Vacated vs Still-Live: How the One-to-One Consent Vacatur Interacts with State Overlays

Quick answer: The FCC's one-to-one consent rule — the December 2023 order that would have forced comparison-shopping lead forms to name one seller per consent — was vacated by the Eleventh Circuit in IMC v. FCC (January 2025) before it took effect. The vacatur restored the pre-rule federal baseline; it did not relax anything. Seven states (FL, OK, MS, LA, AL, AR, WV) run their own mini-TCPA statutes on top of the federal 8 AM–9 PM recipient-local window, and none of those overlays cared about the federal one-to-one rule. The Devotel Orbit posture stays exactly what it was before the vacatur: refuse-by-default for marketing sends to contacts with no recorded consent, opt-in receipts written to an audit log, a known-litigator scrub available per organization, and the federal dialing window intersected per send with state overlays. The controls belong to the tenant; this post maps the vacated rule, the live overlays, and the docs pages that describe each control.

This is the bridge post between two existing reads: the vacatur explainer, which covers the federal rule's rise and fall, and the quiet-hours vs state-window mechanics post, which covers the per-send window math. Neither connects the vacatur context to the platform posture a buyer configures — this one does. Nothing here is legal advice; it is the state of the published law plus a description of shipped tenant-owned controls.

1. The vacated rule — what it would have required, and why the court removed it

The FCC's December 2023 order targeted comparison-shopping and lead-generator websites: pages that show a consumer one checkbox and sell that single "consent" to dozens of sellers. The adopted rule would have required that each valid consent name one seller (one-to-one), and it tightened the topical-relation test so the content of a robocall or robotext had to match the transaction that prompted the consent.

The Eleventh Circuit vacated the rule in IMC v. FCC (Insurance Marketing Coalition v. FCC, January 2025), ruling before the effective date that the FCC exceeded its statutory authority over what the TCPA's "prior express consent" term permits. The vacatur restored the pre-December-2023 doctrine: prior express written consent for autodialed or prerecorded-voice telemarketing, DNC registry and internal do-not-call rules, the federal quiet-hours window, and TSR seller disclosures — all unchanged, all still binding. The full vacatur explainer walks the order and the ruling in detail.

The point most coverage misses: the vacated rule was a consent-scope rule, not a timing rule and not a state-law rule. Its removal resolved one question (whether a lead form must name a single seller) and touched none of the others.

2. What changed in practice — nothing on the timing or state-overlay side

A program that treated the vacatur as a reason to loosen posture would be relaxing against layers that never depended on the vacated rule:

• The federal dialing window stands untouched. 8 AM–9 PM recipient-local (47 U.S.C. § 227(b)(1)(B); 47 CFR § 64.1200(c)(1)) applies to every US outbound dial and send, before and after the vacatur, identically.
• State mini-TCPA overlays stand untouched. Seven states — FL, OK, MS, LA, AL, AR, WV — run stricter overlays: shorter windows, Sunday bans, or both. Federal law expressly does not preempt stricter state law (47 U.S.C. § 227(e)), so the binding window is always the intersection. The Eleventh Circuit vacated one FCC order; it did not reach a single state statute.
• The baseline consent doctrine stands untouched. Prior express written consent under the TCPA and TSR remains the requirement the vacated rule would have added to, not replaced.

On Orbit the intersection computes per send: a recipient's area code resolves to a state, that state's overlay (if any) is intersected with the federal window, and the send either dispatches or defers with a citation-bearing reason and a next_allowed_at. The TCPA quiet-hours vs state-window post walks the deferral examples — a Florida recipient at 8:30 PM Tuesday defers where a Texas recipient at the same clock time dispatches.

3. Why posture-first means refusing by default, independent of the vacatur

"Posture-first" on Orbit names a specific tenant-owned configuration: treat a contact with no recorded consent as unreachable for marketing until a record says otherwise. Three controls compose it, and none of their reasons to exist changed with the vacatur:

• Refuse-by-default for marketing sends. The unknown-marketing policy (GET / PATCH /api/v1/settings/compliance/unknown-marketing-policy) decides what a contact whose consent state is unknown may receive. Its default is refuse: a marketing send to a contact with no recorded consent does not dispatch. The alternative value, allow_with_logging, exists for programs whose lawful basis does not require opt-in — the posture is the tenant's to set, and the audit trail records both the policy and every decision under it. The consent-default-policy docs page covers both policies and their endpoints.
• Audit-logged opt-in receipts. A consent record worth having carries source, timestamp, scope, and the exact disclosure-language version — the same four-field design the vacatur explainer prescribes, and the same ledger pattern the consent-proof-first messaging post generalizes across channels. The vacatur changed which federal rule applies; it changed nothing about what a record must prove in discovery.
• Known-litigator scrub. The Litigator-Known scrub gates SMS/MMS sends against roughly 36 months of TCPA lawsuit history, refreshed daily — a tenant-opted gate whose exposure math ($500–$1,500 per violation, manufactured by professional plaintiffs) is entirely independent of the one-to-one question. The litigator-scrub post covers the resolution chain and the exports.

The discipline the vacated rule formalized — a consent tied to a named seller, captured with its disclosure version — remains the cleanest scope fact a record can carry under the restored baseline. Posture-first is not a reaction to the rule's life or death; it is the configuration that survives either.

4. Where the controls live — the docs anchors

Each layer above has one reference page written for counsel and operators:

• [US Calling Windows: Federal TCPA + State Overlays](https://docs.orbit.devotel.io/compliance/state-calling-windows) — the seven overlay states with statutes, the recipient-state resolution from NANP area codes, the enforcement split between ad-hoc and campaign/dialer voice, and the quiet-hours preview endpoint.
• [Consent Posture: The Unknown-Consent Policies](https://docs.orbit.devotel.io/compliance/consent-default-policy) — the two tenant-owned policies (unknown_marketing_policy for marketing sends, consent_default_policy for CDP fanout), their endpoint shapes, and the refuse-by-default vs allow-with-logging choice.
• [Consent Management & Receipts](https://docs.orbit.devotel.io/compliance/consent-management) — the per-contact consent ledger: grants, revocations, scope, language versions, receipts, and exports.
• [Known Litigator Scrub](https://docs.orbit.devotel.io/compliance/tcpa-known-litigator) — the scrub's layered lookup, the re-scrub cadence, and the discovery-request exports.

Frequently asked questions

Did the vacatur make one-to-one consent unnecessary?

The vacatur removed the federal requirement; it did not remove the discipline. Seller-specific consent with the disclosure version recorded remains the strongest scope fact under the baseline TCPA and TSR — and several state statutes define consent more tightly than the federal baseline regardless.

Which state overlays are live today?

Seven: Florida, Oklahoma, Mississippi, Louisiana, Alabama, Arkansas, and West Virginia. The state-calling-windows docs page keeps the table with each state's window, blocked days, statute citation, and the resulting intersection with the federal window.

Does Orbit block sends outside the window, or just warn?

For campaign and dialer voice the federal window is hard-blocked at the platform level — no tenant toggle relaxes it. The state overlays and the tenant's own quiet-hours gate add on top as tenant-configured deferrals: a blocked send defers with next_allowed_at rather than failing. Ad-hoc voice is advisory until the tenant opts in. The split is documented on the state-calling-windows page.

Who owns the compliance decision — the platform or the tenant?

The tenant. Orbit is the conduit; it enforces the posture you configure and keeps the audit trail, but it does not adjudicate that a send is compliant. The tenant-owned controls are documented in the consent-default-policy and consent-management pages; jurisdiction-level reliance questions stay with your counsel.

The takeaway

The vacatur settled one narrow question — whether a federal order could force lead forms to name one seller — and left every other layer in place: the federal window, seven state overlays, the baseline consent doctrine, and the tenant-owned posture that answers them all. Read the two component posts for the mechanics; read this one when a buyer asks how they fit together; and configure the controls at the docs anchors above. None of it relaxes because a court vacated a rule that never took effect.

Published 22 September 2026.