Permission to Contact Form: Requirements, Consent, and Revocation

A permission to contact form is a signed agreement that authorizes a specific business to reach you by phone call, text message, or email. Federal law sets what the form must say, when a signature is actually required, and how you can take your consent back. The rules change depending on the channel, so a form that works for marketing calls looks different from one a doctor’s office uses to share your health information with a marketer.

What a Valid Form Must Include

For phone and text marketing, the FCC’s rules under the Telephone Consumer Protection Act set a high bar for what counts as valid written consent. A line that says “I agree to be contacted” won’t hold up. The form has to do real work.

It must name the specific company that will be contacting you. A reference to “our partners” or “affiliated companies” is not enough on its own, though a single form can list multiple named businesses.
It must disclose that calls or texts may be delivered using an automated dialing system or a prerecorded voice.
It must state that the communications will be for marketing or advertising.
It must tell you that giving consent is not a condition of buying anything.
It must carry your actual signature, physical or electronic. A pre-checked box does not count.

The disclosure language should sit next to where you enter your phone number, not buried deep in a terms-of-service page. If the consent language is tucked three scrolls below the signature line, that tells you something about how seriously the company takes compliance.

One point worth checking carefully on lead-generation sites: a single form can authorize contact from multiple companies as long as each one is specifically named. Fill out a comparison-shopping form that lists six insurers by name and all six can legally call you from that one signature.¹

Phone Calls and Text Messages

The TCPA makes it illegal to call or text your cell phone using an automated dialing system or a prerecorded voice without your prior express consent. That consent has to exist before the first call or text, not after. When the calls are for telemarketing, the FCC’s rules require the consent to be in writing. That is why an insurance agent or sales team hands you a form before they start dialing.²

Commercial Email

Email is looser. The CAN-SPAM Act does not require a company to get your permission before sending a marketing email. It regulates what the email must contain and how fast the sender must stop once you opt out. Every commercial email has to include a clear notice that it is an advertisement, a working unsubscribe link, and the sender’s valid physical mailing address.³

The unsubscribe link has to keep working for at least 30 days after the message went out, and clicking it can’t cost you a fee or require more than visiting a single page or sending a reply.⁴

Plenty of businesses still use a permission-to-contact form for email anyway. An explicit opt-in creates stronger documentation that you wanted the messages, which matters if there is ever a dispute.

Healthcare Marketing

When a doctor, insurer, or other covered provider wants to use your health information for marketing, a general permission to contact form will not cover it. HIPAA requires a separate written authorization. The only exceptions are face-to-face conversations and promotional gifts of nominal value.⁵

A valid HIPAA marketing authorization has to describe the specific information being used, identify who will receive it, state the purpose, include an expiration date, and explain your right to revoke in writing. If a third party is paying the provider to send you the materials, the authorization must disclose that payment. Your doctor or insurer generally cannot refuse to treat you or deny coverage because you decline to sign one.⁵

Medicare Scope of Appointment

Medicare has its own version of the form, called the Scope of Appointment. Before an agent meets with you about Medicare Advantage, prescription drug plans, or similar products, federal rules require the agent to document which product types you agreed to discuss. The agent has to secure the form before the meeting.⁶

You initial next to only the categories you want to hear about: Medicare Advantage HMO plans, PPO plans, Special Needs Plans, standalone prescription drug plans, and so on. If you initial Medicare Advantage and the agent pivots to pitching an unrelated dental discount plan, the agent has stepped outside the scope. Narrow exceptions apply to walk-ins, inbound calls you initiate, and the final days of an enrollment period.

Signing Electronically

Most permission to contact forms today are signed electronically. Under the federal E-SIGN Act, an electronic signature carries the same legal weight as a handwritten one for any transaction affecting interstate commerce. A form cannot be rejected in court simply because it exists in electronic form.⁷

There is a catch. When a law requires information to be given to you in writing, the electronic version only counts if you affirmatively consent to electronic records, you are told about your right to request paper copies and to withdraw that consent, and you are informed of the hardware and software needed to access the records. You also have to show you can actually open the format, usually by completing the consent process online. Platforms like DocuSign and Adobe Sign handle most of this automatically and produce a timestamped audit trail of when and how you signed.⁷

Keep a copy of whatever you sign. If a dispute arises later, your own copy is the strongest evidence of what you actually agreed to.

How to Revoke Consent

Giving permission is not permanent. You can take it back at any time, and the method does not have to be formal. The FCC has confirmed that consumers who consented to automated calls or texts can revoke through any reasonable means, including replying “STOP” to a text, saying so during a live call, sending an email, or leaving a voicemail.¹

Under TCPA revocation rules that took effect in April 2025, companies must process your opt-out within 10 business days. If the business sends a message confirming the request, that confirmation has to go out within five minutes and cannot contain any marketing content.

Commercial email runs on the same 10-business-day clock under CAN-SPAM once you click unsubscribe.³

HIPAA marketing authorizations can be revoked in writing. The provider has to honor the revocation going forward, though it does not undo any disclosures that already happened while the authorization was valid.⁵

What Happens When a Company Violates the Rules

The TCPA gives you a private right to sue for $500 per unauthorized call or text. If a court finds the violation was willful, it can triple the amount to $1,500 per message. Those numbers add up quickly against a company running automated campaigns, which is why the permission to contact form exists in the first place.²

If you revoked consent and a business kept calling or texting past the 10-business-day window, every message after that is unauthorized and exposes the company to those same per-violation damages. Save your copy of the signed form, the date and method you revoked, and any messages you received afterward. That record is what makes a claim stick.

1
Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991
2
Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
3
Office of the Law Revision Counsel. 15 USC 7704 – Other Protections for Users of Commercial Electronic Mail
4
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
5
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
6
eCFR. 42 CFR 422.2274 – Agent, Broker, and Other Third-Party Requirements
7
Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity