Lead with the correction, because a lot of 2026 martech content still has this wrong: the FCC's one-to-one consent rule is dead. The Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC on 24 January 2025, holding that both the one-to-one requirement and the "logically and topically associated" requirement exceeded the FCC's authority by altering the ordinary meaning of "prior express consent." The FCC subsequently repealed the vacated language and reinstated the prior version.
So the operative standard is the pre-2023 definition of prior express written consent at 47 C.F.R. § 64.1200(f)(9), and a shared-consent lead-generation model is not per se unlawful under the federal rule.
What that does not mean is that consent got easy. The decision did not change underlying TCPA obligations, state mini-TCPA statutes (Florida, Oklahoma, Maryland among them) remain independently enforceable and are where much of the current litigation lives, and plaintiff-side theories about the scope and validity of multi-seller consent are very much alive. A system built on "the 1:1 rule was struck down, so we're fine" is built on a misreading of a narrow holding.
Consent is a data model, not a checkbox
The engineering consequence of all of the above: consent has to be a first-class record the agent cannot route around, carrying who consented, to what, when, through which disclosure text, and on what channel. Two properties matter most:
- Provenance. When a consent record's origin cannot be reconstructed, it is worthless as a defense. Store the actual disclosure language shown and the timestamp, not a boolean.
- Channel scope. Consent for email is not consent for SMS is not consent for a call. An agent that "helpfully" switches channel to improve reply rates has stepped outside the consent it was given.
Suppression lists are a hard constraint, and the failure mode is specific: they must be checked at send time, not at list-build time. An agent that assembles a campaign at 09:00 and sends at 14:00 will contact people who opted out in between. Check immediately before the outbound action, and make suppression a blocking call rather than a filter applied earlier in the pipeline.
Never infer what the prospect did not tell you
Personalization quality is the entire value of a sales agent, and it is also where the reputational failures cluster. Two rules:
Do not infer sensitive traits. Health status, financial distress, immigration status, religion, pregnancy, sexual orientation — inferring any of these from enrichment data and reflecting it in outreach is indefensible regardless of whether a specific statute names it.
Do not fabricate customer facts. "I saw your team just expanded to Berlin" is devastating when it is wrong, and a model asked to write a personalized opener will happily invent it. Every specific claim about the prospect must trace to a retrieved CRM or enrichment field, and the agent must be able to write a generic opener when it has nothing — that is the fallback most implementations forget to build, so the model invents instead.
CRM writes need scoping, dedup, and ownership checks
The CRM is a shared system of record with real ownership politics, and an agent with broad write access breaks it quietly:
- Scoped operations. Read and write permissions per object and per field, not blanket API access. An agent that logs activities does not need to delete opportunities.
- Duplicate detection before create. Agents generate duplicates at machine speed — the same prospect from three sources becomes three contact records, and reps lose trust in the data within days.
- Ownership checks. Writing to a record owned by another rep, or contacting an account already in someone's active cycle, is an internal incident before it is a compliance one. Check ownership and existing engagement before any outbound action.
- Approval gates on irreversible or high-value actions — pricing, contractual commitments, discounts, anything that creates an expectation the company must honor.
Instrument the things that predict trouble
Complaint and unsubscribe rate per campaign (the earliest signal that targeting has drifted), suppression-check latency between assembly and send, duplicate-creation rate, fabricated-fact rate sampled against CRM ground truth, and the share of outreach whose personalization traces to a retrieved field. That last metric is the one that separates a sales agent from a plausible-sounding liability.
Related: production e-commerce agents, human approval gates, agent observability, structured outputs.