Consent across channels
A dated US legal baseline, with policy and engineering choices kept distinct.
US federal baseline, checked October 16, 2026. This is engineering guidance, not legal advice or certification. Recipient location, state law, purpose, dialing technology and exemptions matter. EU/EEA, UK and Canadian requirements are outside this baseline. Obtain program-specific legal review before activation.
Classify the actual channel and message
- SMS/MMS marketing
- Where TCPA-regulated autodialing is involved, prior express written consent is generally required. Do-Not-Call protections can apply independently of autodialer status. An image attachment does not bypass messaging rules.
- Informational SMS/MMS
- Covered autodialed messages generally need prior express consent absent an emergency purpose or applicable exemption. “Transactional” is not itself an exemption.
- Artificial/prerecorded voice
- Mobile informational calls ordinarily require consent, subject to exceptions; marketing generally requires written consent. Residential-line rules and limited exemptions differ. AI-generated voices fall within the artificial/prerecorded-voice rules.
- Human voice
- Manual dialing does not remove applicable DNC, solicitation-time or other telemarketing restrictions.
Sources: 47 CFR §64.1200 and FCC 24-17, AI voice ruling. The Supreme Court's Facebook v. Duguid decision limits the federal autodialer definition to equipment with the specified random/sequential-number-generator capacity. It does not remove the separate artificial-voice restriction. Evaluate the actual system, not an “AI,” “P2P” or “manual” label.
Revocation: current rules and a pending change
The inspected eCFR baseline, current through October 14, recognizes reasonable revocation methods and does not permit an exclusive method. Standard words include STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE; clear natural-language withdrawal also matters. General processing must occur within a reasonable time, at most ten business days; some exemptions demand faster handling. One-way messaging needs disclosure and alternatives. One confirmation may only confirm withdrawal, contain no promotion and be the sole additional message. Within five minutes it is presumed within consent; a longer delay needs justification. If it asks which previously consented categories to retain, cease further consent-required texts absent clarification. See the 2024 Consent Order. Engineering recommendation: suppress promptly, coordinate provider/application acknowledgments and avoid duplicate confirmations.
Specific waiver: DA 26-12, January 6, 2026, extends to January 31, 2027 the delayed requirement to apply a withdrawal responding to one informational category to unrelated future robocalls/robotexts. It does not suspend other revocation duties or justify ignoring an explicit stop-all request. April 11, 2026 is obsolete for this delayed portion.
Adopted, not yet effective on this research date: FCC 26-67 was adopted September 30 and released October 1, 2026. Its amendments take effect 30 days after Federal Register publication; paragraphs 24 and 50 and footnote 64 specify the trigger and a forthcoming Public Notice. The exact effective date was not established in this review. Do not activate new permissions based on adoption alone.
Once effective, the order permits category-specific treatment of informational revocation and specified, clearly disclosed exclusive revocation methods. Marketing revocation still covers future marketing robocalls from that caller. The amendment supersedes the delayed provision above when effective. Shorter processing deadlines, mandatory two-way texting, revoke-all options and affiliate treatment remain questions in its Further Notice, not final requirements. Recheck the official effective-date notice before changing policy.
Separate litigation: the January 24, 2025 Insurance Marketing Coalition decision vacated the FCC's new one-to-one and logically/topically-associated restrictions. Do not present them as binding from January 27, 2025. Other written-consent duties remain. Business-specific permission can also be required by a provider or chosen as stricter product policy.
CAN-SPAM: purpose before labels
Commercial email, including B2B, generally follows a federal opt-out model—not a universal prior-opt-in rule. Required controls include accurate identification, nondeceptive subjects, required advertising identification, a postal address and a functioning opt-out. The mechanism must work for at least 30 days after transmission; honor requests within ten business days without fees, forced login or unnecessary friction. Outsourcing does not remove responsibility. Affirmative subscription is our recommended product policy, distinct from this federal minimum. FTC CAN-SPAM guide.
Transactional/relationship categories are narrow: agreed transactions; warranty/recall/safety/security information; specified ongoing-relationship changes or statements; employment/benefit information; and delivery of agreed goods/services. False routing remains prohibited. For mixed transactional/promotional email, a promotional subject or transactional content not substantially at the beginning can make it commercial. Other mixed content turns on the subject and reasonable reading of the body, including prominence. 16 CFR §316.3.
Recommended control: store the approved classification and template version, then validate rendered content. Coupons, generated subject lines and recommendation modules can change classification. An existing customer relationship or a “receipt” filename does not settle it.
Calling time and recording are separate gates
The FTC Telemarketing Sales Rule guide describes the general outbound telemarketing window of 8 a.m.–9 p.m. at the recipient's location, absent qualifying prior consent, alongside DNC and covered prerecorded-sales-call requirements. State rules can be stricter. Check recipient-local time immediately before dialing and hold uncertain locations for review.
Outreach permission does not automatically authorize recording, transcription, biometric processing or reuse. Review the applicable recording jurisdiction and notice/consent rules independently. Recommended product behavior: identify the business and automation, provide workable opt-out/interruption paths, test voicemail, and disable recording-dependent features without the required basis.
Push permission is only one layer
A browser or operating-system permission allows technical delivery. It does not prove every applicable privacy/marketing basis or permission for every purpose. The Notifications standard defines technical permission behavior. Separately record the app's disclosed purpose and account/device binding, provide accessible settings and stop controls, and respect denial, logout, token rotation and shared devices.
Video and images need their own rights review
Separate permission to deliver a message from authority to use/edit/publish a person's likeness or voice, rights in the underlying work, and authority to reveal content to the intended audience. A private upload remains private by default; permission to receive a photo is not a public-release license.
The FTC biometric policy statement addresses deceptive or unexpected biometric uses and security under existing law; it is not a universal model-release statute. FTC COPPA guidance explains covered operators' duties involving children's information, including photos, video and voice. One checkbox cannot settle every media use.