.png)
6 min read
Summary: The FCC has pushed its TCPA "revoke-all" requirement out to January 31, 2027, but the rest of the consent revocation rule has been in force since April 2025. This guide explains what counts as a valid opt-out, how quickly you have to honor it, and how in-house AR teams should build opt-out handling into their outreach.
If your team collects on its own overdue accounts by text and email, one word from a customer changes what you're allowed to do next: stop.
Handling that word correctly has quietly become one of the most expensive details in consumer communications. The FCC's consent revocation rule, adopted as part of its 2024 Opt-Out Order, reshaped how businesses must accept and process opt-out requests. Most of it has applied since April 11, 2025. The one piece everyone was waiting on — the "revoke-all" requirement — was delayed again in January 2026 and now takes effect January 31, 2027.
That delay has been reported as breathing room. For accounts receivable teams, it mostly isn't. Here's what already applies, what's coming, and how to build an opt-out process that holds up.
What the FCC's consent revocation rule actually requires
The 2024 Opt-Out Order codified rules that had previously been scattered across FCC declaratory rulings. Two parts matter most to anyone sending payment reminders.
Consumers can revoke consent by any reasonable means
You cannot require a customer to opt out through a channel or keyword of your choosing. Under the FCC's rules, a consumer may revoke consent through "any reasonable manner that clearly expresses a desire not to receive further calls or text messages."
In texting, the FCC treats a reply of stop, quit, end, revoke, opt out, cancel, or unsubscribe as a per se reasonable revocation. Critically, that list is a floor, not a ceiling — other words and phrases are not precluded. "Please don't text me about this again" is a revocation even though no keyword appears in it.
The practical consequence: carrier-level keyword filtering is not a compliance program. If your outreach platform only suppresses on the seven magic words, free-text replies that clearly ask you to stop will slip through.
You have ten business days, and one confirmation message
Revocation requests must be honored as soon as practicable, and no later than ten business days after receipt.
You are allowed to send a single confirmation message acknowledging the opt-out, provided it goes out within five minutes of the request and contains no promotional content. If you send a confirmation asking the consumer to clarify the scope of their request and they don't respond, the FCC has said you should treat that silence as a revocation for all robocalls and robotexts from your organization.
What got delayed to January 2027, and what didn't
On January 6, 2026, the FCC's Consumer and Governmental Affairs Bureau issued a Second Extension Order pushing the effective date of one narrow piece of the rule to January 31, 2027.
That piece is the "revoke-all" requirement: the obligation to treat a revocation made in response to one type of informational message as applying to all future robocalls and robotexts from that caller, including on unrelated matters. The Bureau granted the extension while the Commission considers whether to modify the requirement in response to a 2025 rulemaking, and because multiple organizations said they'd face significant burdens building the cross-business-unit suppression it demands.
The extension is genuinely narrow. As the order itself notes, it does not change a caller's existing obligation to honor reasonable opt-out requests under the TCPA. Everything in the previous section still applies today.
Why in-house AR teams can't treat this as an agency problem
There's a common assumption among first-party teams that collections regulation is something third-party agencies worry about. For Regulation F, that's largely fair — Reg F implements the FDCPA and generally applies to third-party debt collectors, not to creditors collecting their own debts.
The TCPA draws no such line. It applies to whoever places the call or sends the text. Move your outreach in-house and you inherit the obligation directly.
The exposure is per message, not per campaign. The TCPA's private right of action provides $500 in statutory damages per violation, trebled to as much as $1,500 for willful or knowing violations. A suppression gap that lets four reminders go out to two hundred customers is not a small number. And TCPA class action activity has been climbing sharply — filings spiked 283% year over year in September 2025 alone.
The uncomfortable irony is that teams which brought collections in-house to reduce cost and regulatory surface area often have the least mature suppression infrastructure: reminders sent from a billing system, service notifications from a CRM, and no shared record of who asked to be left alone.
TCPA and Reg F opt-outs are not the same obligation
If both regimes touch your operation — say you use an outside agency for later-stage accounts, or you've purchased debt — you need to satisfy both, which in practice means meeting the stricter requirement.
Regulation F requires a clear and conspicuous opt-out notice in every electronic communication and attempt to communicate, describing a reasonable and simple method to opt out of further messages to that specific email address or phone number. A hyperlink or "reply STOP" both qualify. It also requires honoring a consumer's request that a particular medium not be used at all, and it limits any opt-out confirmation to nothing beyond the confirmation itself.
The TCPA governs consent for regulated calls and texts, allows revocation by any reasonable means, and sets the ten-business-day clock.
The difference that trips teams up: Reg F opt-outs are scoped to a specific address or number, while the TCPA's revoke-all rule will eventually reach across your whole organization. Design for the broader one.
Building an opt-out process that holds up
- Capture opt-outs from every inbound channel. SMS replies, email replies, the payment portal, inbound calls, live chat, and mail. If a customer can reach you, they can revoke there.
- Don't rely on keyword matching alone. Route free-text inbound replies to human or AI review, and err toward suppression when intent is ambiguous.
- Suppress at the person level, not the account level. This is the single most common failure, and it's the exact gap the revoke-all rule is designed to close.
- Timestamp everything. Record what the customer said, when it arrived, when suppression took effect, and which systems it propagated to. Your records are your defense.
- Keep the confirmation clean. One message, within five minutes, no balance, no payment link, no offer.
- Re-test after every change. New campaign, new vendor, new integration — re-verify that an opt-out in one place stops messages everywhere.
Get ahead of January 31, 2027
Treat revoke-all as your design target now rather than a 2027 project. Map every outreach program to a single customer identity, consolidate suppression into one authoritative list, and confirm that any vendor sending messages on your behalf reads from it in near real time. Teams that do this get a quieter benefit too: customers who feel heard the first time they ask for something are meaningfully more likely to engage when you follow up on a real balance.
Dash is built for teams recovering overdue balances in-house, with automated text and email outreach, self-service payment options, and the audit trail to show exactly what was sent and when. If your opt-out handling currently lives across three systems and a spreadsheet, see Dash in action.
This article is general information for accounts receivable and collections teams, not legal advice. Consult counsel about how these rules apply to your specific communications program.
