First, consent management is more complex. Multi-seller consent is still legal federally, but your consent documentation needs to be airtight. If a state law is stricter, the state law applies. Your forms, your disclosures, and your record-keeping all need to account for where the consumer is, not just where you are.

Second, revocation handling has to be automated. The 10-business-day window and the requirement to honor opt-outs across all channels means you cannot rely on a rep manually updating a CRM record. If someone texts "stop" on Tuesday and gets a marketing call on Wednesday, that is a violation. The system needs to catch it before a human ever touches the lead.

Third, every interaction needs to be logged and auditable. When a compliance dispute arises, your defense is your documentation. Call recordings, transcripts, consent records, opt-out timestamps. If you cannot produce them, you are exposed.

Where AI agents fit

AI agents are not a compliance product. But they solve several of the operational problems that make TCPA compliance difficult at scale.

An AI agent delivers the required disclosures on every call. It does not skip them because the call is running long. It does not paraphrase them because the rep forgot the exact language. The script runs the same way on call one and call ten thousand.

An AI agent checks DNC and opt-out lists before every outbound contact. It does not rely on a batch scrub from three days ago. It checks in real time.

An AI agent logs every interaction automatically. Call recording, transcript, disposition, timestamps. Every contact is documented without relying on a rep to update the CRM after the call.

And an AI agent follows calling-hour restrictions by default. If a state law says no calls after 9pm, the agent does not call after 9pm. There is no judgment call, no timezone math error, no "I thought it was still 8:50."

None of this replaces legal counsel or a compliance program. But it removes the human error that creates most TCPA exposure in the first place.

The point

The headline story in 2026 is not that the rules got easier. The one-to-one consent rule died, but revocation requirements tightened, the DNC registry expanded to cover texts, and a growing number of states are writing their own rules that are stricter than anything the FCC has on the books.

For performance marketing operators running high-volume campaigns across multiple states, the compliance burden has gone up, not down. The question is whether your operation can keep up with it manually, or whether you need systems that enforce compliance by default, on every call, every text, every time.