Side by side
| TCPA (calls & texts) | CAN-SPAM (email) | |
|---|---|---|
| Consent model | Consent-first for autodialed or prerecorded/artificial-voice marketing; prior express written consent for telemarketing | Opt-out: no prior consent required for commercial email |
| Opt-out / revocation | Consumers may revoke consent by any reasonable means; under FCC rules effective April 11, 2025, revocations must be honored within 10 business days | Clear opt-out in every message; honor within 10 business days |
| Timing | Telephone solicitations only 8 a.m.–9 p.m. recipient local time; National Do Not Call Registry applies | No time-of-day rule |
| Required content | Caller identification; Do Not Call handling | Accurate headers and subject lines, ad identification where applicable, valid physical postal address |
| Who enforces | FCC, state attorneys general, and private lawsuits | FTC and other agencies; no general private right of action |
| Exposure | Private statutory damages of $500 per violation, up to $1,500 if willful or knowing | Civil penalties up to $53,088 per violating email (FTC inflation adjustment, January 2025) |
What changed in 2025–2026 on the TCPA
- "One-to-one" consent is gone. The FCC's rule requiring consent to be given to one seller at a time was vacated by the Eleventh Circuit on January 24, 2025 (Insurance Marketing Coalition v. FCC), and the FCC later removed it from its rules. The pre-2023 prior-express-written-consent standard applies.
- Revocation rules are live. Since April 11, 2025, consumers can revoke consent by any reasonable means, and businesses must honor it promptly.
- "Revoke-all" is delayed. The broader requirement that a revocation in one context applies to all of a business's robocalls and robotexts has been pushed back; reports indicate the FCC delayed it to January 31, 2027 and is reconsidering parts of it.
Don't forget the states
Several states have their own telemarketing laws that go beyond the TCPA. Texas, for example, brought marketing texts under its telephone solicitation and registration rules on September 1, 2025 — see our SB 140 explainer.
One operating rule for both
The fastest way to stay inside both laws is a single consent and opt-out record that every sending system reads before it sends. That's how Zielit runs email and phone programs: every contact tracked as opted in, opted out or unknown from the moment it's loaded.
This article is general information about marketing operations, not legal advice. Laws and agency rules change; confirm how they apply to your business with qualified counsel.
Frequently asked questions
Does CAN-SPAM require opt-in consent?
No. CAN-SPAM is an opt-out law: it doesn't require prior consent for commercial email, but it requires honest headers and subject lines, a physical postal address, a clear opt-out, and honoring opt-outs within 10 business days.
Does the TCPA apply to text messages?
Yes. Texts are treated as calls under the TCPA, so the same consent rules apply to marketing texts sent with an autodialer.
Is the FCC one-to-one consent rule in effect?
No. It was vacated by the Eleventh Circuit on January 24, 2025, and the FCC subsequently removed it from its regulations.
How fast must a TCPA opt-out be honored?
Under the FCC's revocation rules that took effect April 11, 2025, revocation requests must be honored within 10 business days, and consumers may revoke by any reasonable means.
What is the CAN-SPAM penalty per email?
Up to $53,088 per violating email under the FTC's January 2025 inflation adjustment; the amount is adjusted periodically.