The TCPA "revoke-all" opt-out rule: what the FCC's 2026 order changes

The TCPA "revoke-all" rule says that when someone opts out of one kind of robocall or robotext from you, the opt-out covers all your robocalls and robotexts, even on unrelated topics. It never took effect: after two waivers, the last to 31 January 2027, the FCC adopted an order on 30 September 2026 (FCC 26-67): a marketing opt-out still stops all marketing from that caller, but an informational opt-out may be limited to its own category. The order takes effect 30 days after Federal Register publication. The rest of the 2024 revocation rules have applied since 11 April 2025 or earlier. Build one consent and opt-out record per person, shared across programs.

This is not legal advice. It summarizes federal rules and FCC documents as they stood on 9 October 2026. It doesn't cover state laws. Ask your counsel before you rely on it, and check the Federal Register for the effective date of FCC 26-67.

#What does the revocation rule require today?

Five requirements from the FCC's February 2024 consent order (FCC 24-24, adopted 15 February 2024) already apply. The confirmation-text rule took effect on 4 April 2024 (Federal Register, 89 FR 15756); the others have applied since 11 April 2025 (Federal Register, 2024):

The rule text is in the current eCFR (eCFR, 2026). The FCC's order explains the purpose: "We strengthen consumers' right to revoke consent by any reasonable means by codifying the right and ensuring callers and texters do not unduly restrict it" (FCC 24-24, 2024).

#What is the "revoke-all" provision, and why was it delayed?

It is the part of 64.1200(a)(10) that makes a revocation apply across message types. The FCC's order says that once consent is revoked, "the caller may no longer make robocalls or send robotexts to a called party absent an exemption", and its summary, which says the Order "reiterates" the point, puts the effect plainly: "consumers only need to revoke consent once to stop getting all calls and texts from a specific entity" (FCC 24-24, 2024).

Banks and other financial institutions asked for more time, because their systems process opt-outs separately per business unit; electric utilities and consumer groups later backed a further delay. The FCC's Consumer and Governmental Affairs Bureau waived the provision twice:

The first waiver was meant to give parties "a reasonable opportunity to implement modifications to communications systems in a cost-effective manner" (DA 25-312, 2025). The second gave the FCC time "to review the record compiled in response to a recent Further Notice of Proposed Rulemaking and to avoid imposing potentially unnecessary compliance costs" (DA 26-12, 2026; FNPRM, 2025). DA 26-12 says the waiver "extends only to section 64.1200(a)(10) to the extent discussed herein". Everything else still applies, and the waiver stays in place until FCC 26-67 takes effect.

#What did the FCC decide on 30 September 2026?

It replaced revoke-all before it ever took effect. On 30 September 2026 the FCC voted 3-0 to adopt a Report and Order and Further Notice (FCC 26-67, released 1 October 2026), based on the draft it had released on 9 September (FCC-CIRC 2609-05) (FCC 26-67, 2026; FCC news release, 2026). The order:

• lets callers interpret an opt-out sent in reply to an informational call or text, one with no advertising or telemarketing, "as applying only to the specific category of informational robocalls and text messages to which the revocation was directed and not to all communications";
• keeps a broad scope for marketing: an opt-out sent in reply to marketing revokes consent "to all future calls or text messages containing an advertisement or constitute telemarketing from that caller";
• lets callers designate one or more exclusive opt-out methods (a key-press option on the call, the seven reply words, or a website or phone number), if they disclose the method clearly and conspicuously on each call or text;
• lets financial institutions send exempt fraud-alert calls and texts to wireless numbers obtained from a "reliable source", such as an authorized family member on the account, not only to numbers the customer gave them;
• keeps the ten-business-day limit for honoring opt-outs;
• takes effect 30 days after Federal Register publication and supersedes "the delayed effective date of the relevant portion of that rule that was previously extended to January 31, 2027".

Compared with the draft, the adopted rule adds that a text sender using reply texts as its exclusive method can meet the disclosure duty by including at least one of the seven words in each text, as long as it accepts all seven. The order also says callers may designate more than one method, and it declines a request to delay the effective date by up to 12 months.

As of 9 October 2026 the order had not been published in the Federal Register, so it was not yet in effect. The FCC says it will announce the exact effective date in a Public Notice. Until then, the current rule and the waiver to 31 January 2027 apply.

The Further Notice asks whether to shorten the ten-business-day deadline (a joint industry and consumer-group letter suggests seven business days), whether to require two-way texting, whether callers must offer a way to revoke consent to all robocalls, and how opt-outs apply across affiliates. Comments are due 30 days, and replies 60 days, after Federal Register publication.

#What counts as a "reasonable means" to opt out?

Under the current rule, any method that clearly expresses a wish to stop. Specifically:

• Reply texts with one of the seven listed words are valid per se. Other wording, such as "please don't text me again", also counts if a reasonable person would read it as a request to stop.
• Other channels, such as an e-mail to your support address or a voicemail, create a rebuttable presumption under 64.1200(a)(11).
• No reply channel. If your texts can't receive replies, each message must say so clearly and give other ways to opt out.

For the confirmation text, the FCC allows one clarifying question where the person had consented to several categories. Senders "can include a request for clarification in this one-time confirmation text, provided the sender ceases all further robocalls and robotexts absent an affirmative response from the consumer" (FCC 24-24, 2024, para. 25). No reply means stop everything. The amended text of 64.1200(a)(12) in FCC 26-67 no longer contains this clarification sentence, so ask counsel how to word multi-program confirmations once it takes effect.

Once FCC 26-67 takes effect, callers that designate an exclusive method won't have to process requests made any other way. Callers that don't designate one keep the "any reasonable means" duty.

#How should the opt-out data model work?

Store the facts, not the conclusion. Record which program each consent covers, and which program each opt-out answered. Then decide the scope when you send, from a policy that you can change on one date without migrating data. A minimal PostgreSQL model:

-- One consent record per person, number and program; one opt-out log for every channel.
CREATE TABLE consent (
  id           bigserial PRIMARY KEY,
  phone_e164   text NOT NULL CHECK (phone_e164 ~ '^\+[1-9][0-9]{6,14}$'),
  program      text NOT NULL,                  -- e.g. 'appointment_reminders', 'weekly_offers'
  category     text NOT NULL CHECK (category IN ('informational', 'marketing')),
  consent_type text NOT NULL CHECK (consent_type IN ('express', 'express_written')),
  granted_at   timestamptz NOT NULL,
  source       text NOT NULL,                  -- form id, keyword, paper, call recording
  evidence     jsonb NOT NULL DEFAULT '{}'     -- wording shown, IP, user agent
);

CREATE TABLE opt_out (
  id                 bigserial PRIMARY KEY,
  phone_e164         text NOT NULL CHECK (phone_e164 ~ '^\+[1-9][0-9]{6,14}$'),
  received_at        timestamptz NOT NULL,
  channel            text NOT NULL,            -- sms_reply, email, voicemail, web, agent, ivr
  raw_text           text,                     -- what the person actually said
  in_reply_to        text,                     -- program of the message they answered; NULL if unknown
  in_reply_category  text CHECK (in_reply_category IN ('informational', 'marketing')),
  processed_at       timestamptz               -- when suppression took effect
);
CREATE INDEX ON consent (phone_e164, program);
CREATE INDEX ON opt_out (phone_e164, received_at);

The send-time check takes the scope policy as a parameter:

--   'revoke_all'  : any opt-out stops every program that needs consent
--   'by_category' : an informational opt-out stops that program; a marketing opt-out stops all marketing
--   'by_program'  : an opt-out stops only the program it answered
-- An opt-out whose program is unknown (an e-mail, a voicemail) always stops everything.
CREATE FUNCTION may_message(p_phone text, p_program text, p_policy text DEFAULT 'revoke_all',
                            p_at timestamptz DEFAULT now()) RETURNS boolean
LANGUAGE sql STABLE AS $$
  WITH c AS (
    SELECT category, max(granted_at) AS granted_at
    FROM consent WHERE phone_e164 = p_phone AND program = p_program AND granted_at <= p_at
    GROUP BY category
  )
  SELECT EXISTS (SELECT 1 FROM c) AND NOT EXISTS (
    SELECT 1 FROM opt_out o, c
    WHERE o.phone_e164 = p_phone
      AND o.received_at > c.granted_at          -- a newer consent for this program re-opts the person in
      AND o.received_at <= p_at
      AND (
            o.in_reply_to IS NULL
         OR p_policy = 'revoke_all'
         OR o.in_reply_to = p_program
         OR (p_policy = 'by_category' AND o.in_reply_category = 'marketing' AND c.category = 'marketing')
      )
  )
$$;

We tested it on PostgreSQL 18 with a fictional number, +15555550100, that had consented to two informational and two marketing programs, then replied STOP to an appointment reminder and to a weekly offer:

A later opt-out by e-mail with no known program blocked every program under every policy. A fresh consent to fraud alerts, recorded after the opt-outs, re-enabled only that program. by_category matches our reading of FCC 26-67. Which policy you run, and from when, is a question for your counsel.

#What about reassigned numbers?

An opt-out, like consent, belongs to a person, not to a number. When a number is disconnected and given to someone new, the old consent doesn't transfer, and the old opt-out tells you nothing about the new subscriber. The FCC's Reassigned Numbers Database answers whether a number was permanently disconnected after a date you give. A wrong "no" answer can give you a narrow safe harbor under 64.1200(m). Our Reassigned Numbers Database guide covers the workflow.

In the data model, that means two things:

• Keep granted_at on every consent row and query the database with it before each campaign.
• Never delete an opt-out because a number was reassigned. Close the old person's record instead, so the audit trail survives.

List hygiene helps too. Our carrier lookup and bulk US and Canada carrier lookup show whether a number is valid, its line type and current carrier. A line-type change since you collected consent, such as mobile to VoIP, is a reason to reconfirm. A lookup is not proof of consent, and MobileValidate doesn't provide consent management or Reassigned Numbers Database queries.

#What should you check before FCC 26-67 takes effect?

Work through this list now; the order takes effect 30 days after Federal Register publication:

• One suppression store. Opt-outs from texts, e-mail, calls, support tickets and stores land in one log keyed on the E.164 number.
• Program on every record. Each consent row names its program and category. Each opt-out records the program it answered, or NULL when unknown.
• Policy as configuration. The scope policy (revoke_all, by_category or by_program) is one setting with an effective date, reviewed by counsel.
• Seven words, any case. Reply matching is case-insensitive and tolerates extra words. Unclear free text goes to a person.
• Ten business days as a ceiling. Automated opt-outs take effect before the next send. Manual ones are tracked against the deadline with processed_at.
• One confirmation, no marketing, sent within five minutes. Where the person had several programs, it may ask which to stop. No answer means stop all.
• Exclusive method, if you choose one. If you designate an exclusive method under FCC 26-67, disclose it clearly on every call and text, and keep accepting any reasonable request until the order takes effect.
• Reassigned numbers checked before campaigns, with consent dates kept.
• A test after every change that sends to a suppressed number and expects a block.

The wider checklist, covering consent types, quiet hours and do-not-call lists, is in our TCPA compliance checklist for SMS. Carrier registration for US long codes is covered in 10DLC registration explained.

#What are the key takeaways?

• Revocation by any reasonable means, the seven reply words and the ten-business-day limit have applied since 11 April 2025; the single confirmation text rule since 4 April 2024.
• Revoke-all, where one opt-out covers unrelated messages, was waived until 31 January 2027 (DA 26-12) and never took effect.
• On 30 September 2026 the FCC adopted FCC 26-67: informational opt-outs may be limited to their category, marketing opt-outs stop all marketing, and callers may designate an exclusive opt-out method. It takes effect 30 days after Federal Register publication, which had not happened as of 9 October 2026.
• Store the program on every consent and opt-out, and decide the scope at send time, so a rule change is a setting, not a rebuild.
• This article is not legal advice. Confirm the current rule and the effective date with counsel before you change your opt-out handling.