How to calculate your TCPA exposure before launching a campaign

Last updated 2026-07-09

Why should you calculate TCPA exposure before a campaign launches?

Run the math first, because a TCPA violation is never one risk. It multiplies by your list size. A campaign to 50,000 contacts carries up to 50,000 separate causes of action, each worth as much as $1,500. That is the number founders skip past and then meet again in a demand letter.

Most outbound teams treat TCPA compliance like car insurance. They know it exists, they pay something toward it, and they hope they never actually need it. That mental model is what puts companies into eight-figure class action settlements.

The statute, 47 U.S.C. § 227, creates strict liability in many contexts. You do not need to have intended harm. You need only to have sent an automated call or text to a cell phone without proper consent, or called a number on the National Do Not Call Registry with no valid exemption. Each contact is a separate cause of action. Each one carries up to $1,500 if a court finds the violation was willful. ^[1]

Courts have certified class actions at exactly this scale, and the settlements are public record. The Cash App TCPA class action settlement and the Credit One TCPA settlement both involved millions of contacts and nine-figure exposure.

Running the math before launch is a business decision, not a legal formality. If a campaign brings in $200,000 and the modeled exposure at a realistic error rate is $4 million, you have a number that justifies rewriting the campaign, scrubbing the list harder, or killing the effort entirely.

What are the exact statutory penalty amounts under TCPA?

TCPA statutory damages are $500 per violation, and a court can treble that to $1,500 per violation if it finds the conduct willful or knowing. Those numbers come straight from 47 U.S.C. § 227(b)(3), which lets a plaintiff recover "actual monetary loss" or "$500 in damages for each such violation, whichever is greater." ^[1]

There is no cap on aggregate damages in class actions. A class of 100,000 people, each with one violation, has a theoretical ceiling of $150 million at the treble rate. Courts certify these classes routinely.

The per-violation structure creates distinct damage tiers depending on the nature of your error:

Violation Type	Base Statutory Damages	Willful/Knowing	Typical Class Context
Autodialed call to cell without consent	$500	$1,500	Often class-certified
Prerecorded voice message without consent	$500	$1,500	Often class-certified
Call to DNC-listed number	$500	$1,500	Often class-certified
Text message to cell without consent	$500	$1,500	Often class-certified
Call to reassigned number	$500	$1,500	Depends on safe harbor

Actual damages almost never drive TCPA cases. Plaintiffs elect statutory damages, because $500 per robocall beats any real economic harm a single consumer suffered from an unwanted call. ^[2]

One figure worth memorizing: TCPA class action settlements from 2010 to 2020 averaged roughly $6.5 million, per analysis by the class action defense bar, though that average gets dragged up by outlier settlements in the hundreds of millions. Median settlements sit lower. They still hurt any small or mid-size company.

How do you actually calculate expected TCPA exposure for a campaign?

Here is the framework I'd use. It is not a legal opinion, and it does not produce a number a court would certify. It produces a risk-weighted estimate good enough to make a go/no-go call.

Step 1: Count total planned contacts. This is your universe. If you plan to call or text 20,000 numbers, write down 20,000.

Step 2: Estimate your consent gap percentage. What share of those numbers lack valid, documented prior express written consent (PEWC)? If you bought a list, the honest answer is often 40-80%. If the list came from a lead generation partner with a consent-compliant intake form, it might be 5-15%, though you need to verify the consent language yourself. ^[3] Apply that percentage to your universe to get your exposed contacts count.

Step 3: Estimate your DNC exposure. Run your list through the National DNC Registry. ^[4] Check your state DNC lists separately where they apply. Any number that hits the DNC and that you call without a valid established business relationship or written consent is an independent violation, whatever your consent status on autodialing. Your do not call list scrub result gives you a second exposure population.

Step 4: Estimate reassigned number risk. The FCC's 2021 order set up a single-call safe harbor for reassigned numbers if you had no knowledge of the reassignment. ^[5] Old lists carry more reassignment risk (data more than 6-12 months old is where this grows). Industry estimates put U.S. number reassignments at tens of millions per year. ^[6] For older lists, add a 1-3% reassignment estimate to your exposed contacts.

Step 5: Apply the damage multiplier. Take your exposed contacts count. Multiply by $500 for base exposure, $1,500 for worst-case willful. In real litigation, settlements usually land somewhere between 10% and 40% of the theoretical maximum for well-documented violations, based on public settlement data, though that range is wide and turns on your jurisdiction, your counsel, and how bad your practices look in discovery.

Example calculation:

• Planned contacts: 50,000
• Consent gap estimate: 30% (15,000 exposed)
• DNC hits after scrub: 500
• Reassignment estimate: 1% of remaining (350)
• Total exposed contacts: 15,850
• Base exposure (at $500): $7,925,000
• Willful exposure (at $1,500): $23,775,000
• Realistic settlement range (10-40% of base): $792,500 to $3,170,000

That math alone tells you plenty about whether this campaign is worth the risk at current list quality.

What counts as a "violation" under TCPA, and does each call really count separately?

Yes. Each call or text is a separate violation. The statute is written at the individual-contact level, and every major circuit court has read it that way. ^[7]

The definition of what triggers a violation matters, because it decides which of your contacts go into the exposure pool.

A TCPA violation happens when you use an automatic telephone dialing system (ATDS) or prerecorded voice to call or text a cell phone without prior express consent. The Supreme Court's 2021 decision in Facebook v. Duguid narrowed the ATDS definition, requiring the system to have the capacity to generate and dial random or sequential numbers. ^[7] That ruling took pressure off systems that dial only from a stored list. It did not eliminate liability for list-based dialers that also carry random/sequential capacity, and it did not touch the Do Not Call provisions at all.

So for DNC violations, the equipment question is mostly beside the point. Call a DNC-listed residential number for telemarketing without consent and you violated the rule, whatever your dialing system. ^[4]

For cell phone calls and texts after Facebook v. Duguid, the question is whether your platform meets the new ATDS definition. Many modern predictive dialers do. Many text blasting platforms do. If you are not sure about your own platform, ask the vendor in writing and keep the answer.

For cold calling operations, the DNC rules usually dominate the exposure math even post-Duguid, because calling any residential landline on the DNC list is still a violation under 47 C.F.R. § 64.1200(c).

How does consent quality affect your exposure calculation?

Consent is the single biggest variable in your model. The gap between "we got express written consent" and "we have some evidence someone agreed to something" is often the gap between a defensible case and an indefensible one.

The FCC requires prior express written consent (PEWC) for marketing calls and texts made using an ATDS or prerecorded voice to cell phones. ^[3] That consent has to be a signed written agreement (electronic signatures count) that names the company calling or texting, uses a clear and conspicuous disclosure, and does not force the person to agree as a condition of purchase.

Common consent failures that create exposure:

• Consent obtained by a third-party lead generator that does not name your company. The FCC's 2023 one-to-one consent rule, effective in 2024, requires consent to name each seller individually. ^[8] Blanket lead-gen consent that lists dozens of possible callers no longer works.
• Consent language buried in terms and conditions with no affirmative opt-in.
• Oral consent recorded for voice-only contacts (does not satisfy PEWC for ATDS calls).
• Consent obtained years ago with no documentation you can produce in litigation.

For your model, rate consent as one of three tiers:

• Tier 1 (documented PEWC naming your company): low exposure, keep as-is
• Tier 2 (some consent record, gaps in specificity or documentation): moderate exposure, weight at 50% of base rate
• Tier 3 (purchased list, no consent record, or legacy blanket consent): full exposure, weight at 100%

This tiering gives you a consent-adjusted exposure number instead of treating all 50,000 contacts the same.

How does DNC list scrubbing reduce your TCPA exposure?

Scrubbing against the National Do Not Call Registry before a campaign is one of the cleanest exposure reducers you have, and the FTC requires it for any telemarketer calling residential numbers. ^[4] Telemarketers must subscribe to the Registry and scrub their lists at least every 31 days. ^[4]

Registry scrubbing is not the whole picture. Several states run their own DNC lists with separate registration and scrubbing rules. Texas, Florida, and Indiana keep state-level lists your federal scrub will not catch. ^[9] Call into those states and you need separate scrubs, and state DNC violations can carry their own per-call penalties on top of TCPA.

For your model, treat DNC exposure as a separate line item:

1. Pull your scrub report from the Registry before the campaign. 2. Count the hits that would have been called. 3. Verify whether your established business relationship (EBR) exemption covers any of them. EBR runs 18 months after a purchase and 3 months after an inquiry, but you need documentation. 4. The remaining DNC hits with no valid exemption go into your exposure pool at full $500-$1,500 per call.

If you have not looked into how to access the Registry, the FTC's guidance on how do I get the do not call list walks through the subscription. Telemarketers pay an annual fee based on the number of area codes accessed, starting around $68 per area code for commercial access under recent FTC schedules, though fees change annually. ^[4]

For cell phones, the mobile phone do not call list question comes up constantly. Cell numbers on the National DNC Registry get the same protection as residential landlines. There is no separate mobile registry, but any cell number on the national list is covered.

What does realistic TCPA litigation cost look like beyond the statutory damages?

The per-violation math is dramatic. It is not the only cost. Before you finalize your model, add the litigation layer.

Defending a TCPA class action from filing through class certification typically runs $500,000 to $2 million in legal fees, even in cases the defendant ultimately wins. Settlements with injunctive relief also carry ongoing compliance monitoring costs. Plaintiffs' attorneys take cases on contingency and often push toward settlement regardless of the merits, because defendants frequently prefer paying over the cost and distraction of a fight. ^[10]

For individual TCPA suits (not class actions), small-claims courts in many states let consumers sue for $500-$1,500 per call without an attorney. TCPA plaintiffs do not have to prove damages. Some serial plaintiffs file dozens of cases a year. This is documented, tracked by defense attorneys, and it means even a small list can generate a cluster of individual suits.

The practical takeaway: add a litigation cost floor of $50,000 to $200,000 even for small campaigns with moderate exposure. That is your minimum cost of being wrong, before any settlement.

LeadCompliant's free TCPA exposure calculator and compliance kit (at leadcompliant.com) helps you structure this for your specific campaign parameters without starting from scratch.

Which campaign variables move the exposure number the most?

Not every input carries equal weight. Here is how they rank by impact.

1. List source (highest impact). A purchased list with no consent record can push your entire universe into the exposure pool. A properly consented opt-in list cuts exposure 80-90% immediately. No other variable moves the number this hard.

2. Contact volume. Exposure is linear with volume. Double the contacts, double the exposure. Obvious, and teams still miss it when they scale a campaign mid-flight.

3. Dialing technology. If your platform qualifies as an ATDS under the post-Duguid test, every unconsented cell contact is a potential violation. If it does not qualify, you still carry DNC exposure and prerecorded-voice exposure, but the ATDS-specific risk drops away. Get clarity from your vendor before launch.

4. DNC scrub recency. A scrub older than 31 days is non-compliant. ^[4] A scrub older than 90 days on a fast-moving list can miss thousands of newly registered numbers. The marginal cost of a fresh scrub is close to zero next to the exposure it clears.

5. State of the consumer's location. Florida's Mini-TCPA (the Florida Telephone Solicitation Act, amended in 2021) sets its own consent requirements and $500 per-call penalties for calls using automated systems. ^[9] Calling into Florida with a problematic list stacks your exposure fast.

6. Willfulness indicators. If internal emails, training materials, or vendor contracts show you knew about a compliance gap and called anyway, a court can treble damages. Document your compliance work, not because it erases liability, but because it is evidence against willfulness.

How do you model TCPA exposure for text message campaigns specifically?

SMS campaigns carry the same per-violation statutory damages as calls. A few mechanics differ.

Texts to cell phones using an ATDS without PEWC violate 47 U.S.C. § 227(b)(1)(A). The consent standard for marketing texts is the same PEWC requirement. ^[3] The Duguid ATDS narrowing applies to texts too, so if your text platform does not randomly or sequentially generate numbers, you may have more room, but most mass text platforms are built in ways that still qualify.

For text message marketing campaigns, add these variables to your model:

• Opt-out compliance. Once someone replies STOP, any later text is a knowing violation. Your platform has to process opt-outs automatically and you have to document that it does. Opt-out failures are clean willfulness evidence.
• Double opt-in gap. Many compliance programs recommend a double opt-in (a confirmation text after the initial opt-in), but the TCPA does not technically require it. Single opt-in with poor documentation is hard to defend. Factor your documentation quality into your consent tier.
• Time of day. The TCPA bars calls before 8 a.m. or after 9 p.m. local time of the called party. ^[1] The same rule applies to texts under FCC interpretation. A time-zone miscalculation on a large SMS blast can push thousands of contacts into violation territory instantly.
• Short codes vs. long codes vs. toll-free. The platform type does not change your liability, but it affects your vendor's ability to hand you compliance logs. Make sure your platform keeps message logs, opt-out records, and delivery receipts for at least four years, the TCPA statute of limitations.

A 20,000-person SMS campaign with Tier 3 consent (purchased or unverified) and no prior opt-out scrub carries $10,000,000 in base exposure at $500 per text. That is not a hypothetical. It is the math.

What steps actually reduce TCPA exposure before you launch?

The calculation is only useful if it drives action. Here is what actually moves the number down before a campaign launches.

Get a fresh DNC scrub. Done in 24-48 hours through the FTC's Registry or a licensed scrubbing service. Zero excuses for skipping it. Check your do not call telemarketer list scrub records before every campaign.

Audit your consent documentation. Pull a random sample of 50-100 records and verify the consent trail (source, date, IP address, consent language) is complete and names your company. If you cannot do this for a sample, assume the full list has the same gap.

Check your platform's ATDS status. Email your dialing or texting vendor and ask directly: "Does this platform have the capacity to generate and dial random or sequential telephone numbers?" Get the answer in writing. If they say yes or cannot answer, treat every cell contact as ATDS-exposed.

Suppress known litigants. Some plaintiffs' firms publish their clients' numbers in PACER filings. Litigation suppression lists exist (several compliance vendors sell them). Adding one costs roughly $200-$500 per campaign and can clear a handful of high-risk numbers that would otherwise trigger fast individual suits.

Document everything before you dial. Consent records, scrub certificates, the ATDS vendor answer, your time-zone logic, your opt-out process. If you get sued, what you can produce in the first 30 days of discovery largely decides whether you settle cheap or expensive.

LeadCompliant's one-time compliance kit includes the documentation templates most small teams lack: consent audit forms, vendor questionnaires, and a pre-campaign checklist you can run in under an hour.

Are there safe harbors that reduce or eliminate TCPA liability?

A few, and they matter to your model because they shrink your effective exposed population.

Established Business Relationship (EBR). For DNC purposes only (not ATDS), you can call a number on the DNC Registry if the person made a purchase or inquiry inside the lookback window: 18 months for purchases, 3 months for inquiries. ^[4] This does nothing for ATDS liability on cell phones.

Prior Express Written Consent. Full PEWC removes ATDS liability for the consenting number. This is the strongest safe harbor and the reason to invest in consent infrastructure.

Reassigned Number Safe Harbor. The FCC's 2021 Reassigned Numbers Database (RND) gives you a one-call safe harbor: check the RND before calling, and if the number is not flagged as reassigned after a given date, you keep that safe harbor even if the number was later reassigned. ^[5] Checking the RND adds a small per-lookup cost (fractions of a cent) and protects the reassignment line of your model.

Informational vs. marketing calls. Purely informational calls that are not marketing carry lower consent requirements under some readings. The FCC has shifted on this over the years, and it is genuinely murky. Do not lean on this without counsel review if your call has any commercial purpose.

Internal DNC lists. Any company placing telemarketing calls has to keep an internal DNC list and honor requests permanently. ^[4] Honoring your internal list does not create a safe harbor, but failing to keep one makes every later call to that person a knowing violation. Low-effort compliance with high litigation value.

What does a pre-launch TCPA compliance checklist look like?

This is the practical output of the exposure calculation. Once you know where your risk lives, you turn it into a checklist you run before every campaign.

A baseline pre-launch TCPA checklist for an outbound call or SMS campaign:

List and consent:

• [ ] Consent documentation reviewed for a random sample (50+ records)
• [ ] Consent language confirmed to name your company specifically (post-2024 one-to-one rule) ^[8]
• [ ] List source and acquisition date documented
• [ ] Age of consent records noted (older than 2 years warrants re-confirmation)

Scrubbing:

• [ ] National DNC Registry scrub completed within last 31 days, certificate retained ^[4]
• [ ] State DNC lists checked for all states in your call area ^[9]
• [ ] Internal DNC / opt-out list applied
• [ ] Reassigned Numbers Database (RND) check completed ^[5]
• [ ] Litigation suppression list applied (optional but recommended)

Technology:

• [ ] Dialing/texting platform ATDS status documented in writing from vendor
• [ ] Time-zone logic verified (no calls before 8 a.m. or after 9 p.m. local time) ^[1]
• [ ] Opt-out processing confirmed automatic and logged
• [ ] Message logs and delivery receipts retained for 4 years

Documentation:

• [ ] Pre-campaign exposure calculation completed and retained
• [ ] DNC scrub certificates filed
• [ ] Vendor ATDS response on file
• [ ] Consent audit results documented

Run this list, keep the outputs in a campaign folder, and you have evidence of a good-faith compliance process. That evidence will not make you immune. It changes how willfulness arguments play out in litigation.

Frequently asked questions

What is the maximum TCPA fine per call or text?

The TCPA sets statutory damages at $500 per violation, trebled to $1,500 per violation if the court finds the violation was willful or knowing. Each individual call or text is a separate violation. There is no statutory cap on aggregate damages in a class action, which is why large SMS or robocall campaigns can generate theoretical exposure in the hundreds of millions of dollars.

Does the TCPA apply to text messages as well as calls?

Yes. The FCC has long read text messages as "calls" under 47 U.S.C. § 227. Sending a marketing text to a cell phone using an automatic telephone dialing system without prior express written consent carries the same $500-$1,500 per-message liability as a voice call. Opt-out failures on SMS campaigns count as knowing violations, which triggers the treble-damage rate.

How does the 2021 Facebook v. Duguid Supreme Court decision affect my exposure calculation?

Facebook v. Duguid narrowed the ATDS definition to require that a system actually has the capacity to generate and dial random or sequential numbers. Systems that dial only from a stored list may not qualify as an ATDS. This can reduce ATDS-specific exposure for list-based campaigns, but it does not touch Do Not Call liability, prerecorded voice liability, or state-law claims, so total exposure often changes less than teams expect.

Does scrubbing against the National DNC Registry protect me from all TCPA claims?

No. The DNC Registry protects against one category of claim: calling registered residential numbers without consent or an EBR. It does not protect against ATDS claims (calling cell phones without PEWC), prerecorded voice claims, or state-level TCPA analogs with their own rules. You need both DNC scrubbing and consent documentation, not one or the other.

How often do I need to scrub my list against the Do Not Call Registry?

The FTC requires telemarketers to scrub against the National Do Not Call Registry at least every 31 days. Running a scrub once at list acquisition and then launching three months later is non-compliant. In practice, many teams scrub within 1-7 days of launch to get the freshest data, since new registrations process continuously.

What is the statute of limitations for TCPA claims?

TCPA claims have a four-year statute of limitations under 28 U.S.C. § 1658, the federal catch-all limitations period. Some courts have applied shorter periods, but four years is the dominant rule. A campaign you run today can generate litigation four years out, which is why retaining consent records, scrub certificates, and call logs for at least four years matters.

Does the one-to-one consent rule change how I calculate exposure for purchased leads?

Yes, a lot. The FCC's 2023 one-to-one consent rule, effective in 2024, requires that consent for marketing calls and texts using an ATDS name each seller individually. Blanket lead-gen consent forms that authorize calls from multiple companies no longer satisfy PEWC for those other companies. If you bought leads under old blanket consent forms, treat every number as fully exposed for ATDS liability.

Can I rely on an established business relationship to avoid DNC liability?

Only for DNC-related claims, not ATDS claims. An EBR lets you call a DNC-listed number if the consumer bought from you within the last 18 months or made an inquiry within the last 3 months. You have to document the EBR. It does not authorize use of an ATDS to call a cell phone without PEWC, so it is a partial defense at best, and only if your records prove the relationship.

What is the Reassigned Numbers Database and should I check it before every campaign?

The Reassigned Numbers Database (RND) is an FCC-administered database of numbers that carriers have reported as reassigned to a new subscriber. Checking the RND before a campaign gives a safe harbor for reassignment-based liability: if the RND shows no reassignment after your consent date, you keep a defensible one-call buffer. The FCC set up this database in a 2021 order. Lookups cost fractions of a cent and take seconds through commercial API providers.

How do Florida's telemarketing rules affect my TCPA exposure calculation?

Florida's Telephone Solicitation Act (FTSA), amended in 2021, adds state-level exposure on top of TCPA. Florida imposes $500 per-call or per-text penalties for automated calls or texts to Florida consumers without proper consent, and some FTSA claims cannot be brought as class actions while others can. If a meaningful share of your list is in Florida, model Florida exposure as a separate line item.

If I use a third-party caller or agency for outbound campaigns, am I still liable under TCPA?

Yes. The FCC holds companies liable for TCPA violations committed by their agents, including third-party vendors and outsourced call centers, under vicarious liability principles. You can limit this risk through contractual indemnification clauses and vendor compliance audits, but you cannot fully transfer TCPA liability by outsourcing the dialing. Model your exposure as if you placed the calls yourself, because courts often treat it that way.

What documentation should I retain to defend a TCPA claim after the campaign?

At minimum: consent records (source, date, IP address, exact consent language, the name of your company as listed), DNC scrub certificates with dates, your dialing platform's ATDS status confirmation in writing, time-zone logic documentation, opt-out records, and call or message logs. Retain everything for at least four years. In litigation, your ability to produce these in the first 30 days of discovery can decide whether you pay $50,000 or $500,000 to resolve a case.

Is a TCPA exposure calculation legally binding or a substitute for legal advice?

Neither. A pre-campaign exposure calculation is an internal risk management tool, not a legal opinion and not a compliance guarantee. It gives you a number to weigh against expected revenue and helps you prioritize where to spend compliance effort. For campaigns with significant volume or consent complexity, get a review from a TCPA-experienced attorney before launch. The calculation helps you have a smarter conversation with that attorney.

Sources

1. Cornell LII, 47 U.S.C. § 227 (Telephone Consumer Protection Act): TCPA statutory damages are $500 per violation, trebled to $1,500 for willful or knowing violations; calls prohibited before 8 a.m. or after 9 p.m. local time of called party
2. Cornell LII, 47 U.S.C. § 227(b)(3) (private right of action, statutory damages election): Plaintiffs may elect statutory damages rather than actual damages under the TCPA
3. Electronic Code of Federal Regulations, 47 C.F.R. Part 64 (TCPA implementing rules, prior express written consent): Prior express written consent (PEWC) is required for marketing calls and texts made to cell phones using an ATDS or prerecorded voice; consent must name the company and be a signed written agreement
4. FTC, National Do Not Call Registry (business compliance guidance): Telemarketers must scrub lists against the National DNC Registry at least every 31 days; EBR applies 18 months after purchase and 3 months after inquiry; companies must maintain internal DNC lists
5. U.S. Supreme Court, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): ATDS definition requires capacity to generate and dial random or sequential numbers; each call or text is a separate violation
6. Electronic Code of Federal Regulations, 47 C.F.R. Part 64 (TCPA one-to-one consent provisions, 2023 order): FCC 2023 one-to-one consent rule requires PEWC to name each seller individually; blanket lead-gen consent naming multiple companies is no longer sufficient
7. Florida Legislature, Florida Telephone Solicitation Act (FTSA), Fla. Stat. § 501.059: Florida FTSA amended in 2021 imposes $500 per-call or per-text penalties for automated telemarketing calls or texts to Florida consumers without proper consent, in addition to federal TCPA liability
8. U.S. Chamber Institute for Legal Reform, TCPA litigation research: Defending a TCPA class action through class certification typically costs hundreds of thousands to millions in legal fees even for defendants who ultimately prevail; plaintiffs' attorneys take cases on contingency