Web-Form Consent and E-SIGN: Does a Click Count as a TCPA Signature?
Yes, a click can be a signature. The FCC’s written-consent rule accepts an electronic signature that federal or state law recognizes, and the federal E-SIGN Act defines an electronic signature broadly enough that a checkbox or submit button can qualify when a person uses it intending to sign. The harder question in litigation is proof of what the form said and who clicked. A company whose consent records answer both points has a strong defense to a marketing-text claim.
When does a business need a “signed” consent at all?
Only for certain calls and texts, and it’s worth knowing which before you spend money redesigning forms.
The signature requirement comes from the FCC’s definition of prior express written consent, which is the signed agreement the rules require before a business sends telemarketing calls or texts using an autodialer or an artificial or prerecorded voice. The rule bars those marketing calls to cell phones and other covered lines “other than a call made with the prior express written consent of the called party,” with a lower consent standard for tax-exempt nonprofits and an exception for certain HIPAA health care messages, under 47 C.F.R. § 64.1200(a)(2).
Two limits matter. The rule reaches marketing, not purely informational messages such as an order confirmation, which still need prior express consent, just not the signed written kind. And it reaches only autodialed or prerecorded traffic. An autodialer, after Facebook, Inc. v. Duguid, is equipment with “the capacity to use a random or sequential number generator to either store or produce phone numbers to be called.” In my view, a platform that only texts a stored customer list doesn’t fit that definition, a point covered in our post on autodialer claims after Duguid.
I’d still build every marketing sign-up form to the written-consent standard. Plaintiffs plead the autodialer theory anyway, the Do Not Call rules have their own written-permission exception, and a compliant form costs you a sentence or two.
Which version of the consent definition applies right now?
The older one. The FCC’s 2023 revision never took effect, and the eCFR is misleading on this point as of this writing.
The eCFR’s current text of § 64.1200(f)(9) displays the 2023 “one-to-one” version, which limited consent to “no more than one identified seller” and required that calls be “logically and topically associated with the interaction that prompted the consent.” That text was set to take effect January 27, 2025.
It didn’t. On January 24, 2025, the FCC’s Consumer and Governmental Affairs Bureau postponed it in DA 25-90, stating that “The previous requirements for prior express written consent in 47 CFR § 64.1200(f)(9) under the Telephone Consumer Protection Act (TCPA) will meanwhile remain in effect.” The same day, in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277, the Eleventh Circuit held the FCC exceeded its authority and wrote: “Accordingly, we grant IMC’s petition for review, vacate Part III.D of the 2023 Order, and remand for further proceedings.” Part III.D is the one-to-one consent rule, so it’s vacated and never took effect.
The operative definition is the one shown in the eCFR’s December 2023 version. It requires “an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller” to send autodialed or prerecorded marketing, plus the telephone number. And it says the term “signature” includes “an electronic or digital form of signature, to the extent that such form of signature is recognized as a valid signature under applicable federal law or state contract law.”
Does a checkbox or a submit button count as a signature?
It can. The FCC said so in 2012, and federal law backs it up.
When the FCC adopted the written-consent requirement in its 2012 Report and Order, it concluded “that consent obtained in compliance with the E-SIGN Act will satisfy the requirements of our revised rule, including permission obtained via an email, website form, text message, telephone keypress, or voice recording.” A website form is on that list by name.
The E-SIGN Act defines an electronic signature as “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record,” in 15 U.S.C. § 7006(5). Its core rule, in 15 U.S.C. § 7001(a), is that a signature or contract “may not be denied legal effect, validity, or enforceability solely because it is in electronic form.”
The phrase doing the work is “with the intent to sign the record.” A box the visitor checks next to the consent language, followed by a button labeled to show agreement, shows that intent far better than a button labeled with a sales prompt and the consent language in small type below it. In my view, the button label is the cheapest piece of evidence a company will ever create, and most forms waste it.
A plaintiff may argue that E-SIGN’s consumer-disclosure section, 15 U.S.C. § 7001(c), required the business to obtain the consumer’s consent to electronic records before the form could count. That section applies when a law “requires that information relating to a transaction or transactions in or affecting interstate or foreign commerce be provided or made available to a consumer in writing.” I read it as governing how a business delivers required disclosures, not whether a click can sign an agreement, and I think that’s the better reading. But it’s an argument you should expect, and a form that cleanly separates the signature from everything else makes it easier to answer.
What does the form itself have to say?
The operative definition requires a “clear and conspicuous disclosure” telling the person two things, as the December 2023 eCFR text puts it: that by signing, the person authorizes the seller to send telemarketing calls using an autodialer or an artificial or prerecorded voice, and that the person “is not required to sign the agreement (directly or indirectly), or agree to enter into such an agreement as a condition of purchasing any property, goods, or services.”
“Clear and conspicuous” has its own definition. It means a notice “apparent to the reasonable consumer, separate and distinguishable from the advertising copy or other disclosures,” under § 64.1200(f)(3).
Practically, that means the consent sentence sits next to the box and the button, in type a visitor will see, and isn’t folded into the terms of service or a privacy policy reachable only by link. The form should name your company as the seller and capture the phone number in the same submission. If texts are part of the plan, say texts.
Who has to prove the click, and how?
The business does. The FCC put the burden on the seller in the 2012 order: “should any question about the consent arise, the seller will bear the burden of demonstrating that a clear and conspicuous disclosure was provided and that unambiguous consent was obtained.”
That burden has two halves. The first is showing what the form said on the day the person submitted it. Websites change constantly, and a current screenshot proves nothing about last spring. Keep dated captures or archived versions of every form, and record which version each submission used.
The second is showing that the person suing is the one who clicked. Under California’s Uniform Electronic Transactions Act, “An electronic record or electronic signature is attributable to a person if it was the act of the person,” and that act “may be shown in any manner,” including through security procedures, under Civil Code § 1633.9.
A California appellate court showed how this goes wrong in Ruiz v. Moss Bros. Auto Group, 232 Cal.App.4th 836 (2014). It was an employment arbitration case, not a TCPA case, but the evidence problem is the same. The employer offered a declaration that the employee had electronically signed an agreement, and the employee said he didn’t recall signing it. The court affirmed the order denying arbitration, holding the employer didn’t prove the signature was his: its declarant never explained how she concluded that, and an electronic signature in his name with a date and time stamp was not enough in the face of his failure to recall. The court summed up the evidence: “This was not a difficult evidentiary burden to meet, but it was not met here.”
Swap a lead form for the employee acknowledgment form and you have the typical consent fight. The fix is a declaration from someone who knows the system, explaining step by step how a submission is tied to a specific person and number: the IP address and device data captured, the timestamp, the form version, and any confirmation step, such as a text the number had to reply to before marketing began.
Common web-consent defenses and the records behind them
| Claim theory | Statute or rule | Exposure per call or text | Defense a signed web form supports |
|---|---|---|---|
| Autodialed or prerecorded marketing without written consent | 47 U.S.C. § 227(b)(1)(A)(iii), (b)(1)(B), (b)(3); 47 C.F.R. § 64.1200(a)(2), (a)(3) | $500, or actual loss if greater, and up to $1,500 if willful or knowing | Signed web form with the required disclosures, or no autodialer under Duguid |
| Marketing to a number on the National Do Not Call Registry | 47 U.S.C. § 227(c)(5); 47 C.F.R. § 64.1200(c)(2) | Up to $500, or actual loss if greater, and up to $1,500 if willful or knowing | Signed written permission naming the seller and the number, the more-than-one-call threshold, or reasonable practices and procedures |
| Consent form signed by someone else | Same as above | Same as above | Attribution evidence: IP, device, timestamp, confirmation reply |
The damages rules come from 47 U.S.C. § 227, subsections (b)(3) and (c)(5). The National Do Not Call Registry is the federal list of numbers whose owners have opted out of telemarketing, and the exception for a signed written agreement is in § 64.1200(c)(2)(ii). Whether to increase damages is up to the court.
What to pull together when a web-consent claim arrives
A demand letter that denies consent is a records question first. The firm’s TCPA litigation defense page covers how these claims move from a letter to a lawsuit. Before anyone responds:
- Put a litigation hold on the submission data for the number, including IP address, device and browser data, timestamps, the form version served, and the call and text logs and platform records for every message sent.
- Export the opt-out and internal do-not-call records for the number, with the date each request came in.
- Pull the National Do Not Call Registry scrub records for the campaign and the dates of the Registry versions used.
- Gather the lead-vendor and platform contracts, archived copies of the form and its consent language, and every message template or recorded message sent.
- Talk to a lawyer before replying to the demand letter, contacting the consumer, or offering any payment.
Web-form consent questions from marketing and compliance teams
Is a pre-checked box a valid TCPA signature?
I wouldn’t rely on one. E-SIGN asks whether the person adopted the signature “with the intent to sign the record,” and a box your form checked for the visitor says little about the visitor’s intent. An unchecked box the person must tick, beside the consent language, is the stronger record. It also helps answer the condition-of-purchase disclosure, because the visitor can complete the form without it.
Does the consent language have to name our company?
Yes, under the operative definition. It authorizes “the seller” to send the messages, and the 2012 order describes consent to calls “by or on behalf of a specific seller.” A form that refers only to unnamed marketing partners invites the argument that no seller was identified. Name your company where the visitor can see it.
Can we prove consent with a screenshot of the form today?
Not by itself. The question is what the visitor saw on the day of submission. If the form changed since then, a current screenshot can hurt you. Keep dated versions of every form, record which version each submission used, and keep the submission data that ties the click to a device and number.
Do consent forms collected by a lead vendor count as our signature?
They can, if the form named your company and the vendor can produce the records. The burden of proof is yours, not the vendor’s, so the contract should require the vendor to keep the form version and submission data, including timestamps, and hand them over on request.
Defending a claim built on a web form
If your company is accused of sending marketing texts or prerecorded calls without written consent, the archived form and the submission data behind each click usually decide whether the consent defense holds. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving disputed online consent forms. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.
Sources
The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, in the eCFR version as of January 28, 2025. The operative written-consent definition appears in the December 2023 eCFR version. The E-SIGN Act is at 15 U.S.C. § 7001 and § 7006, and California’s attribution rule is Civil Code § 1633.9.
The FCC documents are the 2012 Report and Order, FCC 12-21 (Feb. 15, 2012) and the postponement order, DA 25-90 (Jan. 24, 2025).
The court decisions are Facebook, Inc. v. Duguid, 592 U.S. 395 (2021); Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025); and Ruiz v. Moss Bros. Auto Group, 232 Cal.App.4th 836 (2014).
This post is general information about the Telephone Consumer Protection Act and related laws as of January 28, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.