TCPA's One-to-One Consent Rule Is Live — Is Your BDC Legal?

TCPA class-action settlements against automotive groups averaged $2.4 million per case in recent years, and the FCC’s new one-to-one consent rule — fully in force as of January 27, 2026 — just made it significantly easier for plaintiffs’ attorneys to build those cases against your store. If your BDC is still calling or texting leads sourced from Cars.com, CarGurus, or AutoTrader under a blanket consent agreement, you are exposed right now.

What the TCPA One-to-One Consent Rule Actually Changed (Not the Lawyer Version)

Before January 2026, a consumer filling out a lead form on a third-party automotive marketplace could, in fine print, consent to be contacted by a list of dozens of “marketing partners.” That single checkbox was enough to let your BDC legally text and autodial that shopper.

The FCC killed that model. Under the new one-to-one consent standard, express written consent must be given directly to the specific seller who will be making the contact. A lead from AutoTrader who checked a box agreeing to hear from “our trusted dealer partners” is no longer compliant consent for your store to dial or text under TCPA.

This applies to calls and texts using automated dialing systems or prerecorded voices. If your BDC uses a power dialer, a text blast cadence inside VinSolutions, or an AI-powered messaging tool, this rule covers all of it.

The consent also must be logically and topically related. A consumer who consented to receive information about a specific vehicle cannot be texted about your service department’s oil change specials unless they gave separate, specific consent for that purpose.

Why Third-Party Lead Vendors Put Dealers in the Crosshairs

Lead aggregators are not your legal shield. When a lawsuit lands, plaintiffs name the dealership — the entity that made the call or sent the text. Whether the lead originally came from Cars.com, a Cox Automotive product, or a private-label form on your own site matters enormously for your defense, but it does not necessarily remove your liability for the contact itself.

Most lead vendors updated their forms and consent language after the rule took effect, but the timing is uneven. Leads that came in during the transition window — roughly October 2025 through February 2026 — carry the highest risk because consent capture practices were inconsistent across platforms during that period.

Your CRM, whether that’s eLead, CDK, Reynolds, or DealerCenter, stores every lead source. You need to know exactly which leads in your active follow-up queues originated from third-party sources during that window and what consent language was in place at the time. See What Records Do Dealerships Need for TCPA Defense? for the specific documentation your attorney will need if a claim is filed.

The 3 BDC Workflows That Are Now Technically Illegal

Most dealers are running at least one of these:

• Blasting aged third-party leads. If you purchased a list from a data provider or pulled aged leads from a marketplace integration and you do not have direct, specific consent tied to your rooftop, dialing or texting those contacts is non-compliant.
• Re-engaging cold leads with automated texts. A shopper who submitted a lead six months ago and never consented to an ongoing text nurture program from your specific dealership cannot be dropped into an SMS drip sequence today without fresh, direct consent.
• Using one vendor’s consent to justify contact through another channel. A consumer who consented to email marketing from your store has not consented to autodial calls or promotional texts. Channel-specific consent is required.

What Compliant Consent Capture Looks Like in 2026

Compliant consent under the one-to-one rule has four elements: it names your dealership specifically, it identifies the communication channel (call, text, or both), it describes the type of content (sales follow-up, service reminders, promotional offers), and it is captured at the point of the consumer’s own submission — not pre-checked, not buried.

On your own website, this means a visible, unchecked checkbox adjacent to every lead form with language like: “I agree to receive autodialed calls and texts from [Dealership Name] at the number provided regarding vehicle inquiries. Message and data rates may apply.” That language needs to be reviewed by your dealer’s attorney — not copied from a competitor’s site.

For third-party leads, you have two practical options: trust that the vendor’s updated consent language meets the standard (and document that trust with a written vendor agreement), or treat all third-party leads as requiring a compliant re-permission step before any automated contact.

How AI Lead Response Tools Handle Consent Differently Than Human Reps

Here is where dealers get this backwards. A human BDC rep who manually dials a number is generally not using an autodialer and may fall outside the statute’s automated contact requirements. An AI-powered response tool, however, is almost certainly using automation and must operate within TCPA’s consent framework.

The difference is that well-built AI lead response platforms force a compliance checkpoint at the point of engagement. Synthevo, for example, only initiates contact with leads where a direct consent record is attached to the contact. The system does not blast cold lists. It responds to inbound inquiries — shoppers who just submitted a form on your site and whose consent is captured at that moment. That architectural distinction matters legally.

Dealerships running Synthevo today, including early customers like Vanguard Auto Group in Sterling, VA, respond to web leads in under 90 seconds with a conversational AI that captures, logs, and timestamps consent at the moment of first contact — creating a clean record for every engagement rather than relying on a third-party vendor’s paperwork.

The Counterintuitive Case for Fewer Leads, Faster Follow-Up

Here is the argument that most dealers will resist: the TCPA one-to-one consent rule will actually help AI-powered BDCs outperform human teams — because compliant, high-intent leads convert faster than the spray-and-pray lists most dealers are still burning through.

A shopper who just filled out your own form, with clear consent language, is warmer than a recycled third-party lead that your BDC has been redailing for three weeks. Cutting your lead volume to only those where you have airtight direct consent will hurt your pipeline metrics for about 30 days. After that, contact rates go up, conversations improve, and conversion follows.

The dealers most at risk right now are the ones who measured BDC productivity by dials made rather than appointments set. Those shops have the most dead weight in their systems and the most legal exposure. Stores in competitive markets like Northern Virginia — where this issue is discussed in detail in Why Centreville VA Dealerships Lose Leads to Faster Rivals and Why Fairfax VA Dealerships Lose Leads to Faster Rivals — are finding that response speed on compliant leads beats volume on non-compliant ones every time.

Objection: “Our Lead Vendors Said We’re Covered”

This is the most common response we hear from dealers, and it is worth addressing directly. Lead vendors have a financial incentive to tell you their consent language is sufficient. That does not make it true, and it does not transfer liability to them if a class action names your rooftop.

“We’re covered” should come from your dealer attorney, not your account rep at a marketplace. Ask the vendor to provide the exact consent language used for each lead in your current follow-up queue, the date it was captured, and a written indemnification clause in your vendor agreement. If they cannot or will not provide all three, you are not covered.

What to Do This Week: A 5-Step BDC Compliance Audit

1. Pull every active lead in your CRM and tag by source: own website, third-party marketplace, purchased list, or unknown.
2. Identify the consent language attached to each source. Get the exact text and the capture date from each vendor.
3. Quarantine leads from the October 2025 – February 2026 transition window pending review by your attorney. Do not dial or text them until cleared.
4. Audit your website lead forms. Every form should have a visible, unchecked, dealership-specific consent checkbox. If it does not, fix it before next Monday.
5. Document everything. Timestamp your audit, name who conducted it, and store the vendor consent language you collected. If a claim comes later, the audit record is your first line of defense.

TCPA exposure is not a hypothetical risk for dealerships — it is an active litigation category with established plaintiff-side firms who monitor automotive call records. Getting compliant now costs far less than a settlement later.

If you want to see how Synthevo handles consent capture, lead routing, and response speed inside a single workflow, request access to our live demo and we’ll walk you through exactly how it works.