The Short Answer: The TCPA Definition

Prior written consent is a signed, written agreement that clearly authorizes a business to send marketing messages before any are sent. Under the TCPA, it's the strictest tier of consent, defined at 47 CFR § 64.1200(f)(9) as an agreement bearing the signature of the person being contacted that authorizes the seller to deliver advertisements or telemarketing messages.

The word "written" is broader than it sounds. Under the same rule, a signature includes an electronic or digital form, so website forms, text replies, and keypresses all qualify under the E-SIGN Act. Verbal agreement alone does not. A voice recording or spoken "yes" won't satisfy prior express written consent, even though it can meet lower consent standards.

That distinction matters because the TCPA sets three tiers, and the tier you need depends on what you're sending:

• Prior express written consent: required for marketing messages sent via autodialer or prerecorded contact
• Prior express consent: enough for informational or transactional messages, such as appointment reminders, and verbal consent may suffice
• Prior express invitation or permission: applies to manually dialed, non-autodialed calls

Marketing texts demand the top tier, and purely informational texts must stay free of promotional content to remain in the middle one. Valid consent also has to be clear and conspicuous, unbundled from other agreements, collected through unchecked boxes, and revocable at any time. Documentation is where most businesses stumble. Keeping consent records for four or more years matters because that matches the TCPA's statute of limitations, and penalties run $500 to $1,500 per violation, per message.

Worqd builds this into how it works: the booking funnel requires explicit consent before a growth call, and B2B outreach is permission-aware rather than a template blast. If you're hiring any growth partner, remember that liability follows the sender. You can't contract away your responsibility to comply, no matter who sourced the contact.

What Makes Consent Valid (and What Gets Companies Sued)

A single text message can cost a company $1,500. A single misleading email can run $53,088. And a single compliance gap can turn into a class action that dwarfs both numbers. Prior written consent isn't paperwork, it's the difference between a defensible outreach program and a liability waiting to happen.

Courts and regulators have spent years drawing the line. Under the TCPA's definition, valid consent must meet a specific checklist before any marketing message goes out. Miss any element, and the consent collapses, even if the person clicked "submit."

The validity checklist breaks down like this:

• Clear and conspicuous disclosure of what the person is agreeing to receive, in language a real person can read.
• Identification of the specific business that will be contacting them, not a vague "our partners."
• An unchecked, standalone checkbox. Pre-ticked boxes are invalid because no express act of agreement occurred.
• A statement that consent is not a condition of purchase or service.
• Documentation you can produce years later: timestamp, exact language shown, IP, URL, and the signature or equivalent.

The penalty stakes vary by channel and country, and they stack fast. TCPA violations run $500 to $1,500 per text. CAN-SPAM penalties reach $53,088 per email. Under CASL, corporations face up to $10 million per violation. GDPR tops out at €20 million or 4% of global revenue, whichever is greater. These aren't theoretical numbers, they're what plaintiffs' attorneys use to build class actions.

The regulatory ground shifted in January 2025 when the Eleventh Circuit vacated the FCC's one-to-one consent rule days before it took effect. The rule would have required consent for a single identified seller at a time, closing a lead-generator loophole the FCC had flagged in a 2022 enforcement case involving 5,329 marketing partners listed only via hyperlink. With the rule gone, the broader prior standard still applies, but bundled multi-seller consent remains high-risk. A 2022 FCC action cited a site where consumers "consented" to robocalls from thousands of entities hidden behind a hyperlink. That posture still invites scrutiny.

Liability follows the sender, not the lead source. The FTC's guidance is explicit: a company cannot contract away its compliance responsibility, even when hiring an agency or buying a list. Under the TCPA, the business making the call or sending the text carries the exposure if consent is invalid, which is why vetting a provider's consent practices matters as much as vetting their creative.

This is the part where the paperwork stops being abstract. A growth partner that captures explicit opt-in on its booking form, runs permission-aware outreach instead of template blasts, and keeps no sensitive form fields flowing to public analytics is following the same checklist regulators enforce. The companies that get sued are the ones who treated consent as a friction problem to engineer around, rather than a legal standard to meet.

If you're evaluating a provider, ask to see their consent capture flow, the exact language on their opt-in, and how long they retain records. If they can't show you, the $500-per-text math answers the rest.

One List, Many Rulebooks: How Jurisdictions Differ

One email list can trigger four different legal regimes depending on where your recipients sit. The United States takes a surprisingly relaxed view of commercial email, while Canada, the European Union, and Germany all require some form of consent before you hit send.

The U.S. CAN-SPAM Act operates as an opt-out law. The FTC states plainly that you don't need consent to send marketing email; you just need a clear opt-out and honest headers. Penalties reach up to $53,088 per violating message.

Canada's CASL flips that model. Consent must exist before the first email, and regulators can demand proof at any time. Violations run up to $10 million per offense for corporations.

The EU's GDPR requires a lawful basis before sending, usually explicit consent or documented legitimate interest. Penalties top out at €20 million or 4% of global revenue. Germany goes further: its Unfair Competition Act effectively bans cold B2B email without documented prior consent.

The law that applies follows the recipient's location, not yours. A Halifax-based team emailing a contact in Munich answers to German rules. That single fact reshapes how you should think about list management.

The practical fix most experienced senders land on is simple: apply the strictest standard on your list to every recipient. Build your process around CASL-grade consent, and you satisfy CAN-SPAM by default.

• Record where every address came from and when consent was captured
• Use unchecked, standalone opt-in boxes with clear disclosure
• Keep consent records for at least four years to cover the TCPA statute of limitations
• Honor opt-out requests within 10 business days, as CAN-SPAM requires

One warning matters more than most people expect. You can't contract your way out of liability. The FTC is explicit that hiring an agency or buying leads doesn't transfer responsibility; both the promoted company and the sending company can be held accountable.

Under TCPA rules, the business making the contact bears the risk if consent turns out to be invalid, not the lead seller. That makes independent proof of consent your strongest defense.

This is the standard Worqd holds itself to on B2B outreach: personalized, permission-aware contact to relevant accounts, with explicit opt-in captured at the booking stage before any conversation begins. When you're vetting a growth partner, ask directly how they document consent and who carries the liability. The answer tells you a lot about how seriously they take your risk.

How Worqd Handles Consent in Its Own Outreach

You can’t outsource your legal liability for marketing consent. The FTC is clear that even when you hire an agency to handle outreach, you remain legally responsible for compliance with laws like the TCPA and CAN-SPAM. This means the provider you choose must operate under strict, documented consent standards.

Worqd’s internal protocols are designed to meet these high bars without relying on ambiguous practices. Their booking funnel includes an explicit, unchecked checkbox labeled, “I agree to be contacted about my request.” This ensures the user takes an active step to grant permission, rather than being forced into a pre-ticked box. Legal experts note that pre-populated checkboxes are invalid because the customer never performs an express act of agreement.

The company also limits the use of collected data to preparing for the initial call. They do not use these details for unrelated marketing blasts. This aligns with the requirement that consent be specific and not bundled with other permissions. A 2022 FCC enforcement action highlighted the risks of vague consent, where users agreed to calls from thousands of entities listed only via a hyperlink.

Worqd’s B2B outreach strategy is described as personalized and permission-aware. It targets relevant accounts rather than sending template blasts to broad lists. This approach respects the specific nature of consent required for different channels and jurisdictions. For example, while U.S. email law allows for opt-out models, Canadian and EU regulations require consent before the first message is sent.

To ensure transparency and data security, Worqd implements strict analytics policies. Sensitive form fields are never sent to public analytics tools. This prevents personal data from leaking into third-party systems where it could be mishandled or exposed. Such measures are critical for maintaining trust and adhering to privacy standards.

Here is how Worqd’s stated practices map to key validity criteria:

• Explicit consent captured via an unchecked checkbox in the booking funnel
• Details used strictly to prepare for the call, not for broader marketing
• Permission-aware B2B outreach that avoids template blasting
• Exclusion of sensitive form fields from public analytics

These practices reflect a commitment to clear and conspicuous disclosure. The company identifies itself and states the purpose of the contact upfront. This helps users understand exactly what they are agreeing to.

It is important to note that these are Worqd’s own stated policies. No independent third-party source in the current research verifies these specific operational details. However, they align closely with the documentation requirements recommended by compliance experts.

When you vet a growth partner, ask how they handle consent. Look for clear, written agreements and specific use cases for data. A provider that treats consent as a legal obligation rather than a marketing tactic will protect your business from penalties.

The regulatory landscape is shifting, with recent court rulings affecting how consent is interpreted. Staying updated on these changes is essential. Worqd’s approach suggests a focus on long-term compliance rather than short-term gain.

If you are looking for a partner who prioritizes these standards, consider how they handle the initial interaction. The details matter. From the first click to the booked call, every step should respect the user’s explicit permission.

Questions to Ask Before You Hire a Growth Partner

When you hire a growth partner, you're not just buying leads or campaigns. You're inheriting their consent practices, and the liability that comes with them. Before you sign, ask these questions.

Where does the consent actually come from? Under the TCPA, prior express written consent means an agreement, signed by the person contacted, that clearly authorizes a seller to send marketing messages before anything is sent. It's the strictest tier of consent, so vague assurances about "permission-based lists" don't cut it. Ask your partner to name the source of every record: a website form, a text reply, a keypress. If they can't, that's your answer.

Can they produce the records? Valid consent requires documentation: date, signature, phone number, exact opt-in language, timestamp, and URL. Verbal permission alone doesn't satisfy the written standard, and pre-ticked boxes are invalid because the person never took an express action to agree. Ask to see a sample record. If a partner can't show you one, they can't prove consent to a regulator either.

How do opt-outs and revocations work? Consent is revocable at any time, by any reasonable method, and opt-out requests must stop the messages. Ask how fast their system suppresses a contact after a request, and whether that suppression carries across every channel they run for you. CAN-SPAM requires opt-outs honored within 10 business days, but a partner managing live conversations should move faster than the legal floor.

Do they apply the strictest standard? Consent rules swing sharply by jurisdiction. U.S. email runs on an opt-out model, while Canada's CASL and GDPR require consent or another lawful basis before the first message, and Germany effectively prohibits cold email without documented prior consent. If your partner mails into multiple regions, they should apply the strictest standard across the whole list.

Who carries liability if a lead's consent is invalid? You do. The FTC is clear that you cannot contract away your legal responsibility to comply, and under the TCPA the business making the call or sending the text is liable, not the lead seller. Penalties run $500 to $1,500 per violation, per message.

• Ask for the consent source on every record, not a summary of it.
• Request a sample record showing exact language, timestamp, and signature.
• Confirm how fast opt-outs suppress contacts across all channels.
• Ask which jurisdiction's standard governs your list.
• Get in writing who is liable if consent turns out to be invalid.

Worqd's own stated practice is explicit consent inside its booking funnel ("I agree to be contacted about my request") and permission-aware B2B outreach rather than template blasts. That's the posture to demand from any partner. Documented consent isn't just legal cover. It protects the pipeline you're paying to build, because leads you can't legally contact aren't leads at all.

Ready to see how a consent-first growth partner runs the whole path from first click to booked call? Book a growth call and we'll walk through the plan together.