The FCC rewrites how customers opt out of robocalls and texts

On 26 October 2026 the Federal Communications Commission published a final rule amending its Telephone Consumer Protection Act rules in 47 CFR Part 64. It changes how a consumer revokes consent to robocalls and automated texts, and it amends the exemption that lets financial institutions send certain alerts without prior consent. The rule is effective 25 November 2026.

That date matters for one piece in particular. The new version of paragraph (a)(10) of section 64.1200 "will go into effect at that time and supersede the delayed effective date of the relevant portion of that rule that was previously extended to January 31, 2027." Anyone who had pencilled in early 2027 for this work has lost about two months.

Callers can choose one way to opt out

Under the amended (a)(10), "Callers may designate any of the following methods as the exclusive means to revoke consent." There are three: "an automated, interactive voice or key press-activated opt-out mechanism on a call"; "replying to an incoming text message with any one of the following standardized words"; or a revocation made "pursuant to a website or telephone number designated by the caller to process opt-out requests."

The standardized words are "stop," "quit," "end," "revoke," "opt out," "cancel" and "unsubscribe." A texter can include "at least one of the standardized words" in each message to tell people how to opt out, but still has to honor all of them.

The designation has a condition attached: "The caller must clearly and conspicuously disclose the designated method to revoke consent on the call or in the text." If you do that, you are "not required to process revocation requests made by any other means."

If you don't designate a method, the open standard applies. Callers "must process revocation requests made by any reasonable means," and the rule "creates a rebuttable presumption that the consumer has revoked consent" when someone uses a means the rule doesn't list.

Either way, a revocation "must be honored within a reasonable time not to exceed ten business days from receipt of such request." A confirmation text is allowed. "If the confirmation text is sent within five minutes of receipt," it "will be presumed to fall within the consumer's prior express consent."

Revoking one kind of message, not everything

The FCC dropped the "revoke all" approach for informational messages, saying it "does not align with consumer expectations and poses significant risks to the delivery of essential information." The rule now says "Callers may interpret a revocation request made in response to an informational call or text message (i.e., a call or text message that does not contain any advertising or telemarketing) as applying only to the specific category of informational robocalls and text messages to which the revocation was directed."

That category limit is for informational messages only; the rule text gives no such limit for advertising or telemarketing.

The financial institution exemption

The exemption in section 64.1200(a)(9)(iii) covers, in the FCC's words, communications "related to transactions and time sensitive events" and those "informing consumers of a risk of fraud or identity theft." Until now it was limited to customers "who have provided their telephone numbers to that financial institution." The FCC said that condition "unduly restricts the ability to communicate important, often time-sensitive information to customers."

The amended (a)(9)(iii)(A) says exempt calls and texts "must be sent only to the wireless telephone number(s) provided by the customer of the financial institution or obtained from a reliable source." A number from a reliable source is one "supplied by a spouse or other family member who is authorized to be on the account;" "obtained when the customer calls the financial institution;" or "included in records obtained from another financial institution."

The last one is easy to miss, and should help with numbers that arrive in an acquired loan portfolio.

What it could mean

We think the exclusive-means option is the part to decide on before 25 November. It looks like a gift: name the STOP reply as the one channel, and the rule says you are "not required to process revocation requests made by any other means," such as a customer emailing a branch. That only works if every message carries the disclosure "clearly and conspicuously," and if every vendor sending texts in your name does the same. If one vendor's texts lack the wording, you're back to "any reasonable means" for that stream.

The category rule needs a decision too. A customer who replies STOP to a payment reminder can now keep getting fraud alerts, but only if your systems record opt-outs by message category rather than as one flag on the phone number. Many cores and texting platforms hold one flag. Our guess is that the cheapest safe answer for a small institution is to keep honoring a STOP across all informational texts for now, and to fix the data model on its own timetable.

The wider exemption is a plain win for fraud teams. It's worth checking whether your alert vendor still filters out numbers that came from an authorized family member or another institution, since that filter was built for the old text. It's also a good moment to test how long an opt-out really takes to reach every system that sends messages.