The State Law Patchwork: Texas, Virginia, and One-to-One Consent Explained
This article is general information, not legal advice. Consult qualified telecommunications counsel before designing an outbound calling program.
Teams building AI outbound programs often stop their compliance research at the federal TCPA. That's a mistake. The TCPA is the floor, not the ceiling — it does not preempt state laws that are more protective. And in 2024–2026, states have been busy adding rules that go well beyond the federal baseline.
Here's a map of the pieces that matter most, and why the patchwork forces you to design for the strictest applicable rule rather than the federal minimum.
The one-to-one consent shift
The most consequential recent change is the move toward one-to-one consent. The old practice let a single consent form authorize contact from multiple businesses — a lead generator collected consent once and passed it to many buyers.
That practice is being eliminated. Under the tightening interpretation, consent must specifically authorize the particular company doing the calling. You cannot rely on a lead's consent given to a third-party data vendor unless that consent specifically names you or a sufficiently described category of callers.
For anyone buying leads, this is a big deal: the vendor's blanket consent form no longer covers you. You need consent that names your company, and the liability for getting it wrong lands on the caller — vendor indemnification clauses rarely survive a real class action.
Texas: expanding the definition of solicitation
Texas has moved aggressively. Recent Texas legislation expanded the definition of "telephone solicitation" to explicitly include text messages, and violations can trigger the Texas Deceptive Trade Practices Act, potentially resulting in treble (triple) damages.
On the AI-specific side, Texas requires AI voice technology to be disclosed within the first 30 seconds of a call and prohibits voice cloning of identifiable people without consent. Texas's broader AI law, effective at the start of 2026, requires certain regulated industries to disclose AI interaction without using dark patterns — meaning the disclosure has to be genuinely visible, not technically-present-but-hidden.
Virginia: the long opt-out memory
Virginia added a rule with a long tail: businesses must honor text opt-out requests for ten years — significantly longer than federal requirements. If someone opts out of your texts, that suppression has to persist for a decade.
The operational implication is that your suppression lists can't be treated as short-term. An opt-out you recorded years ago still binds you, which means your DNC and suppression infrastructure needs durable, long-horizon record-keeping, not a list that gets rebuilt every campaign.
The other layers that stack on top
Beyond these headline examples, several state frameworks routinely come into play:
- California — CCPA data-handling requirements apply to call data
- Illinois — its biometric privacy law is in scope if your AI does any voice biometric processing
- Florida — its mini-TCPA has a broader autodialer definition than the federal TCPA, covering some dialers federal law has been read to exclude
- State disclosure laws — California, Illinois, Colorado and others require AI disclosure at the start of a call
None of these preempt each other. They stack.
Why this forces "strictest applicable rule" design
Here's the practical consequence of a non-preempting patchwork: if you call into multiple states, you're subject to the rules of each. You can't run one program that's compliant "on average." You have to be compliant with the most restrictive law that applies to any number you dial.
That's why serious operators design their calling program to comply with the strictest applicable state law for their target geography, not the federal minimum. It's simpler to build one program to the highest standard than to maintain fifty conditional rulesets — and far safer than discovering after the fact that a batch crossed into a stricter jurisdiction.
The takeaway
Federal TCPA is the floor. On top of it sits a growing, non-preempting patchwork: one-to-one consent killing shared lead-gen forms, Texas expanding solicitation to texts and mandating early AI disclosure, Virginia demanding ten-year opt-out memory, and a dozen other state rules stacking alongside. Because they don't preempt each other, the only sane design is to build to the strictest applicable rule. Assume more, not less — the states are still tightening.
Perceive8's compliance layer is built to the strictest applicable standard, with durable suppression records and configurable disclosure. Learn more.