Skip to content
eConsent API

TCPA Compliance Guide

The Telephone Consumer Protection Act (TCPA) is a federal law that restricts telemarketing calls, auto-dialed calls, pre-recorded calls, text messages, and unsolicited faxes. Violations can cost between $500 and $1,500 per call or text, making TCPA litigation one of the most expensive categories of consumer class actions in the United States.

eConsent provides the evidentiary infrastructure to prove that consent was obtained, what the consumer saw, and when they agreed.

Who needs TCPA compliance

Section titled “Who needs TCPA compliance”

Any business that contacts consumers by phone or text message should evaluate their TCPA exposure. This includes:

  • Lead generators selling consumer leads to buyers who will call or text
  • Insurance agencies contacting prospects about quotes
  • Solar and home improvement companies following up on form submissions
  • Financial services reaching out about loan offers or debt relief
  • Healthcare organizations sending appointment reminders or marketing
Section titled “Prior express written consent”

The FCC requires prior express written consent (PEWC) before making telemarketing calls or sending marketing texts using an autodialer or prerecorded voice. PEWC must meet these requirements:

  1. Written agreement (electronic signatures count) that clearly authorizes the calls or texts.
  2. Clear and conspicuous disclosure of what the consumer is agreeing to.
  3. Not a condition of purchase --- consent cannot be required to complete a transaction.
  4. Identifies the specific seller(s) authorized to contact the consumer.
  5. Includes the phone number to which calls or texts will be made.

What eConsent captures for PEWC

Section titled “What eConsent captures for PEWC”

eConsent automatically records and certifies the following for every consent event:

Evidence elementHow eConsent captures it
Consent language shownSHA-256 hash of the exact disclosure text on the page
Consumer interactionFull session replay showing the consumer checking the box and submitting
TimestampServer-side UTC timestamp with millisecond precision
Phone numberExtracted from the form submission and stored on the certificate
IP address and deviceCaptured in the session metadata
Page structureDOM snapshot proving the disclosure was visible and not hidden

Five-year record retention

Section titled “Five-year record retention”

The FCC mandates that businesses retain consent records for a minimum of 5 years from the date consent was obtained. eConsent supports configurable retention periods up to 5 years per property.

Section titled “Recommended retention configuration”
Terminal window
curl -X PUT https://api.econsent.org/api/retention/settings \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
    "autoRetentionEnabled": true,
    "autoRetentionMode": "certificates",
    "notifyOnOverage": true,
    "overageNotificationEmails": ["compliance@yourcompany.com"]
  }'

Set the property-level expiration to 5 years in the dashboard to align with FCC requirements.

Revocation rules

Section titled “Revocation rules”

Under the TCPA, consumers have the right to revoke consent at any time and through any reasonable means. The FCC has clarified that callers cannot restrict the method of revocation (e.g., requiring a specific keyword or phone call).

eConsent supports revocation through:

  • API endpoint for programmatic opt-out processing
  • Dashboard for manual single or bulk revocation
  • CSV upload for large-scale opt-out list processing

Once revoked, all verification API calls for that certificate return a 403 response. See Revocation & Opt-Out for full details.

Section titled “Implementing consent tracking”

Step 1: Install the tracking script

Section titled “Step 1: Install the tracking script”

Add the eConsent script to your lead form pages:

<script
  src="https://api.econsent.org/api/web"
  data-property-id="YOUR_PROPERTY_ID"
  async
></script>
Section titled “Step 2: Configure the consent selector”

Tell eConsent which element on your page represents the consent action (typically a checkbox or submit button adjacent to a TCPA disclosure):

Use the Consent Selector tool in your dashboard to visually select the consent element on your page. See Consent Selector for a walkthrough.
Section titled “Step 3: Verify consent via API”

After a lead is submitted, verify that a valid consent certificate exists before making a call:

async function verifyConsent(phone, email) {
  const response = await fetch('https://api.econsent.org/api/verify/match', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${process.env.ECONSENT_API_TOKEN}`,
    },
    body: JSON.stringify({
      phone: phone,
      email: email,
      company_id: process.env.ECONSENT_COMPANY_ID,
    }),
  });


  const result = await response.json();


  if (result.status === 200 && result.certificate_id) {
    // Consent verified --- safe to call
    return { verified: true, certificateId: result.certificate_id };
  }


  // No matching consent found --- do not call
  return { verified: false };
}

TCPA compliance checklist

Section titled “TCPA compliance checklist”

Disclosure language

Ensure your TCPA disclosure is clear, conspicuous, and identifies all parties who may contact the consumer. eConsent captures a SHA-256 hash of the exact disclosure shown.

Consent evidence

Every consent event generates a certificate with a full session replay, DOM snapshot, and cryptographic attestation.

Record retention

Configure 5-year retention on all properties to meet FCC requirements. Enable auto-retention in certificates mode to retain only sessions with valid consent.

Revocation handling

Process opt-out requests immediately via the API or dashboard. eConsent propagates revocations in real time with no delay.

Next steps

Section titled “Next steps”