The Consent Rules That Actually Apply to Your Outreach

Outreach compliance stopped being a set-it-and-forget-it task. In 2025 alone, the rules governing how you contact prospects shifted twice at the federal level, and the standard you meet still depends on the channel you're using and the country you're sending into.

Start with calls and texts. Under the TCPA, prior express written consent means permission that is written, signed by the consumer, built on clear disclosures, and given through an affirmative action. A pre-ticked box a consumer has to uncheck does not count, according to IAPP's breakdown of the FCC marketing rules. Violations run $500 per message, or $1,500 if willful.

The 1-to-1 rule, which would have required separate consent for each seller, took effect January 27, 2025, was vacated by the Eleventh Circuit on January 24, 2025, and gave way to the FCC's prior written-consent standard on August 29, 2025, as ActiveProspect's consent timeline documents. Practitioners still recommend 1-to-1 style consent anyway, since stricter-than-required consent is the safer posture. Since April 11, 2025, consumers can revoke consent by any reasonable means, and businesses must honor that within 10 business days.

Canada works differently. CASL requires consent before any commercial electronic message, and the sender carries the burden of proving it was obtained, per the CRTC's CASL guidance. Email under CAN-SPAM is the outlier: it's opt-out, not opt-in, but penalties reach $53,088 per email and liability is shared between the promoted company and the sender.

• Calls and texts: prior express written consent, affirmative opt-in, no pre-ticked boxes.
• Revocations: honored within 10 business days.
• Canadian recipients: consent first, sender proves it.
• Email: opt-out, but $53,088 per-email penalties and shared liability.

This is why a provider's consent practices matter before you sign. Worqd captures explicit opt-in consent in its booking funnel and runs permission-aware outreach to relevant accounts rather than template blasts, so the consent standard is applied consistently across channels.

More demand. Faster follow-up. Better creative. Book a growth call and we'll walk through how consent-first outreach fits your funnel.

Why Your Provider's Consent Practices Are Your Risk

Outsourcing your outreach doesn't outsource your legal exposure. Whoever sends the message, the rules still land on you, and regulators have made that position explicit in both the U.S. and Canada.

Start with Canada. Under CASL, the onus is on the sender to prove consent existed, and senders are frequently unable to prove it when enforcement comes knocking. If your provider can't produce records showing who consented, when, and to what language, you're the one left standing without evidence. CASL does offer a due diligence defense if you can show you took reasonable steps to prevent the violation, which makes vetting a provider's consent practices a genuine legal shield, not just good manners.

The U.S. works the same way for email. The FTC's CAN-SPAM compliance guide is blunt: liability falls on both the company being promoted and the sender, and you can't contract away your responsibility to comply. A tidy indemnification clause in your agency agreement doesn't change what the FTC says.

The dollar figures explain why this matters. Under the TCPA, penalties run $500 per violation, or $1,500 per call or text if the violation is willful, and those numbers stack fast across a campaign. The FTC's Telemarketing Sales Rule sets a minimum five-year retention window for consent records, so "we deleted the form data" isn't a defense either.

Then there's the problem nobody likes to talk about: bots. According to consent documentation analysis, sophisticated bots can submit forms using real consumer data and check consent boxes with no human intent behind the action. That "consent" isn't legally defensible, yet it sits in your CRM looking legitimate until a plaintiff's attorney tests it.

When you evaluate a provider, ask a few direct questions:

• Can they show you the exact consent language each contact saw, with timestamps?
• Do they require an affirmative opt-in, never a pre-ticked box a person must uncheck?
• How do they filter bot submissions before a lead ever enters a sequence?
• Do they retain consent records for at least five years?

Providers who take consent seriously tend to talk about it unprompted. Worqd, for example, requires explicit opt-in in its own booking funnel ("I agree to be contacted about my request") and describes its B2B outreach as permission-aware and personalized rather than a template blast. That's the pattern you want: consent treated as a design principle, not a disclaimer buried in fine print.

Consent discipline won't show up in a pitch deck's growth slides. But it's one of the clearest signals you'll get about whether a provider will still be a safe partner two years from now, when the records are what count.

What Permission-Aware Outreach Looks Like in Practice

A consent standard only matters if you can show how you met it. When a regulator or a court asks "did this person agree to hear from you?", the answer lives in your records, not in your intentions.

The affirmative opt-in pattern

Start with how consent gets captured. Under the TCPA, prior express written consent must be in writing, include the consumer's signature, and carry clear and conspicuous disclosures, according to analysis of the FCC's reinstated standard. It also has to be an active choice. A summary of the FCC's marketing rules notes that consent "cannot be a pre-ticked box a consumer has to uncheck to refuse the communications." The person opts in. Nobody opts them in by default.

You'll see this pattern in Worqd's booking funnel, which asks visitors to check a box reading "I agree to be contacted about my request" before the call gets scheduled. The form also states that the details you share are only used to prepare for that call. That's the affirmative model in miniature: specific language, tied to a specific request, checked by a human.

What to record, and for how long

Capture is half the job. The other half is documentation, because under Canada's CASL the burden of proving consent sits with the sender, per the CRTC's guidance. If you can't produce the record, the law treats the message as unsolicited. The FTC's Telemarketing Sales Rule sets a floor of five years of record retention for consent documentation.

A defensible consent record includes:

• The date and time the consent was given
• The source, meaning the exact form, page, or interaction
• The exact consent language the person saw and agreed to
• How the person opted in, such as an unchecked box they actively ticked
• Any later revocation, since consumers can now withdraw consent by any reasonable means, with businesses required to honor it within 10 business days

Legal counsel writing for McMillan on CASL enforcement points out that senders are frequently unable to prove they obtained consent before sending, and that maintaining a tracking method for consent is the prudent posture. Records are also what support a due diligence defense if a violation happens anyway.

Channel-specific rules

Calls and texts to mobile numbers carry the strictest bar: prior express written consent, with TCPA penalties of $500 per violation and $1,500 if the violation is willful or knowing. Email works differently. The FTC's CAN-SPAM guide explains that commercial email, including B2B, doesn't require prior consent at all. It's an opt-out law: accurate headers, honest subject lines, a valid physical postal address, and a working unsubscribe honored within 10 business days. Penalties run up to $53,088 per email, and liability attaches to both the sender and the company being promoted, so you can't contract the responsibility onto your vendor.

That shared liability is why consent discipline matters when you're choosing a growth partner. Worqd describes its B2B outreach as "personalized, permission-aware outreach to relevant accounts, the opposite of a template blast," which is the working posture worth asking any provider about: how consent is captured, what language is shown, and how long the records are kept. If a provider can't answer those three questions quickly, treat that as a finding.

How to Check a Provider's Consent Practices Before You Sign

The regulatory ground shifts fast, but your exposure stays constant. You need to know if your provider actually captures consent or just hopes for the best.

Prior express written consent requires a documented, opt-in action. It cannot be a pre-ticked box or an implied assumption. The consumer must actively agree to be contacted by a specific seller. Recent FCC guidance clarifies that this consent must be in writing and include the consumer’s signature.

This creates a direct risk for you. Under the CAN-SPAM Act, liability is shared between the promoted company and the sender. You cannot contract away your legal responsibility to comply with the law. FTC resources confirm that you remain liable even if your vendor handles the outreach.

Ask these questions before you sign any agreement:

• Where is consent captured? Is it a distinct, affirmative action separate from general terms and conditions?
• How are records stored? Can they show you the specific timestamp and method for each consent record?
• What is their retention policy? The FTC Telemarketing Sales Rule suggests keeping records for a minimum of five years.
• How do they handle revocation? They must honor requests within 10 business days under current TCPA rules.
• Do they apply consent-first practices across every channel? Or only where strictly legally required for calls and texts?

Email presents a unique nuance. The CAN-SPAM Act is an opt-out law, not an opt-in law. It does not require prior consent to send commercial messages. However, the penalties are severe. You face fines of up to $53,088 per separate email in violation. A provider that treats email with the same rigor as phone calls protects you from these costly mistakes.

Worqd operates with a "permission-aware" approach to outreach. Our booking funnel includes explicit consent language, such as "I agree to be contacted about my request." This ensures we never rely on ambiguous permission. We document the interaction so you are never guessing about compliance.

The legal landscape is volatile. The FCC’s one-to-one consent rule was vacated in early 2025, but the prior standard was reinstated later that year. Legal analysts still recommend the stricter, one-to-one model as a safe posture. If a provider cannot show you the consent record, you are carrying the risk. Stricter-than-required practices are the only reliable shield against liability.