Why the Definition Matters Before You Sign an Outreach Contract

Hire an outreach provider without asking how they define consent, and you're the one holding the legal risk. The FTC is blunt on this point: even if you hire another company to handle your email marketing, you can't contract away your legal responsibility to comply with the law. Your vendor's shortcuts become your liability.

And the exposure is per message, not per campaign. Under CAN-SPAM, penalties run up to $53,088 per violating email. Under the TCPA, it's $500 to $1,500 per call or text, and lawsuits can reach back four years. A single bad list of a few thousand contacts can turn into a seven-figure problem fast.

This is why "prior written consent" matters before you sign anything. It's the strictest consent standard in U.S. outreach law: a clear, standalone, documented agreement obtained before any marketing call or text, with no pre-checked boxes and no bundling into terms of service. Purdue Global Law School notes that promotional texts are strictly prohibited without it, and the agreement can't be a condition of making a purchase.

The rules also shift depending on where your recipient sits, not where you do. CAN-SPAM takes an opt-out approach for U.S. email, but GDPR, CASL, and most other regimes require consent before you send. A US business emailing someone in Germany means GDPR applies to that contact. A provider that only meets one jurisdiction's minimum will fail you the moment you cross a border.

So when you evaluate a provider, ask a simple question: what counts as consent in your process? You're looking for answers like:

• Consent is captured in writing, with a timestamp and a record you can produce later.
• The opt-in is standalone and clearly discloses what the person is agreeing to.
• Contacts come from real interactions, never scraped or purchased lists, which research on B2B data compliance shows are fundamentally incapable of obtaining consent.
• Consent can be revoked at any time, and revocation is honored quickly.

One more reason to insist on the strict standard: the law is in flux. In February 2026, the Fifth Circuit rejected the FCC's written-consent rule for automated calls, holding that oral consent can suffice, but only within that circuit. Other circuits and state statutes still require written consent, and companies must still show clear, direct, and unequivocal consent. Documented written consent is the one standard that satisfies every regime at once.

That's the baseline we hold ourselves to at Worqd. Our booking funnel requires explicit agreement ("I agree to be contacted about my request"), and our B2B outreach is personalized, permission-aware outreach to relevant accounts, not a template blast. If a provider can't describe their consent standard that clearly, keep looking.

What Prior Written Consent Actually Requires

Under the Telephone Consumer Protection Act, prior written consent has a precise legal name: prior express written consent (PEWC). It's the strictest consent standard in U.S. outreach law, and it applies before you send marketing texts, autodialed calls, or prerecorded voice messages. According to Purdue Global Law School, the TCPA strictly prohibits promotional texts without it, and the agreement "cannot be a condition of making a purchase."

That last part matters more than most businesses realize. You can't bury the opt-in inside your terms of service or make signing up the price of buying something. The consent has to stand on its own.

So what does valid written consent actually look like? The mechanics are consistent across sources:

• A standalone opt-in with no pre-checked boxes
• Clear disclosure of exactly what the person is agreeing to receive
• Identification of who will be sending the messages
• Documented records with a date, signature (e-signatures qualify), and contact number
• The right to revoke consent at any time

Skip the disclosure step and the consent collapses. As Purdue Global Law School notes, failing to tell users what they're signing up for invalidates the agreement entirely. And keeping records isn't optional housekeeping: consent logs should be retained at least five years, and TCPA lawsuits can reach back four years.

The same idea shows up in other bodies of law, just under different names. Under HIPAA, using patient health information for marketing requires written authorization specifically for that use, not a checked box at registration. Under GDPR, consent must be "freely given, specific, informed, and unambiguous," which rules out pre-ticked checkboxes and bundling consent into general terms and conditions, according to Securiti's analysis of GDPR email rules. France's CNIL fined Google €50M partly for invalid consent around ad personalization, so regulators take the mechanics seriously.

Here's the practical takeaway for anyone vetting a growth partner: the law follows the recipient, not the sender. A US business emailing someone in Germany means GDPR applies to that contact. That's why we treat explicit written consent as the baseline everywhere, not a nice-to-have in one jurisdiction. When you book a growth call with Worqd, the funnel asks for explicit agreement ("I agree to be contacted about my request") before any follow-up happens, and our B2B outreach is permission-aware outreach to relevant accounts rather than a template blast to scraped lists.

That distinction isn't cosmetic. Scraping tools simply extract contact information without any mechanism for agreement, which means scraped and purchased lists can't produce valid consent at all. Get this wrong and the numbers get ugly fast: TCPA penalties run $500 to $1,500 per call or text, and CAN-SPAM violations can cost up to $53,088 per email. Documented, timestamped consent obtained before outreach is the standard that holds up under every regime, and it's the only one worth building on.

The Law Follows the Recipient, Not the Sender

Here's a question most senders get wrong: whose law applies when you hit "send"? The answer is the recipient's, not yours. A US business emailing someone in Germany means GDPR applies to that contact, even though the sender's home country runs on an opt-out model.

The split matters because the rules point in opposite directions. The US CAN-SPAM Act lets you email first and honor opt-outs within 10 business days; the FTC's guidance confirms you don't need consent to send marketing emails to US recipients. But GDPR in Europe, CASL in Canada, Australia's Spam Act, Brazil's LGPD, and several others require consent before the first message. One list, two legal realities.

The stakes scale fast. CAN-SPAM penalties run up to $53,088 per violating email, and TCPA claims run $500 to $1,500 per call or text, with lawsuits reaching back four years. Enforcement isn't theoretical: security company Verkada paid a $2.95M settlement in 2024, the largest in FTC history, after sending 30 million emails over three years with no opt-out and no physical address.

The rules are also shifting under your feet. In February 2026, the Fifth Circuit ruled in Bradford v. Sovereign Pest Control that express consent under the TCPA can be oral, not just written. But that holding applies only within the Fifth Circuit. Other circuits and state telemarketing statutes can still require written consent, and companies must still show "clear, direct and unequivocal consent" either way. Attorneys at Holland & Knight advise that even oral consent should be documented and independently verifiable to withstand future scrutiny.

That patchwork is why documented written consent has become the practical safe harbor. It satisfies the strictest regime on the map, so you don't have to re-litigate the question contact by contact:

• GDPR consent must be freely given, specific, informed, and unambiguous, with no pre-ticked boxes.
• CASL fines reach $10M CAD per violation for organizations.
• Scraped or purchased lists can't produce valid consent anywhere; automated tools extract data with no mechanism for agreement.
• Liability can't be outsourced. Even if you hire another company to handle your email, you can't contract away your legal responsibility.

That last point is worth pausing on when you're choosing a growth partner. If a provider blasts purchased lists on your behalf, the penalty lands on you. Worqd takes the opposite approach: its booking funnel asks for explicit agreement ("I agree to be contacted about my request") before any follow-up, and its B2B outreach is personalized, permission-aware outreach to relevant accounts rather than a template blast. When the law follows the recipient, consent-first is the only standard that travels well.

CTA text: Want outreach that's permission-aware from the first touch? Book a growth call and we'll show you how we build your pipeline the compliant way.

How Worqd Builds Consent Into Every Touch

Compliance isn't something you want to find out about after the first complaint. The penalties stack up fast: up to $53,088 per violating email under CAN-SPAM, and $500 to $1,500 per call or text under the TCPA, with lawsuits reaching back four years. So when you're choosing a growth partner, the question worth asking is simple: how do they actually get consent?

Worqd's stated practices map cleanly onto the valid-consent checklist that regulators and courts use. Here's how the pieces fit.

Consent captured before contact, in plain language. The booking funnel at Worqd requires explicit agreement before any follow-up happens: "I agree to be contacted about my request." That's a standalone opt-in tied to a specific purpose, which is exactly what the TCPA standard demands. Under the law, the agreement must be clear, unambiguous, and documented, and it can't be a condition of making a purchase. A checkbox buried in terms and conditions fails that test. A direct statement about what the person is agreeing to passes it.

Permission-aware outreach, not blasts. Worqd describes its B2B outreach as "personalized, permission-aware outreach to relevant accounts, the opposite of a template blast." That distinction matters legally. Automated scraping tools are fundamentally incapable of obtaining consent; they extract information with no mechanism for agreement from the person whose data is being taken. Under GDPR, purchased lists are generally prohibited, and if an organization can't verify that people on a list consented to direct marketing, it must not use the list at all. Worqd doesn't rely on scraped or purchased lists, which removes the biggest source of invalid consent in B2B outreach.

Disclosure of what the data is for. The booking funnel also states that details are only used to prepare for the call. Failing to tell people what they're signing up for invalidates consent, so this kind of plain disclosure isn't just good manners. It's the difference between consent that holds up and consent that doesn't.

Why does this matter for you as a buyer? Because liability can't be outsourced. The FTC is explicit that hiring another company to handle your marketing doesn't contract away your legal responsibility, and for purchased leads, liability falls on the calling brand, not the seller. If your provider cuts corners, the fine lands on you.

There's also the shifting legal ground to consider. In February 2026, the Fifth Circuit rejected the FCC's written-consent rule for the TCPA, holding that express consent can be oral or written, but only within that circuit. Other jurisdictions and state statutes still require written consent, and attorneys at Holland & Knight advise that any consent be carefully documented and independently verifiable regardless.

That's the case for a consent-first standard. When a provider captures explicit, documented, written consent before every touch, it satisfies the strictest regime on the books, which means it satisfies all of them. CASL in Canada, GDPR in Europe, the TCPA in the US: one standard covers everything, and you never have to wonder which law applied to which email.

If you want to see how that works in practice, book a growth call and watch the consent step yourself. It's the same standard Worqd applies to every campaign it runs.