TCPA Consent for Law Firm Intake Texts

Last reviewed 31 July 2026  ·  Federal sources current through the review date; not legal advice.

Did the FCC one-to-one consent rule take effect?

No. In January 2025, the Eleventh Circuit vacated Part III.D of the FCC’s 2023 Order, which contained the one-to-one consent restrictions, and remanded the matter to the FCC.¹ Forms should not describe that vacated rule as a current federal requirement.

The decision did not repeal the TCPA or every FCC consent rule. It removed a specific set of restrictions. A firm still needs to analyze the type of message, the technology used, whether the communication is informational or marketing, and what consent or exception applies.

Does a website intake checkbox make every text compliant?

No. A checkbox is evidence, not blanket immunity. The form language, number supplied, message purpose, sending technology, disclosure placement, and later conduct all matter. The workflow should store the exact disclosure version, timestamp, source page, number, and user action.

If the person does not agree to texts, the system should not silently treat an email address or case description as SMS permission. It can use another permitted channel or route the lead to staff.

How should a law firm handle STOP and other revocations?

Treat reasonable opt-out language as a command to suppress future automated texts, not merely as text to classify later. The FCC has long recognized revocation through reasonable means, and its consent-order rules address confirmation texts and do-not-call procedures.²

A safe design records suppression before any optional database update, rechecks suppression immediately before send, cancels queued messages, sends at most the permitted confirmation, and makes repeated STOP requests idempotent.

What changed in the FCC revocation rules for 2026?

The FCC extended a limited waiver under section 64.1200(a)(10) until 31 January 2027.³ It concerns treating a revocation made in response to one informational message as applying to unrelated robocalls and robotexts from that caller. The Order says this does not delay the other consent-order rules.

That narrow waiver should not be confused with the vacated one-to-one lead-generation rule. They concern different provisions and different compliance questions.

Is an immediate reply to an inbound lead always exempt?

No universal exemption should be assumed. A requested, case-specific intake reply is operationally different from an unsolicited marketing campaign, but TCPA analysis still depends on the message, technology, relationship, and consent record. Keep intake replies and later promotional messages in separate policies and systems.

Do not append marketing offers to an intake exchange merely because the person submitted a form. If the firm wants a later campaign, evaluate and document that purpose separately.

What records should the intake system retain?

Retain enough evidence to reconstruct why the message was sent. That includes the consent event, disclosure text and version, source URL, timestamp, normalized number, purpose, provider identifier, delivery status, opt-out event, and suppression result. Limit retention and access according to the firm’s privacy and security policy.

The record should let the firm reconstruct why a message was sent without exposing more prospective-client data than necessary. Access controls, tenant isolation, and deletion logs belong in the design.

What should be tested before launch?

Test both the permitted and blocked paths. Include checked and unchecked consent, malformed numbers, duplicates, STOP before a lead exists, repeated STOP, HELP, a queued message after opt-out, a provider failure, and staff takeover. Verify the database and delivery status, not only the client-facing screen.

Have TCPA counsel review the exact disclosure, scripts, routing, and provider configuration. A generic article cannot determine the lawfulness of a specific campaign.

Is the FCC one-to-one consent rule currently in effect?

No. The Eleventh Circuit vacated Part III.D of the FCC's 2023 Order in January 2025. That removed the one-to-one consent restrictions in that part of the Order, but it did not erase the TCPA or every other FCC consent and revocation rule.

Is a checked website checkbox enough for every automated text?

No. It is one piece of evidence. The disclosure, message purpose, technology, number, source, and later opt-out behavior still matter. Store the exact disclosure version, timestamp, source page, number, and user action.

What should happen when a lead texts STOP?

Record suppression before later optional updates, cancel queued automated texts, send only any permitted confirmation, and make repeated STOP requests safe. Recheck suppression immediately before every send.

Can a law firm text someone who did not check the SMS box?

Do not treat an unchecked box as permission. Route the inquiry through another permitted channel or to staff, and have counsel determine whether a different basis applies to the specific message and technology.

Does an intake reply count as marketing?

A requested case-specific response differs from an unsolicited promotional campaign. The exact legal classification still depends on the message and circumstances. Keep intake and marketing workflows separate.

What TCPA evidence should an intake platform preserve?

Preserve enough evidence to reconstruct the send. Include the disclosure version, consent event, timestamp, source, normalized number, purpose, provider identifier, delivery status, revocation, and suppression result, subject to the firm's retention and access policy.