FCC 1-to-1 Consent Rule: What Changed for AI Calling in 2025

TL;DR

The FCC's 1-to-1 consent rule (effective January 2025) requires that consumers give consent to be contacted by a specific, named seller about a specific topic. Blanket consent shared across multiple companies is no longer valid. AI callback from your own website forms already satisfies this rule because the lead consents directly on your form, to your company, about the service they requested. This guide explains the rule, what changed, and why first-party AI callback is one of the cleanest compliance paths available.

What Is the FCC 1-to-1 Consent Rule?

In December 2023, the FCC adopted a rule requiring "one-to-one" consent for telemarketing calls and texts made using automated technology. The rule took full effect on January 27, 2025. It closes the "lead generator loophole" that allowed a single consumer consent to be shared with dozens of sellers.

Under the previous framework, a consumer filling out a form on a lead generation website could unknowingly consent to receive calls from 10, 20, or even 50 different companies. The new rule eliminates this. Consent must now be:

Seller-specific. The consumer must consent to receive calls from one identified seller at a time.
Topic-specific. The consent must relate to the specific subject matter the consumer inquired about.
Logically and topically related. The calls must be logically connected to the interaction that produced the consent.

A lead form that says "By submitting, you agree to be contacted by our partners" with a long list of companies buried in fine print no longer satisfies the consent requirement for any of those companies.

What Changed for Lead Generation

The biggest impact is on third-party lead generators and comparison shopping sites. Before the rule, a consumer requesting a home insurance quote on a comparison site might trigger calls from 15 different insurance agents. The consumer consented once, and that single consent was sold to every agent willing to pay for the lead.

Under the new rule, each of those 15 agents would need separate, individual consent from the consumer. In practice, this means:

Lead generators must restructure their forms to obtain consent for each seller individually
Comparison sites must present each company separately and let the consumer choose which ones can contact them
Lead buyers can no longer rely on a single shared consent form as their TCPA defense
Consent records must clearly document that the consumer agreed to contact from the specific company that called

Why AI Callback from Your Own Forms Already Complies

If you are using AI callback to call leads who submit forms on your own website, the 1-to-1 consent rule does not change anything about your compliance posture. Here is why:

Seller-specific by default. The form is on your website, branded with your company name. The consent language identifies your company. There is no ambiguity about who will be calling.
Topic-specific by default. The lead is requesting information about your specific service. A roofing form generates a roofing call. A dental form generates a dental appointment call. The topic is inherently matched.
One company, one call. Your AI is calling on behalf of your business only. There is no consent sharing, no lead reselling, no ambiguity about which company is calling or why.

This is the core advantage of first-party lead generation with AI callback. The consent chain is short, clear, and auditable. The lead submitted your form, consented to a call from your company, and your AI called them about the exact service they requested.

Comparison: First-Party vs Third-Party Consent

The difference between first-party and third-party consent under the new rule is stark:

First-Party (Your Website Form + AI Callback)

Lead visits your website and fills out your contact form
Form includes consent language naming your company
Lead checks consent checkbox (unchecked by default)
AI calls back within 60 seconds on behalf of your company
Call is about the specific service the lead requested
Consent documentation: timestamped form submission with checkbox state, IP, and form URL

Third-Party (Lead Aggregator)

Lead visits a comparison or lead generation site
Lead fills out a form that may list multiple companies
Under the new rule, lead must individually consent to each company
Lead data is sold to multiple buyers, each needing their own consent record
Multiple companies may call about the same inquiry
Consent chain is longer and harder to prove in a dispute

If you are currently buying leads from third-party generators, ask your provider how they are obtaining 1-to-1 consent under the new rule. If they cannot show you a clear, seller-specific consent record for each lead, you are exposed to TCPA liability.

How to Strengthen Your First-Party Consent

Even though first-party AI callback is already well-positioned, there are steps you can take to make your consent documentation bulletproof:

Name your company in the consent language. Instead of generic language like "you agree to be contacted," use "you agree to receive an automated phone call from [Your Company Name]."
Reference the specific service. Add context: "regarding your [service type] inquiry." This satisfies the topic-specific requirement explicitly.
Use an unchecked checkbox. The consent must be affirmative. Pre-checked boxes do not count under the TCPA, and the FCC has reaffirmed this position.
Include the "not required for purchase" language. State that consent is not a condition of purchasing any goods or services.
Log everything. Record the timestamp, IP address, form URL, checkbox state, and exact consent language displayed at the time of submission. Store these records for at least 5 years.

What About Lead Forms on Google and Facebook?

Google Lead Form Extensions and Facebook Lead Ads present a nuanced scenario. The form is hosted on the ad platform, not your website, but the lead is responding to your ad specifically.

Under the 1-to-1 rule, this is generally compliant because:

Your ad identifies your company
The form is triggered by the lead clicking on your specific ad
The lead is consenting to contact from the advertiser (you), not from a list of companies

However, best practice is to include explicit consent language in the form's privacy notice or disclaimer text. Both Google and Facebook allow custom disclaimer text in their lead forms. Use it to add clear, seller-specific consent language. For a detailed guide on Google Ads lead form compliance, see our sister site's TCPA compliance guide for Google Ads AI callback.

Enforcement and Penalties

The FCC enforces TCPA violations through both direct enforcement and by empowering private lawsuits. The penalties have not changed:

$500 per violation for standard violations
$1,500 per violation for willful or knowing violations
Each call without proper consent is a separate violation

Class action TCPA lawsuits remain one of the most active areas of consumer litigation. The 1-to-1 rule gives plaintiffs' attorneys a new angle of attack against companies relying on shared consent from lead generators. If you are using third-party leads and cannot demonstrate seller-specific consent, your exposure is significant.

Action Steps

Whether you are already using AI callback or evaluating it, here is what to do:

Audit your lead sources. Identify which leads come from your own forms (first-party) and which come from third-party lead generators.
Review third-party consent documentation. Ask every lead provider for a sample consent record. Verify it names your company specifically and relates to the topic of the lead.
Update your own forms. Ensure your consent language names your company and references the service topic. Use an unchecked checkbox.
Shift toward first-party lead generation. The 1-to-1 rule makes first-party leads more valuable because the consent is inherently cleaner. Invest in your own website, content, and advertising.
Document everything. Whether you use AI callback or human follow-up, maintain detailed consent records for every lead you contact.

Disclaimer: This guide provides general information about FCC regulations and TCPA compliance. It is not legal advice. Consult with a qualified attorney for guidance specific to your business, industry, and jurisdictions.

Want to see how AI callback works with compliant, first-party website forms? Book a discovery call and we will walk through your setup.

Frequently Asked Questions

Does the 1-to-1 consent rule apply to AI calling?

Yes. The rule applies to all calls made using an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice, which includes AI voice agents. Any AI calling system that contacts consumers needs seller-specific, topic-specific consent from each individual.

Can a lead form still list multiple companies?

Yes, but the consumer must give separate, individual consent to each company. A single checkbox covering multiple sellers no longer satisfies the consent requirement. Each company must be presented individually with its own consent mechanism.

Does this rule affect calls to business numbers (B2B)?

The TCPA's consent requirements primarily apply to calls to residential and mobile numbers. Calls to business lines using automated systems have different (generally less restrictive) requirements. However, many B2B leads provide personal cell phones, which are fully covered by the rule. When in doubt, treat every number as requiring full consent.

How does this interact with state-level calling regulations?

The FCC rule is a federal baseline. States can (and do) impose additional restrictions. For example, Florida's Telephone Solicitation Act has its own consent requirements, and California layers on CCPA data handling rules. Always comply with both federal and applicable state regulations. See our TCPA compliance guide for more on state-specific requirements.

What should I do if I am buying leads from a third-party generator?

Request written documentation showing how your provider obtains 1-to-1, seller-specific consent that names your company. If they cannot provide this, you should stop using those leads for automated calling until the consent process is updated. The liability falls on the company making the call, not just the lead generator.