What is express written consent? The practical difference from SMS opt-in

Express written consent

The current FCC rule defines it as a signed written agreement from the person called. It must clearly authorize the seller to deliver, or cause delivery of, advertisements or telemarketing messages to the specified number. The agreement must include a clear and conspicuous disclosure. That disclosure says the person is authorizing such messages and is not required to sign the agreement as a condition of purchasing property, goods, or services.

Electronic and digital signatures can qualify. The practical question is therefore not whether a merchant used paper. It is whether the consent event and disclosure form a defensible written agreement under the applicable rule.

The 2023 one-to-one restriction is not the current rule

This is a major freshness trap. In 2023 the FCC adopted an additional restriction often described as the one-to-one consent rule. It would have required, among other things, consent to one seller at a time and a logical/topical relationship between the consent and the interaction that prompted it.

The Eleventh Circuit vacated that portion of the 2023 order on January 24, 2025 in Insurance Marketing Coalition Ltd. v. FCC. The rule had been postponed pending judicial review and did not become the enduring consent standard. The FCC later conformed its rules after the decision. As of September 2026, do not tell readers that the vacated one-to-one restriction is a current FCC requirement.

That does not mean that consent no longer needs to identify the seller or clearly authorize the relevant messages. The pre-existing prior-express-written-consent definition remains. Nor does the court decision erase other laws, state requirements, carrier expectations or provider policies that may constrain lead generation and messaging.

Consent formation and consent revocation are separate questions

Another frequent error is mixing up how permission is first obtained with how it can later be withdrawn. The written-consent rule answers a formation question: what agreement is required before a covered advertising/telemarketing communication?

The FCC’s newer revocation provisions answer a later question: how can a consumer tell the caller/texter to stop, and how quickly must that instruction be honored?

Most of the FCC’s 2024 revocation rule changes became applicable on April 11, 2025, including recognition of reasonable revocation methods and an outer limit of 10 business days to honor covered revocations. A separate portion concerning the broader effect of revocation across categories has been waived through January 31, 2027. That delayed revocation issue should not be confused with the vacated one-to-one consent rule.

A strong ecommerce consent record

Consider a checkout-adjacent signup that says, in substance, that by affirmatively signing up the shopper agrees to receive recurring promotional texts from the named store at the number provided, with the required disclosures and links. The system should preserve:

Figure 1

Written consent is an evidence bundle and a history, not a boolean

Consumer + phone number: Which person and number acted
Named seller: Which business was authorized
Authorization / purpose: Advertising or telemarketing, where that is the permission sought
Disclosure version: The exact language the consumer saw
Not a condition of purchase: Disclosed as voluntary
Signature / action: Electronic, digital, or other qualifying signature
Timestamp + source: When and where the agreement was made

EventConsent agreement eventEvidence bundle recorded, not a boolean
OngoingCurrent permissionActive until revoked
If revokedRevocation eventPermission blocked, original record kept
If re-consentedNew consent eventNew version, does not erase history

Do not store only consent=true. The evidence is the event plus its disclosure and context, not a single field.

The 2023 one-to-one restriction was vacated. Do not add it back as a current field requirement.

A defensible record reconstructs who agreed, to which seller, under what disclosure, and when. A later revocation blocks permission without deleting what happened.

This is stronger than taking a screenshot of today’s form after a dispute. The goal is to preserve what that consumer saw and did at that time.

“They bought from us, so they consented”

A purchase is not a substitute for the required agreement when prior express written consent applies. The rule specifically requires the disclosure that consent is not a condition of purchase.

“The phone number field was required, so it counts”

A required contact field can serve fulfillment or account purposes. It does not by itself communicate authorization for telemarketing.

“Our terms say we may contact customers”

A buried general clause is not automatically the clear and conspicuous authorization contemplated by the FCC definition.

“The one-to-one rule was vacated, so lead consent can be unlimited”

Vacating one additional FCC restriction did not abolish the underlying consent definition or other applicable law and policy.

“Written consent lasts forever no matter what”

A later valid revocation changes send eligibility. Keep formation evidence, but honor the latest applicable instruction.

Designing for evidence without dark patterns

The strongest consent flow is usually the one a normal customer can understand without a lawyer explaining the interface. Use a clear brand identity, plain explanation of the message program, a distinct affirmative action, required disclosures near the action, and a durable record of what happened. Avoid preselection, misleading button labels, or burying the operative permission inside unrelated terms.

This is not merely defensive compliance. Clear consent generally produces a healthier list because recipients understand what they will receive.

Clear and conspicuous means the disclosure has to function as a disclosure

The FCC definition does not reward technically present words that a normal user is unlikely to understand as the operative agreement. Product teams should design the authorization so the identity of the seller, the nature of the messages and the no-purchase-condition disclosure are readable near the action that creates the agreement. Avoid patterns such as:

preselected marketing boxes
an ambiguous “Continue” button that also creates marketing permission without saying so
consent language hidden only behind a link while the visible call to action says something unrelated
a required checkbox that makes promotional consent appear necessary to complete checkout
a disclosure whose named seller does not match the business that later sends

A consent flow can be visually compact without being semantically vague.

Seller identity matters even without the vacated one-to-one rule

The court’s 2025 decision removed the additional 2023 one-to-one restriction. It did not remove the current regulatory definition’s requirement that the agreement authorize a specified seller.

This distinction is especially important for lead-generation marketplaces. A statement such as “I agree to receive marketing from selected partners” raises different evidence questions from a form that clearly names the business that will call or text. The exact legality of a lead flow can be fact-specific, but a platform should preserve which seller identity was disclosed rather than assuming the one-to-one vacatur makes identity irrelevant.

For a SaaS form builder, this argues for storing seller_display_name or an immutable rendered-disclosure snapshot with the event, rather than reconstructing the name from the merchant’s current account profile years later.

Evidence should survive product changes

A common audit failure occurs when the business retains an event timestamp but not the historical disclosure. The website is redesigned, the checkbox copy changes, and 6 months later nobody can prove what the earlier customer saw. Preserve the historical version. Useful approaches include:

immutable disclosure text plus a version ID
a rendered HTML/text snapshot
content hash and deployment version
source URL plus archived template version
form/campaign ID tied to version-controlled copy

The goal is not to collect unlimited personal data. It is to retain enough evidence to reconstruct the agreement while respecting privacy and retention obligations.

Separate 4 records in the data model

For high-integrity systems, keep these concepts distinct:

consent event - the historical agreement and evidence
current permission state - whether the person is presently eligible under your rules
suppression event - later revocation, complaint or other block
send decision - why a particular message was sent or skipped at a particular time

This structure prevents a later opt-out from “deleting” evidence that valid consent once existed, while still ensuring the old consent cannot override the newer instruction.

What changed and what did not after the court decision

This table is the shortest way to avoid carrying a stale 2024 compliance checklist into a 2026 product.

Option	Question	Current 2026 answer
Is the FCC’s 2023 one-seller-at-a-time restriction current?	Is the FCC’s 2023 one-seller-at-a-time restriction current?	No. The Eleventh Circuit vacated it in January 2025.
Does the existing prior-express-written-consent definition remain?	Does the existing prior-express-written-consent definition remain?	Yes.
Does the agreement still need to clearly authorize the seller and covered messages?	Does the agreement still need to clearly authorize the seller and covered messages?	Yes, under the current definition when that standard applies.
Did the court decision eliminate revocation obligations?	Did the court decision eliminate revocation obligations?	No. Revocation is governed separately.
Are all 2024 revocation provisions fully effective without qualification?	Are all 2024 revocation provisions fully effective without qualification?	No. A specific cross-category portion remains under waiver through January 31, 2027.

Consent review should happen before creative reaches the queue

A messaging platform cannot decide every fact-specific legal question for a merchant, but it can prevent avoidable ambiguity. Before a merchant activates a high-risk promotional workflow, the product can require them to identify the sending brand, choose the communication purpose, attach or select the collection source, and acknowledge that uploaded numbers need a valid permission basis.

The system should then carry those facts into the send-decision layer. This is better than asking for “proof of consent” only after a provider blocks traffic or a recipient complains.

For forms the platform itself hosts, the evidence path can be stronger: version the disclosure automatically, bind the affirmative action to that version, and make the resulting consent event immutable. For external/imported collection, store the merchant-supplied basis and provenance without pretending the platform witnessed an event it did not observe.

What does this page teach beyond a generic glossary definition?

It separates 3 timelines that are often incorrectly merged:

the enduring FCC definition of prior express written consent
the 2023 one-to-one restriction that was vacated in January 2025
the separate 2024-2026 revocation-rule implementation and waiver timeline

That chronology is what keeps a 2026 consent page from repeating stale advice. > This page is an educational description of current federal rules and operational evidence practices, not legal advice. The TCPA is fact-dependent, and state laws can impose additional requirements.

Worked example

Suppose a store runs a footer form that says the shopper agrees to receive recurring promotional text messages from Example Store at the number provided, includes the required no-purchase-condition disclosure for the program, and uses an unchecked checkbox plus a Join by text button. A useful evidence object would not merely say consent=true. It could preserve:

normalized phone number
seller/brand shown to the shopper
exact disclosure version or immutable snapshot
affirmative action used as the electronic signature/agreement
form and page identifier
event timestamp and timezone
source URL and deployment/template version
downstream profile ID created from the event

If that customer later complains, the business can answer a concrete question: what agreement existed at the time of the send? If the customer later opts out, the answer to a different question, may we send now?, becomes no. Historical evidence and current eligibility should not overwrite each other.

What Express written consent requires

A useful consent record should make it possible to reconstruct at least these facts:

the consumer: which person/phone number acted
the seller: which business the consumer authorized
the purpose: advertising or telemarketing authorization where that is the permission being obtained
the channel/covered contact: the specified telephone number
the disclosure: what authorization language the consumer saw
voluntariness: that the disclosure did not make consent a condition of purchase
the signature/action: the electronic, digital or other qualifying signature mechanism
time and source: when and where the agreement was made

A database field called consent=true proves very little on its own. The evidence is the event plus its disclosure and context.

What passes and what does not

The FCC definition expressly accommodates electronic records and signatures to the extent permitted by the E-SIGN Act and applicable state law. In ecommerce, this is why a properly designed web form can create written consent
The exact UI does not have to look identical across every merchant. A checkbox, button, form submission or other electronic act can play a role if the full agreement satisfies the requirements. What matters is the meaning and evidence of the action, not copying a visual pattern from another brand