What Actually Changed in TCPA in 2025: The Vacated One-to-One Rule, McKesson & Quiet-Hours Lawsuits

If you read a blog post about US text-message compliance written before 2025, a lot of it is now wrong. The biggest shift: the FCC's "one-to-one consent" rule that everyone spent 2024 panicking about was vacated by a federal appeals court on January 24, 2025 (Insurance Marketing Coalition v. FCC, 11th Circuit) — it never took effect. Three things actually changed in 2025: that rule died, the Supreme Court stripped FCC TCPA orders of their binding force in McLaughlin v. McKesson, and a wave of "quiet-hours" class actions started hitting businesses for texts sent minutes outside the legal window. This article walks through each one in plain English, with the numbers that matter and a do/don't checklist you can actually use.

Is the FCC one-to-one consent rule still in effect?

No. The FCC's one-to-one consent rule was vacated on January 24, 2025, and never took effect — so if a competitor's blog still describes it as upcoming or current law, that content is stale.

Here's the short history. In December 2023 the FCC adopted a rule that would have required "one-to-one" consent: a consumer's prior express written consent could only authorize calls and texts from a single, specifically named seller — not a list of partners buried in fine print. It was scheduled to take effect January 27, 2025. Then, three days before that date, the U.S. Court of Appeals for the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC (No. 24-10277), holding the FCC had exceeded its statutory authority under the TCPA by inventing "prior express consent plus" requirements the statute didn't contain (Wiley / Perkins Coie / Womble Bond Dickinson, 2025).

So what's the actual rule now? The long-standing standard is back and unchanged: marketing texts require prior express written consent. The FCC has since deleted the vacated language. For a small-business owner, the practical takeaway is reassuring — you don't have to rebuild your consent forms around a "one seller per checkbox" rule, because that rule is dead. But you still need documented written consent before you market by text, and that part never went away.

What did McLaughlin v. McKesson change about the TCPA?

On June 20, 2025, the Supreme Court ruled 6-3 in McLaughlin Chiropractic Associates v. McKesson Corp. that federal courts are not bound by the FCC's interpretation of the TCPA — they must read the statute independently and give the agency only "appropriate respect."

This is more consequential than it sounds. For decades, when the FCC issued an order interpreting some ambiguous part of the TCPA, courts largely treated that interpretation as binding. After McKesson, FCC TCPA orders are persuasive, not controlling. A district court judge in Texas can now read the statute differently from a judge in California, and both can decline to follow an FCC carve-out they disagree with (McLaughlin v. McKesson, No. 23-1226, 606 U.S. ___ (2025); Troutman Pepper Locke, 2025).

For your business, this creates uncertainty in both directions. Plaintiffs' lawyers can challenge FCC interpretations they think are too business-friendly; defendants can challenge ones they think are too aggressive. The conservative posture for an SME is simple: don't bet your compliance on a single favorable FCC ruling. Follow the strictest reasonable reading of the statute, keep clean consent records, and treat any "the FCC said it's fine" assurance as weaker than it used to be.

There's a practical reason this matters more for small businesses than for the big corporate defendants the headlines focus on. A large company has in-house counsel to track which FCC orders are still being honored in which circuit; you almost certainly don't. So the realistic move is to stop relying on the precise edges of any one ruling and instead operate well inside the lines — clear written consent, honest opt-out handling, and conservative send times. If a court somewhere reads a rule against you, you want to be nowhere near the edge of it. That's a posture, not a one-time fix, and it's the safest way to absorb a legal landscape that McKesson made genuinely less predictable.

What are the new TCPA opt-out and revocation rules?

As of April 11, 2025, consumers can revoke consent by any reasonable means — not just the word "STOP" — and you must honor that opt-out within 10 business days.

This is the change most likely to trip up an automated messaging system. Under the FCC's revocation order (DA-25-312), certain words are per se valid opt-outs: stop, quit, end, revoke, opt out, cancel, and unsubscribe. But the rule goes further. If a customer replies "please stop texting me" or "take me off your list," that's a valid revocation too, even though it isn't a magic keyword. You're allowed to send one confirmation message within five minutes of the opt-out, as long as it contains no promotional content (Nixon Peabody, 2025).

If you're running an AI agent on a phone-number channel, this is decisive: keyword-only detection is legally insufficient. Your system has to recognize natural-language opt-outs, not just a hardcoded list. The good news is that understanding intent in plain language is exactly what a modern AI agent is built to do — far better than a rigid rules engine that only fires on "STOP."

One related rule is still pending. The "revoke-all" provision — where opting out on one channel revokes consent across all of them — was originally set for April 11, 2026, then delayed, and has now been further extended to January 31, 2027 while the FCC reviews comments (Consumer Financial Services Law Monitor, January 2026). Treat that one as not-yet-in-force but coming, and design as if it's already here.

Can I text customers after 9pm? The quiet-hours litigation wave

No — federal law prohibits marketing texts before 8 a.m. or after 9 p.m. in the recipient's local time, and in 2025 a wave of class-action lawsuits began targeting businesses for messages sent even a few minutes outside that window.

The federal quiet-hours rule (47 C.F.R. § 64.1200(c)) isn't new. What's new is the litigation. Starting in 2025, plaintiffs' firms began filing class actions over texts sent at, say, 9:04 p.m. or 7:55 a.m. — even when the recipient had given consent. The theory: consent to receive messages isn't consent to receive them outside the legal hours. A petition asking the FCC to clarify this is pending, but until it's resolved, the litigation risk is live and real (Privacy World, 2025).

Several states are stricter than the federal floor, and this is where automated systems get sloppy. Florida and Oklahoma effectively run 8 a.m.-8 p.m.; Texas SB 140 sets 9 a.m.-9 p.m. on weekdays with tighter Sunday limits (Postscript / Privacy World, 2025). The recipient's local time is what controls, so a business in New York texting a customer in California at 8:30 p.m. Eastern is hitting that customer at 5:30 p.m. Pacific — fine — but the reverse can put you over the line. Any AI agent that sends outbound marketing texts needs timezone-aware send windows, not a single server-clock cutoff.

What makes quiet-hours claims attractive to plaintiffs' firms is how easy they are to prove. There's no dispute about what was said in the message or whether the recipient was annoyed — the timestamp either falls inside the window or it doesn't. A single mistimed automated campaign can sweep in thousands of recipients, and with damages running per message, that's a class action that practically builds itself. For a small operator the lesson is blunt: the safest send time is comfortably inside the window, not right up against 9 p.m., and you should let the system enforce that rather than trusting whoever scheduled the blast to do the timezone math in their head.

How much can a TCPA violation cost a small business?

TCPA statutory damages run up to $500 per unsolicited text and up to $1,500 per knowing or willful violation — and because damages are per message, a single bad campaign to a list can multiply into real money fast.

That's the math that makes the TCPA one of the most litigated consumer-protection statutes in the country (47 U.S.C. § 227 / Texty Pro, 2026). Send 2,000 marketing texts without proper consent and you're theoretically looking at $1 million in exposure before you account for willfulness multipliers. You don't need to be a spammer to get caught — a misconfigured opt-out flow or a single after-hours blast to a consented list is enough to draw a demand letter.

State "mini-TCPAs" stack on top of the federal exposure. Connecticut bans marketing outreach without written consent and allows up to $20,000 per violation; Oklahoma caps calls at three per 24 hours (research brief, 2026). So "we got their number from a form" is not a defense, and "they bought from us once" is not consent to market. Consent is tied to the person and the specific purpose — it isn't transferable, and you can't buy, rent, or share a list and inherit consent with it.

Here's how the 2025 changes net out against the old understanding:

Does the TCPA apply to WhatsApp and web chat?

Generally not today — the TCPA targets calls and texts sent to a telephone number over the carrier network, so messages exchanged inside WhatsApp or a web-chat widget over the internet are largely outside its reach. But "largely" is doing real work in that sentence, and you shouldn't read it as a free pass.

This is a genuine, underappreciated reason to think about channel as part of your compliance strategy. Because in-app and web messages aren't SMS/MMS to a phone number, the core TCPA consent-and-quiet-hours machinery generally doesn't attach to them the way it attaches to texts (Troutman Amin / TCPAWorld commentary, 2025). For a small business that wants to stay reachable without living in fear of a $500-per-message lawsuit, shifting conversations into a web widget or WhatsApp meaningfully lowers the surface area.

Three honest caveats, because anyone who tells you it's settled is overselling it. First, courts could read the TCPA more broadly, and at least one has applied it to app messages that were ultimately delivered as SMS. Second, a pending bill (Rep. Pallone) would expand the TCPA's "text message" definition to cover app-based messaging — so this could change. Third, WhatsApp Business has its own rulebook: Meta's Business Policy requires opt-in consent, pre-approved message templates, and runs a quality-rating system that can ban accounts for spam. US SMS over standard 10-digit numbers also still requires 10DLC registration (Conversive, 2025).

The defensible way to think about it: web chat and WhatsApp reduce messaging-consent risk; they don't eliminate compliance duties. This is also where channel mix matters in practice. Omago, an AI agent platform that helps SMEs automate customer conversations across WhatsApp, Telegram, and web chat, leans toward those lower-risk channels by design — but good consent hygiene is still the standard you should hold yourself to regardless of where the conversation happens. If you're weighing where to put your customers, our guide to choosing the right messaging channel for an AI agent goes deeper on the trade-offs.

What should an AI agent on messaging actually do to stay compliant?

It should treat consent, opt-outs, send-time, and identification as hard rules baked into the system — not as policies a human is supposed to remember. The whole point of automating messaging is that the rules get enforced consistently, every time, without someone forgetting to check the clock.

Here's the practical do/don't list for any automated messaging setup on a phone-number channel:

• Get prior express written consent before sending marketing texts. Having a customer's number is not consent to market to them.
• Recognize opt-outs in plain language, not just the word "STOP." Honor any reasonable revocation within 10 business days.
• Send marketing only between 8 a.m. and 9 p.m. in the recipient's local time — and respect stricter state windows (FL/OK 8a-8p; TX 9a-9p weekdays).
• Identify your business in every message so the recipient knows who's texting.
• Never buy, rent, or share phone-number lists — consent is tied to the person, not the number.
• Don't assume any FCC carve-out is litigation-proof post-McKesson; follow the strictest reasonable reading.

The reassuring part is that most of this is exactly the kind of thing software does well and humans do badly. A person managing a list will eventually fire off a "limited-time offer" at 9:15 p.m. or miss a "please leave me alone" because it didn't say STOP. A well-built AI agent enforces the send window, parses the opt-out by intent, logs consent, and stamps the business name on every message — automatically. That said, automation is not a substitute for legal review of your consent language and your privacy notice. If you want the foundational version of these rules without the 2025 news cycle, see our companion piece on TCPA, SMS and WhatsApp compliance fundamentals.

Frequently Asked Questions

Is the FCC one-to-one consent rule still coming?

No. It was vacated by the Eleventh Circuit on January 24, 2025, three days before its scheduled effective date, and the FCC has deleted the rule language (Insurance Marketing Coalition v. FCC, 2025). The standard for marketing texts is still prior express written consent — but the "one named seller per consent" requirement never took effect, so any article describing it as current or upcoming law is out of date.

What happens if I text someone who replied "stop texting me" without the word STOP?

You're at risk. As of April 11, 2025, consumers can revoke consent by any reasonable means, so "stop texting me" is a valid opt-out even though it isn't a per se keyword (FCC Order DA-25-312; Nixon Peabody, 2025). If your system only detects the literal word "STOP" and keeps messaging, each subsequent text can be a separate violation at up to $500 each — or $1,500 if it's deemed willful.

Can I text customers after 9 p.m.?

Not for marketing. Federal law prohibits marketing texts before 8 a.m. or after 9 p.m. in the recipient's local time, and a wave of class-action lawsuits in 2025 has targeted businesses for texts sent just minutes outside that window — even with consent (Privacy World, 2025). Some states are stricter, so build timezone-aware send windows and respect the tightest applicable rule.

Does the TCPA apply to WhatsApp Business messages?

Generally not, because the TCPA targets messages sent to a phone number over the carrier network, and WhatsApp messages travel over the internet (TCPAWorld commentary, 2025). But this isn't settled law — courts could expand coverage, a pending bill could redefine "text message," and WhatsApp Business still imposes Meta's own opt-in and template rules. Treat it as lower-risk, not no-risk.

Are FCC TCPA rulings still binding after McKesson?

No. In McLaughlin v. McKesson (June 20, 2025), the Supreme Court held that courts must interpret the TCPA independently and aren't bound by FCC orders, giving the agency only "appropriate respect" (No. 23-1226, 606 U.S. ___ (2025)). FCC interpretations are now persuasive rather than controlling, which means outcomes can vary by court — so don't rely on a single favorable FCC carve-out as your whole defense.

This article is current as of June 2026 and is general information, not legal advice. The TCPA landscape is in flux — the revoke-all rule, quiet-hours litigation, and the Pallone bill are all unresolved — so consult counsel for your specific situation.

Sources: Insurance Marketing Coalition v. FCC, 11th Cir. (Wiley/Perkins Coie/Womble Bond Dickinson, 2025); McLaughlin Chiropractic Associates v. McKesson Corp., No. 23-1226, 606 U.S. ___ (2025) (Troutman Pepper Locke, 2025); FCC Order DA-25-312 (Nixon Peabody, 2025); Consumer Financial Services Law Monitor (January 2026); Privacy World (2025); Postscript (2025); TCPA 47 U.S.C. § 227 (Texty Pro, 2026); TCPAWorld/Troutman Amin (2025); Conversive (2025).