This page explains what the rules say. It is not legal advice. Where the answer depends on your license, your consent records, or the states you lend in, it says so and tells you who to ask.

What the TCPA covers

The Telephone Consumer Protection Act governs how you contact consumers by phone. It reaches calls, text messages, prerecorded voice, and artificial voice. It sits at 47 U.S.C. § 227.

Text messages count as calls under the statute. That single point is where most mortgage exposure comes from, because texting feels informal and the rules are not.

Damages are $500 per violation. A court can increase that to $1,500 where the violation was willful or knowing. There is no cap on the total.

Read that as per message, not per campaign. A single non-compliant blast to four thousand purchased records is a four thousand violation problem.

Federal law is the floor. Six state examples further down show what sits on top of it.

What changed, and what it means for purchased leads

The rule that would have broken the shared-lead model was struck down in January 2025.

The FCC had adopted a one-to-one consent requirement. Under it, a consumer would have had to consent to each individual seller by name. A lead form listing dozens of lenders would no longer have produced valid consent for any of them.

The Eleventh Circuit vacated it in Insurance Marketing Coalition, Ltd. v. FCC, 127 F.4th 303, decided January 24 2025. The court held the FCC had gone beyond its statutory authority. The mandate issued April 30 2025.

The court struck a second requirement at the same time. Consented calls no longer have to be logically and topically associated with the interaction that produced the consent.

That one gets less attention and it matters here. Consent captured on a refinance form can support a purchase conversation.

The FCC then conformed its rules. Order DA 25-621 on July 14 2025 reverted 47 C.F.R. § 64.1200(f)(9) to the pre-2023 definition. The change took effect August 29 2025.

For anyone buying shared or ping-post leads, that is the single most consequential development of the last two years. The pricing and the economics of the shared lead market rested on it.

It did not eliminate the consent requirement. It restored the older one. Consent still has to be valid, and the plaintiffs’ bar still litigates consent defects.

The revocation rules did take effect

A separate FCC order on revocation of consent took effect on April 11 2025. A consumer can revoke by any reasonable means that clearly expresses the intent to stop.

One part of that order was delayed. It would make a revocation sent to one business unit stop calls from every other unit. Same sender, every channel. Financial institutions asked for time to build it.

The FCC granted a waiver, then extended it. Order DA 26-12, issued January 6 2026 in docket CG 02-278, runs the waiver to January 31 2027.

The waiver is narrow. It covers only the cross-topic requirement. Every other revocation obligation is live now.

The rule is also under review. The FCC opened a proceeding on October 29 2025 asking whether to modify or replace it. The Bureau cited that proceeding as its reason for the extension.

So the date may move again, and the rule itself may change. Do not read either as permission to ignore it.

Timeline of four FCC and court actions on TCPA consent, from the January 2025 vacatur to the January 2027 waiver deadline

Prior express written consent is a signed written agreement. It authorizes marketing calls or texts to one specific number. The calls can be placed by an automated system or a prerecorded voice.

Four elements. The signature. The specific number. Clear and conspicuous disclosure of what is being authorized. And a statement that the consumer is not required to consent as a condition of purchase.

An electronic signature counts. So does a checkbox, in the states that have said so expressly.

Where mortgage consent breaks

Three places, in the order they show up.

Third-party lead forms. You did not draft the disclosure and you cannot see how it was presented. You are relying on a vendor’s record of a moment you were not present for. Ask for the disclosure language, the timestamp, and a screenshot of what the consumer saw. A Trusted Form certificate on each lead is a non-negotiable.

Consent that never named the right contact method. A form authorizing calls does not authorize texts if the disclosure did not say so.

Consent that is real but unprovable. Losing the record is the same as never having it. The burden of showing consent sits with you.

Consent state, opt-out flags, and Do Not Call status are database fields, and they decay like any other field. A number reassigned to a new subscriber carries no consent at all. So consent belongs in data quality, not only in the legal file. It also belongs in the system that does the outreach. A rule enforced somewhere else is a rule someone can bypass. That is the argument for running automated borrower follow-up tools inside the system of record.

When you can call and text

Federal rules restrict telemarketing calls to between 8am and 9pm in the recipient’s local time.

Recipient time, not yours. An 8:30am call from a Pennsylvania desk reaches a California borrower at 5:30am.

Area code is a weak proxy for location, because numbers move with people. Florida presumes a call to its area code reached a Florida resident.

Several states narrow the window further. Pennsylvania goes furthest from October 18 2026. No solicitation calls before 9am, after 7pm, or at any time on Sunday.

Post #26 covers quiet hours in detail. It handles the state variations and the time zone problem on a national file.

Six states that go further than the federal rule

These six are illustrative. They are not a fifty-state survey, and the point is not to memorize them. State law diverges in kind, not in degree. Know the rules where you lend.

State Instrument What it adds
Florida Fla. Stat. § 501.059 Private right of action. Narrowed in 2023. Text claims require a STOP reply first.
Oklahoma 15 O.S. §§ 775C.1–775C.6 8am to 8pm recipient time. Three calls per 24 hours on the same subject.
California Penal Code §§ 632, 637.2; B&P §§ 17511–17513 All-party consent to record. Registration and a $100,000 bond.
Washington RCW 19.158, 19.190 Department of Licensing registration. Flat ban on commercial texts without prior consent.
Texas Bus. & Com. Code ch. 301–305 Texts pulled into the telemarketing regime. $10,000 bond. DTPA claims.
Pennsylvania 73 P.S. §§ 2241–2249, as amended by Act 47 of 2026 Registration and a $50,000 bond. State Do Not Call list. From October 18 2026, no calls before 9am, after 7pm, or on Sundays.

Two statutes that look identical and are not

Oklahoma copied Florida. In 2023 Florida amended its version and Oklahoma did not.

Florida’s automated system trigger now reads selection and dialing, at § 501.059(1)(g). Oklahoma’s still reads selection or dialing, at § 775C.3.

One conjunction. It is the difference between covering most dialing technology and covering very little of it. Oklahoma is now stricter than the statute it was copied from.

Florida also added a pre-suit step for texts. Before suing, the recipient must reply STOP, and the sender has 15 days to stop. That is at § 501.059(10)(c).

Registration is a separate obligation from consent

Several states require you to register as a telemarketer before you call, and to post a bond. That obligation has nothing to do with whether your consent is valid.

Pennsylvania is the clearest example, and it catches people twice.

It triggers by calling a consumer in Pennsylvania. It also triggers if you are in Pennsylvania when the call is placed. The consumer’s state does not matter. A Media office calling Texas registers in Pennsylvania on that second prong.

From the Attorney General’s own guidance:

  • A $50,000 surety bond
  • A $500 application fee
  • Registration valid two years
  • Filed 30 days before you offer anything for sale

Failing to register carries up to two years imprisonment. Also a $5,000 fine and loss of the right to telemarket there.

The exemption most lenders will land in, and what it does not cover

Pennsylvania exempts businesses licensed, certificated, or registered with a federal or state agency. The exemption holds only within the scope of that license.

A licensed lender making calls about lending reads as inside it. The Attorney General’s own illustration draws the line. A utility is exempt for selling gas and electricity. It must register if it starts selling appliances. Scope is defined by what the license covers, not by who holds it.

Texas takes the same shape from a different angle. Chapter 302 exempts supervised financial institutions at § 302.053(4) and companies regulated by the FCC at § 302.053(6).

Exemption from registration is not exemption from everything else. Pennsylvania requires every telemarketer making solicitation calls to buy the state Do Not Call list whether or not they are exempt from registering. That is $495 a year, with 30 days to purge after each quarterly issue. Calling a listed number carries up to $1,000, or $3,000 where the person called is 60 or older.

The burden of proving an exemption sits with whoever claims it. The guidance says so directly. The analysis has to exist in writing before anyone relies on it.

This is the section to take to counsel. Not because the rules are unclear, but because the answer turns on which licenses you hold and what they cover.

Pennsylvania rewrites the whole statute on October 18 2026

Act 47 of 2026, signed July 20, is the first substantial update to the Telemarketer Registration Act since 1996. Everything above describes the law until October 18. After that date most of it moves.

What changes:

  • Texts and ringless voicemail are telephone solicitations. Not by interpretation. By definition.
  • Calling hours narrow to 9am through 7pm, with no calls at all on Sunday. The old window was 8am to 9pm, matching federal. The Sunday ban did not exist before.
  • The consent exclusion tightens. The old law excluded communications made at the consumer’s express request. The new one requires prior express written consent, meaning a signed agreement, a form submission, a checkbox, or similar documentation.
  • Robocalls need prior express written consent for residential, business and wireless lines. Electronic and digital signatures count where they meet E-SIGN.
  • Seven opt-out keywords are codified: STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE. A platform listening only for STOP does not comply.
  • Caller ID falsification is prohibited without an intent requirement. Federal law asks whether you meant to deceive. Pennsylvania does not.
  • Synthetic and computer-generated messaging used to deceive is banned outright.
  • Federal violations travel. Breaching the FTC’s Telemarketing Sales Rule or the FCC’s caller ID rules now creates Pennsylvania exposure as well.

Read the consent change carefully, because it runs opposite to how it is being described. It is a narrowing. A shop relying on a verbal request or an inferred opt-in had an exclusion under the old law. It loses that exclusion under the new one.

The registration relief is real. Two things sit outside the definition of telephone solicitation. Communications made on prior express written consent, and communications within an established business relationship in the past twelve months. Something outside that definition does not trigger registration.

The existing exemptions survive alongside it, including the one for licensed and registered businesses. But some provisions that used to be built into the definition of telemarketer have been reorganized as registration exemptions only. That is not a cosmetic change. Anyone who relied on the older structure should check they land in the same place.

One provision matters more than the others here. The synthetic messaging ban reaches AI-generated voice. That makes Pennsylvania the second state on this page to legislate on it, which is a pattern rather than a California quirk.

Texas, opt-in texting, and the lead list carve-out

Texas SB 140 took effect September 1 2025 and pulled text messages into the telemarketing regime. Registration runs per business location, with a $200 fee and a $10,000 security deposit. A private right of action under the state’s Deceptive Trade Practices Act came with it.

Litigation followed immediately. In September 2025 the Attorney General’s office took the position that consent-based texts are not captured by chapter 302. The case ended in a joint dismissal on November 6 2025, with a stipulated order on November 17.

The Secretary of State’s own guidance now says it plainly. A business sending texts with the consumer’s prior consent does not have to file the registration statement.

The mechanism is narrow. SB 140 gave “telephone call” the meaning in § 304.002. That section excludes certain transmissions to a mobile number the customer agreed to receive.

Three caveats matter more than the relief does.

The reading is contested. Registration triggers on “telephone solicitation,” not on “telephone call.” SB 140 expressly amended the first term to include text messages. Practitioners have flagged the gap.

It is guidance, not a ruling. The Secretary of State asked the Attorney General for a formal opinion on December 17 2025, filed as RQ-0626-KP. As of publication it is still pending, with no opinion associated with the request.

And the carve-out is for consent. Cold texting and third-party lead lists are outside it. If you buy leads and text them, this is not your exemption.

It is not a one-way ratchet, but Pennsylvania is the pattern

Washington moved the other way. HB 2274 was signed on March 23 2026 and took effect June 11 2026. It cut statutory damages for recipients under the state’s email statute. $500 down to $100 per violation. It also added a knowledge element to the false subject line standard.

That followed a wave of class actions after a 2025 state Supreme Court decision.

It changed nothing about texting. RCW 19.190.060 still prohibits commercial texts to Washington numbers without prior affirmative consent.

Washington is the exception. Pennsylvania is the pattern, and Texas moved the same direction in 2025. Plan for tightening and treat a loosening as a bonus.

Recording is a separate statute again

California and Pennsylvania both require all parties to consent before a call is recorded.

California carries the sharper remedy. Penal Code § 637.2 provides the greater of $5,000 per violation or three times actual damages. The section states that the plaintiff need not have suffered actual damages at all.

If you record calls, this exposure is larger than the TCPA. It is also governed by a different body of law. Post #202 covers it.

Prerecorded voice, artificial voice, and AI agents

The TCPA restricts artificial or prerecorded voice calls. That language predates the technology now being sold into mortgage.

California has already legislated on it. AB 2905 amended Public Utilities Code § 2874, which governs automatic dialing-announcing devices. Under that section, an unrecorded natural voice announcement has to come first. It must do three things:

  • State the nature of the call and identify the business
  • Ask whether the person consents to hear the prerecorded message
  • Tell them if that message uses an artificial voice

The section defines artificial voice to include a voice generated using artificial intelligence.

Note the frame. It governs devices that play a prerecorded message. A conversational agent generates speech live and plays no recording. Whether that sits inside the section is not settled by the text.

That is a real open question and not a hedge. Anyone deploying an AI voice agent should answer it with counsel before the first outbound call, not after.

What you have to be able to evidence

Compliance is a records problem more than a policy problem. The fields it depends on decay like any other. The CRM data hygiene checklist covers what rots and how fast.

Four things have to be retrievable on demand.

The consent itself. Timestamp, source, the number consented to, and the exact disclosure language shown to the consumer. A checkbox with no record of what sat next to it proves nothing.

The opt-out and when it was honored. Both facts, not just the flag.

The calling window determination. Which time zone you used and what it was based on.

A retention period long enough to outlast the limitations window. Records that expire before the claim does are not records.

None of that survives if it lives in three systems and a spreadsheet. Consent state and opt-out flags belong in the system that places the calls. Shape holds them on the contact record.

A number reassigned to a new subscriber carries no consent at all. A stale opt-out flag is worse than no flag, because it reads as permission.

The mortgage CRM buyer’s guide compares how the major systems handle consent capture and audit trails.

Figures we left out

Three numbers circulate widely in this category and none of them appears above.

An 8pm calling cutoff and a three-call daily cap, attributed to Florida. Neither is in Fla. Stat. § 501.059. Both are Oklahoma’s, at 15 O.S. § 775C.4. The attribution is repeated across most of the pages ranking for this topic.

A flat $500 to $1,500 per violation range. The $500 is the statutory figure. The $1,500 is a discretionary increase a court may apply for willful or knowing violations. Presenting it as a range implies a floor and a ceiling that do not work that way.

A 2026 figure on how many loan officers text from unapproved platforms. Attributed to a trade publication study we could not locate. Plausible, and not verifiable, so it is not here.

Two published guides call Pennsylvania a one-party recording state. Another says it has no state Do Not Call list. Both are wrong on the face of the Attorney General’s own pages.

Frequently Asked Questions

Does the TCPA apply to text messages?+

Yes. Text messages are treated as calls under the TCPA, and the same consent rules apply. Marketing texts sent with an automated system require prior express written consent. Damages run at $500 per message, and a court can raise that to $1,500 where the violation was willful. Several states add their own texting rules on top.

Is the one-to-one consent rule still in effect?+

No. The Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, decided January 24 2025. The FCC conformed its rules and the change took effect August 29 2025. The pre-2023 prior-express-written-consent standard governs. Shared and purchased lead consent still has to meet it, and consent defects remain the most litigated issue here.

Do mortgage lenders have to register as telemarketers?+

It depends on the state and on your license. Pennsylvania and Texas both exempt licensed or regulated financial businesses acting within the scope of their license. Registration exemption does not remove other obligations, and Pennsylvania still requires exempt callers to buy its Do Not Call list. The burden of proving an exemption falls on the business claiming it.

Can a loan officer record calls with borrowers?+

It depends on where the parties are. Most states allow recording with one party’s consent. California and Pennsylvania require all parties to consent. California’s remedy is the greater of $5,000 per violation or treble damages. No showing of actual harm is required. Recording rules sit outside the TCPA entirely.

Can an AI voice agent legally call mortgage leads?+

The TCPA restricts artificial and prerecorded voice calls, and California requires disclosure when a prerecorded message uses an artificial voice. Those rules are written around devices that play recordings. Whether a real-time conversational agent falls inside them is unsettled. Answer that with counsel before deploying one.