The Three-Part Test: Before, In Writing, Provable

You cannot prove consent if you never recorded it. The legal standard for prior written consent rests on three specific pillars: timing, format, and evidence.

The first pillar is timing. Permission must be obtained before the contact occurs. In the context of U.S. telemarketing regulations, this means the agreement exists before the first automated call or text is sent. You cannot retroactively claim consent after a lead has already received a message.

The second pillar is format. The permission must be in a durable, written form. This includes signed agreements, electronic signatures, or affirmative actions on a digital form. The Federal Communications Commission standard requires a signed written agreement that clearly authorizes specific marketing calls. It must also specify the phone number and disclose that consent is not a condition of purchase.

The third pillar is provability. You must be able to demonstrate how and when consent was given. Under GDPR Article 7, businesses bear the burden of proof. If a regulator asks for evidence, you cannot just say "we asked." You need a timestamped record.

Many common practices fail this three-part test completely. They look like consent to an untrained eye, but they do not hold up legally.

• Pre-ticked boxes that users must actively uncheck.
• Silence or inactivity interpreted as agreement.
• Vague permission statements that lack specific scope.
• Implied consent derived from previous business relationships.

These methods do not create a defensible record. A recent Fifth Circuit ruling challenged the strict written requirement for oral consent, but that decision applies only within its specific circuit. Outside of that jurisdiction, written consent remains the safest standard.

The stakes are high. GDPR consent violations account for roughly 35% of all fines issued, with penalties reaching up to €20 million or 4% of global revenue. In the U.S., the TCPA imposes penalties of $500 per call, rising to $1,500 for willful violations.

When you choose an outreach provider, you are not just buying a service. You are accepting shared liability. The FTC has made it clear that you cannot contract away your legal responsibility to comply with the law. Even if a vendor handles the sending, your name is on the list.

Worqd approaches this by treating consent as a continuous system, not a one-time checkbox. Our booking funnel requires explicit, affirmative opt-in before any contact occurs. We use permission-aware outreach that respects these boundaries. This ensures that every interaction is grounded in a documented, provable agreement.

Ask your provider for their consent records. If they cannot show you the timestamp and method of capture, they do not meet the standard. Your reputation depends on it.

Why the Rules Change by Channel and Country

Consent rules shift depending on the channel you use and where your prospect lives. A single blanket policy won't hold up across voice, email, and text, because each medium sits under a different legal framework with its own definitions of what counts as permission.

In the U.S., the TCPA requires prior express written consent for any autodialed or prerecorded marketing call or text, regardless of whether the number is a mobile or landline. Live calls to corporate landlines follow a looser rule: you can generally call without prior consent, but you must still honor Do Not Call list scrubbing at least every 31 days, per compliance guidance on cold-calling law.

Email sits under different rules entirely. The FTC's CAN-SPAM framework does not require prior consent at all. Instead it demands accurate headers, honest subject lines, and a working opt-out mechanism, with penalties reaching up to $53,088 per violating email according to the FTC's compliance guide for business.

Across the EU, the picture gets more complicated:

• GDPR B2B cold email typically relies on legitimate interest under Article 6(1)(f), backed by a documented Legitimate Interest Assessment rather than a consent form.
• Germany and Austria generally require prior consent even for B2B email, a stricter national reading of the same framework.
• Canada's CASL requires express consent or narrowly defined implied consent before the first commercial electronic message.

The practical takeaway for any provider handling multi-channel outreach: the legal basis changes with the medium and the jurisdiction, so consent handling has to be channel-aware. A team running paid ads, cold email, and AI-driven follow-up needs different documentation for each path. That's why Worqd runs permission-aware B2B outreach that maps to the specific legal basis each channel requires, rather than treating consent as a one-time checkbox across every touchpoint.

If you're evaluating a provider, ask how they document consent for each channel separately. The answer reveals whether they understand that consent is not one policy but several, each tied to a different statute and a different risk profile.

The Cost of Getting It Wrong (and the Shifting Legal Ground)

The penalties for getting consent wrong are not theoretical. Regulators have collected roughly €7.1 billion in GDPR fines since May 2018, and about 35% of those fines involved consent violations, according to a DLA Piper survey cited by Scrap.io. That single category outweighs most other enforcement themes combined.

The exposure varies sharply by regime. CAN-SPAM allows up to $53,088 per violating email, GDPR reaches €20 million or 4% of global revenue, CASL tops out at $10 million per violation for corporations, and the TCPA carries $500 per call, rising to $1,500 for willful violations, as outlined in this compliance breakdown. Per-violation math matters: a list of 10,000 contacts is not one mistake, it is 10,000.

• SOLOCAL: €900,000 for prospecting without consent (CNIL, 2025)
• Orange France: €50,000,000 for ads served without clear consent, affecting 7.8 million people
• Carrefour Spain: €3,050,000 for failed unsubscribe handling
• Verkada: $2,950,000 FTC penalty for missing unsubscribe links

Two live developments make the ground shift under anyone relying on loose consent. On February 25, 2026, the Fifth Circuit ruled in Bradford v. Sovereign Pest Control of TX, Inc. that the TCPA does not distinguish between written and oral consent, rejecting the FCC's 2012 written-consent rule, per Holland & Knight's analysis. That applies inside the Fifth Circuit only. Elsewhere, written consent remains the prudent standard, and the court itself cautioned that oral consent must be carefully documented and independently verifiable.

Then there is the FCC's revoke-all-consent rule, effective January 31, 2027, which requires senders to stop all consent-based robocalls and robotexts the moment someone revokes. Consent is never permanent, and revocation can arrive in any reasonable form, not just a "STOP" reply.

For B2B outreach, the standard is channel-specific rather than uniform. GDPR cold email generally rests on legitimate interest with a documented assessment, while automated calls require prior express written consent. That is why Worqd treats outreach as permission-aware and requires explicit opt-in in its booking funnel, where contacts agree to be reached about their request. Written, documented consent remains the safe standard everywhere the law is still unsettled, and the burden of proof sits with you regardless of who sends the message.

What to Ask a Provider Before You Sign

Ask any provider to show you the paperwork, not describe it. Compliance liability stays with you even when you outsource the work, since the FTC is explicit that you cannot contract away your legal responsibility to follow the law. That single fact turns "we handle consent" from a reassurance into a question: prove it.

Request these records before you sign anything:

• Consent records showing how and when each contact opted in, since GDPR Article 7 requires you to demonstrate consent, not just hold it.
• Opt-out logs with timestamps, because revocations must be honored within 10 business days and suppression lists kept at least four years.
• Legitimate interest assessments for B2B prospecting, the documented basis that separates a routine workday from a €900,000 fine.
• DNC scrubbing records showing a refresh at least every 31 days.
• Disclosure of third-party data sources, which GDPR Article 14 requires within one month.

Those numbers matter because the consequences are real. CAN-SPAM penalties run up to $53,088 per violating email, and GDPR fines have reached €7.1 billion since May 2018, with roughly 35% tied to consent violations. A provider who cannot produce logs for opt-outs, scrubbing, and data provenance is selling you a promise, not a system.

Ask one more question: which consent standard applies to each channel? Automated and prerecorded calls require prior express written consent, while B2B cold email under GDPR properly rests on legitimate interest. A provider applying one blanket rule to every channel has not thought it through. Note too that the Fifth Circuit's February 2026 ruling in Bradford v. Sovereign Pest Control held the TCPA does not require written consent, but that applies only within its circuit, and the FCC's "revoke all consent" rule takes effect January 31, 2027. Written, documented consent stays the safest standard.

Worqd builds consent into the funnel itself: the booking form carries an explicit "I agree to be contacted about my request" opt-in, and outreach stays permission-aware rather than templated. That's the posture to demand from anyone you hire.

How Worqd Handles Consent in Practice

When you hand your contact details to a company, the moment of consent should be obvious. That's the standard the research sets: a proactive opt-in, captured in writing, that the business can later prove. Under GDPR Article 7, consent must be demonstrable, and pre-ticked boxes, silence, or vague permission statements don't count as valid opt-ins (compliance guidance).

Worqd's booking funnel is built around that standard. Before you can book a growth call, you check a box that says "I agree to be contacted about my request." It's an explicit, affirmative action, which is exactly the kind of online form or electronic checkbox the FCC recognizes as valid written consent under the TCPA framework (consent basics). The funnel also states plainly that your details will only be used to prepare for the call. That matters, because the FCC standard expects consent to be scoped: you authorize contact about a specific request, not an open-ended license to market anything, forever.

The same channel-aware thinking shows up in Worqd's B2B outreach. The company describes its approach as "personalized, permission-aware outreach to relevant accounts," explicitly positioning it as the opposite of a template blast. That's the right legal posture, and the research explains why. For B2B cold email in the EU, prior consent generally isn't even possible before the first touch; legitimate interest is the designed mechanism for that scenario, while Germany and Austria do require prior consent even in B2B contexts (GDPR cold email analysis). Meanwhile, automated or prerecorded calls in the U.S. require prior express written consent regardless of line type. A provider that treats every channel identically is getting something wrong somewhere.

A few practices worth noting in how Worqd frames this:

• Consent is captured before contact happens, through an explicit opt-in rather than an assumption buried in terms of service.
• The stated use of your details is narrow: preparing for the call you requested.
• B2B outreach is personalized to relevant accounts instead of sent as an undifferentiated blast, which aligns with the "B2B is not a blanket license" caution compliance sources emphasize.
• No sensitive form fields are sent to public analytics tools, limiting where your data travels.

One honest caveat: these are Worqd's stated practices, drawn from its own site. No outside research in this article independently verified them. That's why the advice in the previous section applies here too. When you evaluate any provider, including this one, ask for the actual mechanics. How is consent recorded? Where are opt-out logs kept? Can they produce a consent record on request? Remember that even if you hire an agency to handle outreach, you can't contract away your legal responsibility to comply (FTC guidance), and with roughly 35% of GDPR fines involving consent violations, the paperwork is what separates a fine from a normal workday.

If you want to see how the funnel handles consent firsthand, book a growth call at worqd.com/book and read the opt-in language for yourself before you share anything.