TCPA damages: how much each violation actually costs you

Last updated 2026-07-10

What are TCPA damages and how does the statute define them?

The Telephone Consumer Protection Act, codified at 47 U.S.C. § 227, sets a floor for what a plaintiff can recover when a company makes an illegal call or sends an illegal text. Subsection (b)(3) states that a person may bring a private action to recover "the greater of the actual monetary loss from such a violation, or $500 in damages for each such violation." ^[1] If the court finds the defendant willfully or knowingly violated the Act, it "may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available." That puts the ceiling at $1,500 per violation for willful conduct. ^[1]

Actual damages almost never top $500, so plaintiffs plead the statutory floor every time. That is the whole point. Congress built a private enforcement engine that pays individuals to sue even when the real-world harm is a single annoying text.

The statute splits calls into three buckets: (1) autodialed or prerecorded calls to cell phones without consent, (2) prerecorded calls to residential lines without prior express consent, and (3) calls or texts to numbers on the National Do Not Call Registry. Each bucket triggers the same $500/$1,500 framework, but the consent standard and the procedural rules differ among them. ^[1]

Here is what the statute does not contain: a damages cap. There is no provision saying "maximum $10 million" or anything close. That single omission is what makes class actions so dangerous for callers.

How does the per-violation math work in a real lawsuit?

Every call or text is one violation. Send 500,000 texts to people who never gave express written consent and a court can certify a class of 500,000 plaintiffs at $500 each. That is $250 million in statutory damages before attorney fees. At the $1,500 willful rate, it is $750 million.

Courts have occasionally flinched at this math. A handful of district courts have called damage awards "grossly excessive" relative to actual harm and cut them under due process analysis. The Ninth Circuit and most other circuits have gone the other way, holding that Congress set the number on purpose and courts should not rewrite it. ^[2]

The per-violation count matters a lot in practice. Dialing the same person twice in one day is two violations. A confirmation text sent after an outbound call is its own violation if the text itself broke a rule. Some defendants have argued that an entire "campaign" should count as one violation. That argument has mostly lost. Courts count the message or call as the unit, not the campaign. ^[3]

Willfulness is the multiplier that hurts. Plaintiffs' attorneys and regulators hunt for proof that the company knew the TCPA applied and dialed anyway, or ignored a cease-and-desist, or kept calling after opt-out requests. Internal emails, vendor contracts that name the TCPA, a written compliance policy nobody followed: all of it feeds a willfulness finding and the treble award.

What have courts actually awarded or settled for?

Real outcomes are the best guide to your exposure. Below is a comparison of notable TCPA settlements and verdicts. Keep in mind that most cases settle before trial, so the settlement column is usually a negotiated number, not a jury verdict.

Case / Company	Approximate Class Size	Settlement Amount	Per-Class-Member Estimate
Capital One (2014)	~17 million	$75.5 million	~$4.45
Bank of America (2014)	~7.2 million	$32 million	~$4.44
UnitedHealthcare (2024)	~170,000	$2.5 million	~$14.70
Credit One Bank	undisclosed class	multiple seven-figure settlements	varies
Truist Bank	pending	$9.95 million proposed	TBD
Albertsons/Safeway	pending	$9.4 million proposed	TBD

Those per-class-member numbers look tiny because most settlements land at a fraction of statutory damages. The defense points to available defenses, to the cost of trial, and to the company's financial condition. Plaintiffs' lawyers take the fraction because it buys certainty and funds their fees, which typically run 25 to 33% of the settlement fund. ^[4]

A few cases go to trial instead of settling. A federal jury in Oregon awarded $925 per call against ViSalus in 2019, and the district court entered judgment for roughly $925 million before years of appeals over due process reduced and reshaped the number. ^[5] The lesson is plain. Settlement is almost always cheaper than trial, but the settlement alone can still end a small company.

The Cash App TCPA class action settlement shows that even tech-forward companies with sharp legal teams get caught. No industry is safe here.

Does the TCPA allow class actions, and how do they amplify damages?

Yes. Federal courts hear TCPA class actions under Federal Rule of Civil Procedure 23. Plaintiffs have to show numerosity, commonality, typicality, and adequacy of representation, and autodialer cases clear those hurdles easily because the conduct is uniform and the class can be built straight from the caller's own records. ^[6]

The amplification effect is brutal and mostly arithmetic. One person suing over one call recovers $500 to $1,500. That same call, blasted to 100,000 numbers, becomes a class action with $50 million to $150 million in theoretical exposure. Attorney fees sit on top, granted separately under fee-shifting principles or paid from the settlement fund.

Class certification got harder after the Supreme Court's 2021 decision in Facebook v. Duguid, which tightened the definition of an automatic telephone dialing system (ATDS). ^[7] Plaintiffs now have a tougher road certifying classes against companies that use human-intervention dialers, because they must prove the specific technology met the ATDS definition for every class member. Some defendants have beaten certification on exactly that point. Prerecorded voice cases and DNC cases are not touched by Duguid, so class risk stays very real for those calling modes.

State mini-TCPA statutes add another layer. Washington, Florida, and Oklahoma each have state analogues with per-violation penalties that run alongside, and sometimes above, the federal number. A single campaign can trigger federal and state class actions at the same time.

What is the difference between $500 and $1,500 per violation, and when does the higher amount apply?

The $500 floor is automatic once a violation is proven. You do not have to show intent, because strict liability applies to most TCPA provisions. The plaintiff just has to show you called their cell phone with an ATDS or prerecorded voice without consent, called a number on the DNC list, or sent a non-compliant text.

The $1,500 treble award needs an extra finding that the violation was "willful or knowing." Courts read that as a low bar, not a criminal-intent standard. Knowing that you made the call is enough if the legal requirements were objectively clear. Had a written TCPA policy and ignored it? That is knowing. Got a written opt-out and called again? That is willful. If a vendor's contract disclosed that it uses an ATDS and you never checked for consent records, courts have found constructive knowledge. ^[3]

The gap between $500 and $1,500 is often the gap between a bad quarter and a closed company. A business with one million unconsented contacts faces $500 million at $500 each. At $1,500 each, it is $1.5 billion. Neither number is payable by most small businesses, which is why settlement value tracks the defendant's ability to pay and litigation risk far more than the statutory ceiling.

One live area of uncertainty: some courts let plaintiffs seek both the $500 floor and actual damages when actual damages exceed $500. Others read the statute as "the greater of" and allow only one. No circuit has resolved this cleanly across every context.

Can the FCC or FTC impose separate fines on top of private lawsuits?

Yes, and that stacks on top of everything else. The FCC has authority under 47 U.S.C. § 227(f) to bring its own enforcement actions, and it does not use the $500/$1,500 per-violation structure. The FCC issues forfeiture orders under its general enforcement authority, which allows fines up to $23,727 per violation, adjusted for inflation under the Federal Civil Penalties Inflation Adjustment Act. ^[8]

The agency swings big when the volume justifies it. In 2023 the FCC proposed a $299 million forfeiture against a health insurance lead generation operation for allegedly making roughly 1.2 billion robocalls. Whether that amount ever gets collected is a separate story, but the proposed number shows the FCC's appetite for large round penalties against high-volume callers. ^[9]

The FTC enforces the Telemarketing Sales Rule (TSR), which overlaps with the TCPA for outbound telemarketing. The TSR carries civil penalties up to $51,744 per violation as of 2024, adjusted annually. ^[10] The FTC has hit lead generators and debt collectors with judgments in the tens of millions.

A company can face all three at once: a private class action, an FCC enforcement action, and an FTC case. That is rare, and it happens to egregious callers. For a typical small outbound sales team, the realistic fear is the plaintiff's attorney, not the regulator. Plaintiff firms work on contingency and file fast.

What defenses actually reduce or eliminate TCPA damages?

A few defenses carry real legal weight, and you should know them even if you hope never to use them.

Prior express written consent is the strongest defense for ATDS or prerecorded calls to cell phones. If you have documented, unambiguous consent that meets the FCC's 2012 consent rule (a signed written agreement, paper or electronic, with a clear disclosure of what the person agreed to receive), the plaintiff has no claim. ^[11] The catch is proving it. Consent records have to be timestamped, tied to the exact number dialed, and kept long enough to produce in litigation.

Established business relationship (EBR) is narrower. It applies to residential landlines under the DNC provisions, not to cell phones that require express written consent. Do not mix the two up.

The safe harbor under the National DNC rules protects a company from liability if it maintains written procedures, trains staff, bought the registry data within 31 days of the call, and honors opt-outs, even when an error slips through. ^[12] That safe harbor does nothing for ATDS claims. It is a DNC defense, full stop.

Arguments about whether the technology was actually an ATDS under Facebook v. Duguid are now common. If your dialer needs human click-to-dial and the calling sequence is not generated by a random or sequential number generator, you may knock out the ATDS element entirely, which collapses the claim.

Bona fide error is available in some circuits if you show the violation came from a good-faith mistake despite procedures built to comply. It is narrow and courts are skeptical. It does not work as a broad "we tried our best" excuse.

How do small businesses and outbound sales teams actually manage this exposure?

Most small outbound teams never see a class action. They see one-off demand letters, often from serial plaintiffs who hand their number to companies on purpose, wait for a non-compliant call, then demand a few thousand dollars to go away. That cottage industry is real. The per-violation math makes small payouts rational for the defendant even when the case is thin.

The operational fixes are simple to name, even if the work takes effort. Scrub every list against the National DNC Registry before you dial. Honor opt-outs within ten business days (the regulatory standard) and internally within hours. Keep consent records for at least four years, which lines up with the TCPA statute of limitations. Audit your dialer to know whether it meets the ATDS definition under Duguid.

Text marketing gets special attention because it exploded and draws heavy litigation. Document express written consent with a compliant opt-in flow, show a clear disclosure at the moment of opt-in, and give an easy opt-out keyword like STOP. The FCC's 2023 one-to-one consent rule requires consent for each specific seller rather than bundled across brands. ^[13] The FCC set that rule to take effect in 2025, though its implementation date shifted amid litigation, so check the current status before you rebuild your consent forms. That rule changed how lead generators can transfer or share consent, and many companies have not updated their practices.

LeadCompliant's free DNC checker and TCPA compliance kit are a reasonable starting point for teams with no dedicated compliance function. They will not replace a lawyer once you are sued, but they help you audit your exposure before the demand letter lands.

Buying leads from a third party? Get contractual reps and warranties about consent quality, then audit a sample. You can be held liable for calls made on leads where consent was faked, even when you never collected it yourself.

Is there a statute of limitations on TCPA damage claims?

The TCPA itself sets no limitations period, which created a circuit split. Most federal circuits apply the four-year catch-all from 28 U.S.C. § 1658, which governs federal statutes enacted after 1990. ^[3] A few early cases borrowed a shorter period by analogy to the forum state's consumer protection law, but four years is now the majority rule and the safer assumption for compliance planning.

Four years is a long time in outbound calling. A campaign you ran in 2022 can spawn a lawsuit filed in 2026. Your records from that stretch need to be retrievable. Most small companies do not keep detailed call logs for four years, which makes defense harder even when the calls were compliant.

Class action tolling can stretch this further. If a class action gets filed and then decertified, class members can re-file individually within a tolled window. Exposure on one campaign can run well past four years in practice.

Companies watching TCPA news should track the FCC's rulemaking calendar, because regulatory changes sometimes open a fresh window of enforcement or clarify which past practices were compliant.

What should you do if you receive a TCPA demand letter?

Stop the calling practice named in the letter right away, at least for that number and preferably for the whole campaign type if you are not sure of your consent footing. That one step limits ongoing willful violation exposure.

Get a TCPA-specialized attorney before you respond. This is not a letter you answer on your own. Demand letters often carry language built to pull admissions out of you or start the clock on statutory response periods. An attorney who handles TCPA cases in your jurisdiction will know whether the sender is a serial plaintiff (there are several well-documented ones), what a realistic settlement range looks like, and whether the underlying call was even a violation.

Preserve everything. Do not delete call logs, consent records, dialer configuration files, or employee communications about the campaign. Spoliation after you have notice of a claim can earn you an adverse inference instruction at trial, which turns a winnable case into a very hard one.

If the letter demands a few thousand dollars and your attorney agrees the exposure is real, settling is probably the rational move. TCPA plaintiff's attorneys know the math too. They set demands high enough to be worth suing over but low enough that fighting costs more than paying. That calculation flips if you have ironclad consent records.

For recurring problems, a compliance audit covering your dialer technology, consent collection, DNC scrubbing, and opt-out handling is worth the cost before the next demand arrives.

How do TCPA damages compare to other consumer protection statutes?

The $500/$1,500 per-violation structure is unusually aggressive next to most consumer protection laws. The Fair Debt Collection Practices Act (FDCPA) caps statutory damages at $1,000 per plaintiff and $500,000 (or 1% of net worth) for class actions. ^[2] The TCPA has no class cap, which is why it produces so much more class action activity.

The CAN-SPAM Act for commercial email allows up to $53,088 per day of violation as of 2024 (per day, not per email), and private plaintiffs cannot sue under CAN-SPAM at all. Only ISPs and the FTC can enforce it. ^[10] That is why email marketers face far less private litigation than telemarketers.

State laws add to TCPA damages rather than replace them. California's Invasion of Privacy Act (CIPA) has been paired with TCPA claims to stack per-violation state penalties. Washington's Commercial Electronic Mail Act and Florida's mini-TCPA (enacted in 2021) both create extra exposure for calls and texts into those states.

No class cap, strict liability for the base award, and a four-year lookback together make the TCPA the most plaintiff-favorable telemarketing statute in federal law. That is more than an opinion. It is why TCPA filings have ranked among the most common federal consumer class actions for more than a decade.

Frequently asked questions

How much is one TCPA violation worth in damages?

One violation is worth $500 in statutory damages, or $1,500 if the court finds the conduct was willful or knowing. These numbers come straight from 47 U.S.C. § 227(b)(3). Actual damages can substitute, but they rarely top the statutory floor. Each call or text message counts as a separate violation, not each campaign and not each defendant.

Is there a maximum or cap on TCPA damages in a class action?

No. The TCPA does not cap total class action damages. A class of one million plaintiffs at $500 each equals $500 million in theoretical exposure. Courts have discretion to reduce awards under constitutional due process principles if they are grossly disproportionate, but the statute itself sets no ceiling. This is the main reason TCPA class actions are among the most financially threatening suits in consumer protection law.

Do I owe TCPA damages even if the person did not answer the call?

Yes. The violation happens when the call is placed to a cell phone using an ATDS or prerecorded voice without consent, or to a DNC-listed number. Whether the person answered is irrelevant to liability. Courts have held this consistently, which means a dialed-but-unanswered campaign can still produce full per-call damages across every number reached.

Can I face TCPA damages for texts as well as phone calls?

Yes. The FCC and courts treat a text message as a "call" under the TCPA. The same $500/$1,500 per-violation framework applies. Text marketing is one of the highest-litigation areas under the TCPA right now, partly because companies adopted mass texting fast and consent practices lagged. Express written consent is required before you send marketing texts to cell phones.

What is the statute of limitations for TCPA damages claims?

Most federal circuits apply a four-year statute of limitations, using the general federal catch-all from 28 U.S.C. § 1658. A few older cases used shorter state-law periods, but four years is the dominant rule. Calls or texts made in 2022 can still generate a lawsuit filed in 2026. Retain consent records and call logs for at least four years.

Does the TCPA require me to have intended to break the law before I owe damages?

No. The base $500 award is strict liability. You do not have to know the call was illegal. You just have to have made it without the required consent or to a DNC-listed number. The $1,500 willful tier requires a finding of knowing or willful conduct, but most courts set that bar low: knowing you made the call while the legal obligation was objectively clear can be enough.

How are TCPA attorney fees handled, and do they come out of the damages award?

In class action settlements, attorney fees usually come from the settlement fund and get approved separately by the court, often running 25 to 33% of the total. The TCPA has no general fee-shifting provision for private plaintiffs the way some statutes do, so fees in individual cases are usually borne by each party unless the settlement says otherwise. In FCC enforcement actions, fees are not typically awarded to private parties.

Can the FCC fine me separately from a private lawsuit?

Yes. The FCC can issue forfeiture orders independent of private litigation, with per-violation amounts up to about $23,727 (adjusted for inflation). The FTC can also pursue civil penalties up to $51,744 per violation under the Telemarketing Sales Rule. You can face a class action, an FCC action, and an FTC action for the same campaign at once, though that combination is rare outside large-scale or egregious operations.

What evidence do I need to defend against a TCPA damages claim?

The strongest evidence is a timestamped, call-specific prior express written consent record tied to the exact number dialed and kept in a form you can produce in discovery. For DNC claims, you need proof of your DNC scrub within 31 days of the call plus your internal opt-out list. Dialer configuration records showing the technology does not meet the ATDS definition under Facebook v. Duguid (2021) can defeat the claim entirely.

Are TCPA damages taxable income to the person who receives them?

Generally yes, at the federal level. The IRS treats statutory damages that do not compensate for physical injury or physical sickness as ordinary income. Class action settlement amounts are usually taxable too. Plaintiffs receiving TCPA settlement payments should get a Form 1099 if the amount exceeds $600. This is a question for the recipient's tax advisor and does not change the defendant's liability calculation.

What is the difference between a TCPA class action settlement and a jury verdict?

A settlement is a negotiated payment agreed to before final judgment, usually for a fraction of maximum statutory damages. A verdict is what a jury awards after trial, based on the full per-violation calculation. Jury verdicts can dwarf settlements: the ViSalus case produced a verdict of $925 per call, which translated to hundreds of millions before appeals. Most cases settle because the downside risk of trial is too big for both sides to ignore.

Does the new FCC one-to-one consent rule change TCPA damages exposure for lead generators?

Yes, potentially a lot. The FCC's 2023 rule requires consent for one specific seller at a time, not bundled across multiple companies in a single disclosure. Its effective date shifted amid litigation, so confirm the current status. Lead generators who used broad multi-seller consent forms may have sold leads to companies now calling without legally valid consent, exposing both the lead generator and the buyer to TCPA damages claims.

How do TCPA damages interact with state mini-TCPA laws?

State laws add to federal exposure. Florida's 2021 mini-TCPA, Washington's Consumer Protection Act, and Oklahoma's statute all carry separate per-violation penalties that can run alongside federal TCPA claims. A company calling into multiple states can face stacked federal and state claims from the same campaign. Some state statutes have lower consent thresholds or broader auto-dialer definitions, raising the chance of liability even where a federal claim might fail.

Can a serial plaintiff sue me for TCPA damages even if I only called them once?

Yes. One call to a cell phone using an ATDS or prerecorded voice without consent is one violation worth $500 to $1,500. There is no minimum frequency. People known informally as professional plaintiffs deliberately give their numbers to companies and wait for a non-compliant call. These cases are real, they are common, and they almost always settle for a few thousand dollars because fighting them costs more than settling.

Sources

1. U.S. Code, 47 U.S.C. § 227 (TCPA text via Cornell LII): Statutory damages of $500 per violation, up to $1,500 for willful or knowing violations; 'the greater of the actual monetary loss or $500 in damages for each such violation'
2. Federal Trade Commission, Fair Debt Collection Practices Act (FDCPA), Legal Library: FDCPA caps class action statutory damages at $500,000 or 1% of net worth, contrasting with TCPA's uncapped class damages
3. Federal Judicial Center, resources on class action settlement and claims administration: Attorney fee awards in class settlements typically run 25-33% of the settlement fund under federal court approval practice
4. U.S. District Court, District of Oregon, Wakefield v. ViSalus Inc. TCPA verdict (Case No. 3:15-cv-01857): Oregon jury found ViSalus liable at $500 per call in 2019, producing a judgment of roughly $925 million before due process appeals
5. Federal Rules of Civil Procedure, Rule 23 (Cornell LII): Class certification requirements of numerosity, commonality, typicality, and adequacy under FRCP 23
6. U.S. Supreme Court, Facebook, Inc. v. Duguid, 592 U.S. 365 (2021): Supreme Court narrowed the definition of ATDS in 2021, requiring a random or sequential number generator for ATDS classification
7. FTC, Telemarketing Sales Rule and Legal Library: TSR civil penalty up to $51,744 per violation as of 2024, adjusted annually for inflation; CAN-SPAM per-day penalty adjusted to $53,088
8. National Do Not Call Registry (FTC), Safe Harbor provisions (16 CFR 310.4(b)(3)): DNC safe harbor requires written procedures, training, registry purchase within 31 days, and internal opt-out list compliance