TCPA Revoke-All Rule 2026: What the FCC Just Adopted

The rule everyone had been planning around for eighteen months is not the rule that shipped. On September 30, 2026, the FCC voted at its Open Meeting to adopt the Report and Order it had circulated on September 9, rewriting the TCPA’s “revoke-all” consent rule, the one insurance agencies were told to prepare for by January 31, 2027, and replacing it with something narrower, faster, and structured differently, according to Tech Times’ same-day report on the meeting and a client alert Mac Murray & Shuster LLP published the next morning.

This was not a delay. It is a different rule, with a different shape, arriving on a different schedule, and most of what agencies read about the “revoke-all” rule over the past year, including an earlier version of this article written before the vote, described a version of the rule the FCC has now moved away from. Here is what the adopted order actually does, what’s still settled law today while everyone waits on a Federal Register date, and what to do with both.

What the FCC’s September 30 order actually does

The order the Commission adopted pairs a Report and Order with a Further Notice of Proposed Rulemaking, a combination the FCC uses when it wants to finalize part of a policy while asking for public comment on what else might need to change. Two things in it matter directly to how an insurance agency runs its follow-up calls and texts.

Informational opt-outs get narrower, not broader. Right now, the piece of the 2024 order already in effect links a revocation across channels on the same subject matter: a text opt-out and a call opt-out about the same product are already treated as one revocation. What was still coming, on the original 2027 timeline, was extending that link across every unrelated product and campaign. The adopted order takes informational, non-marketing messages, payment reminders, appointment confirmations, service alerts, in a different direction: a revocation now applies only to the specific category of informational message it responds to, not to every informational message a business sends, per Tech Times’ report on the adopted text. Marketing and telemarketing opt-outs are not changed by this piece; a single revocation there still cancels all future marketing contact from that caller.

Callers can finally pick one exclusive opt-out channel. This is the bigger operational change for anyone running automated dialing and texting. Since April 11, 2025, a business has not been allowed to tell a consumer there is only one valid way to opt out; any reasonable method counts, and the FCC put the burden on the business to show otherwise. The new order lets a caller designate a single exclusive method instead, an automated interactive voice or key-press option on calls, a defined set of text-reply keywords such as stop, quit, end, revoke, opt out, cancel, or unsubscribe, or a designated website or phone number, as long as it’s clearly and conspicuously disclosed. Once designated, the business will not have to process a revocation made through any other channel, once the order’s Federal Register effective date arrives, not before.

A financial-institution fraud-alert exemption got wider too. The adopted order also expands the existing TCPA exemption that lets financial institutions send fraud, identity-theft, and security-breach alerts without prior consent. That exemption used to cover only numbers a customer gave the institution directly. Under the new order it extends to numbers from what the order calls “reliable sources”: a number supplied by a spouse or other authorized family member on the account, a number captured from caller ID when the customer called in, or a number obtained from another financial institution’s records, per Tech Times’ reporting. This piece is not aimed at insurance agents, but it shows the Commission moved on more than the headline opt-out issue in the same order.

This is now the settled outcome, not a draft anyone can still comment their way out of. The FCC moved this timeline twice before adopting the new approach outright, and a vote at an Open Meeting is a real, binding Commission action, not a signal of intent. What’s still pending is the paperwork: the full adopted order text and a Federal Register publication date, both of which determine exactly when the new rule starts applying.

The FNPRM half: what’s still just a question

The order doesn’t only tighten things in the industry’s favor. The Further Notice half opened a new comment period on ideas that would go the other direction: shortening the current 10-business-day window a business has to honor a revocation, requiring businesses running one-way texting platforms to support two-way replies so a consumer’s STOP actually gets acknowledged, creating a mandatory universal “revoke everything at once” option regardless of what a business’s own designated channel is, and clarifying how a revocation should travel across affiliated businesses and brands operating under a shared parent. None of that is adopted yet, and an FNPRM can sit open for a long time before anything comes of it. It’s worth tracking anyway, because it shows the Commission isn’t done shaping this area even after finalizing the piece it just adopted.

The timeline, updated

Three shifts in under two years is worth reading plainly: the FCC kept deciding the original cross-topic “revoke-all” concept, in the form it was written, didn’t fit how businesses and platforms actually operate. Twice it bought time with a delay. The third time, it changed the substance instead and adopted the replacement.

What already applies today, while everyone waits on a Federal Register date

This is the part that gets lost every time there’s new FCC news, and it hasn’t changed through any of the drafts, delays, or the September 30 adoption. Four things have been the law since April 11, 2025, right now, and they stay the law until the new order’s Federal Register effective date actually arrives.

Any reasonable means, for now. A business cannot currently tell a consumer the only way to opt out is one specific channel. A consumer can revoke however they reasonably choose: replying STOP, QUIT, END, REVOKE, OPT-OUT, CANCEL, or UNSUBSCRIBE to a text; saying “stop calling me” on a call; leaving a voicemail; or emailing an address the business actually monitors, per Bryan Cave Leighton Paisner’s summary of the rule. The September 30 order changes this, but only once it’s published and its 30-day clock runs out; until then, an exclusive channel is not enforceable.

A 10-business-day window. Once a revocation request comes in, current law gives you no more than ten business days to stop. Treat that as the outer edge, not a target, especially with an FNPRM already asking whether that window should shrink further.

Cross-channel honoring, same subject matter. If a lead revokes consent for texts about a specific product, that revocation already has to be honored for calls about that same product too, and vice versa. What changes under the September 30 order is how far a revocation reaches beyond that one subject, not whether the same-subject, cross-channel piece applies; that part stays in force regardless.

No CRM feature does this for you automatically. HighLevel’s own support documentation describes its automatic opt-out messaging as a setting controlled per sub-account, per location, not something that propagates account-wide. That’s a useful disclosure tool. It is not the same thing as a revocation automatically reaching every campaign your agency runs, especially if Medicare, life, and P&C sit in separate sub-accounts.

What one mistake still costs, regardless of which rule applies

None of the drafting activity changes the penalty for getting an existing rule wrong. Under 47 U.S.C. Section 227(b)(3), a consumer who receives a call or text that violates the TCPA can sue for actual monetary loss or $500 in statutory damages, whichever is greater, and a court has discretion to raise that award to as much as three times that amount, up to $1,500, if it finds the violation was willful or knowing, per Cornell Law School’s Legal Information Institute. That’s per call or per text, not per campaign, and it has nothing to do with whether the contact led to a sale.

Continuing to contact someone after a documented revocation is one of the clearest fact patterns for a willful finding, because the business had actual notice and acted anyway. An agent who keeps a lead in an active dialer after a STOP, because a different campaign in a different sub-account never saw the opt-out, is not a hypothetical. It is the exact seam every version of this rule, adopted or proposed, is aimed at.

How to get ready, step by step, without buying anything

None of this requires new software before you decide whether it’s worth it. Every step below runs on a CRM you already have and staff you already employ.

1. Find out how your CRM actually scopes an opt-out today. Log into each sub-account, campaign, or number you use and manually test whether a STOP in one place is visible in the others. HighLevel’s own documentation confirms its automatic opt-out language is configured per sub-account, a strong hint that revocation tracking may be scoped the same way unless you’ve built a workaround.
2. Separate your informational messages from your marketing messages, in your own records, not just in theory. The adopted order treats these two categories differently. If your CRM tags a payment reminder and a marketing drip the same way, you won’t be able to tell which scope applies to a given revocation once the new rule’s effective date arrives.
3. Decide now whether you want to designate an exclusive opt-out channel, and don’t implement it yet. The order allows one, but it is not enforceable until its Federal Register effective date passes. Plan which channel you’d choose, most agencies will land on a text-reply keyword set, but wait for that date before telling leads it’s their only valid option.
4. Keep your internal SLA well under 10 business days regardless of the Federal Register timeline. That’s the current federal maximum, and the open FNPRM raises the possibility it gets shorter, not longer.
5. Log the revocation itself, not just its effect. Keep the date, the channel, the exact language, and which category, informational or marketing, it applied to. That distinction mattered less before September 30; it matters more now that the order is adopted.
6. Watch for the Federal Register publication date. That date, not September 30 itself, is what starts the 30-day clock to the new rule’s actual effective date. Nothing in the order is enforceable against you, and nothing new is enforceable by you, until that clock runs out.

You can run all six steps yourself with a CRM export and a disciplined process, and plenty of agencies do exactly that rather than change vendors over it.

The CMS layer stacks on top, separately

If one of your parallel campaigns touches Medicare Advantage or Part D prospects, none of the above replaces CMS’s own marketing rules; it sits alongside them. CMS’s Medicare marketing framework carries its own recording-retention, disclosure, and unsolicited-contact restrictions, independent of the TCPA’s consent and revocation framework, and both apply at once to the same call. The CMS 2027 Medicare marketing rules guide on this site covers that layer in full, and the aged insurance leads guide covers how consent questions interact with an older, already-collected database specifically.

Where TheAffordableAI fits

Building a revocation record that correctly separates informational from marketing contact, by category, the distinction the FCC’s adopted order now turns on, is a CRM-configuration and process decision, and no vendor, including us, makes that decision for you. Where a managed AI caller helps is in what happens once that structure exists: every call TheAffordableAI places gets logged against the lead’s record automatically, including disposition and any opt-out language spoken on the call, and that log syncs natively with HighLevel rather than sitting in a system someone has to reconcile by hand later. That doesn’t remove your obligation to build the categorization correctly. It does mean the calling layer stops being the part most likely to drift out of sync with the rest of your compliance setup, whichever version of the rule ends up in force. The full list of what’s included on every plan is on the features page.

If your workflows already live in HighLevel, the GoHighLevel workflow guide on this site walks through building a trigger-to-warm-transfer sync that logs opt-outs the same place everything else lands.

Where this isn’t the right tool, and where a rule change doesn’t help either

It would be dishonest to sell this as a technology fix, because it isn’t one. The hard part of the adopted rule is the decision layer: does your agency want to categorize informational versus marketing contact consistently across every campaign, and does it want to pick one exclusive opt-out channel once the Federal Register date makes that option enforceable. No AI caller, no CRM feature, and no vendor answers those questions for you. They’re compliance and operations decisions that belong to someone who understands your book of business, ideally with input from counsel who has looked at your specific multi-line structure, before any calling platform gets configured around them.

If your agency runs a single line of business through a single system already, you likely don’t need to change much beyond keeping your SLA under the 10-business-day window and watching for the Federal Register publication date. Spending money on new tooling to solve a problem you don’t actually have isn’t a good trade, and it’s worth ruling that out before assuming a bigger system is the answer.

The rule that would have forced one revocation to silence every unrelated campaign an agency runs was never allowed to take effect. On September 30, 2026, the FCC replaced that idea entirely with a narrower, category-specific framework. What’s enforceable right now, since April 11, 2025, still hasn’t moved and won’t until the new order’s Federal Register date arrives: any-reasonable-means revocation, a 10-business-day window, and cross-channel honoring on the same subject matter. The $500-to-$1,500 statutory exposure for getting any of that wrong applies the same way it always has. Check how your CRM actually scopes an opt-out this month, and start separating informational from marketing contact in your own records now. It’s a smaller project than it sounds like, and it’s the one piece of this story that doesn’t depend on when the Federal Register publishes.