TCPA suit: what it costs, how it starts, and how to avoid one

Last updated 2026-07-10

What is a TCPA suit and who can file one?

A TCPA suit is a lawsuit brought under the Telephone Consumer Protection Act, 47 U.S.C. § 227, a federal statute from 1991 that lets private individuals sue companies that call or text them without proper consent or in violation of Do Not Call rules ^[1]. That private right of action is the whole story. You do not need the FCC or the FTC to move first. Anyone who got a violating call or text can file on their own, in federal district court or, in many states, state court.

The statute says a person may "bring in an appropriate court of that State" or in federal court a claim for the greater of actual damages or $500 per violation ^[1]. Read that again. There is no requirement to show you lost money. One unwanted robocall clears the bar.

So who files? Two groups. First, professional serial plaintiffs, sometimes called "TCPA trolls," who keep several phone numbers, wait for violations, then demand a few thousand dollars to settle before they ever file. Second, class action attorneys who pool hundreds or thousands of identical violations from one company's campaign into a case worth tens of millions. Both are real. Their scale is not remotely the same.

What does a plaintiff need to prove in a TCPA lawsuit?

A TCPA plaintiff has to prove very little, which is exactly why these suits are so common. For an automated call or text claim under 47 U.S.C. § 227(b), the plaintiff generally shows three things: the defendant used an automatic telephone dialing system (ATDS) or a prerecorded or artificial voice; the call or text went to a cell number or residential line; and the plaintiff never gave prior express consent, or for telemarketing, prior express written consent ^[1].

The ATDS definition has been the fight of the decade. In Facebook v. Duguid (2021), the Supreme Court narrowed it, holding that a qualifying system must have the capacity to generate random or sequential phone numbers and then dial them, more than store and dial from a list ^[2]. That killed a pile of claims overnight. It did not end TCPA exposure. Prerecorded voice claims need no ATDS at all. And a texting platform with random or sequential generation capacity still counts.

For Do Not Call claims under 47 U.S.C. § 227(c), the plaintiff shows they are on the National DNC Registry or a company-specific list and still got a telemarketing call ^[1]. Consent and an established business relationship can be defenses, but the caller carries the burden of documenting them.

Here is where most companies lose. You may have had oral consent from the lead. You may have had a checkbox on a form. But if you cannot produce a timestamped, IP-logged record tying that consent to the exact number you dialed, a court treats it as no consent at all.

How much does a TCPA suit actually cost a defendant?

Base damages are $500 per violation and $1,500 per willful or knowing violation ^[1]. Every call, every text, every fax is its own violation. A single blast that reached 50,000 people without consent is not a $500 problem. It is a $25 million problem at the base rate, and $75 million if a court finds willfulness.

Settlements prove the math. UnitedHealthcare paid $2.5 million to resolve TCPA allegations. Credit One Bank's settlement drew heavy litigation attention. Truist Bank faced a class action over automated contact claims. Cash App faced its own class action. Albertsons and Safeway settled over marketing texts. These are not flukes. They are what happens when large-scale outreach runs without airtight consent records.

Then there is the legal bill. Defending a contested TCPA class action often runs $500,000 to several million dollars before any settlement. A single serial-plaintiff case usually settles for $2,000 to $25,000, depending on how many calls there were and how clean your records are. Some TCPA defense firms put the all-in cost of a single-plaintiff suit that reaches settlement at $5,000 to $15,000 once you count attorney time.

There is no statutory cap on class awards. Courts have discretion and have sometimes trimmed "shocking" aggregate numbers, but that is not a bet you want your company sitting on.

What are the most common triggers for a TCPA lawsuit?

Most TCPA suits trace back to a short list of operational failures, not clever legal theories.

Texting or calling without documented prior express written consent is the biggest single trigger. The FCC's 2012 rule change made that consent mandatory for autodialed or prerecorded telemarketing calls and texts ^[3]. "Written" does not mean paper. It means a signed agreement (electronic signatures count) that specifically authorizes contact from that company by that method. A terms-of-service checkbox buried in a signup flow usually does not clear the bar.

Ignoring Do Not Call requests is second. Once a consumer says "stop calling," a company has a limited window, generally no more than 30 days under FCC rules ^[3], to pull them from every list. Miss that on the first ask and you have exposure under 47 U.S.C. § 227(c) and under the FTC's Telemarketing Sales Rule.

Dialing reassigned numbers is the quiet one. Someone consented years ago, their number got reassigned, and now you are calling a stranger who never agreed to anything. The FCC's Reassigned Numbers Database exists to catch this, but plenty of callers never scrub against it ^[4].

Buying leads with bad consent is a growing category. If a vendor sold you leads on forms that never named your company, or that were captured through deceptive dark patterns, you can be liable even after you reviewed the form and thought it looked fine. The FCC's one-to-one consent ruling (effective January 2025, then vacated on appeal) was aimed straight at this gap ^[5].

Calling before 8 a.m. or after 9 p.m. in the recipient's local time is a simpler violation under 47 C.F.R. § 64.1200 that piles onto other claims and sometimes stands on its own ^[11].

How does a TCPA class action work differently from an individual suit?

An individual TCPA suit is a nuisance. A class action can end the company.

Class certification under Federal Rule of Civil Procedure 23 requires plaintiffs to show the class is numerous (usually 40 or more, though TCPA classes often run into the thousands), there are common questions of law or fact, the named plaintiff's claims are typical of the class, and that plaintiff can represent the group adequately ^[6]. TCPA classes get certified often because the core question, did the defendant send this without consent, is identical for everyone who got the message.

Once a class is certified, the math turns brutal. A company that sent 200,000 promotional texts without proper written consent faces potential statutory damages of $100 million at the base $500 rate, or $300 million if a court finds willfulness. That number forces settlements no individual plaintiff could ever pull.

The Kaiser TCPA settlement shows the standard shape: a fund is set up, class members file claims, and per-person recovery stays modest (often $50 to $200) while the total payout and the attorney fees run large.

One nuance matters. A class action waiver inside an arbitration agreement can block a class TCPA suit if the agreement is drafted well and covers the contact at issue. Several defendants have won on this. But the clauses have to be airtight, and courts do sometimes find them unconscionable or a poor fit for tort claims. Use this defense as one tool, not your whole plan.

What defenses actually work in TCPA litigation?

Defenses fall into a handful of buckets, and they do not all pull the same weight.

Prior express written consent is the strongest. Produce a clear, timestamped record that the plaintiff affirmatively agreed in writing to the exact type of contact you sent, and most claims die on the spot. The record needs the date, the phone number entered, the specific consent language, and ideally the IP address and the URL of the page where consent was captured.

Established business relationship (EBR) still helps for calls to residential lines on the National DNC list, but EBR does not excuse the ATDS or prerecorded consent requirement for cell phones ^[1]. Companies mix up these two consent tracks constantly.

The ATDS challenge under Facebook v. Duguid works when you can show your dialer pulled from a fixed stored list without random or sequential number generation ^[2]. In circuits applying Duguid strictly, this defense wins regularly.

Honoring opt-outs fast, and documenting that you did, can shrink per-call damages in a serial-plaintiff case. If a plaintiff called on day one, you removed them within 24 hours, and you never called again, your exposure is one violation, not twenty.

Safe harbor is narrow. The FCC provides one for calls to reassigned numbers where the caller had no knowledge of the reassignment and had prior consent for the original subscriber ^[4].

What does not work: arguing you did not know the number was a cell phone, arguing a call with an obvious commercial purpose was not "telemarketing," or leaning on oral consent you cannot document.

How does a TCPA suit start, step by step?

Knowing the procedural arc tells you when to act and what moves you have at each stage.

It starts quietly. A consumer gets an unwanted call or text. They contact a plaintiff's attorney directly, find one through an ad, or an attorney's office spots them through complaint databases or by running numbers themselves. Some serial plaintiffs go hunting for violating campaigns on purpose.

Before filing, the plaintiff or attorney often sends a demand letter. For a small shop, that letter is sometimes the only step before filing if a quick settlement never comes. For class actions, the attorney usually files first and negotiates later, because the filed complaint is where the pressure comes from.

The complaint lands in federal district court, or in state court in places like Florida with their own mini-TCPA statutes. It names the technology used, the number of alleged contacts, and the statutory damages demanded.

Discovery is where defendants burn most of their defense money. Plaintiffs ask for call logs, dialer configuration records, consent documentation, vendor contracts, employee training records, and internal emails about the campaign. Missing or contradictory records feed the willfulness argument.

Most cases settle before trial. The American Bar Association estimates well over 90 percent of civil cases settle, and TCPA cases settle at even higher rates because the damages math makes trial too dangerous for defendants.

Get a demand letter or a complaint? Do not ignore it. Hire a TCPA-experienced attorney right away. You have 21 days to respond to a federal complaint (60 if you waive service). Blow that window and you hand the plaintiff a default judgment.

Can the FCC or FTC also sue you, or is it only private plaintiffs?

Both can. The FCC brings enforcement actions under the TCPA and its rules, and the FTC enforces the Telemarketing Sales Rule (TSR), which overlaps heavily with TCPA requirements for outbound telemarketing ^[10].

FCC enforcement produces forfeiture penalties that sit on top of any private litigation. The FCC's base forfeiture for TCPA violations is $10,000 per violation, up to $1 million per single act or failure to act ^[7]. The agency has issued multi-million dollar fines in robocall cases.

State attorneys general can sue too, under 47 U.S.C. § 227(g), which lets states bring actions for their residents and recover up to $25 per violation or $25,000 per day of violation, whichever is greater ^[1].

Several states run their own call and text statutes with separate penalties. Florida's Telephone Solicitation Act (FTSA) carries a $500 per-call private right of action that runs alongside the federal TCPA, and Florida courts have seen a wave of FTSA filings since 2021. TCPA news from statehouses matters here, because state exposure keeps growing.

One bad campaign can expose a company to private class liability, FCC forfeiture, FTC enforcement, and a state AG action at the same time. None of those cancel each other out.

What steps actually prevent a TCPA suit?

Prevention beats defense by roughly 100 to 1 in almost every real case.

Get consent documentation right before the first dial. Every lead source should hand you an exportable record showing the phone number, the date and time consent was given, the exact consent language displayed, and the URL where it was captured. If a lead vendor cannot produce that, find a new one or treat those leads as unconsented and never auto-dial them.

Scrub against the National DNC Registry at least every 31 days ^[8]. The FCC requires commercial telemarketers to honor DNC registrations within 31 days. Scrub more often on high-volume lists.

Keep an internal DNC list and honor opt-outs within 30 days, though same-day or next-business-day is the standard to aim for ^[3]. Log every opt-out with a timestamp.

Audit your dialing technology. Know whether your platform counts as an ATDS under the post-Duguid standard in your circuit. Get a written technical description from the vendor. If they cannot tell you how the system picks numbers to dial, that is a red flag.

Train your people. An agent who calls a number back after a revocation because they "didn't see the note in the CRM" creates willful-violation exposure. Training records show up in discovery, and they help prove good faith.

Running SMS marketing? Make sure every campaign has a working stop mechanism and that STOP replies are processed before the next send. LeadCompliant's free TCPA tools include a consent checker and an opt-out log template a small team can use with no technical setup. A documented process like that is what separates a defensible program from an indefensible one.

If you use a third-party dialer or text platform, read the vendor's BAA and indemnification language. When a vendor causes a violation by misconfiguring your campaign, you want contractual coverage. Plenty of TCPA defendants learn too late that their vendor agreement has no indemnification at all.

How do courts calculate damages and can they be reduced?

Statutory damages are set at $500 per violation and $1,500 for willful or knowing violations ^[1]. Courts have no discretion to drop below $500 the way some consumer statutes allow. They have, on occasion, used due process to trim aggregate class awards that would be "grossly excessive" against the actual harm.

The case people point to is Wakefield v. ViSalus, where the Ninth Circuit in 2022 looked at whether a $925 million jury verdict for roughly 1.8 million automated calls could survive due process review ^[9]. The court held that due process does require judges to weigh proportionality, but it did not toss the award outright. It sent the case back for more analysis. This area is still moving. Do not count on a judge to shrink a massive class for you.

Willfulness is the line between $500 and $1,500. Courts find it when a company knew the TCPA rules and violated them anyway, kept calling after opt-out requests, or ignored internal legal warnings. An email thread where someone flagged a compliance concern and got overruled is about the most damaging document a plaintiff can find.

The plaintiff does not have to be harmed beyond getting the call. Lost time, interruption, and annoyance are enough, and courts have generally upheld Article III standing on that basis even after the Supreme Court's Spokeo and 2021 TransUnion decisions tightened standing elsewhere. TCPA plaintiffs keep surviving standing challenges when they allege concrete receipt of an unwanted message.

What should a small outbound team do right now to reduce exposure?

Small teams are not safe. Sometimes they are softer targets, because they have less compliance infrastructure and serial-plaintiff attorneys know a small company will settle fast to dodge defense costs.

Start with a consent audit. Pull a random 50 leads off your current list and try to retrieve consent documentation for each. If you strike out on more than a handful, you have a systemic gap.

Check whether any of your numbers are cell phones you are hitting with an autodialer or prerecorded message without express written consent. That is your single highest risk. The text message marketing guide on this site walks through what a compliant consent flow looks like in practice.

Build a DNC process that is not manual. If opt-outs live in one rep's spreadsheet, some will get missed. Use a platform that automatically flags and suppresses opted-out numbers before any campaign fires.

Document everything. Courts read missing records as evidence of bad practice. Even when your actual practices are solid, the absence of paper hands the plaintiff's attorney a story to tell.

If you operate in a high-litigation state like Florida, California, or Illinois, get a short review with a TCPA-experienced attorney before you launch any new campaign. TCPA lawyers in Kentucky and other states are an option for local counsel who know the state-specific quirks.

LeadCompliant's compliance kit includes a consent documentation checklist, a DNC log template, and a pre-launch review form. None of it replaces legal advice, but it gives a small team a structured start and a paper trail that shows good-faith effort, which counts in willfulness fights.

One more thing. Get a demand letter, do not ignore it, and do not respond without counsel. The settlement window is usually short, and the balance of power flips fast once a complaint is filed.

Frequently asked questions

How long do plaintiffs have to file a TCPA lawsuit?

The statute of limitations for a private TCPA claim is four years under 28 U.S.C. § 1658, the general federal four-year catch-all. Some courts have applied a shorter two-year period by analogy to state tort statutes, but federal district courts predominantly use four years. A call made today could produce a lawsuit years out, so retain your consent and call records accordingly.

Can a TCPA lawsuit be filed in small claims court?

Yes, in many states. Because individual TCPA damages run $500 to $1,500 per violation, a single-plaintiff case with a handful of calls often fits inside small claims limits, which range from $2,500 to $25,000 depending on the state. Some serial plaintiffs prefer small claims because defendants often skip hiring an attorney over a small amount and default or settle cheaply. Do not ignore a small claims TCPA summons.

Does the TCPA apply to B2B calls?

Generally no for the Do Not Call provisions, which protect residential subscribers. But the autodialer and prerecorded voice restrictions in 47 U.S.C. § 227(b) apply to any call to a cell number, business use or not. An employee's cell phone that gets an autodialed sales call from your company can still generate a TCPA claim, even if it sits on a business account.

What is the difference between a TCPA suit and an FCC enforcement action?

A private TCPA suit is brought by an individual or class seeking statutory damages of $500 to $1,500 per violation. An FCC enforcement action is brought by the government and can produce forfeiture penalties up to $10,000 per violation with a $1 million cap per act under 47 U.S.C. § 503. Both can run at once; one does not bar the other. FTC actions under the Telemarketing Sales Rule are a third parallel track.

What evidence do I need to defend a TCPA suit?

Your best evidence is documented prior express written consent for the specific number called: an export from your consent platform showing the timestamp, IP address, and exact consent language. You also want call logs showing when contacts happened, opt-out records proving timely removal, DNC scrub certificates, and technical documentation showing your dialer is not an ATDS under Duguid. Missing any of these makes defense harder and far more expensive.

Do arbitration clauses stop TCPA class actions?

They can, but not automatically. A well-drafted arbitration clause with a class action waiver has blocked TCPA class suits in many cases. But courts have voided such clauses when they were unconscionable, when they did not clearly cover tort claims, or when the underlying consent to arbitrate was itself tainted by a TCPA violation. Arbitration clauses cut class risk without being a full shield, and they need careful legal drafting.

Can I be personally liable for a TCPA violation as an individual employee or owner?

Yes. Courts have held individual owners, managers, and employees personally liable when they directly participated in the violating conduct and controlled the campaign. Corporate structure does not automatically protect individuals. This hits small businesses hardest, where the owner personally sets up and runs the dialing. Personal liability claims show up in roughly 10 to 15 percent of contested TCPA suits against small companies.

What does a TCPA demand letter look like and how should I respond?

A TCPA demand letter usually identifies the plaintiff's phone number, lists the dates and approximate times of the allegedly violating contacts, states the number of violations and the calculated damages, and demands a settlement within a short window (often 14 to 30 days). Do not respond yourself. Forward it to a TCPA-experienced attorney right away. Responding without counsel can create admissions or waive defenses.

Is there a way to get a TCPA class action dismissed early?

Yes. The common early exits are: a motion to dismiss for failure to state a claim, often arguing no ATDS was used under Duguid; a motion to strike class allegations before full certification briefing; or an offer of judgment under Federal Rule 68 made to the named plaintiff before certification. If accepted, an individual offer moots the class claims in some circuits, though courts have split on that tactic. Each needs experienced TCPA defense counsel.

What is prior express written consent and how do I document it?

Prior express written consent for autodialed or prerecorded telemarketing calls and texts means a signed written agreement, electronic signatures included, that clearly authorizes contact using an ATDS or prerecorded voice from the specific company to the specific phone number, as required by 47 C.F.R. § 64.1200. Documentation should capture the consumer's name, the phone number, the date and time, the consent language verbatim, the page URL, and the submitting device's IP address.

How do TCPA lawsuits affect my company's insurance coverage?

Many general commercial liability (CGL) policies exclude or limit TCPA claims, often under a "violation of statutes" exclusion. Some carriers offer TCPA-specific endorsements or errors and omissions (E&O) policies that cover regulatory and privacy claims. Read your policy language before a claim arrives, because plenty of companies discover their CGL does not cover TCPA suits only after they have been served. Specialty media liability and technology E&O policies are more likely to include coverage.

What happened to the FCC's one-to-one consent rule for lead generation?

The FCC adopted a one-to-one consent rule in December 2023, effective January 27, 2025, requiring consent to name each specific seller individually rather than a broad list of partners on one lead form. The rule was challenged and the Eleventh Circuit vacated it in January 2025, finding the FCC exceeded its statutory authority. The rule is not in force, but the underlying risk of non-specific consent forms stays live in private litigation. Watch FCC rulemaking for any successor rule.

What are some of the largest TCPA settlements on record?

Some of the largest include Capital One's $75.5 million settlement (2014), Bank of America's $32 million settlement (2014), and DirecTV's $13 million settlement (2017), all over autodialed calls to cell phones without proper consent. More recently, defendants across insurance, retail, banking, and healthcare have settled for $2.5 million to over $70 million. The Joseph Snyder Credit One TCPA case shows how individual litigation can climb through the federal system.

How do I stop receiving robocalls if I've been targeted, and is there a claim?

Register your number on the National Do Not Call Registry at donotcall.gov if you have not already. If autodialed or prerecorded calls keep coming after 31 days, you may have a TCPA claim. Document every call: date, time, calling number, content. File complaints with the FCC and FTC. The how to stop robocalls guide covers both carrier-side tools and the legal options open to consumers.

Sources

1. Cornell Legal Information Institute, 47 U.S.C. § 227 (Telephone Consumer Protection Act): Private right of action, $500 per violation, $1,500 for willful violations, DNC rights, and state AG enforcement authority
2. U.S. Supreme Court, Facebook Inc. v. Duguid, No. 19-511 (2021): An ATDS must have capacity to generate random or sequential phone numbers and dial them; storing and dialing a list alone is insufficient
3. Cornell Legal Information Institute, 47 C.F.R. § 64.1200 (implementing the TCPA): Prior express written consent required for autodialed/prerecorded telemarketing calls and texts; DNC opt-outs must be honored within 30 days
4. FCC / Reassigned Numbers Database Administrator, reassigned.us: The FCC established a Reassigned Numbers Database to help callers identify numbers reassigned to new subscribers and avoid TCPA violations
5. U.S. Court of Appeals, Eleventh Circuit, Insurance Marketing Coalition v. FCC (2025), vacating the FCC one-to-one consent rule: FCC adopted a one-to-one consent rule requiring consent to name individual sellers; the Eleventh Circuit vacated it in January 2025
6. Cornell Legal Information Institute, Federal Rule of Civil Procedure 23, Class Actions: Class certification requirements: numerosity, commonality, typicality, and adequacy of representation
7. Cornell Legal Information Institute, 47 U.S.C. § 503 (forfeiture penalties): FCC base forfeiture for TCPA violations is $10,000 per violation, up to $1 million per act under 47 U.S.C. § 503
8. FTC / FCC, National Do Not Call Registry: Telemarketers must scrub against the National DNC Registry at least every 31 days
9. U.S. Court of Appeals, Ninth Circuit, Wakefield v. ViSalus Inc., No. 20-35827 (2022): Ninth Circuit held courts must consider due process proportionality for aggregate TCPA class action damage awards; $925 million verdict remanded for analysis
10. FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310: FTC's TSR overlaps with TCPA for outbound telemarketing; FTC can bring independent enforcement actions parallel to FCC and private litigation
11. Cornell Legal Information Institute, 47 C.F.R. § 64.1200 (calling time restrictions): Calls before 8 a.m. or after 9 p.m. local time are prohibited under 47 C.F.R. § 64.1200