2026 Outlook: Telephony Regulation Changes Every Agent Should Know

The biggest 2026 compliance shifts for outbound agents are the delayed TCPA revocation-all rule (now effective April 11, 2026), expanded STIR/SHAKEN enforcement on smaller carriers, maturing Reassigned Numbers Database litigation, and the spread of state mini-TCPAs in Florida, Oklahoma, Maryland, and Washington. The one-to-one consent rule was vacated by the Eleventh Circuit in January 2025 (Insurance Marketing Coalition v. FCC), but operationally the industry has not rolled back.

TL;DR

• Revocation-all rule: FCC delayed the "opt out of any message = opt out of all" requirement to April 11, 2026 (further delayed in some categories to January 2027 per FCC 2026 order).
• One-to-one consent: Federally vacated but enforced in substance by Florida FTSA, Maryland, and Oklahoma.
• STIR/SHAKEN: Small-carrier extensions expired; Robocall Mitigation Database filings are being audited.
• RND safe harbor: Courts increasingly treat 47 CFR 64.1200(m) non-use as negligence.
• State patchwork: Plaintiff's bar concentrates in Florida, Washington, California, Maryland, and Oklahoma.

The Four Tracks That Matter

1. FCC revocation-all and consent rulemaking — delayed effective dates, but the direction is set.
2. STIR/SHAKEN enforcement — A-level attestation is now a commercial requirement.
3. RND safe harbor litigation — "I didn't check" is no longer a defensible posture.
4. State mini-TCPAs — Florida (FTSA), Oklahoma, Maryland, Washington, and pending bills in New York.

The One-to-One Consent Saga

In December 2023, the FCC adopted a rule requiring prior express written consent from a single consumer for a single seller (FCC 23-107, "Closing the Lead-Generator Loophole"), effective January 27, 2025.

On January 24, 2025, the Eleventh Circuit Court of Appeals vacated the rule in Insurance Marketing Coalition Limited v. FCC, holding that the FCC exceeded its TCPA authority. The rule never took effect. The Consumer Financial Services Law Monitor and Goodwin walk through the reasoning.

Post-vacatur:

• The FCC signaled it will pursue alternative rulemaking within statutory bounds.
• Florida's FTSA, Maryland's Stop the Spam Calls Act, and Oklahoma's state TCPA already operate under similar consent standards.
• Plaintiff's attorneys have pivoted to state-law claims where federal preemption is weak.

For 2026, plan as if one-to-one consent is the de facto standard.

The Revocation-All Rule (Delayed, Not Dead)

The FCC's "revocation-all" provision would require that a consumer's opt-out on any channel be treated as revocation of consent across all automated marketing and informational messages from that sender. Originally effective April 2026, in January 2026 the FCC delayed certain categories to January 31, 2027. Other requirements — including the core "reasonable means to revoke" and 10-business-day propagation rule — are already live under 47 CFR 64.1200(a)(10).

Practical impact: cross-channel revocation plumbing between dialer, CRM, and any outsourced callers has to exist and propagate within 10 business days, or the next call is a TCPA violation.

STIR/SHAKEN: The Net Tightens

STIR/SHAKEN has been mandatory for large voice providers since June 2021. Key 2026 milestones:

• Expired small-carrier extensions mean every originating provider in the call path must support full attestation.
• The Robocall Mitigation Database is being audited aggressively; the FCC has taken enforcement actions against providers with inadequate mitigation plans.
• Terminating carriers increasingly block or label calls with less than A-level attestation.

Practical impact: the gap between A and B/C attestation is now a hard commercial gap. Anything less than A faces materially higher terminating-side filtering.

Reassigned Numbers Database: Safe Harbor Gets Tested

The FCC's RND went live November 1, 2021. The 47 CFR 64.1200(m) safe harbor has been tested in court through 2024 and 2025. What's emerging per National Law Review analysis and CompliancePoint:

• Courts treat RND non-use as evidence of negligence, not just absence of safe harbor.
• Class action filings referencing RND non-compliance have risen.
• Statutory damages of $500–$1,500 per call at scale are drawing plaintiff-side capital into this niche.

In 2026, expect aggressive discovery for RND query logs. If you dial consumer numbers with consent dates older than 30 days and cannot produce query records, you are the defendant. For mechanics, see The Hidden Cost of Reassigned Phone Numbers.

State Mini-TCPAs: The Patchwork Problem

Agents running nationally face a patchwork where the minimum is set by whichever state is strictest on the specific call. Most compliance-forward agencies have already standardized on the strictest standard rather than maintaining per-state flows.

What to Do Before Q2 2026

• Audit consent records. Each active lead must have timestamp, source URL, IP address, user agent, and exact disclosure language. Missing any field means treat the lead as unconsented for 2026 dialing.
• Log every RND query. Your TCPA defense includes producing query logs — build them now with timestamp, number, consent date, and response.
• Verify STIR/SHAKEN A-level attestation end-to-end. Ask your origination carrier for documented confirmation. If they hedge, migrate.
• Tighten CNAM and analytics hygiene. Regulation does not require it, but terminating carriers filter on reputation independent of attestation.
• Standardize on the strictest-state consent flow. Building state-specific consent is brittle.

For operational tactics on the dialer side, see Setting Up a Compliant Outbound Call Strategy for the New Year.

Enforcement Heat Map

Where plaintiff and state AG activity are concentrated in 2025–2026:

• Florida — FTSA class actions, even after the 2023 amendments tightened the autodialer definition.
• Washington — state AG telemarketing enforcement.
• California — CIPA-adjacent recording claims layered on TCPA.
• Maryland — private actions under Stop the Spam Calls Act.
• Oklahoma — aggressive plaintiff's bar post-2022.

Dialing into these states without hardened consent flows is structurally more expensive. Many agencies geofence out the worst-heat states while they harden — an imperfect but defensible stopgap.

FAQ

Q: Did the FCC one-to-one consent rule go into effect? A: No. The Eleventh Circuit vacated it in IMC v. FCC on January 24, 2025, before the January 27 effective date. State mini-TCPAs have similar rules, and most mature agencies build to one-to-one regardless.

Q: What's the difference between A, B, and C attestation under STIR/SHAKEN? A: Full (A) attestation means the originating provider authenticated the caller and verified number rights. Partial (B) means authenticated caller, unverified number rights. Gateway (C) means neither. A is the operational requirement for reliable delivery.

Q: Do I need to scrub against the Reassigned Numbers Database before every call? A: You must scrub before calling any consumer number whose consent date is old enough to have allowed reassignment. The 47 CFR 64.1200(m) safe harbor requires a definitive "no" and that consent date be supplied. Most agencies scrub nightly.

Q: If I'm in a state with a mini-TCPA, does federal law preempt it? A: Generally no. The TCPA explicitly preserves state authority to regulate more strictly. State claims run concurrent with federal claims, with their own damage provisions.

Q: What's the status of the revocation-all rule? A: The FCC delayed the full effective date from April 2025 to April 11, 2026, and in a January 2026 order pushed certain informational-call categories to January 31, 2027. Core revocation-handling rules under 47 CFR 64.1200(a)(10) remain in force.

Q: Are there any new safe harbors coming that actually help agents? A: The RND safe harbor is the main one in effect. Industry groups have petitioned for additional safe harbors on good-faith scrubbing and attestation compliance; none have been granted as of Q1 2026.

Q: How aggressive is FCC enforcement in 2026 going to be? A: Enforcement resources are constrained but focused on originating carriers that fail to implement robocall mitigation. Agents feel this indirectly when carriers tighten acceptance policies to protect their Robocall Mitigation Database standing.

Q: How does the 2023 FTSA amendment change exposure in Florida? A: The May 2023 amendment narrowed the autodialer definition to systems that both select and dial numbers, which reduced the plaintiff-friendly reading of the prior version. Bradley Arant has tracked the litigation fallout. Exposure is lower than 2022 but still material.

Stop guessing. Run the audit.

LineAudit checks your first 20 DIDs free. You'll see exactly which numbers are flagged, mis-registered, or at risk — in 30 seconds.

Run Free Audit →