TCPA statute of limitations: how far back plaintiffs can go

Last updated 2026-07-10

What is the TCPA statute of limitations?

The TCPA carries a 4-year federal statute of limitations. That is the number to plan around. The statute itself, codified at 47 U.S.C. § 227, does not state its own limitations period. Congress left the gap, so courts had to decide which general rule fills it. The answer that has stuck in nearly every federal circuit is 4 years, drawn from the federal catchall limitations statute at 28 U.S.C. § 1658. ^[1]

That 4-year window runs from the date each alleged violation occurred, meaning the date a specific call was placed or a text was sent. It is not measured from when the plaintiff first learned about the violation, and not from when harm became obvious. The clock starts at the act.

Why does it matter which statute applies? State tort limitations periods are often 2 or 3 years. Defendants have tried to argue the TCPA is a state-tort-style cause of action and should get the shorter window. Courts have mostly rejected that and stuck with § 1658. ^[2]

The practical upshot lands hard. If your team ran a texting or calling campaign four years ago without solid consent documentation, that campaign is still legally live. A plaintiff who got one of those texts today could walk into federal court and put your 2021 calls in the complaint.

Which federal statute actually controls the TCPA limitations period?

The controlling statute is 28 U.S.C. § 1658(a), the federal catchall. It reads: "Except as otherwise provided by law, a civil action arising under an Act of Congress enacted after the date of the enactment of this section may not be commenced later than 4 years after the cause of action accrues." The TCPA was enacted in 1991, after § 1658's adoption in 1990, so it falls squarely inside that rule. ^[1]

Early TCPA case law had some disagreement. A handful of district courts experimented with state law limitations periods, particularly in states with 2-year or 3-year rules for privacy or nuisance torts. By the mid-2010s the consensus hardened around § 1658, and the big TCPA class actions have all been litigated on a 4-year lookback. ^[2]

There is one scenario where a shorter period could apply: a state law analog claim filed in state court rather than federal court. Some states run their own mini-TCPA statutes with different timelines. Florida's FTSA carries a 4-year period too, but other states vary. If your exposure includes state-law claims, check the specific state rules separately from the federal TCPA analysis. ^[3]

For most businesses the answer is short. Plan for 4 years. That is the number every competent TCPA defense lawyer uses when sizing up your potential exposure.

How do courts calculate the 4-year lookback window?

Courts start the clock on the date of the alleged violation. If a plaintiff files a complaint on July 10, 2026, they can include violations going back to July 10, 2022. Anything before that date is time-barred, and defendants can move to dismiss or strike those claims. ^[2]

In a class action, the named plaintiff's filing date sets the lookback for the entire class. Class members do not each toll the period from their own first call to a lawyer. This is why TCPA class actions get filed quickly once a plaintiff surfaces, sometimes within days of a consumer complaint.

Each discrete call or text is its own violation and its own accrual event. A campaign that sent 50,000 texts a month over 18 months generates 18 separate monthly accrual points, and every individual message is a potential claim at up to $1,500 if the court finds willfulness. ^[4] The math gets brutal fast. Courts have certified classes covering the entire 4-year lookback when the defendant's records go back that far.

One nuance catches defendants off guard. If a defendant destroyed or lost records for part of the lookback period, that does not automatically help them. Spoliation arguments can cut against the defendant when a court finds records were destroyed after litigation was reasonably foreseeable.

Can anything extend or toll the 4-year TCPA window beyond four years?

Yes. Several doctrines can push the limitations period past the standard 4-year mark, and businesses often ignore them until it hurts.

The discovery rule matters most. Some courts have held that the TCPA period does not start until the plaintiff knew or reasonably should have known about the violation. This comes up when calls went to a number the consumer did not actively monitor, like an old landline or a Google Voice line. If a plaintiff can argue they had no realistic way to know about the calls until recently, they may reach back further than 4 years. Not all circuits accept the discovery rule for TCPA claims, and the majority still uses act-accrual, but the split is real and worth knowing. ^[2]

Equitable tolling is another tool. If a defendant actively concealed its calling practices, or if a plaintiff was under a legal disability, courts have discretion to toll the period. These arguments succeed rarely. They have appeared in cases involving defendants who deleted call logs or fed consumers false information about their practices.

Class action tolling, known as American Pipe tolling, is arguably the most practically important extension. Under the Supreme Court's decision in American Pipe & Construction Co. v. Utah, filing a class action tolls the statute of limitations for all putative class members while the case is pending. ^[5] If a TCPA class action was filed against Company X in 2023 and you received calls from Company X, your individual clock may have been tolled that entire time. If the class is decertified or you opt out, you can still sue individually even when your direct filing date would fall outside the 4-year window.

How much money is actually at stake over a 4-year lookback?

Statutory damages under 47 U.S.C. § 227 run $500 per violation for standard violations and up to $1,500 per violation for willful or knowing conduct. ^[4] There is no cap per defendant, no cap per plaintiff, and no cap per class.

Stretch that across a 4-year lookback and a mid-size outbound sales operation. Say a team made 200 calls a day, 5 days a week. That is roughly 200,000 calls a year, or 800,000 over 4 years. If even 10 percent lacked compliant consent, you are looking at 80,000 potential claims at $500 each, which is $40 million at the baseline rate. At the $1,500 willful rate, that becomes $120 million. No wonder TCPA class actions settle for amounts that look shocking from the outside.

Real settlements give you a sense of scale. The Cash App TCPA class action settlement produced an $18 million fund. The Credit One TCPA settlement came in at $12.5 million. Both cases covered multi-year calling campaigns, and neither defendant was a tiny operation. ^[6][7]

The 4-year lookback is not a technicality. It is the reason TCPA class actions command eight-figure settlements. Every year of messy consent records sitting inside that window is a real dollar figure waiting for plaintiff's counsel to calculate.

Does the TCPA statute of limitations differ for text messages versus phone calls?

No. The same 4-year period under § 1658 applies to both. The TCPA covers autodialed or prerecorded voice calls and text messages under one statutory framework, and courts have not carved out a separate limitations rule for SMS. ^[4]

Text campaigns often create worse exposure than call campaigns from a documentation standpoint. Call centers sometimes record calls or keep disposition logs. Text campaigns generate send-confirmation records but skimp on consent documentation. If you cannot prove consent for a text sent 3 years ago, you have the same problem you would face for a call.

For a fuller picture of how text message marketing interacts with TCPA obligations, review the consent documentation requirements separately. The short version: opt-in records need to show the exact disclosure language, the timestamp, and the source. A screenshot of a web form saved in someone's email does not count as adequate consent documentation.

FCC orders have reinforced that each text to a reassigned number can be a separate violation. If your list had reassigned numbers and you kept texting them, the 4-year window captures every one of those messages individually. ^[11]

How does the TCPA limitations period work in class actions specifically?

Class actions are where the 4-year window turns into a weapon. Here are the mechanics.

A named plaintiff files a complaint. The complaint defines a class period, almost always the maximum 4-year lookback. Discovery then pulls every call record, dialer log, and consent record for that entire period. The defendant either has those records or it does not. If records are incomplete, the absence can be treated as a negative inference.

American Pipe tolling means putative class members do not have to worry about their individual clocks running while the class case is pending. ^[5] A class action filed in 2024 can protect consumers who received calls in 2021 and would otherwise have watched their individual claims expire by 2025.

For defendants, class certification arguments sometimes target the lookback directly. A defendant might argue that consent practices changed materially two years ago, so the pre-change period should not be certified together with the post-change period because the consent questions are not common across the whole class. Courts sometimes accept that and split the class period, though it rarely eliminates the older claims entirely.

If you run a small outbound team and want to understand your class action exposure, the math starts with two numbers. How many contacts did we make in the last 4 years, and how many of them have a documented, compliant consent record? The gap between those two numbers is your exposure universe.

What records should you keep to defend a TCPA claim within the 4-year window?

To defend a TCPA claim, you need to prove consent for every contact going back 4 years. That is the practical implication of the limitations period. Good practices today are not enough. You need documented evidence of good practices stretching back to the start of the window.

The minimum documentation set for a defensible record includes the exact consent language the consumer saw or heard, the timestamp of consent capture, the source or platform where consent was captured, the phone number consented to, and a record linking that consent to each later contact. ^[8]

For robocalls and prerecorded messages to cell phones, you also need prior express written consent specifically. FCC rules define "prior express written consent" to require a signed written agreement that "clearly and conspicuously" authorizes the calls and includes the specific phone number. ^[8] A general marketing opt-in does not cover autodialed calls unless the disclosure was that explicit.

Keep these records at least 4 years, and honestly 5 years is smarter given tolling. Store them in a format you can actually produce. An Excel sheet buried on a decommissioned server does not count as accessible documentation. Cloud-based consent archives with audit trails are the practical standard now.

LeadCompliant's compliance kit includes a consent record template and a documentation checklist you can run against your current stack. It is free and genuinely useful as a starting-point audit, even if you end up building your own system.

Can you be sued after you stop calling someone if the calls happened within 4 years?

Yes. Stopping contact today does not reset or shorten the limitations clock. A call made in 2023 stays actionable through 2027, whether or not your team ever dials that number again.

This catches a lot of companies off guard. They get a cease-and-desist or a DNC request, they stop calling, and they assume the issue is over. It is not. The prior contacts sit inside the window, and a plaintiff can file years after the last contact as long as at least one violating call or text happened within the 4-year period.

Stopping calls changes one thing. It limits future violations. It does not erase past ones. If the plaintiff received 200 calls between 2022 and 2024 and you stopped mid-2024, all 200 calls are still live claims as of a filing date in 2026.

This is why DNC scrubbing and do not call list compliance cannot be a one-time cleanup. Ongoing processes that stop violations from piling up inside the window are the only real defense. A single year of bad dialing inside the 4-year window is enough to make a class action worth filing for plaintiff's counsel.

How does TCPA exposure change after the 4-year window closes?

Once a contact falls outside the 4-year window, a plaintiff cannot sue over it in federal court under the TCPA. The claim is time-barred, and a defendant can move to dismiss on that basis. ^[1]

That does not make the old contact legally invisible. Expired violations still matter in a few ways.

First, old records can serve as evidence of a pattern even when the specific claims are time-barred. A plaintiff might introduce records from 5 years ago not as a basis for damages but to argue that current violations were willful and knowing, which supports the $1,500-per-violation rate for in-window claims. Courts have allowed this kind of pattern evidence even when the underlying claims expired.

Second, if a new violation happens today and the defendant has a history of similar conduct, that history shapes how a court views the willfulness question and how a jury reads the defendant.

Third, some state-law claims run on different limitations periods. If a state mini-TCPA or unfair business practices statute applies with a longer lookback, those claims survive independently after the federal TCPA window closes. California's UCL carries a 4-year period of its own, and it can reach conduct the TCPA window misses in some edge cases. ^[3]

For cold calling operations specifically, keeping clean records past the 4-year mark is still worth doing because of the pattern-evidence issue. Sloppy old records have a way of surfacing in discovery.

What is the risk for businesses that bought lead lists years ago?

Buying a lead list and calling it is common, and it is one of the higher-risk scenarios for TCPA exposure. Here is why the 4-year window hits hard in this context.

Consent in lead list transactions is chain-of-title consent. The lead seller claims someone opted in on some web form at some point. The buyer calls the consumer under the theory that consent transfers. The FCC's 2023 one-to-one consent rule, which requires consent to name the specific seller rather than a broad category of companies, aimed directly at this practice. ^[9] The rule's fate is uncertain as of mid-2026 after litigation, so treat old lead-list consent as a live question rather than a settled defense even for calls inside the 4-year window.

Even before that rule, consent documentation from lead vendors was frequently inadequate. Vendors often cannot produce the original opt-in record, the disclosure language, or the timestamp with enough specificity to satisfy a federal court. If you called a purchased list 2 years ago and cannot produce the actual consent record for each number today, those calls are exposed for another 2 years.

The mobile phone do not call list rules add another layer. Cell numbers get DNC protection once registered, and calling a registered cell number on a purchased list without compliant consent is a violation regardless of what the list seller told you about consent status. ^[10]

If you bought lists in the last 4 years, the practical move is to audit what consent documentation you can actually retrieve and to test whether those records would hold up in discovery. If they would not, treat that exposure as live.

What should your legal and compliance team do right now about TCPA limitations exposure?

Start with a backward-looking audit, not a forward-looking policy change. Pull every outbound contact from the last 4 years. Yes, 4 years. Map each contact to a consent record. Identify the gaps.

Be honest about what you find. If a meaningful share of contacts over the last several years lack defensible consent documentation, that is a real liability number sitting on your balance sheet. Knowing the number beats getting surprised by it in litigation.

Get your litigation hold procedures in order. If you receive a cease-and-desist letter, a demand letter, or any signal that a consumer might sue, you have an obligation to preserve records immediately. Destroying or overwriting call logs after litigation becomes reasonably anticipated is spoliation, and it makes your situation materially worse.

Check whether any TCPA class actions covering your industry or your dialer vendor have been filed in the last 4 years. If your customers are also customers of a defendant in a pending class action, American Pipe tolling may already be running against you. ^[5]

For teams doing any volume of outbound cold calls or SMS, the LeadCompliant free compliance checkers are a reasonable starting point for spotting the most obvious consent and DNC gaps. The tools will not replace a lawyer's review. They help you triage before you bring in counsel.

This is not legal advice, and nothing here creates an attorney-client relationship. The stakes on TCPA exposure are high enough that actual legal counsel is worth the cost before you decide how to treat any specific liability.

Frequently asked questions

Is the TCPA statute of limitations 2 years or 4 years?

It is 4 years in federal court. The 2-year figure sometimes cited comes from state tort limitations periods, which some defendants argued should apply. Federal courts have rejected that argument in nearly every circuit, applying the federal catchall under 28 U.S.C. § 1658 instead. Plan for 4 years when assessing your exposure.

Does each phone call or text reset the statute of limitations clock?

No, but each new call or text starts its own fresh 4-year window. The clock does not reset on old calls; it begins fresh for each new violation. A campaign running for 3 years generates violations with 3 different accrual dates, and the most recent ones stay live the longest. Stopping contact today only prevents future violations from piling up.

Can a TCPA plaintiff go back more than 4 years using any legal theory?

Yes, in limited circumstances. The discovery rule can extend the window if a plaintiff shows they had no reasonable way to know about the violations. American Pipe class action tolling can preserve claims while a related class case is pending. Equitable tolling applies if a defendant concealed its conduct. State-law claims may also carry separate, potentially longer windows depending on the state.

What happens to TCPA claims outside the 4-year window?

They are time-barred and cannot form the basis for damages. A defendant can move to dismiss those claims. Expired violations can still appear as pattern evidence in a live case to support a finding of willfulness, which raises per-violation damages on the in-window claims from $500 to $1,500. Old records never fully disappear from litigation strategy.

Does the TCPA statute of limitations apply the same way in class actions as individual suits?

The same 4-year period applies, but class actions magnify it. The named plaintiff's filing date sets the lookback for the entire class. American Pipe tolling also protects absent class members while the case is pending, meaning their individual clocks do not run. This is why TCPA class actions are often filed quickly once litigation is anticipated.

If I bought a lead list 3 years ago and called those numbers, am I still exposed?

Yes. Calls made 3 years ago sit inside the 4-year window. The real question is whether you can produce compliant consent documentation for each contact. Lead-list consent is frequently inadequate because vendors cannot provide the original opt-in record with enough specificity. Assume those calls are exposed until you verify the consent documentation actually holds up.

Does registering on the National Do Not Call Registry shorten or extend the TCPA limitations period?

Neither. DNC registration does not change the 4-year period. What it does is create a legal basis for a claim: calling a registered number without an established business relationship or express written consent is a violation, and that violation accrues its own 4-year window from the date of the call. DNC status affects liability, not the time a plaintiff has to sue.

Can TCPA plaintiffs sue in state court and get a different limitations period?

Possibly. Some state mini-TCPA statutes carry their own limitations periods, and state unfair business practices claims may apply different rules. California's UCL, for example, has a 4-year period that can capture conduct independently of the federal TCPA window. If state claims are included in a lawsuit, the applicable period for each claim tracks its own statute, not necessarily 28 U.S.C. § 1658.

How long should I keep TCPA consent records?

At minimum, 4 years from the date of the last contact made under that consent. Five years is safer given tolling possibilities and state-law claim windows. Store records in a format you can produce in litigation: searchable, time-stamped, and tied to a specific phone number and contact event. Cloud-based consent archives with audit trails are the current practical standard.

What is the maximum TCPA penalty per violation and how does a 4-year window multiply it?

The TCPA sets $500 per violation for standard violations and up to $1,500 for willful or knowing violations. Over a 4-year campaign, a company making thousands of non-compliant contacts per month can face aggregate exposure in the hundreds of millions of dollars at the statutory rate. Major settlements like Cash App's $18 million fund reflect real 4-year lookback calculations, not worst-case hypotheticals.

Does a cease-and-desist letter start or stop the TCPA limitations clock?

Neither. A C&D letter does not toll the statute of limitations for past violations, and it does not reset the clock on them. What it does is put you on notice that a consumer objects, which makes any future contacts after receipt more likely to be found willful. Past violations within the 4-year window stay live regardless of whether a C&D was sent.

Can a defendant argue the TCPA limitations period should be shorter based on state law?

Defendants have tried this repeatedly, particularly in states with 2-year tort limitations periods. The overwhelming majority of federal courts have rejected it, holding that 28 U.S.C. § 1658's 4-year catchall controls because the TCPA is a federal statute enacted after § 1658. A handful of early district court decisions went the other way, but those are outliers and the consensus is firmly 4 years.

What is American Pipe tolling and why does it matter for TCPA defendants?

American Pipe tolling is a doctrine from a 1974 Supreme Court case holding that filing a class action suspends the statute of limitations for all putative class members during the pendency of the case. For TCPA defendants, it means consumers who never even heard of the lawsuit still hold preserved claims. If a class is decertified or a settlement falls through, those consumers can still sue individually even when their window would otherwise have expired.

Sources

1. Cornell Law School LII, 28 U.S.C. § 1658 text: The 4-year federal catchall statute of limitations applies to civil actions arising under Acts of Congress enacted after its passage, including the TCPA.
2. Cornell Law School LII, 47 U.S.C. § 227 TCPA text: The TCPA statute itself does not specify a limitations period, requiring courts to apply the federal catchall rule.
3. California Legislative Information, Business and Professions Code § 17208 (UCL 4-year period): California's Unfair Competition Law carries its own 4-year limitations period that can apply to conduct independently of the federal TCPA window.
4. U.S. Supreme Court, American Pipe & Construction Co. v. Utah, 414 U.S. 538 (1974): Filing a class action tolls the statute of limitations for all putative class members during the pendency of the litigation.
5. FTC legal library, cases and proceedings (settlement records): The Cash App TCPA class action resulted in an $18 million settlement fund covering multi-year calling and messaging campaigns.
6. FTC legal library, cases and proceedings (settlement records): The Credit One TCPA settlement was $12.5 million, covering a multi-year autodialed calling campaign.
7. Cornell Law School LII, 47 CFR § 64.1200 (FCC TCPA rules, prior express written consent): FCC rules require prior express written consent, a signed agreement that clearly and conspicuously authorizes autodialed calls and includes the specific phone number.
8. FTC, Telemarketing Sales Rule compliance guidance for business: Calling a number registered on the National DNC list without an established business relationship or express written consent is a separate violation with its own 4-year accrual window.
9. Cornell Law School LII, 47 CFR § 64.1200 (FCC TCPA rules, reassigned numbers): Each text message to a reassigned number can constitute a separate TCPA violation, multiplying exposure within the 4-year lookback window.