TCPA Rules for Calling and Texting Mortgage Leads in 2026

A large share of the compliance advice written for loan officers in the last two years describes a rule that was struck down three days before it was due to start. Meanwhile the rules that do bind you, and that are producing almost all of the current litigation against mortgage companies, get very little attention. This page separates the two, with links to the primary documents so you can check any of it yourself.

Written for US loan officers and mortgage brokers, current as of September 2026. It is general information about a body of law that changes often, not legal advice, and your own compliance team or counsel is the right place to take a specific question.

The one to one consent rule that never happened

In December 2023 the FCC adopted an order it described as closing the lead generator loophole. The part everyone remembers changed the definition of prior express written consent so that a consumer could only give it to one identified seller at a time, and so that any resulting call or text had to be logically and topically associated with the interaction that produced the consent. That would have ended the comparison site consent page that discloses a list of partner companies, which is how a large part of the lead industry works.

It was set to take effect on January 27, 2025. On January 24, 2025, the Eleventh Circuit vacated it in Insurance Marketing Coalition Ltd v. FCC. The court read the statutory phrase against its ordinary meaning and held that a caller must obtain prior express consent, and not, as it put it, prior express consent plus. The FCC had added conditions the statute did not contain. Separately and on the same day, with the appeal still pending, the Commission had already postponed the effective date by a year. It did not seek further review of the decision, and in July 2025 it issued an order removing the vacated language and putting the earlier definition back in place.

So the practical position is straightforward. One to one consent and the topical relatedness test are not law, were never law, and a single consent form disclosing several companies can still produce valid consent as a matter of federal law. If you are reading a compliance guide that tells you a generic checkbox is no longer sufficient because consent must now name the specific company contacting the consumer, you are reading a description of the vacated rule.

What the decision did not do is make the evidence problem go away. Vacating the rule removed a regulatory requirement. It did not change the fact that if you are sued, you have to prove that this particular consumer agreed to receive calls from you, and a list of forty partner names on a form you have never seen is a thin thing to be relying on when that day comes.

What consent has to look like now

The reinstated definition requires an agreement in writing, bearing the signature of the person called, that clearly authorizes the seller to deliver advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and that identifies the telephone number the person is authorizing those messages to be sent to.

The rule then adds two things. The agreement has to carry a clear and conspicuous disclosure that signing it authorizes those messages, and a statement that the person is not required to sign it as a condition of buying any goods or services. Signature includes an electronic or digital signature to the extent one is valid under applicable federal or state contract law, which is why a tick box on a web form can work, provided your system actually captures the act of signing rather than merely displaying the words.

A useful habit is to look at any lead form, your own or a vendor's, and check for five things: the number being consented to, the company or companies authorized to make contact, the authorization for automated or prerecorded contact, the not a condition of purchase statement, and a captured signature event with a timestamp. If any of the five is missing, the form is not producing prior express written consent, whatever the vendor's marketing says about it.

When you need it, and when you do not

Written consent at that standard is required for telemarketing calls and texts placed to a cell phone number using an autodialer or an artificial or prerecorded voice. Messages that are purely informational or transactional sit in a different category and generally require only prior express consent, which is usually satisfied by the consumer giving you the number in connection with the transaction. Telling a borrower their appraisal is booked, or that a condition has cleared, is not telemarketing.

The line is drawn by content, not by intention. The moment a message sells or cross sells something, it becomes telemarketing, and adding a rate quote or an invitation to refinance to the end of an otherwise operational message is what tends to move it across. It is worth reading your own templates with that in mind, because a status update with a marketing sentence stapled to the bottom is a common way for a compliant message to become a non compliant one.

Do not call is the rule that actually catches people

Loan officers tend to think about the TCPA as a consent question. The cases being filed against mortgage companies at the moment are mostly Do Not Call cases, and Do Not Call has nothing to do with what kind of dialer you use. It is worth more of your attention than the consent question, because the obligations are administrative and the failures are usually process failures rather than judgment calls.

Three separate lists apply. There is the National Do Not Call Registry, which you have to scrub against. The Telemarketing Sales Rule requires sellers to synchronize with an updated version of the registry at least every thirty one days, so a list you bought and scrubbed in March is not scrubbed in May. There is your own internal do not call list, which is the one people forget. And there are the state registries that some states maintain in addition.

The internal list obligations are specific and they are the ones an examiner or a plaintiff's lawyer will ask about first. You need a written do not call policy available on demand. You need to have trained your people in it. You have to record the request and add the number at the time it is made, and honor it within a reasonable time not exceeding ten business days. Anyone making calls has to give their name, the name of the company on whose behalf the call is being made, and a contact number or address. And a do not call request has to be honored for five years.

That written policy is not paperwork for its own sake. The statute gives a defendant an affirmative defense where it has established and implemented, with due care, reasonable practices and procedures to prevent violations. The written policy, documented training, and evidence of regular scrubbing are what that defense is made of. Without them, there is nothing to argue.

The established business relationship, and the ninety day myth

A registered number can still be called where an established business relationship exists. The durations matter and they are worth committing to memory, because they explain a good deal of how lead vendors price aged data. The relationship runs for eighteen months from a purchase or transaction, and for three months from an inquiry or application.

That three month figure is almost certainly where the industry belief that consent expires after ninety days came from. There is no federal rule that expires consent. What expires at three months is the inquiry based business relationship that lets you call a registered number without separate written consent, which is a different thing entirely. Treating them as the same idea leads people to both over-restrict and under-restrict themselves, usually at the same time.

One rule overrides all of this. An established business relationship never survives a request not to be called. If somebody tells your company to stop, the relationship is irrelevant, and that is true whether the request arrives by text, on a call, in an email or through a form.

Calling hours are set by their clock, not yours

Telephone solicitations to residential subscribers are restricted to between 8am and 9pm in the local time at the called party's location. For anyone dialing nationally, this is the easiest rule in the whole area to break by accident, because a perfectly reasonable 7pm call from Phoenix lands at 10pm in Boston. Any dialing tool worth using should be enforcing the recipient's local time rather than yours, and several states run narrower windows than the federal one.

Does the registry cover cell phones?

The FCC's position has long been that it does. Courts have not been entirely uniform, and since the Supreme Court's 2025 decision in McLaughlin v. McKesson, district courts are no longer bound to follow the FCC's interpretation of the statute and must reach their own. This is an open question rather than a settled one, and given that essentially every lead you work is a cell phone number, the sensible working assumption is that the registry applies.

Opt outs, and the rule that is currently on hold

The FCC adopted a revocation order in February 2024, and most of it has been in force since April 11, 2025. A person may revoke consent using any reasonable method that clearly expresses a desire not to receive further calls or texts. Replying with stop, quit, end, revoke, opt out, cancel or unsubscribe is automatically reasonable, and that list is illustrative rather than exhaustive, so a reply saying please take me off your list counts too. Revocation by voicemail or email creates a rebuttable presumption that it is valid.

Once revoked, you have a reasonable time not exceeding ten business days to stop. You may send a single confirmation message, carrying no marketing, and it may ask only which types of message the person wants stopped. Send it within five minutes and it is presumed to fall within the consumer's existing consent. Five minutes is a presumption rather than a deadline, so a later confirmation is not automatically a violation, but you would then be the one arguing it was within scope, which is not a position worth choosing.

One piece of the order is not yet compulsory. The rule that an opt out given in response to one kind of message stops every other kind of automated message from your company, including on unrelated matters, has been the subject of a limited waiver, most recently extended to January 31, 2027. Two things follow. It is coming, so building your systems as though it already applied costs nothing and saves a rebuild. And a waiver of an FCC rule is not a guarantee that a court will read the statute the same way, which since McLaughlin is a more live concern than it used to be.

Why the autodialer question protects fewer people than they think

In 2021 the Supreme Court decided Facebook v. Duguid and held that to be an automatic telephone dialing system, equipment must have the capacity to store or produce telephone numbers using a random or sequential number generator. That narrowed the definition considerably, and a great many platforms sitting in loan officers' hands are not autodialers under it.

It resolves less than it appears to, for four reasons. The statute separately prohibits calls using an artificial or prerecorded voice, and Duguid expressly left that alone, which is why AI voice agents and ringless voicemail drops carry real exposure regardless of how the numbers were dialed. Do Not Call claims contain no dialer element at all. Several state statutes define an automated system far more broadly than the federal definition, and a system that is safely outside Duguid can sit squarely inside Oklahoma's or Maryland's definition. And failures to honor opt outs are process failures that do not care what dialed the number.

The states that go further than federal law

If you are licensed in several states, the state statutes are likely to be a bigger practical risk than the federal ones, because most of them define automated systems broadly, several carry per message statutory damages, and most carry a private right of action. The picture below is a snapshot and these statutes change frequently, so check the current position for any state you actually work.

• Florida. The Florida Telephone Solicitation Act was amended in 2023 in a way that narrowed it considerably, requiring a covered system to both select and dial numbers, and adding a text safe harbor under which a recipient must first ask for messages to stop and the sender then has fifteen days to comply. Damages run at 500 dollars per violation or actual damages, trebled for willful or knowing violations. It remains a busy jurisdiction, with claims having shifted toward the caller identification provisions.
• Oklahoma. In force since November 2022 and one of the harder statutes to sit outside, because it covers an automated system for the selection or dialing of numbers, which is the broader formulation Florida abandoned. It requires prior express written consent, restricts calls to 8am until 8pm, caps contact at three calls in any twenty four hour period, and provides 500 dollars per violation with trebling.
• Washington. Amendments in force since June 2022 require identification within the first thirty seconds, require the caller to stop within ten seconds of an opt out request, make an opt out last a year, and restrict calls to 8am until 8pm. Damages are lower at 100 dollars per violation, but attorney's fees are available and the private right of action attaches to repeated violations.
• Maryland. The Stop the Spam Calls Act requires prior express written consent, applies to systems for the selection or dialing of numbers, restricts calls to 8am until 8pm, and caps contact at three calls in twenty four hours on the same subject. It is enforceable both by the state and by private parties.
• Texas. SB 140 took effect on September 1, 2025 and extended the definition of telephone solicitation to text and image messages, with a private right of action running through the state's deceptive trade practices statute. The registration requirements are a genuine trap for out of state lead buyers who have never thought of themselves as telemarketers.
• Oregon. HB 3865 took effect on January 1, 2026. It brought text messages within the definition of telephone solicitation, pulled the calling window back to 8am until 8pm, and capped contact at three solicitations in twenty four hours absent an established business relationship.
• Pennsylvania. SB 992 was signed in July 2026 and takes effect on October 18, 2026. It is the most significant near term change for anyone dialing nationally, because it narrows the calling window to 9am until 7pm and prohibits solicitations on Sundays, both materially tighter than the federal position. It requires prior express written consent, extends to texts and voicemail, and provides penalties up to 1,000 dollars per call or text, rising to 3,000 dollars where the recipient is sixty or older.

Other states have their own statutes and more are being introduced every session. A bill materially raising the private right of action passed the Michigan Senate in January 2026, to take one example, so it is worth checking the current position rather than relying on a list of this kind. The practical takeaway is that a national calling program should be running the tightest common denominator rather than the federal minimum, because once Pennsylvania starts, the federal 8am to 9pm window is no longer a useful default anywhere.

Buying leads does not move the risk anywhere

This is the part worth reading twice if you buy leads. There are two ways liability attaches. Direct liability sits with whoever places the call or sends the text, and when you dial a purchased lead, that is you. Vicarious liability can reach a company for a vendor's conduct where the vendor was acting as its agent, or where it knew or should have known the leads were bad.

Because of the first of those, buying a lead does not transfer the exposure to the seller. It creates your own, immediately, at the moment you dial. An indemnity from a lead vendor is a claim against that vendor's balance sheet, which is a very different asset from a defense, and it is worth asking what that balance sheet looks like before treating the indemnity as protection.

There is also no such thing as a TCPA compliant lead you can simply buy, whatever the phrase appears on. What you can do is hold the evidence. For each lead that matters, that means the original form language as it appeared to that consumer on that date rather than a current screenshot of the vendor's site, the list of companies actually disclosed, a timestamp with the IP address and the page URL, an independently retrievable consent certificate rather than a reference number, and the phone number consented to matched against the number you dialed. Where the Telemarketing Sales Rule applies to you, consent records must be kept for five years, and in any event you want them for longer than the federal four year limitations period.

One point that surprises people: the Telemarketing Sales Rule does apply to independent mortgage brokers and non bank lenders. The FTC lacks jurisdiction over banks, federal credit unions and federal savings and loans, which is where the belief that the rule is somebody else's problem comes from, but that carve out does not describe most brokerages.

Two related points sit just outside this page. Where the leads come from a real estate brokerage rather than from a lead vendor, a second body of law applies on top of this one, because what you may pay a referral source for business is governed by RESPA rather than by the TCPA, and the two are assessed separately on the same purchase. That is the subject of RESPA and Realtor Co-Marketing. And the cleanest way to reduce the whole of this exposure is to generate more of your own, because a form you built yourself is a form whose exact wording you can still produce four years later. The Movie Ticket Method is one way to start doing that with no list and no budget.

On the supply side, the Homebuyers Privacy Protection Act was signed in September 2025 and took effect in March 2026. It amends the Fair Credit Reporting Act so that credit bureaus may only furnish mortgage trigger leads where the consumer has given documented opt in authorization, or where the requester is the consumer's current originator or servicer or holds a current account with them. It is not a TCPA rule, but it has changed what is available to buy, and the two questions tend to arrive together.

What it costs when it goes wrong

For the autodialer and prerecorded voice provisions, the statute provides 500 dollars for each violation, which a court may increase to up to three times that amount for a willful or knowing violation. The do not call provision is worded slightly differently, at up to 500 dollars per violation, so the amount there is within the court's discretion rather than fixed. Either way it applies per call and per text, and separate theories stack, so a single prerecorded marketing call to a registered number can support both a consent claim and a do not call claim, with a state law claim on top of the same message.

Small per message numbers multiplied across a list is how these become class actions. Publicly reported outcomes in and around this industry include a 20 million dollar settlement involving Anywhere Real Estate, and a 7.2 million dollar settlement by Cardinal Financial in 2023. Defense wins do happen. LoanStream faced a proposed class of more than fifty three thousand call recipients, defeated certification in May 2026 and won summary judgment the following month, which is worth remembering before assuming that a claim of this kind can only be settled.

The sector is being actively targeted. National Mortgage News reported in late January 2026 that at least eight complaints had been filed against mortgage industry defendants over the preceding months, and by the end of May 2026 counted eleven more filed in the previous two months, with the paper putting the total at at least two dozen since the start of that year and several defendants appearing more than once. CompliancePoint's review of 2025 filings put financial services as the most sued sector. The dominant theory in those complaints is do not call, which is the practical reason the internal list and the scrubbing schedule deserve more of your attention than the dialer question.

A newer fact pattern worth watching is AI voice. A class action filed in Michigan in February 2026 alleges AI generated cold calls placed without prior express written consent, in which the artificial voice presented as human and claimed to be returning a call the recipient says he never made. These are allegations rather than findings, but the shape of the claim is the point. An artificial voice is squarely within the prohibition that Duguid left standing, which is worth sitting with before adding an AI caller to an outbound program.

A working checklist

1. Write the do not call policy down, make it available on request, and train your people in it. This is the affirmative defense, and it does not exist unless it is on paper.
2. Scrub against the national registry at least every thirty one days, and keep the evidence that you did.
3. Keep one internal do not call list across the whole company, honor requests within ten business days, and keep them for five years.
4. Enforce calling hours in the recipient's local time, and set the window to the tightest state you operate in rather than the federal default.
5. Honor opt outs expressed in any words at all, not only the seven keywords, and send at most one confirmation message with no marketing in it.
6. Build now for the rule that an opt out from one message stream stops all of them, since the waiver runs out in January 2027.
7. For every purchased lead, hold the consent record itself rather than the vendor's promise that one exists, and audit a sample regularly.
8. Read your own templates and find the operational messages that have quietly acquired a marketing sentence.
9. Check the state rules for every state you are licensed in, not only the one you sit in.

Common questions

Sources

Everything above is drawn from the primary documents rather than from secondary summaries, and they are worth reading directly if a question turns out to matter to you.

• Insurance Marketing Coalition Ltd v. FCC, No. 24-10277 (11th Cir., January 24, 2025)
• FCC Bureau Order DA 25-621, reinstating the prior definition of prior express written consent
• 47 CFR 64.1200, the operative FCC rule on calls and texts
• FCC Report and Order 24-24 on revocation of consent (February 2024)
• FCC Bureau Order DA 26-12, extending the limited waiver to January 31, 2027
• FTC guidance on the Do Not Call provisions of the Telemarketing Sales Rule
• 16 CFR 310.5, the Telemarketing Sales Rule recordkeeping requirements
• Facebook, Inc. v. Duguid, 592 U.S. 395 (2021)
• McLaughlin Chiropractic Associates v. McKesson Corp. (2025)
• 47 U.S.C. 227, the Telephone Consumer Protection Act

This page is general information for loan officers and mortgage brokers, not legal advice, and it does not create any professional relationship. Federal rules, state statutes and the case law all move quickly, and several of the questions covered here are genuinely unsettled. Take a specific situation to your compliance team or to counsel who works in this area.