Blog

Guides and insights on AI voice agents, call centers, and calling at scale.

Compliance & Regulations

Consent for Business Calls: What It Means and How to Get It Right

Published September 8, 2025

Consent sits at the center of almost every rule about business calls and texts. Whether a call is legal often depends not on what's said, or even how it's made, but on whether the person agreed to receive it.

Yet consent is also one of the most misunderstood parts of calling compliance. Businesses sometimes assume that having someone's phone number means they can call it, that ticking a box on a website covers any kind of call, or that consent once given lasts forever. None of these is necessarily true. This article explains what consent means for business calls, the different types that exist, how to obtain and record it properly, and how it can be withdrawn.

This article is for general information only and isn't legal advice. Consent requirements vary by country, type of call, and circumstance, and businesses should seek legal advice for their specific situation.

Why Consent Matters

Consent is how the law balances a business's interest in reaching people with a person's right not to be disturbed. Calls that people have agreed to receive are, by definition, less intrusive. Calls that they haven't agreed to, especially automated or marketing calls, are the ones laws are designed to restrict.

In practice, consent can determine whether a call is allowed at all, whether a business can call someone on a Do Not Call list, and whether it can use automated dialing, prerecorded messages, or AI-generated voices. Getting it wrong can lead to complaints, regulatory action, and, in the United States, lawsuits where damages are calculated per call.

Consent in the United States

In the US, the most important consent rules come from the Telephone Consumer Protection Act (TCPA) and the rules issued under it by the Federal Communications Commission (FCC). There are two main levels of consent.

Prior express consent

Prior express consent is the basic level. It's generally required for non-marketing calls and texts to mobile phones made using an autodialer or an artificial or prerecorded voice, such as appointment reminders, delivery updates, or account notifications.

This kind of consent doesn't have to be in writing. In many situations, when a person knowingly gives their phone number to a business, for example when making a purchase or opening an account, that can count as consent to be contacted at that number about related matters. But the consent is limited to the purpose for which the number was provided. Giving a number to arrange a delivery doesn't mean agreeing to sales calls.

Prior express written consent

Prior express written consent is a higher standard, required for telemarketing calls and texts made using an autodialer or an artificial or prerecorded voice, including AI-generated voices.

Under FCC rules, prior express written consent must be:

A written agreement, which can be signed electronically, for example through a website form or a text message reply, as long as it meets the requirements for electronic signatures.
Clear in what it authorizes, stating that the person agrees to receive marketing calls or texts from the specific seller using automated technology or an artificial or prerecorded voice.
Tied to a specific phone number, which the person provides.
Accompanied by a clear disclosure that the person isn't required to give consent as a condition of buying anything.

The person must understand what they're agreeing to. Consent hidden in long terms and conditions, or worded so vaguely that the person couldn't know they were agreeing to marketing calls, is unlikely to meet the standard.

Consent through lead generation

Many businesses obtain contacts through lead generation, where a website, often a comparison site or online form, collects people's details and passes them to businesses that then contact them.

This area has drawn significant attention. Some lead generation forms have been criticized for gathering consent on behalf of long lists of businesses at once, often without the person realizing who would be calling them. In 2023, the FCC adopted a rule requiring consent to be given to one seller at a time, but a federal appeals court struck that rule down in early 2025 before it took effect.

Even so, the underlying requirement remains: consent must clearly cover the specific business making the call. Businesses that buy leads should check exactly how consent was collected, what the person saw, and whether the business is clearly named, rather than assuming the lead provider has handled it correctly.

Consent and the Do Not Call Registry

For live telemarketing calls, consent also matters because of the National Do Not Call Registry. A business generally can't make telemarketing calls to registered numbers unless it has the person's express written permission to call that number, or an established business relationship exists.

Consent in the United Kingdom

In the UK, consent for calls is governed mainly by the Privacy and Electronic Communications Regulations (PECR), along with the UK GDPR, which sets the standard for what valid consent looks like.

The standard for valid consent

Under UK data protection law, consent must be:

Freely given, meaning the person has a genuine choice and isn't pressured or required to agree in order to get something unrelated.
Specific, covering particular purposes and, for marketing, the particular organization.
Informed, so the person knows who is asking and what they're agreeing to.
Unambiguous, given through a clear positive action, such as ticking an unticked box. Silence, pre-ticked boxes, or simply not objecting don't count.
As easy to withdraw as it was to give.

When consent is required for calls

Automated marketing calls, including recorded messages, require the person's specific prior consent to receive automated calls from that organization. This applies regardless of whether they're registered with the Telephone Preference Service (TPS).

Live marketing calls to TPS-registered numbers require that the person has specifically told the organization they don't object to its calls.

Live marketing calls to numbers not on the TPS don't always require consent, but the business still needs a lawful basis for using the person's personal data, must identify itself, and must stop calling if asked.

The Scope of Consent

Consent isn't a blanket permission. It has limits, and calls that go beyond those limits may not be covered. Consent is generally limited to:

The business it was given to. Consent to one company doesn't extend to its partners, affiliates, or anyone it sells the data to, unless the person clearly agreed to that.

The purpose it was given for. Agreeing to appointment reminders isn't the same as agreeing to sales calls.

The type of contact. Agreeing to emails isn't agreeing to calls, and agreeing to live calls isn't necessarily agreeing to automated or prerecorded ones.

The phone number provided. Consent attaches to a specific number, and if that number is later reassigned to someone else, the consent doesn't pass to the new owner.

Proving Consent

When a business relies on consent, it's usually responsible for being able to prove it. If a complaint or legal claim arises, saying "they agreed" isn't enough without evidence.

Good consent records typically include:

Who gave consent, including their name and phone number.
When it was given, with a date and time.
How it was given, such as through a website form, a recorded call, or a text reply.
Exactly what the person saw or heard, including the wording of the consent statement at that time.
Where it was given, such as the web page address and, for online forms, technical details like the device's IP address.
Which businesses and purposes it covered.

Some businesses use third-party services that record the process of a person completing an online form, providing independent evidence of what they saw and agreed to.

Records should be kept for as long as the consent is relied on, and for a reasonable period afterward in case questions arise.

Withdrawing Consent

People can change their minds, and both US and UK rules recognize their right to withdraw consent.

In the United States, the FCC has made clear that people can revoke consent through any reasonable means, such as saying "stop calling me" on a call, replying "stop" or similar words to a text, or contacting the business another way. Businesses can't insist that people use one specific method. Under rules adopted in 2024, these requests must be honored within a short period, no more than ten business days.

In the United Kingdom, withdrawing consent must be as easy as giving it, and businesses must stop relying on consent once it's withdrawn.

Businesses should make sure that every route through which someone might withdraw consent, whether it's a call, text, email, or form, actually leads to that person's number being removed from calling lists, across all relevant systems and any partners calling on their behalf.

Common Consent Mistakes

Many consent problems come from the same handful of mistakes:

Assuming a phone number equals consent for any kind of call.
Burying consent in lengthy terms and conditions where people won't notice it.
Using pre-ticked boxes or making consent a condition of purchase.
Relying on vague wording that doesn't clearly name the business or the type of calls.
Using consent beyond its scope, such as making sales calls to people who only agreed to service updates.
Buying leads without checking how consent was obtained.
Failing to keep records that prove consent was given.
Not acting on withdrawals promptly, or only honoring them through certain channels.
Calling reassigned numbers, where the new owner never gave consent.

Good Practice for Business Calls

A few principles help businesses get consent right:

Be clear and specific. Say exactly who will contact the person, how, and why.
Make it a genuine choice. Use unticked boxes or clear opt-in actions, and don't require consent to buy something.
Separate different types of consent, such as marketing calls, texts, and automated calls, so people can choose each one.
Record everything, including the exact wording shown and when and how consent was given.
Respect the limits of what was agreed.
Check bought-in data carefully before calling anyone.
Make withdrawal easy, and act on it quickly everywhere.
Review consent regularly, especially for older records or numbers that may have been reassigned.

Permission as the Starting Point

Consent is more than a legal box to tick. It's a person telling a business that they're willing to hear from it. Businesses that ask clearly, record carefully, respect the limits of what was agreed, and stop promptly when asked are far less likely to face complaints or legal problems. More importantly, their calls reach people who actually expect them, which makes every conversation more likely to be welcome.