Contributors

Related

The FCC has given callers two long-sought compliance accommodations and expanded banks’ ability to send fraud alerts. In a Report and Order adopted September 30, 2026, the Commission narrowed its 2024 “revoke all” rule. An opt-out from one category of automated informational calls and texts no longer need apply to every communication from that caller. The Order also allows callers to choose an exclusive method for revoking consent, rather than recognizing revocations made in “any reasonable manner,” and expands the financial institutions’ fraud-alert exemption beyond wireless numbers provided directly by customers. A companion Further Notice of Proposed Rulemaking (FNPRM) asks whether the Commission should shorten the deadline for honoring revocations and require callers to also provide a one-step “revoke all” option.

The Order addresses two rules from the FCC’s 2024 TCPA Consent Order that the agency proposed revisiting in a 2025 FNPRM. The first, the “revoke all” rule, treated an opt-out from one communication, such as a payment reminder, as revoking consent to all robocalls from that caller, including fraud alerts and appointment reminders. Industry and consumer groups argued that the rule conflicted with consumer expectations and needed costly system changes across platforms and channels. The Consumer and Governmental Affairs Bureau (CGB) waived the provision twice, most recently through January 31, 2027, so it never took effect. The second rule barred callers from limiting revocations to a specified method under the “any reasonable manner” standard, even though the FCC identified three methods as automatically reasonable. Those methods are an automated voice or key-press option during a call, a reply text using “STOP” or another standardized word, and a caller-provided website or telephone number.

FCC Reverses Course on Broad “Revoke All” Requirements

The FCC concluded that a single opt-out should not automatically revoke consent to all informational calls and texts because that approach may block communications consumers still want. Callers may now treat a revocation made in response to an informational message as limited to that message category. The change is optional, so callers that already apply opt-outs across all categories may continue doing so. The Order does not define “category,” but provides examples such as payment reminders, fraud alerts, multi-factor authentication codes, appointment reminders, and utility outage notices. Callers must therefore draw defensible category lines that reflect the consumer’s clear intent. Telemarketing is still subject to a broader rule. An opt-out from an advertising or telemarketing message revokes consent to all telemarketing from that caller, and a do-not-call request also covers affiliates the consumer would reasonably expect it to include.

Callers may also designate one or more of the three approved methods as the exclusive means of revocation and need not process requests made through other channels. To do so, callers must clearly and conspicuously disclose the designated method on each call or in each text. The Commission rejected allowing callers to choose when and how to provide notice. It did, however, confirm that a text sender need not list all seven standardized opt-out words in every message. “Reply STOP to opt out” is sufficient if the sender honors all seven words. The FCC also declined to let callers subject to other agencies’ rules, including debt collectors, substitute those agencies’ revocation methods. Existing opt-out requirements for exempt calls and prerecorded telemarketing calls remain unchanged. Callers that do not designate an exclusive method remain subject to the “any reasonable manner” standard and its rebuttable presumption.

Banks Gain Broader Authority to Send Fraud Alerts

The narrower fraud-alert change will be significant for financial institutions such as banks and credit unions. The 2015 exemption allows financial institutions to send fraud, data-breach, and money-transfer alerts to wireless numbers without prior consent but previously required the customer to provide the number. The Order replaces that condition with a “reliable source” standard. Covered sources include an authorized spouse or family member, caller identification captured when the customer contacts the institution, and records obtained from another institution. The other rule requirements are the same, including the three-message-per-event limit over three days and the requirement to honor opt-outs immediately. The FCC also encouraged financial institutions to consult the Reassigned Numbers Database. The Commission declined to extend the exemption to other messages or industries.

The Order also directs the CGB, in consultation with the Enforcement Bureau, to rewrite section the TCPA rules in plain language. The current rule’s evolution over nearly three decades has resulted in dense provisions addressing automated, prerecorded, and artificial calls and texts, do-not-call requirements, and call blocking. The CGB may not make substantive changes and must seek comment before adopting revisions. The effort could still benefit businesses with text-message programs. Compliance teams must reconcile FCC requirements with carrier and CTIA 10DLC registration and messaging rules, which use different terms for consent, opt-outs, and content categories. A clearer federal rule would make those frameworks easier to compare and help identify where carrier requirements exceed the regulatory minimum.

The FNPRM builds on a joint proposal from the American Bankers Association, the National Consumer Law Center, and ACA International. The Commission seeks comment on whether to reduce the deadline for honoring revocations from ten business days to seven, eliminate one-way texting protocols that cannot receive replies, condition category-specific opt-outs on offering an automated “revoke all” option, and treat separately branded affiliates and divisions as separate callers. It also asks whether a revocation should apply only to the number that received it rather than every number on the account, whether to shorten the list of standardized opt-out words, and whether confirmation texts may ask which category the consumer intended to stop. Separately, the Order authorizes the CGB to propose a plain-language rewrite of the FCC’s rules without substantive changes and after further comment.

How Businesses Should Respond

Businesses should begin preparing now. The amendments take effect thirty (30) days after Federal Register publication, well before the January 2027 date many compliance teams anticipated for the narrower “revoke all” rule. Callers should decide whether to use category-specific opt-outs and, if so, define and document those categories using the FCC’s examples. They should also consider whether to choose an exclusive revocation method and revise call scripts and text templates to disclose it on every contact. Financial institutions should review how they obtain wireless numbers and whether to rely on the expanded exemption. Businesses aligning FCC requirements with 10DLC carrier rules should monitor the Bureau’s plain-language proposal and consider commenting on provisions that are difficult to implement in text-messaging programs.

Comments on the FNPRM are due thirty (30) days after Federal Register publication, and replies are due thirty (30) days later. Callers in the financial, health care, utility, and collections sectors should consider addressing the proposed seven-day deadline and mandatory “revoke all” requirement.

If you have any questions about the issues raised in this alert, please contact the authors or the Womble Bond Dickinson attorneys with whom you normally work.