Of the TCPA changes in the last two years, this is the one with real operational teeth, and it has had a fraction of the attention paid to the consent rule that was struck down. Effective 11 April 2025, the window to honour a revocation of consent dropped from 30 business days to 10.
Stated that way it sounds like a parameter change. It is not. It is a change that breaks a specific and very common architecture.
Why the queue is the problem
A great many outbound operations handle suppression in batches. Opt-outs accumulate — from SMS replies, from a web form, from agents dispositioning calls — and get reconciled into the dialler on a schedule. Weekly is typical. Fortnightly is common. Under a 30-business-day rule, a fortnightly reconciliation had roughly a month of headroom and essentially never breached.
Under 10 business days, that same fortnightly cycle is already outside the window before anyone touches it. The process did not degrade; the deadline moved underneath it. And because nothing visibly breaks, the failure is silent — there is no error, no bounce, no alert. The first signal is a demand letter.
Two weeks is now late
10 business days is about two calendar weeks. Any suppression process that runs on a fortnightly or monthly cadence is, by construction, capable of breaching. If reconciliation is manual and someone is on leave, it will.
The channel gap
The second failure mode is structural rather than temporal. Opt-outs frequently arrive on a different system from the one that will place the next call: an SMS platform captures the STOP, and the dialler never learns about it. Both systems are working exactly as designed.
The regulatory position on cross-channel revocation is unsettled — the broad "revoke-all" provision has been waived twice and the FCC has proposed deleting it. But the unsettled state is an argument for suppressing more broadly, not less. Suppression costs nothing. A consumer who texted STOP and then got called is not going to find the distinction between channels persuasive, and neither is a jury.
What a compliant process looks like
- Suppress on receipt, not on schedule. The moment a revocation is captured it should be written to a durable suppression list. Treating this as an event rather than a batch removes the deadline problem entirely.
- One suppression list, all channels. Voice, SMS and email should read the same list. If they read three lists, you have three chances to fail.
- Capture the verbatim. Store what the consumer actually said, with a timestamp and channel. When the question later is whether a phrase conveyed a desire not to be contacted, the transcript is the evidence and the presumption runs against you without it.
- Make it permanent. Revocations must outlive the campaign that produced them. A suppression that lives in a campaign export dies with the campaign.
- Instrument the lag. Measure the time between revocation and suppression and alert on it. If nobody measures it, nobody finds out it drifted.
Where this sits relative to scrubbing
Worth being clear, because the categories get blurred: this is a your systems problem, not a data-vendor problem. No external file tells you that someone asked you to stop — that record only exists inside your own operation, and no scrub can reconstruct it.
What external checks cover is the adjacent risk. A list can be perfectly suppressed and still full of disconnected numbers, landlines, and serial litigators who never opted out because being called is the point. Those are complementary problems. Solving one has never solved the other, and the 10-day rule does not change that — it just shortens the time you have to get your half right.
For the full current position, see the TCPA compliance guide.
Frequently asked questions
What counts as a valid revocation?
Any reasonable method. The seven magic words — stop, quit, revoke, opt out, cancel, unsubscribe, end — are treated as automatically effective, but they are a floor rather than a list.
Anything else a consumer says that reasonably conveys a desire not to be contacted creates a rebuttable presumption that consent was revoked. In practice that means a reply of "please stop calling me" counts, and so does telling an agent on a live call. Rebutting the presumption is your burden, not theirs.
Does an opt-out on one channel stop the others?
This is the part that is genuinely unsettled, and the reason to be careful. The FCC adopted a broad "revoke-all" provision, but it has been waived twice and the Commission has proposed deleting it, so it is not currently in force.
That is a poor foundation for a business decision. A consumer who texts STOP and then receives a marketing call has an obvious grievance whatever the regulation says, and the cost of suppressing across channels is close to zero. Suppress broadly.
Is 10 business days a target or a deadline?
A deadline, and an outer one. Nothing rewards you for using the full window. Every call placed between the revocation and the suppression is a call to someone who has already told you to stop — technically inside the window, and exactly the fact pattern that produces a claim.
Do I still need an internal do-not-call list?
Yes, and it is separate from both the national registry and your consent records. A revocation has to persist after the campaign that produced it ends, which means it belongs in a durable suppression list rather than in a campaign export. See the Do Not Call Registry entry for how the obligations differ.