TCPA Compliance in 2026: What Changed and What You Need to Know

The Consent Landscape Just Got Rebuilt

If you're still running your outbound program the way you were in 2024, you're running it wrong.

The FCC's one-to-one consent rule took effect January 27, 2025, and it fundamentally changed how lead generation works in the United States. Not at the margins. Not a tweak. The entire model of buying a lead list and having 12 companies call the same person off a single opt-in form? Dead.

Let's break down what actually happened, what's still happening at the state level, and what you need to do about it right now.

The FCC One-to-One Consent Rule

Before January 2025, a consumer could fill out a single form on a comparison-shopping site and "consent" to calls from dozens of companies at once. The consumer rarely knew who those companies were. The companies rarely cared — they had a "consent" checkbox and that was enough.

The FCC closed that door.

Under the new rule, prior express written consent must be given to one specific seller at a time. No more blanket consent. No more lead aggregators collecting a single signature and selling it to 15 different solar companies. Each company needs its own, individually granted consent.

Here's what that means in practice:

• Lead gen forms must clearly identify the specific company the consumer is consenting to hear from
• Comparison sites can still exist, but each seller needs a separate, clearly labeled consent mechanism
• Consent records must tie back to a single identified seller — not a category, not a list of partners, not "and affiliates"
• Existing leads collected under the old rules don't get grandfathered forever — the FCC has signaled enforcement is coming for companies still working old-format consent

The companies that adapted early are fine. The companies still buying leads from aggregators who haven't updated their forms? They're carrying six- and seven-figure liability on their books and most of them don't even know it.

The State Mini-TCPA Wave

Federal TCPA is the floor. It's never been the ceiling.

In 2025 and 2026, state legislatures accelerated their own telecom laws at a pace we haven't seen before. Florida's FTSA was the template — private right of action, $500 per violation, broad ATDS definition — and other states took notes.

The three states driving the most change right now:

Florida (FTSA) remains the most aggressive mini-TCPA in the country. The Florida Telephone Solicitation Act gives consumers a private right of action at $500/call, uses a broader ATDS definition than federal law, and has generated more TCPA-related litigation than any other state statute. If you're making outbound calls into Florida without specific, documented, one-to-one consent — stop reading and go fix that first.

Washington (CEMA) introduced the Commercial Electronic Message Act amendments targeting AI-generated voice calls. Washington now requires explicit disclosure when a call uses AI or synthetic voice technology, and the penalties stack. This isn't theoretical — Washington's AG office has been actively investigating AI voice platforms since Q3 2025.

Oklahoma joined the mini-TCPA trend with its own consumer protection amendments covering unsolicited commercial calls and texts. The law expands state-level enforcement authority and creates additional registration requirements for telemarketers operating in the state.

Beyond these three, at least 15 states introduced telecom-related legislation in 2025-2026 sessions. The trend is clear: states are not waiting for the FCC to act. They're building their own enforcement frameworks, and the penalties are real.

AI Voice Regulation Is Here

This is the one most operators underestimate.

If you're using AI-generated voice for outbound calls — whether that's a full AI agent, a voice clone, or even AI-assisted scripts with synthetic voice — new disclosure requirements apply in multiple jurisdictions.

The key rules:

• FCC: Calls using AI-generated voice are classified as "artificial or prerecorded voice" under the TCPA, requiring prior express written consent for marketing calls
• Washington: Explicit disclosure required at the start of the call that AI is being used
• California: Deepfake and synthetic media laws apply to commercial voice communications
• FTC: Updated guidance classifying undisclosed AI voice in commercial calls as a deceptive practice

The common thread: you must tell people when they're talking to AI. The days of trying to pass off an AI voice agent as a human are numbered everywhere, and already illegal in several states.

This doesn't mean you can't use AI voice technology. It means you need proper disclosures, proper consent, and proper documentation. The operators who get this right will have a massive efficiency advantage. The operators who try to hide the AI will get the lawsuits.

What You Should Do Right Now

Stop reading about compliance theory. Here's the action list:

1. Audit Your Consent Records

Pull every active lead source. For each one, verify:

• Does the consent form name your specific company?
• Is the consent separate from consent for other companies?
• Can you produce the consent record with timestamp, IP, and form language?

If any answer is "no" — stop calling those leads.

2. Update Your Lead Gen Agreements

If you buy leads from aggregators or comparison sites, get written confirmation that their forms comply with the one-to-one consent rule. Get a copy of the actual form language. If they can't produce it or it still shows blanket consent, find a new lead source.

3. Check Every State You Call Into

Federal compliance is not enough. Use the TCPA Guide state pages to check:

• Does the state have a mini-TCPA?
• Are calling hours stricter than federal?
• Is there a state DNC list you need to scrub against?
• Does the state require telemarketer registration?

One missed state registration can turn a routine compliance audit into an enforcement action.

4. Add AI Disclosures

If you use any AI voice technology, add disclosure language at the top of every call. Don't wait for every state to pass a law — the FCC and FTC framework already covers you, and "we were waiting for state-level guidance" is not a defense.

5. Document Everything

Consent records, call recordings, DNC scrub logs, AI disclosure confirmations — if it's not documented, it didn't happen. When the class action complaint arrives (and at current enforcement rates, the question is when, not if), your documentation is your defense.

The Bottom Line

2026 compliance isn't harder than 2024 compliance. It's just more specific. The one-to-one consent rule, the state mini-TCPA wave, and AI voice regulations all point in the same direction: you need to know who you're calling, prove they said yes to YOU specifically, and be transparent about your technology.

The operators who treat compliance as infrastructure — not overhead — are the ones still operating profitably. Everyone else is a lawsuit waiting to happen.

TCPA Guide tracks every state regulation, calling hour restriction, consent requirement, and enforcement action in one place. Bookmark it. Use it before every campaign. And if you want someone to audit your specific setup, book a compliance review with Catalyst Partners.