What happened to the FCC’s one-to-one consent rule?
It never took effect. The FCC adopted the rule in its December 2023 Second Report and Order (FCC 23-107), published in the Federal Register in January 2024 and scheduled to apply from January 27, 2025. On January 24, 2025, three days before that date, the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, holding that the new consent restrictions conflicted with the ordinary meaning of “prior express consent” in the TCPA.
The rule targeted the lead generator loophole. Picture a quote request on a home insurance comparison site: one checkbox, then calls and texts from a string of different sellers, each claiming the consumer gave prior express written consent. A single checkbox could be worded to cover an unlimited list of “marketing partners.” The FCC’s fix had two parts: consent to one seller at a time, and only for calls “logically and topically associated” with the interaction where consent was given. The court vacated both (Part III.D of the order).
What didn’t change:
- The rest of FCC 23-107 still stands, including applying National Do Not Call Registry protections to text messages.
- The 2012 rule that telemarketing robocalls and robotexts need prior express written consent (47 CFR 64.1200(a)(2)-(3)) was never in question.
If you run outbound SMS or voice campaigns from third-party lead flows, the vacatur removed one federal rule. It didn’t remove your exposure.
What does valid consent need to look like now?
Federally, there is no one-to-one requirement, but prior express written consent still has a precise definition. Under 47 CFR 64.1200(f)(9), it is a written agreement signed by the consumer (an electronic signature counts) that clearly authorizes the seller to deliver telemarketing calls or texts using an autodialer or prerecorded voice to a specific phone number. The disclosure must be clear and conspicuous and must say that signing isn’t a condition of purchase.
That definition is about “the seller,” so consent still has to be clear about who will contact the consumer. Shared lead forms where your brand is one of twenty logos in a disclosure paragraph, or co-registration flows where a consumer opts in to a “network of partners,” are weak evidence that this particular consumer agreed to hear from you. Defending them is a fact question in each case, and some states set their own rules on top of the federal ones.
The strongest consent is still collected on your own web property, your own SMS keyword opt-in, your own IVR, or a co-registration arrangement where your brand is named and the call-to-action is unambiguous about who will make contact.
You should also be able to show when the consent was recorded, what the form or interface looked like at that moment, what phone number was submitted, and that the number was a real, reachable line at the time of submission. That last point is where phone validation comes in.
Why is line type the threshold question?
Because the written-consent rule depends on the kind of line you’re calling. Under 47 CFR 64.1200(a)(2), telemarketing calls and texts made with an autodialer or a prerecorded voice to a mobile number need prior express written consent. Non-marketing (informational) autodialed calls and texts to a mobile number need prior express consent, which doesn’t have to be written. For residential landlines, (a)(3) requires written consent for prerecorded telemarketing calls, while live marketing calls to landlines are governed mainly by the Do Not Call rules.
So before you decide which consent you need, you have to know what you’re calling.
In practice, lead forms collect a phone number and nothing else. A consumer can type in a Google Voice number, a VoIP line, a ported number, or a landline. You can’t tell by looking at it. The 10-digit format is identical.
CheckThatPhone’s dipCarrierType field returns mobile, landline, invalid, or undefined from a live carrier dip at lookup time, so it reflects the number’s current carrier even after a port. Use it, not nanpType, for this decision: nanpType comes from numbering-plan data, which doesn’t follow a number when it ports (the API docs make the same point about nanpCarrier). If dipCarrierType is mobile, treat the number as needing the full written-consent record for marketing. If it’s landline, the rules are different, though you should still confirm the number is reachable.
dipCarrierSubType gives you more detail: it distinguishes a traditional wireless line (WIRELESS, PCS) from a VoIP line (IPES) or a reseller. That matters because VoIP numbers show up in consumer flows and courts have not been uniform about how they treat them. Knowing the subtype lets you flag those for manual review rather than loading them straight into your dialer.
What does a defensible consent record contain?
Four things: the form, the validated number, a reassignment check, and a litigator scrub.
First, a timestamped screenshot or server-side render of the exact form the consumer saw, with your brand name visible and the consent language legible.
Second, the submitted phone number with a validation result attached. This is your evidence that the number was a real, active, mobile line at the moment of opt-in, not a mistype or a Google Voice placeholder.
Third, a reassignment check for older records. Consent belongs to the person who gave it, and numbers get disconnected and reassigned to new subscribers. dipPorted doesn’t answer that question: a port means a number moved carriers, usually with the same subscriber. The FCC’s Reassigned Numbers Database does, and if you query it and it wrongly reports no disconnection, 47 CFR 64.1200(m) gives you a safe harbor. Our deactivationDate field shows a carrier deactivation within the last 45 days, which is a good reason to stop and re-confirm, but it is not a reassignment signal.
Fourth, a litigator scrub result. Serial TCPA plaintiffs are well documented. Adding litigatorFilter: true to your lookup request returns litigator, litigator_type, and litigator_name. Calling a known litigator is not automatically losing, but it is expensive to defend and you will have a hard time explaining why you did not check. The TCPA litigator scrub use case walks through how to add this to a signup flow, and how to filter out professional plaintiffs covers what the database contains.
A single API call to POST https://api.checkthatphone.com/v1/lookup with your Authorization: Bearer <key> header returns the validation and litigator results together. Store the response alongside your consent record in your CRM. That is your paper trail.
What should you do with your existing list?
Re-check the consent records first, then the numbers. Because the one-to-one rule never took effect, consent you collected before or after January 27, 2025 is judged by the existing standard: did this consumer sign a clear written agreement to receive marketing calls or texts from you, at this number? Blanket “network of partners” opt-ins are the records most likely to fail that test.
For a large list, the fastest way to check the numbers is a bulk validation pass. In the CheckThatPhone dashboard, open Bulk CSV and upload your file. We deduplicate it, run carrier and line type validation (plus the litigator scrub and landline SMS lookup if you enable those add-ons) on every unique number, and give you a downloadable result file. The upload and the result file are hard-deleted within 24 hours. For real-time validation on each form submission, call the /v1/lookup endpoint directly.
From the bulk results, I would segment three ways. Numbers where dipCarrierType is "mobile", litigator is "false" and deliverable is "true" go into your verified contact pool. Numbers where litigator is "true" come out completely. Numbers where deliverable is "false" or deactivationDate is populated are dead or recently deactivated lines and should be suppressed regardless of what consent you think you have. See the contact list hygiene use case for a fuller walkthrough.
Landlines are a separate question. If you want to text a landline, landlineSmsLookup: true on the request returns dipMessagingLookup, dipMessagingEnabled, and dipMessagingProvider. About 7% of landlines we check are SMS-capable (see landline SMS lookup). That doesn’t change your consent obligations, but it does change which channels can actually reach the number.
The practical bottom line
The vacatur took away a federal rule, not the problem it was aimed at. If your acquisition stack relies on aggregator leads, you still need consent that names you clearly, documentation you can produce on demand, and validation at the point of opt-in so you know exactly what you collected and when.
For every new mobile opt-in, check dipCarrierType at form submission, store the full API response with your consent record, and enable the litigator scrub. For your existing list, run a bulk validation pass before your next campaign. The pricing page shows what that costs at volume, and the API docs have the full field reference. If you buy leads from affiliates, the affiliate marketer’s TCPA exposure covers the same ground from the publisher side.
None of this is a legal opinion, and if you are running high-volume outbound you should have TCPA counsel review your specific flows. But the validation layer is cheap to add and not complicated to implement.