How to Revoke Consent: Written and Verbal Methods, Proof, and Timelines

To revoke consent, you tell the organization to stop — verbally for things like telemarketing calls or a medical procedure in progress, and in writing for anything governed by HIPAA. The method that works depends on what you originally agreed to and which federal rule covers it. One principle runs through all of them: revocation stops future use of your information or future contact, but it cannot undo anything the organization already did while your consent was still valid.

Get Your Details Together First

Before you contact anyone, pull the information that lets the organization find your file quickly. You need the date you originally gave permission, the full names of everyone involved, and any account numbers or reference codes tied to the authorization. Without those identifiers, your request can sit in a queue while someone tries to match it to the right record.

Define what you’re withdrawing. A blanket “revoke everything” request creates confusion when you have several authorizations with the same organization: one for sharing your medical history with a specialist, another for marketing emails, a third for insurance claims. HIPAA requires authorizations to describe the specific information being disclosed and the specific parties allowed to receive it, so your revocation should mirror that specificity.¹ Keep a copy of the original authorization on hand so you can match the scope of your revocation to what you signed.

When You Can Revoke Verbally

An oral revocation is a direct verbal statement — by phone, in person, or by text — telling someone to stop. It works immediately in a few common situations, though proving it later is harder than with a written record.

Telemarketing and Robocalls

Federal rules give you broad power here. You can revoke consent for robocalls and automated texts by any reasonable method, and the FCC has identified specific words that count as automatic revocation when sent as a reply to an incoming text: “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe.”² Callers cannot force you into one exclusive method. Telling a live telemarketer over the phone to stop calling counts too.³

Medical Procedures

A patient can verbally withdraw consent to a medical procedure at any point before or during treatment, and the provider must stop. Refusal doesn’t even need to be verbal; clinicians are expected to watch for nonverbal signs of withdrawal.

HIPAA treats the authorization to share your medical records differently from consent to the treatment itself. Revoking permission to share your health information has to be done in writing.⁴ You can say “stop the procedure” out loud, but you cannot say “stop sharing my records” and expect that alone to be legally effective.

Documenting What You Said

The weakness of a verbal revocation is proving it happened. Right after the conversation, write down the full name of the person you spoke with, the date and time, what you said, and how they responded. Note if the line was recorded. This personal log won’t carry the weight of a certified letter, but it holds up far better than trying to reconstruct the exchange months later during a dispute.

When You Need to Put It in Writing

Written revocation creates a permanent, dated record that’s hard to dispute. For HIPAA authorizations, it’s the only method that works, and it doesn’t take effect until the covered entity actually receives it.¹

Check the organization’s website or contact its privacy office first. Many provide a standardized revocation form. If no form exists, a formal letter works as a legal substitute. Your letter should include:

Your identifying information: full name, date of birth, account number, or other reference codes that link you to the original authorization.
A clear statement of intent, such as “I am revoking my authorization for the use and disclosure of my personal health information, effective immediately.”
The specific authorization: the date it was signed, who was authorized to receive information, and what type of information was covered.
Your signature and the date. Both are required under HIPAA and serve as the verifiable timestamp for when revocation was initiated.

Vague language is where these letters fall apart. “I want to cancel my consent,” attached to no account number and no description of which authorization you mean, gives the organization an easy reason to delay. Be specific enough that someone in a records department could pull the right file without guessing.

Electronic Signatures Are Valid

You don’t need to print, hand-sign, and mail a physical letter for every revocation. Under the E-SIGN Act, electronic signatures carry the same legal weight as handwritten ones for most transactions.⁵ If an organization’s portal lets you submit a revocation form with an electronic signature, that submission is legally valid. The E-SIGN Act does require the organization to have previously informed you of your right to withdraw consent electronically and described the procedure, but that’s their obligation, not yours.

Getting Proof of Delivery

How you deliver a written revocation matters almost as much as what it says, because revocation doesn’t take effect until the organization receives it.

Certified Mail

Sending your revocation by certified mail with a return receipt requested is the most reliable method. The return receipt shows the delivery date and the signature of the person who accepted it. If the organization later claims they never got your letter, you have a postal record proving otherwise. “We never received it” is one of the most common defenses organizations raise when they continue using your data after you thought you’d revoked.

Online Portals

Organizations with digital account management often let you upload a revocation document or click through an opt-out workflow directly. After submitting, the system should generate a confirmation number or electronic receipt. Save it. Take a screenshot of the confirmation page with the date visible. If the portal has a “download confirmation” button, use it. These digital receipts serve the same evidentiary purpose as a certified mail return card.

Email

Email is convenient but legally weaker than certified mail because proving the recipient actually received your message is harder than it sounds. Hitting “send” doesn’t establish delivery. Messages can be filtered, bounced, or lost. If you use email, request a read receipt through your email program and keep any automated delivery confirmations. For anything high-stakes, follow up with a certified letter. The email establishes the earliest date of your intent; the certified letter removes any doubt about delivery.

Revocation Only Works Going Forward

This is the most misunderstood part of revoking consent. Revocation is prospective only. It stops future use of your information or future contact, but it cannot undo actions the organization already took while your consent was still active.

Under HIPAA, a covered entity that shared your medical records with an insurer last month, while your authorization was still valid, has no obligation to retrieve that information after you revoke.¹ The E-SIGN Act works the same way: withdrawing your consent to receive electronic records doesn’t retroactively invalidate records you already received electronically.⁵

Timing matters. The longer you wait, the more actions pile up under valid consent that you cannot reverse. If you know you want to revoke, do it now rather than next month.

How Fast They Have to Stop

Different federal frameworks impose different timelines for how quickly an organization must honor your revocation.

Telemarketing and Robocalls

The FCC tightened its rules in 2024, cutting the maximum processing window from 30 days to 10 business days. Callers must honor your revocation within a reasonable time, not to exceed 10 business days from receipt.² Calls or texts after that window put the caller in violation of federal law.

Commercial Email

Under the CAN-SPAM Act, senders must stop emailing you within 10 business days of receiving your opt-out request.⁶ The law also prohibits the sender from selling or transferring your email address to anyone else after you opt out, except for compliance purposes.

Health Care

HIPAA doesn’t specify a fixed number of days. The revocation takes effect when the covered entity receives it, and the entity must stop further disclosures from that point. Administrative processing adds a short delay in practice, but there is no built-in 30- or 60-day grace period. A provider still sharing your records weeks after receiving your written revocation is looking at a potential violation, not a processing lag.

Revoking Consent for a Child Under 13

Parents have specific rights under the Children’s Online Privacy Protection Act when a website or app collects personal information from a child under 13. A parent can direct the operator to delete the child’s information and refuse further collection at any time.⁷ The operator must verify that the person making the request is actually the child’s parent or guardian before complying.

One trade-off: once you direct the operator to delete your child’s data and stop future collection, the operator is allowed to terminate the child’s access to the service entirely.⁷ The operator’s privacy policy should describe the specific procedures for exercising these rights, so check there before submitting your request.⁸

If the Organization Ignores You

Organizations that keep using your data or keep contacting you after a valid revocation face real financial consequences. The specific penalties depend on the legal framework.

Under the Telephone Consumer Protection Act, you can sue for $500 per violation, meaning per call or per text sent after your consent was revoked. If a court finds the violation was willful, it can triple that to $1,500 per violation.⁹ Class action TCPA settlements routinely reach the millions because the per-violation math adds up fast.

HIPAA violations are enforced by the Department of Health and Human Services, not through private lawsuits. Penalties are tiered by how culpable the organization was, running from roughly $145 per violation at the low end to over $2 million per violation for willful neglect that isn’t corrected. The figures are inflation-adjusted annually.¹⁰ A provider that ignores your written revocation and keeps disclosing your records likely falls into the willful neglect tiers.

Where you complain depends on the violation. Telemarketing complaints go to the FCC, and you can also pursue a private TCPA lawsuit. Health care privacy complaints go to the HHS Office for Civil Rights. Broader consumer privacy issues, including companies ignoring opt-out requests, can be reported to the FTC at reportfraud.ftc.gov. The confirmation receipt, certified mail return card, or screenshot you saved during delivery is your primary evidence in any of these filings.

1
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
2
eCFR. 47 CFR 64.1200 – Delivery Restrictions
3
Federal Communications Commission. Stop Unwanted Robocalls and Texts
4
U.S. Department of Health and Human Services. Can an Individual Revoke His or Her Authorization
5
Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity
6
Office of the Law Revision Counsel. 15 USC 7704 – Other Protections for Users of Commercial Electronic Mail
7
eCFR. 16 CFR 312.6 – Right of Parent to Review Personal Information Provided by a Child
8
Federal Trade Commission. Complying with COPPA – Frequently Asked Questions
9
Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
10
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment