FCC One-to-One Consent Rule Vacated: What Dispensaries Should Do Now

The FCC’s 2023 one-to-one consent rule was vacated by the Eleventh Circuit on January 24, 2025. Dispensaries should not treat its one-seller-at-a-time and logically related restrictions as an operative federal requirement. The ruling did not remove the TCPA’s existing consent rules.

Editorial correction, September 30, 2026: an earlier version of this article described the vacated rule as current. This version separates the court decision from practical consent controls a dispensary still needs.

What happened to the FCC’s one-to-one consent rule?

The FCC’s 2023 order added two restrictions to the definition of prior express written consent: consent to one seller at a time, and messages logically and topically associated with the interaction that prompted consent. In Insurance Marketing Coalition Ltd. v. FCC, the court vacated Part III.D of that order and remanded it to the agency. Read the court’s published opinion.

This matters when reviewing an old compliance checklist. A statement that the FCC’s 2023 rule now requires every form to collect consent one seller at a time misstates the result.

Does a dispensary still need consent to send marketing texts?

Yes. The decision did not erase existing consent requirements. The current TCPA regulations address prior express written consent for covered telemarketing calls and texts, required disclosures and consumer revocation. Applicability depends on the messaging technology, message purpose and other facts. State law and carrier policies can add separate obligations.

Buying from a store, joining a rewards program or supplying a number for an order should not be treated as interchangeable with permission to receive recurring marketing texts. Confirm the permission actually collected before importing a list. Start with our dispensary SMS opt-in guide.

A practical consent record for dispensary texting

Keep a record your team can inspect, rather than a spreadsheet column that simply says “subscribed.” For each marketing subscriber, preserve:

• The number and the date, time and source of the opt-in.
• The exact disclosure and form version the person saw.
• The business or businesses identified and the types of messages agreed to.
• The affirmative action used to give permission.
• Subsequent withdrawals of permission and suppression history.

Use clear sender identification, explain message purpose and frequency, provide an accessible way to stop messages, and keep disclosures consistent with the actual program. Have counsel review the form and your specific use case.

What about multiple locations or shared customer lists?

Check the original disclosure before extending a program to another store or brand. The court decision does not prove that any list may be sold, transferred or reused for any purpose. Separate brands, location preferences and communication purposes in your data, and obtain appropriate permission when the proposed use exceeds what the customer agreed to.

For example, an order-status number collected by one store should not silently become a marketing subscription for another business. Give the customer a clear choice and keep the evidence of that choice.

Consent, registration and cannabis policy are separate checks

Valid consent does not establish that a cannabis-related message is permitted by a carrier. A registered brand does not make every campaign lawful or guarantee delivery. An age gate does not by itself verify someone’s age or make a prohibited offer acceptable.

Review the sender, text, media, linked destination and actual use case together. Blackleaf supports registration, opt-out handling and messaging workflows; the operator remains responsible for its audience, permissions and content. Our compliance guide, age-gating guide and carrier-filtering guide explain those distinct checks.

Before your next campaign

1. Remove references to the vacated 2023 rule from your operating checklist.
2. Review consent records and suppress contacts without adequate permission for the proposed send.
3. Test opt-out handling and reconcile suppression across connected systems.
4. Check the actual message and destination against current law and carrier policy.
5. Document who approved the audience, content and sending schedule.

For help configuring Blackleaf, talk with our team or use the onboarding guide. This article is operational information, not a substitute for legal advice about your program.