Compliance
What your opt-in form must say.
Updated
Under 47 CFR § 64.1200(f)(9), prior express written consent means an agreement in writing, bearing the signature of the person called, that clearly authorises the seller to deliver advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and that identifies the telephone number to which they may be delivered. It must carry a clear and conspicuous disclosure that the signer authorises those calls and is not required to sign as a condition of purchasing anything.
Your registration page is where all of that either exists or does not. It is the single artifact the whole arrangement rests on, it belongs to you rather than to any service provider, and it is the thing a plaintiff's attorney asks for first.
This is not legal advice
Does a webinar registration count as prior express written consent?
Not by itself, and that is the whole answer people keep hoping to avoid. A phone number typed into a field is a phone number typed into a field. Prior express written consent is an agreement, and the regulation lists what the agreement has to contain in five mandatory elements[1]: it is in writing, it bears the signature of the person called, it clearly and conspicuously authorises telemarketing calls using an autodialer or an artificial or prerecorded voice, it states that signing is not a condition of purchase, and it identifies the number.
The good news is that none of that requires paper. Subparagraph (f)(9)(ii) says the term signature “shall include an electronic or digital form of signature” where valid under applicable federal or state contract law, and the E-SIGN Act provides that a “signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form”[2]. A checkbox on a submitted form can be a signature. A checkbox that was already ticked when the page loaded cannot, because nothing was signed.
“What does my registration form need to say? Will you put that in writing?”
Six things, and they are where forms actually fail — not on the absence of a checkbox, which everybody remembers, but on the state of it, the wording next to it, the name inside it and the record behind it.
Not be pre-checked
A box ticked on page load is not an affirmative act by the person called, and a signature is precisely an affirmative act. This is the single most common defect and it is also the cheapest to avoid.
Be clear and conspicuous
47 CFR 64.1200(f)(9)(i) requires the disclosure to be clear and conspicuous. Text placed next to the phone field and the submit button reads as clear and conspicuous; the same text three clicks away inside a terms-of-service link does not.
State that consent is not a condition of purchase
Subparagraph (f)(9)(i)(B) requires the disclosure to say the person is not required to sign, directly or indirectly, as a condition of purchasing anything. Note 'indirectly': gating the join link behind the checkbox makes consent a condition even if the form technically submits.
Name the specific seller
The FTC's rule requires an express written agreement evidencing willingness to receive calls from a specific named seller, and consent runs to that named entity. A registrant who consented to one company has not consented to another, which is why consent is captured per client in the client's own legal name and can never be pooled, shared or inherited across clients.
Name artificial voice — and, sensibly, AI
The regulation's own language turns on an automatic telephone dialing system or an artificial or prerecorded voice, so consent that mentions only 'calls' leaves an argument open. No adopted federal rule requires the words 'artificial intelligence' today; FCC 24-84 proposes it and several states legislate around it. Including it costs a sentence.
Retain the proof, in a form you can render later
The consent text exactly as displayed and its version, the timestamp, the IP, the user agent, the page URL, the affirmative checkbox state, the number as entered and the seller named. Defendants lose these cases on records rather than on the absence of a checkbox, and the burden of proving consent sits on the caller.
What we will and will not put in writing
Whose name goes on the form — yours, or your service provider’s?
Yours. This is the constraint that shapes everything about how a multi-client operation can be run, and it is the one most people discover late. Consent runs to the entity named on the form. A registrant who consented to one coach has not consented to a service provider in the abstract, and has certainly not consented to a second coach whose webinar they never heard of.
The FTC's rule states it directly for prerecorded telemarketing: the express written agreement has to evidence willingness to receive calls from a specific named seller[3], and carry the recipient's number and signature. The FCC's do-not-call exception is built the same way: it turns on prior express invitation or permission “evidenced by a signed, written agreement between the consumer and seller which states that the consumer agrees to be contacted by this seller”[4] and includes the number.
One vacated rule that people misread as permission
| What the form has to do | Source | How forms fail it |
|---|---|---|
| Be in writing and bear a signature | 47 CFR § 64.1200(f)(9), (f)(9)(ii); E-SIGN, 15 U.S.C. § 7001(a) | A phone field with no agreement attached to it |
| Be affirmative rather than pre-checked | The signature element of (f)(9) | Ticked on page load to save the visitor a click |
| Authorise autodialed or artificial-voice marketing calls and texts, clearly and conspicuously | 47 CFR § 64.1200(f)(9)(i)(A) | “We may contact you from time to time”, or the disclosure buried in a linked policy |
| State that consent is not a condition of purchase | 47 CFR § 64.1200(f)(9)(i)(B) | The join link gated behind the checkbox, which makes it a condition indirectly |
| Name the specific seller | 16 CFR § 310.4(b)(1)(v); 47 CFR § 64.1200(c)(2) | “Us and our marketing partners”, or the agency's name instead of the client's |
| Identify the telephone number the consent applies to | 47 CFR § 64.1200(f)(9) | Consent captured against one number, calls placed to another one found later |
| Name text messages as well as calls | 47 CFR § 64.1200(a)(2) | A voice-only consent used to justify the text thread |
| Address artificial voice, and sensibly AI | FCC 24-17 ¶5 (AI is inside “artificial voice”); FCC 24-84 proposes explicit AI language; Cal. Pub. Util. Code § 2874 requires the announcement to disclose an artificial voice | Silence today, then retrofitting disclosure into a live script fleet later |
“Do you handle calling hours in the registrant’s time zone, not mine?”
Quiet hours are measured “before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)” [5], and the FTC's rule sets the same window. The operative words are the called party's location — not your office, and not the area code, which has drifted a long way from geography since number portability.
So the form does a second job people rarely notice: capturing the browser time zone at registration gives a far better signal than an area-code lookup, costs nothing, and is the difference between a defensible dialling window and a guess. Where the two disagree, the more restrictive one is the safe one, and the check belongs at the moment the call is placed rather than when the list was built.
A scheduling consequence, not a legal one
“Having them opting out with you doesn’t work” — what does an opt-out have to reach?
That line was written to a small-business owner describing a lawsuit, and it means something narrower and more useful than it first appears: an internal opt-out list does not substitute for the National Do Not Call Registry[6]. They are different obligations and satisfying one does not satisfy the other.
The revocation rules then widen the target. A revocation may be made in any reasonable manner, the request must be “honored within a reasonable time not to exceed ten business days from receipt”[7], and no caller may designate one exclusive channel for it. A conversational text thread makes this harder, not easier, because opt-outs arrive as sentences rather than as keywords — which is why detecting revocation intent in ordinary prose is a compliance control rather than a feature, and why the correct behaviour on detecting it is to acknowledge and stop rather than to answer back.
One boundary worth stating plainly, because it is the reason this page exists at all: your form is your artifact. No service provider can make your consent record good on your behalf, and any vendor telling you their product makes you compliant is describing something a product cannot do. Ours is built to refuse work it should not do — a number with no consent record behind it is not dialable — and that is a control, not a compliance opinion. What the calls themselves say is on what it says.
Frequently asked questions
Only if the registration form was built to be one. 47 CFR 64.1200(f)(9) defines prior express written consent as an agreement in writing bearing the signature of the person called, authorising the seller to deliver advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and identifying the telephone number to which they may be delivered, with a clear and conspicuous disclosure that consent is not a condition of purchase. A phone field on a registration page with nothing attached to it satisfies none of that. The same page can satisfy all of it.
The regulation contemplates it. Subparagraph (f)(9)(ii) states that the term signature includes an electronic or digital form of signature to the extent it is recognised as a valid signature under applicable federal law or state contract law, and the E-SIGN Act provides that a signature, contract or other record may not be denied legal effect solely because it is in electronic form. What makes it fail is not the medium but the state: a box that arrives pre-ticked is not an affirmative act by the person called.
The seller's. Consent runs to the entity named on the form, which means a registrant who consented to one company has not consented to a different one, and consent cannot be pooled or reused across clients. The FTC's rule makes the point directly: an express written agreement for prerecorded telemarketing has to evidence willingness to receive calls from a specific named seller. Naming one specific company is trivially defensible. Naming a company and its unspecified partners is an exhibit.
No adopted federal rule requires it as of the date on this page. FCC 24-84, a notice of proposed rulemaking, would add a consent-time disclosure at 47 CFR 64.1200(a)(13) and an in-call disclosure at 64.1200(b)(1), and both remain proposals. State law is a different matter: California Public Utilities Code section 2874 requires the announcement made before an automatic dialing-announcing device operates to inform the person called if the prerecorded message uses an artificial voice. Including AI language costs nothing today and avoids retrofitting a live script fleet later.
Enough to reconstruct the page the person actually saw: the consent text as displayed and its version, the timestamp, the IP, the page URL, the affirmative state of the checkbox, the number as entered and the seller named. Under the FCC's revocation framework the burden of proving consent sits on the caller, so a consent you cannot produce functions as a consent you never had. Separately, 47 CFR 64.1200(d)(6) provides that a do-not-call request must be honoured for five years from the time it is made.
Everything, not just the channel it arrived on. Revocation may be made in any reasonable manner and the request must be honoured within a reasonable time not to exceed ten business days from receipt, and the caller may not designate a single exclusive means of revoking. In practice that means an opt-out spoken on a call has to stop the texts, an opt-out typed as ordinary prose has to be recognised as one, and the suppression has to be applied at the moment of dialling rather than at the moment a list is built.
Yes, and we will also tell you plainly what that document is not. It is a description of what named regulations require, so that you and your attorney can check your page against it. It is not legal advice, it is not a warranty that your form is sufficient, and no service provider can make your consent record good on your behalf — the form is your artifact, on your domain, in your name.
The companion question — whether the calls and texts are lawful at all, and who is exposed when they are not — is answered from the same primary sources on is it legal to call and text registrants. How many touches a registrant receives, and on what triggers, is on the sequence. And once more, plainly: this page describes what the sources say, it is not legal advice, and it makes no assessment of your form.
Founder & Operator, CallHush
Founder and operator of CallHush. The offer is one sentence: you run a webinar, and we increase your show-up rate and your post-webinar sales with an AI voice and SMS system. CallHush has no closed clients yet — the first engagement is a pilot run as a split of the client’s own registrant list, and nothing on this site is presented as a client result.
View all articles