TCPA insurance: what it covers, what it costs, and what it won't save you from

Last updated 2026-07-09

What is TCPA insurance and does a standard business policy cover it?

Short answer: almost certainly not.

The Telephone Consumer Protection Act (47 U.S.C. § 227) exposes businesses to statutory damages of $500 per violation, or $1,500 per willful violation, with no cap once a case becomes a class action. ^[1] Those numbers add up fast. A mid-size outbound team runs a 50,000-call campaign with one consent defect and can face a seven-figure class action before anyone drafts a demand letter.

Standard commercial general liability (CGL) policies cover bodily injury and property damage. A TCPA claim fits neither bucket. The CGL's "personal and advertising injury" coverage sometimes gets argued as a hook, because that section covers violations of a person's right of privacy, and courts have split on whether an unwanted call counts as a "privacy" violation under the policy language. Some insurers have paid out under that theory. Others have excluded it and won. You cannot bank on a CGL bailing you out.

Here's the honest picture. If you run outbound calls or texts at scale, go find coverage that actually names telephony liability, electronic communications liability, or TCPA violations in the insuring agreement. Hoping a standard CGL stretches far enough is a bet you lose more often than you win.

Which types of insurance policies can actually cover TCPA claims?

A few policy types have real potential, and they work differently.

Media liability / advertising injury policies. Built for companies that communicate with consumers at volume. The better ones name "telephone consumer protection" or "electronic communications" as a covered offense. Read the insuring agreement word by word before you buy. Do not rely on a broker's verbal summary.

Technology E&O (errors and omissions). If your business delivers software, a SaaS dialer, or any tech product used to make calls or send texts, a tech E&O policy often covers third-party claims arising from that product. A lead generation platform sued because a downstream client used its data for TCPA-violating calls might find coverage here.

Directors and officers (D&O) and employment practices liability (EPLI). These don't cover TCPA. Anyone telling you they do is wrong.

Specialty telephony / outbound marketing riders. Some carriers, mostly in the surplus lines market (think Lloyd's syndicates or admitted specialty carriers), have started writing endorsements or standalone policies built for TCPA and DNC exposure. ^[12] These are the closest thing to purpose-built TCPA insurance you can buy right now.

The table below compares how each policy type typically responds to a TCPA claim. Coverage varies by carrier and form. Treat this as a general guide, not a guarantee.

Policy type	Likely covers TCPA?	Depends on...
Standard CGL	Rarely	Whether "privacy" language sits in the personal/advertising injury clause
Media liability	Often, if properly endorsed	Specific TCPA language in the insuring agreement
Tech E&O	Sometimes	Whether the tech product was the instrumentality of the violation
Cyber liability	Rarely	Usually excludes telephone-based claims
Specialty telephony rider	Yes (by design)	Carrier availability; usually surplus lines
D&O / EPLI	No	N/A

How much does TCPA insurance cost for a small outbound team?

Nobody has clean, published pricing on this. The surplus lines market doesn't file rates the way admitted carriers do, so figures come from broker quotes and ranges shared in compliance circles. Take the numbers below as directional, not gospel.

For a team placing under 100,000 outbound contacts a year, with documented consent practices, annual premiums for a specialty media liability policy or telephony endorsement tend to run $2,000 to $8,000. ^[2] That widens to $8,000 to $20,000 or more if you place higher volumes, work in higher-risk sectors like insurance, mortgage, or debt collection, or carry prior TCPA claims on your loss history.

Deductibles (or "self-insured retentions" in the surplus market) typically start at $10,000 and climb to $50,000 or higher. That matters a lot. Buy a policy with a $25,000 SIR, then get hit with a single-plaintiff suit demanding $5,000 to go away, and you pay that settlement entirely out of pocket before the policy touches a dollar.

Some carriers price on outbound contact volume. That creates an incentive to document your calling volume honestly. Understate your volume to shave the premium, then watch a high-volume call log surface in discovery, and you have a genuinely bad day.

What do TCPA settlements actually cost, and why does insurance matter so much?

The class action settlements that make the news show you the real shape of the exposure. UnitedHealthcare agreed to pay $2.5 million to resolve TCPA allegations involving automated calls. Credit One Bank's settlements have run into the millions across multiple cases. The Truist Bank TCPA class action settlement and the Albertsons/Safeway TCPA settlement both show mid-size companies writing large checks.

Even single-plaintiff cases cost real money. Defense attorneys in federal court bill $400 to $700 an hour in most major markets. A case that settles after six months of litigation, no trial, can generate $30,000 to $80,000 in legal fees before you write the settlement check. A policy that covers defense costs, even one with a high self-insured retention on the indemnity side, can keep a small company out of a cash crisis.

The Cash App TCPA class action settlement makes the point. Big enough that individual class members got modest payments, and the total fund plus legal fees ran to millions. A class action at that scale is not something most small teams survive without coverage.

What do TCPA insurance policies typically exclude?

This is where policies bite people. Read the exclusions before you buy anything.

Intentional or knowing violations. If evidence shows your team knew it was calling numbers on the National Do Not Call Registry and did it anyway, most policies invoke an intentional acts exclusion. Willfulness is also what triggers the $1,500-per-call rate under 47 U.S.C. § 227(b)(3)(C). ^[1] A policy that excludes intentional acts is nearly useless once a plaintiff can make a credible willfulness argument.

Prior known claims or circumstances. Get a cease-and-desist letter, a demand letter, or an FCC complaint before the policy period starts, and most policies exclude claims arising from those circumstances, even if the lawsuit lands later.

Regulatory fines and penalties. Insurance generally cannot cover government-imposed fines. FCC forfeitures under TCPA enforcement are not insurable in most states.

Criminal or fraudulent acts. Not usually a TCPA issue, but confirm the language doesn't accidentally sweep in aggressive calling practices.

Contractual liability. If your calling platform contract includes an indemnification clause and a downstream client sues, you may not be covered for that indemnity obligation.

One line from the statute is worth quoting. The TCPA lets consumers recover "actual monetary loss" or "$500 in damages for each such violation, whichever is greater." ^[1] That per-violation floor is why class certification is so dangerous. There's no judicial discretion to drop statutory damages below $500.

Does TCPA insurance replace the need for consent documentation?

No. Any broker or vendor suggesting otherwise is setting you up for a bad surprise.

Insurance responds after a claim arises. Consent documentation stops the claim from being valid in the first place. A call to a consumer who gave express written consent, documented and time-stamped in your CRM, is not a TCPA violation. A call made without consent is, no matter what sits in your insurance binder.

The FCC's 2023 one-to-one consent rule, which took effect in January 2025, tightened what counts as valid prior express written consent for calls and texts made with an automatic telephone dialing system or prerecorded voice. ^[5] Consent obtained through a lead generator's blanket disclosure form no longer covers downstream callers. Each calling party must be named, or logically and necessarily implied by the consumer's action.

That change made consent documentation more work than it already was. It also made vague, third-party-generated consent records much likelier to fail in court. Which means insurance claims will rise as companies discover their old consent flows don't hold water.

The division of labor is simple. Compliance work (consent flows, DNC scrubbing, call frequency limits) cuts the number of meritorious claims against you. Insurance pays when something still goes wrong despite good practices.

How does the FCC's enforcement posture affect your insurance risk?

The FCC doesn't sue companies the way plaintiffs' lawyers do, but FCC enforcement creates separate financial exposure that insurance generally cannot cover.

The FCC can issue a Notice of Apparent Liability (NAL) and assess forfeitures for TCPA violations. Those forfeitures are penalties paid to the government, not damages paid to consumers, and are not insurable in most states. ^[6] The FCC's forfeiture authority under 47 U.S.C. § 503 allows penalties up to $23,727 per violation as of the most recent inflation adjustment. ^[6]

More relevant to most outbound teams: the FCC's 2024 and 2025 rulemaking has been aggressive. The one-to-one consent rule, the shifting definition of what qualifies as an automatic telephone dialing system after Facebook v. Duguid ^[7], and the FCC's focus on lead generation chains all shape how courts evaluate TCPA class actions. Insurers watch this and price accordingly. Carriers who wrote broad TCPA coverage cheaply a few years ago have tightened exclusions and raised premiums.

Stay current on TCPA news. A regulatory change can shift your insurance exposure inside a single policy year.

What should you ask a broker before buying TCPA insurance coverage?

Most commercial brokers have never placed a TCPA-specific policy. You want a specialty E&O or media liability broker, or someone with real experience placing technology and communications liability for outbound marketing firms.

Questions to bring to the meeting:

1. Does the insuring agreement specifically name TCPA violations, or are we relying on a privacy-adjacent clause? 2. Does the policy cover defense costs inside or outside the limits? Inside means defense fees eat into the money available to pay settlements. 3. What is the self-insured retention, and does it apply separately to defense and indemnity? 4. Is willful violation excluded, and how does the policy form define "willful"? 5. How does the carrier define an "occurrence" or a "claim"? A class action with 10,000 members might be one occurrence or 10,000, depending on the wording. 6. Are FCC investigations or inquiries covered as a "claim," or only lawsuits? 7. What compliance documentation does the carrier want before binding? Some want to see your consent flows, DNC scrubbing procedures, or a compliance audit before they'll quote.

If the broker can't answer questions 1 through 5 without checking with underwriting, that's fine. It means they're being honest. What's not fine is a broker who waves the questions off with "you're covered, don't worry."

How do courts treat insurance in TCPA class actions?

Coverage disputes in TCPA cases have grown their own body of case law, mostly in federal district courts and state appellate courts reading CGL policy language.

The core fight is almost always whether a TCPA claim falls within the "personal and advertising injury" coverage in a CGL, which typically covers injuries arising from "oral or written publication, in any manner, of material that violates a person's right of privacy." Courts in some jurisdictions have held that an unwanted automated call or text is a privacy violation covered by this language. Others disagree, finding TCPA violations are economic or nuisance-type harms, not privacy violations in the insurance-law sense.

The Ninth Circuit and several state supreme courts have addressed versions of this question. There is no uniform national rule. Your coverage can turn on which state's law governs your policy.

One more wrinkle. Even when a court finds coverage, the insurer can argue the "expected or intended" exclusion applies to intentional calling campaigns. Running an auto-dialer is intentional. Whether the resulting violation was "expected or intended" depends on whether you had notice your consent or DNC compliance was defective.

For how courts assess the liability facts that feed these coverage fights, cases like Joseph Snyder v. Credit One show the evidentiary record a plaintiff builds to establish willfulness.

What compliance steps actually reduce your TCPA insurance premium and exposure?

Insurers are underwriters, not compliance consultants. But carriers who specialize in this space do look at your risk management when they price, and documented compliance genuinely moves the number.

Steps that cut both your litigation risk and your insurance cost:

Scrub against the National Do Not Call Registry before every campaign. Registered callers download DNC data from the FTC's registry. ^[8] Scrubbing is not optional under 47 U.S.C. § 227(c) and its implementing rules at 47 C.F.R. § 64.1200. ^[9]

Keep written consent records with a timestamp, IP address, and the exact disclosure shown to the consumer. If your consent form doesn't meet the one-to-one standard the FCC finalized in 2023, fix it before you call a single lead.

Run an internal DNC list. When a consumer asks not to be called, log it. 47 C.F.R. § 64.1200(d) requires it, and carriers read the absence of an internal DNC process as evidence of sloppy risk management. ^[9]

Audit your lead vendors. After the 2025 rule, buying a lead from a vendor who captured consent under a broad, multi-advertiser disclosure does not give you valid consent to call. Get the consent documentation, read it, and reject any lead where the disclosure doesn't specifically authorize your calls.

LeadCompliant's free compliance kit has checklist templates for consent documentation and DNC scrubbing workflows. They aren't a substitute for legal counsel, but they're a starting point for the written procedures carriers want to see.

The text message marketing rules layer on top of voice call rules for any team running SMS, and some insurers underwrite voice and SMS exposure differently.

Is TCPA insurance worth buying for a small team?

For most teams doing steady outbound calling or texting, yes, if you can find the right coverage at a reasonable self-insured retention.

Here's the honest math. A single-plaintiff TCPA suit, even one you'd likely win, costs $20,000 to $60,000 in defense fees to resolve. A $4,000-a-year policy that covers defense costs outside the limits pays for itself after one nuisance suit. Class actions are a different category entirely.

Where I'd push back on insurance as a first priority: if your team is tiny (say, two or three salespeople calling warm inbound leads who gave explicit consent), your TCPA risk is genuinely low, and $8,000 a year in premium is probably better spent on a proper consent audit and a DNC scrubbing subscription. Insurance without good compliance is expensive. Insurance on top of good compliance is usually worth it.

If you buy or generate leads from third parties and call them, the risk profile flips. Third-party lead consent is the single biggest source of TCPA exposure for small outbound teams right now. Insurance combined with tight vendor auditing is the right pairing.

LeadCompliant's free TCPA checkers can help you audit your current consent flows and flag gaps before a claim arises. That due diligence also makes you a better insurance risk.

What happens if you don't have TCPA insurance and get sued?

The realistic worst case: a class gets certified, discovery reveals your consent records are incomplete, the class is 30,000 people, and you face $15 million in statutory damages. No small company survives that without either a favorable ruling or insurance.

The common case: a plaintiff's attorney sends a demand letter for $15,000 to settle a single-plaintiff claim. You have no insurance, you haven't scrubbed the DNC list in six months, and you have no consent documentation for the call at issue. Fight it or pay it. Fighting costs more than $15,000. Paying feels like extortion. Paying is cheaper.

TCPA plaintiffs' firms run this playbook constantly. They monitor call records, buy leads from the same lead gen networks their targets use, receive ATDS calls with no consent, then send demand letters. Some individual plaintiffs file dozens of cases a year. ^[10] It's a real business model. The Kaiser TCPA settlement claim deadline and the Credit One TCPA settlement both show how class mechanisms roll individual claims into enormous exposure.

Going without insurance doesn't guarantee you get sued. It means that if you do, every dollar of defense and settlement comes straight out of operating cash. For most outbound teams calling any real volume, that's an unacceptable risk.

Frequently asked questions

Does my general liability policy cover a TCPA lawsuit?

Probably not. Standard CGL policies cover bodily injury and property damage. A TCPA claim might squeeze into the "personal and advertising injury" section if the policy covers privacy violations, but courts are split on whether an unwanted call is a covered privacy violation. Read your actual policy language and ask your carrier directly. Don't assume coverage exists until you have it confirmed in writing.

What is the minimum insurance a small outbound sales team should carry?

At minimum, ask a specialty broker to quote a media liability or tech E&O policy with an explicit TCPA endorsement. Premiums for low-volume teams start around $2,000 to $4,000 a year. If you buy third-party leads or run autodialer campaigns, also look at surplus lines carriers who write telephony-specific liability. A standard business owners policy is almost never enough on its own.

Can insurance cover the $1,500 per-call willful TCPA penalty?

This is where most policies struggle. The $1,500 statutory rate under 47 U.S.C. § 227(b)(3)(C) applies to willful violations. Most policies exclude claims arising from intentional or knowing acts. If a plaintiff proves willfulness, the insurer may disclaim coverage under that exclusion. It's a real gap, and one reason compliance work matters more than insurance for willful violation risk.

Does TCPA insurance cover text message violations as well as phone calls?

It depends on the policy form. The TCPA covers both calls and texts to cell phones made with an automatic telephone dialing system or prerecorded voice. Many TCPA-specific policies cover both, but confirm the insuring agreement explicitly includes SMS or electronic communications. Some older policies were written with calls in mind and have ambiguous language around texts. Check before running an SMS campaign under a policy you haven't verified.

Does TCPA insurance cover FCC fines and forfeitures?

No. Government-imposed fines and regulatory penalties are generally not insurable. Most states prohibit insuring against penalties designed to punish and deter, and FCC forfeitures fall into that category. The FCC can assess up to roughly $23,727 per violation under its forfeiture authority. That exposure sits entirely outside your insurance program, which is one more reason to invest in real compliance.

What is a self-insured retention (SIR) and how does it affect TCPA claims?

A self-insured retention works like a deductible. You pay claims out of pocket up to the SIR amount before the policy responds. In TCPA specialty markets, SIRs often start at $10,000 and reach $50,000 or more. For small nuisance suits where the plaintiff demands $5,000 to $15,000, the entire settlement can fall within your SIR. Defense costs may also count against the SIR depending on the policy structure.

How do I find an insurance broker who actually understands TCPA coverage?

Ask specifically for brokers who place media liability, technology E&O, or telephony liability for outbound marketing companies. Wholesale brokers in the surplus lines market are likelier to have carrier relationships for this niche than a retail business insurance agent. Ask how many TCPA-related placements they've done in the last two years. If the answer is zero, keep looking.

Does the FCC's 2023 one-to-one consent rule change my TCPA insurance risk?

Yes, meaningfully. The FCC's 2023 rule (effective January 2025) requires that prior express written consent for ATDS calls and texts identify the specific calling party. Consent obtained through a shared lead form covering multiple advertisers no longer covers any individual caller. Teams relying on third-party lead consent that pre-dates this rule now carry a much larger gap in their records, which creates more meritorious claims and likely higher premiums going forward.

What documentation do insurance carriers want to see before writing TCPA coverage?

Most specialty carriers want to review your consent capture forms or disclosures, your DNC scrubbing process and how often you scrub, whether you keep an internal do-not-call list, your call volume by channel, any prior TCPA claims or demand letters, and your lead sourcing practices. Carriers treat well-documented compliance as evidence of lower risk and price accordingly. Showing up with nothing documented usually means a higher premium or a declination.

Can a company be sued under TCPA even if they bought leads from a third party?

Yes. Buying leads does not transfer TCPA liability. If the lead generator captured defective consent, the downstream caller is still the entity making the call and bears the liability. Courts have generally not let companies escape liability by pointing to a vendor contract. The FCC's one-to-one consent rule specifically targeted this structure. Your indemnification clause with the vendor may help, but only if the vendor can pay.

Are there any insurance products specifically designed for TCPA exposure?

Yes, though they are niche and mostly placed in the surplus lines (non-admitted) market. Some Lloyd's syndicates and domestic surplus lines carriers write endorsements or standalone policies covering TCPA and Telemarketing Sales Rule violations for outbound marketing firms. These policies vary widely in form and aren't standardized the way ISO CGL forms are. Working with a surplus lines broker is the most direct path to this coverage.

What's the difference between claims-made and occurrence coverage for TCPA policies?

Claims-made policies cover claims reported during the policy period, regardless of when the underlying calls happened (subject to retroactive date limits). Occurrence policies cover incidents that happen during the policy period, even if the claim is filed later. Most media liability and E&O policies are claims-made. This matters enormously for TCPA, because class periods often cover calls made years before the lawsuit is filed. Your retroactive date needs to reach back to the start of your calling activity.

Can TCPA insurance coverage protect individual employees or just the company?

Typically, TCPA suits name the corporate entity. Individual employees are rarely named unless they have decision-making authority over the calling program. Check whether the policy extends to officers and directors as named insureds if that's a concern. D&O policies do not cover TCPA, and EPLI policies do not cover TCPA. This protection has to be built into the media liability or telephony policy itself.

How quickly can a TCPA lawsuit turn into a class action?

Very quickly. A plaintiff's attorney can file a class action complaint on day one, and the class certification motion typically comes within the first year of litigation. Courts have granted certification in TCPA cases in as little as six to twelve months after filing. Once a class is certified covering, say, 50,000 people at $500 each, the theoretical exposure is $25 million. Most cases settle before that point, but the certified class is what drives the settlement pressure.

Sources

1. U.S. Code, 47 U.S.C. § 227, Telephone Consumer Protection Act: TCPA imposes statutory damages of $500 per violation or $1,500 per willful violation; private right of action for 'actual monetary loss' or '$500 in damages for each such violation, whichever is greater'
2. Insurance Journal, surplus lines market coverage: Specialty media liability and telephony endorsement premiums for small outbound teams estimated in the $2,000-$20,000 range depending on volume and sector
3. U.S. Code, 47 U.S.C. § 503, forfeiture penalty authority: FCC forfeiture authority allows penalties up to roughly $23,727 per violation as of the most recent inflation adjustment; forfeitures are government penalties not insurable in most states
4. U.S. Supreme Court, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): Supreme Court narrowed the definition of ATDS under the TCPA in 2021; ongoing FCC guidance continues to shape interpretation
5. FTC, National Do Not Call Registry: Registered telemarketers must scrub against the National DNC Registry; registry access available via FTC portal
6. FCC regulations, 47 C.F.R. § 64.1200, delivery restrictions for telephone solicitations: 47 C.F.R. § 64.1200(d) requires companies to maintain internal do-not-call lists and honor opt-out requests
7. WebRecon LLC, monthly complaint and lawsuit statistics: Professional TCPA plaintiffs file dozens of cases per year; plaintiffs' firms operate systematic call-monitoring programs to identify TCPA violations
8. U.S. Courts, PACER federal docket database: TCPA class actions can be certified covering tens of thousands of class members; individual class member recovery typically $50-$300 after attorneys' fees
9. National Association of Insurance Commissioners (NAIC), surplus lines resources: Surplus lines (non-admitted) carriers including Lloyd's syndicates write specialty telephony liability policies not available through the standard admitted market