Can You Legally Text Old Leads? The 2026 TCPA Rules, Corrected

In December 2023 the FCC adopted a lead-generation order carrying a "one-to-one consent" requirement. Consumers would have to consent to each seller individually, and each call would have to be logically and topically associated with the interaction that produced the consent. It would have made most shared and purchased lead data unusable.

On 24 January 2025 the US Court of Appeals for the Eleventh Circuit vacated the rule in Insurance Marketing Coalition Ltd. v. FCC. The court held that both the one-to-one and the logically-and-topically-associated requirements impermissibly altered the ordinary meaning of prior express written consent, exceeding the FCC's statutory authority under the TCPA.

The FCC did not seek rehearing or Supreme Court review. It subsequently issued a final rule deleting the vacated language and reinstating the prior version. The pre-2023 standard governs today.

This matters because the incorrect version is now the majority of what is published on the subject, and it is the version AI assistants are most likely to repeat. Acting on it means either abandoning a campaign that is lawful, or, worse, assuming the rules were rewritten in your favor when the actual obligations below still apply.

Four separate regimes touch a campaign that texts or calls dormant contacts. They are commonly collapsed into one, which is where most compliance failures start.

The Do Not Call trap

The established business relationship exemption is the most misused idea in reactivation. It does exist: it lets you contact someone on the National Do Not Call Registry for 18 months after their last transaction, or 3 months after an inquiry or application.

But it is an exemption from the Do Not Call Registry rules only, and it covers live calls, not autodialed or prerecorded calls and texts. A bulk SMS reactivation campaign is exactly the thing it does not cover. A past customer relationship does not substitute for consent to automated marketing texts. If a vendor tells you an old customer list is safe to blast because you did business with them, that is the error being made.

The provision at 47 CFR 64.1200(a)(10) makes a single revocation apply to every future call and text from you to that number, on any topic, unless an exemption applies. Opt out of a promotion and you have also opted out of appointment reminders on unrelated matters.

It was scheduled to take effect 11 April 2025, delayed to 11 April 2026, and the FCC has since extended the waiver to 31 January 2027. The practical consequence is architectural rather than legal: consent and revocation state has to live on the contact record and be respected by every system that can send, not tracked per campaign inside whichever tool sent the last one. Businesses running reactivation through a separate blast tool that does not write back to the CRM are the ones that will be exposed.

In February 2024 the FCC issued a declaratory ruling classifying AI-generated voices as an artificial or prerecorded voice under the TCPA. The consequences are direct:

• An AI voice call to a mobile number requires prior express consent. If the call is telemarketing, it requires prior express written consent.
• Identification and opt-out requirements apply to the AI agent the same way they apply to a prerecorded message. The agent has to identify the business and offer a way out.
• AI does not create a lighter-touch category. Relative to a human dialing manually from a list, an AI voice agent raises the consent standard rather than lowering it.

AI SMS sits in the ordinary text analysis: what matters is whether the message is marketing, whether sending is automated, and what the contact consented to. The AI part changes the volume and the speed, not the rules.

This is the sequence we run on partner accounts. It is also a usable checklist if you are running the campaign yourself or auditing someone who is.

• Segment by consent origin, not by age. Contacts who completed your own form with a marketing disclosure are a different population from contacts who arrived through a third-party lead seller. They get different treatment, and sometimes the second group gets no automated messaging at all.
• Scrub against the National DNC Registry and your internal do-not-contact list. The internal list matters more than operators expect, because it survives platform migrations badly and is often the thing that got lost.
• Identify the business in the first message and carry clear opt-out language. A contact who has not heard from you in two years does not recognize the number.
• Wire revocation back to the CRM record, not just to the sending tool, and honor plain-language opt-outs, not only keywords. This is the work that makes the January 2027 change a non-event rather than a migration.
• Throttle and monitor. Carrier filtering and complaint rates are the practical constraint on a large first send, separately from the legal one.
• Where consent is genuinely unclear, use email first. Email sits under CAN-SPAM, a materially lower bar, and a reply re-establishes an active conversation you can then move to text.