Last updated 2026-07-09
TL;DR
TCPA compliance in 2026 means getting one-to-one written consent before autodialed or prerecorded calls and texts, scrubbing federal and state DNC lists every 31 days, honoring opt-outs fast, and keeping consent records at least 5 years. Each violation costs $500, or $1,500 if willful, with no cap. Class actions run into the millions.
What is the TCPA and why does it matter for outbound teams in 2026?
The Telephone Consumer Protection Act, codified at 47 U.S.C. § 227, has been federal law since 1991. It restricts autodialed calls, prerecorded voice messages, and text messages to cell phones, plus any call to a residential line using an artificial or prerecorded voice. [1] The FCC enforces it. Private plaintiffs sue under it. The damages run per message: $500 for a negligent violation, $1,500 for a willful one, with no statutory cap on how many violations a single lawsuit can stack. [1]
The risk is not abstract. TCPA class actions settle for real money. UnitedHealthcare paid $2.5 million over alleged TCPA violations. Credit One Bank faced a separate multimillion-dollar settlement. Truist Bank reached a class action settlement on similar claims. These are not fringe outcomes.
Two things make 2026 different. An FCC rule that took effect January 27, 2025 rewrote how prior express written consent works for lead-generation scenarios. And several states have layered their own mini-TCPA statutes on top, with stricter standards. Run your program the way it worked in 2023 and you are very likely out of compliance right now.
What changed with the FCC's one-to-one consent rule?
The one-to-one consent requirement is the biggest shift in recent TCPA history. The FCC's December 2023 Report and Order (FCC 23-107) closed what the agency called the "lead generator loophole." [2] Before the rule, one consent on a comparison shopping site could be sold to dozens of unrelated sellers. That is now prohibited.
Under the rule that took effect January 27, 2025, prior express written consent for autodialed or prerecorded marketing calls and texts had to be given to one seller at a time, topically related to the website where it was collected, and never bundled with consent to unrelated companies. [2]
The FCC's order put it plainly: "a consumer who consents to receive calls from a solar energy company while visiting a solar energy website has not thereby consented to receive calls from auto insurance companies, mortgage lenders, or any other unrelated seller."
So if you buy leads from a third-party generator, you need to confirm the consent form named your company specifically, that the consumer saw your name before clicking, and that the page topic matched your product. Blanket "partner list" consents are dead. Period.
One wrinkle matters. A federal appeals court vacated the one-to-one portion of the FCC order in early 2025, so the rule is not currently enforced as written. [3] But the FCC has signaled it may re-issue similar rules, and plaintiffs' lawyers are already using the one-to-one standard as a litigation benchmark regardless of the vacatur. Treating one-to-one consent as your operating standard is the safer path. Nobody has clean data on how courts will treat borrowed leads in this gap; the conservative read is that vague consent still loses.
What does prior express written consent actually require?
Prior express written consent is the standard required before any autodialed or prerecorded marketing call or text hits a cell phone. The FCC's definition at 47 C.F.R. § 64.1200(f)(9) requires a written agreement (electronic counts) that does three things: [4]
- Clearly authorizes the seller to deliver advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice
- Shows the phone number the signatory is authorizing messages to
- Includes a clear and conspicuous disclosure that the person is not required to sign or agree to messages as a condition of buying anything
That last point trips up teams constantly. If your checkout says "by providing your number you agree to receive marketing texts" and the only way to finish the purchase is to check that box, you have a consent-as-a-condition problem. Keep the marketing checkbox separate from the purchase flow. Make it genuinely optional.
Informational or transactional messages (appointment reminders, fraud alerts, order confirmations) need only prior express consent, the lower standard with no "written" requirement, as long as the message carries no marketing content. One promotional sentence flips an informational text into a marketing one. [4]
Log every consent: timestamp, IP address, the exact language the consumer saw, and the page URL. Store it at least 5 years. In litigation the burden effectively falls on you to prove consent existed.
What counts as an automatic telephone dialing system (ATDS) after Facebook v. Duguid?
In Facebook, Inc. v. Duguid (2021), the Supreme Court narrowed the ATDS definition sharply. The Court held that under 47 U.S.C. § 227(a)(1), the equipment must use "a random or sequential number generator" to store or produce the numbers it dials. [5] A system that dials from a stored list of specific numbers, without generating them randomly, does not meet that definition under the Court's reading.
This matters because a lot of outbound dialers work from uploaded lists. Power dialers, preview dialers, click-to-call systems. Those may not qualify as an ATDS under the federal standard. That shrinks TCPA exposure, but it does not erase it. Prerecorded voice calls and calls to DNC-registered numbers stay restricted even with no ATDS in the picture.
State law is a different animal. Florida's FTSA, Washington's robocall law, and other statutes use broader definitions that can catch list-based dialers. A clean federal reading does not make you clean in every state your prospects live in.
So document your dialing technology carefully. Know whether your system generates numbers randomly or pulls from a stored list. That single distinction shapes your litigation exposure more than almost anything else.
2026 TCPA compliance checklist: the full list by category
Use this as an operational checklist, not a legal opinion. Every item reflects current statute text, FCC rules, or settled litigation patterns as of mid-2026. Have counsel review anything you are unsure about.
CONSENT [ ] Obtain prior express written consent before any autodialed or prerecorded marketing call or text to a cell phone [ ] Consent names your specific company, not a generic "marketing partners" category [ ] Consent is logically related to the page topic where it was collected [ ] Consent is not a condition of purchase [ ] Consent language is clear, conspicuous, and above the submit button [ ] Consent records store timestamp, IP, exact disclosure language, URL, and phone number [ ] Retention period is at least 5 years [ ] Third-party lead consent: verified your company was named on the opt-in page before purchase
DNC SCRUBBING [ ] Registered on the National Do Not Call Registry and paying the annual fee if applicable [6] [ ] Scrub your calling list against the federal DNC registry at least every 31 days [6] [ ] Maintain a company-specific internal DNC list [ ] Honor internal DNC requests within 30 days (federal standard); many state laws require faster [ ] Scrub against state DNC lists where applicable (Florida, Indiana, Texas, and others run their own) [ ] Document every scrub: date, list version, record count
CALLING HOURS [ ] Calls to residential lines only between 8 a.m. and 9 p.m. local time of the called party [1] [ ] Text messages follow the same window; some states are stricter (Florida limits to 8 a.m. to 8 p.m.) [ ] Use the called party's local time zone, not yours
SMS / TEXT MESSAGING [ ] Written consent obtained before any marketing text [ ] Every marketing text includes a clear opt-out mechanism (STOP, UNSUBSCRIBE, or equivalent) [4] [ ] Opt-out requests honored within 10 business days (federal rule); shorter under several state laws [ ] No texts to landlines [ ] Confirm your SMS platform meets current carrier requirements (10DLC registration for A2P messaging) [ ] Review your text message marketing program against both TCPA and carrier rules
ROBOCALLS / PRERECORDED MESSAGES [ ] Prerecorded marketing messages to residential lines require prior express written consent [ ] Emergency or informational calls without marketing content may qualify for the lower consent standard [ ] Identify your company clearly at the start of every prerecorded message [1] [ ] Provide a callback number or opt-out mechanism in prerecorded messages to residential lines
DO-NOT-CALL AND INTERNAL SUPPRESSION [ ] Written DNC policy exists and is available to anyone who asks [6] [ ] Staff trained on the DNC policy annually [ ] Any employee can add a number to the internal DNC list in real time
RECORD KEEPING AND TRAINING [ ] Consent records retained at least 5 years [ ] Call records retained at least 4 years (matches the TCPA limitations period; some states require longer) [ ] Annual compliance training with dated sign-off [ ] Incident log for any consumer complaint about unwanted calls or texts
VENDOR AND LEAD BUYER DUE DILIGENCE [ ] Written contract with each lead vendor specifying consent requirements [ ] Audit clause allowing you to inspect consent records [ ] Indemnification clause if vendor-supplied consent turns out invalid [ ] Spot-check at least 5% of incoming leads against your consent standards quarterly
How does DNC scrubbing work and how often do you have to do it?
The National Do Not Call Registry is run by the FTC. [6] To call consumers for telemarketing, you register your organization (free for exempt callers, fee-based for commercial callers depending on how many area codes you access), then download and scrub against the registry at least every 31 days. [6] That 31-day cycle is a floor. High-volume teams scrub weekly, because a fresh registration takes effect within 31 days of the consumer's request, and calling a freshly registered number is a clear violation.
Federal DNC registration does not cover everything. Calls to business lines are generally exempt (individual business cell phones get trickier). Calls to existing customers within 18 months of the last transaction are exempt. Calls where the consumer gave express prior invitation or permission are exempt. [6] These are real exemptions with real limits. The 18-month clock resets on each transaction, not the first one.
Several states run their own lists. Florida's is maintained by the Florida Department of Agriculture and Consumer Services. Indiana, Texas, Wyoming, and others have similar programs. Call into those states and you scrub their lists separately.
For internal, company-specific DNC, the federal rules give you 30 days to honor a do-not-call request and require you to keep that suppression at least 5 years. [6] Some states, including Florida under the FTSA, expect near-immediate suppression. The safe move is adding the number to your suppression file the same day the request lands.
What are the TCPA penalties in 2026 and how are they calculated?
The TCPA sets $500 per violation for standard violations and up to $1,500 per violation for willful or knowing ones. [1] Each call or text is its own violation. Send 10,000 texts without proper consent and the theoretical exposure is $5 million to $15 million before a class ever gets certified.
Few cases settle at the statutory maximum. But the math makes even small campaigns expensive once consent is missing. The Cash App TCPA class action settlement and the Albertsons/Safeway TCPA settlement both grew out of marketing text campaigns run at scale.
The FCC can also impose civil forfeiture penalties separate from private suits, up to $25,712 per violation as of the 2024 inflation adjustment. [7] That number gets less attention than the $1,500 private right of action, but it bites companies that draw an FCC enforcement letter.
State attorneys general can bring parens patriae actions under the TCPA at $500 per violation on behalf of residents. [1] State mini-TCPAs like Florida's FTSA and Washington's robocall law pile their own penalties on top of the federal exposure.
The single most effective way to cut cost is airtight consent documentation. Courts have dismissed TCPA cases when defendants produced clean, timestamped consent records. The fastest route to a large settlement is a missing or vague consent record paired with high message volume.
| Violation Type | Per-Violation Amount | Who Enforces |
|---|---|---|
| Standard TCPA (private suit) | $500 | Private plaintiff / class |
| Willful TCPA (private suit) | Up to $1,500 | Private plaintiff / class |
| FCC civil forfeiture | Up to $25,712 (2024 adj.) | FCC |
| State AG parens patriae | $500 per violation | State attorney general |
| Florida FTSA (per text) | $500 standard, $1,500 willful | Private plaintiff |
See the latest TCPA news for recent enforcement actions and settlement trends.
What state laws add requirements beyond the federal TCPA?
Federal TCPA compliance is a floor, not a ceiling. Several states passed statutes that go further, and some reach the business-to-business calls the federal law mostly exempts.
Florida Telephone Solicitation Act (FTSA): Florida created a private right of action mirroring the TCPA's $500/$1,500 structure, but it applies to any "telephonic sales call" made with a system that can send texts or calls to multiple people, even from a list. [8] That is broader than the post-Duguid federal ATDS definition. The FTSA also caps calls and texts at 8 a.m. to 8 p.m. local time and demands written consent before any commercial text. Florida is the most active state for TCPA-style litigation.
Washington robocall law (RCW 80.36.390): Washington bars using an autodialer to call cell phones without consent, on a definition closer to the pre-Duguid federal standard. [9] Washington also allows private suits with $500 to $25,000 per violation for commercial robocalls.
California: California has not passed a direct FTSA equivalent, but the California Consumer Privacy Act touches call and text consent through its opt-out rules, and California courts have historically read the TCPA favorably for plaintiffs.
Indiana, Texas, Wyoming: All three maintain state DNC lists you must scrub separately when calling consumers there.
Here is the practical answer. Identify your top 5 states by call volume, then have someone (in-house or outside counsel) map each state's telemarketing statute against your current practices. A one-size approach built on federal law alone will leave gaps.
How should you handle third-party leads and consent verification?
Buying leads is not a TCPA problem by itself. The problem is buying leads where the consent is vague, stale, or never specific to your company. Under the one-to-one consent standard (and the litigation risk that lives on regardless of regulatory status), you are the one responsible for confirming the consent you rely on is valid.
Here is an approach a small team can actually run.
Before you buy from any vendor, ask for a sample opt-in screenshot showing the exact disclosure language, the date and time, and the page URL. If the vendor cannot produce that within 24 hours for a single sample, that tells you what their record-keeping looks like across the whole file.
Next, write a contract clause that pins down four things: consent must meet the prior express written consent standard at 47 C.F.R. § 64.1200(f)(9); your company must be named on the consent form; the vendor must keep consent records for 5 years and hand them over within 72 hours of a request; and the vendor indemnifies you for TCPA claims from invalid consent. Vendors who fight clause four are telling you something.
Then run a random sample of 50 to 100 records from each batch through manual verification. Have someone open the actual consent page using the stored URL and confirm the disclosure was sufficient and your company was named. Do this quarterly.
LeadCompliant's free consent checker can audit the disclosure language on your own opt-in pages before you go live.
Last, track which leads came from which vendor. When a complaint or a demand letter arrives, you need to trace that phone number to a specific consent record from a specific vendor in hours, not days.
What records do you need to keep to defend a TCPA claim?
TCPA litigation almost always turns on records. The plaintiff says they got an unwanted call or text. You either have proof of consent or you do not. Courts have made clear the burden of proving consent sits with the party claiming it. [10]
For every contact you reach by autodialer, prerecorded message, or marketing text, keep:
1. The consent record: timestamp to the second, IP address, phone number, the exact disclosure language shown, and the URL where consent was collected. 2. The dialing record: which number was called, at what time, which system placed the call, and the outcome (connected, voicemail, no answer). 3. The DNC scrub record: the date your list was last scrubbed, the registry version you scrubbed against, and which records got suppressed. 4. Any opt-out requests and the date you actioned them. 5. Any consumer complaints, with the response and resolution.
Retention: keep consent records at least 5 years from the last contact. Keep call detail records at least 4 years, since the TCPA limitations period is 4 years under 28 U.S.C. § 1658 (some states differ). Keep DNC scrub logs at least 5 years. [6]
Store all of it in a format you can actually search. A spreadsheet you cannot query by phone number is close to useless when opposing counsel asks for every communication with a specific number. A CRM or compliance database with indexed phone-number search is the minimum setup worth running.
For teams at risk of litigation or already in it, records in a searchable, exportable format are the difference between a quick dismissal and months of expensive discovery.
What are the SMS-specific rules for 2026?
Text messaging under the TCPA carries every rule that applies to autodialed calls, plus a carrier layer enforced independently of the statute.
On the legal side: any marketing text to a cell phone sent with an autodialer (or, in most state courts, any platform capable of mass sending) needs prior express written consent. Opt-out requests must be honored. The standard opt-out keywords are STOP, QUIT, CANCEL, UNSUBSCRIBE, and END. Your platform should process them automatically. Someone sends STOP, you send another marketing text, that second text is a clean violation with zero ambiguity.
On the carrier side, the CTIA (the wireless carrier trade association) maintains voluntary guidelines that carriers enforce through network filtering. Under 10DLC (10-digit long code) rules that became standard in 2023 and still hold for 2026, A2P (application-to-person) business texting from 10-digit numbers requires registering your brand and each messaging campaign. [11] Unregistered 10DLC traffic gets filtered hard. Shared shortcodes for marketing are basically gone. Dedicated shortcodes still work but cost more.
For text messaging marketing programs, registration means registering your brand with The Campaign Registry (TCR), registering each use case (marketing, alerts, and so on) as its own campaign, and providing sample messages plus the URL where you collect opt-in consent. Approval is not guaranteed and runs 1 to 4 weeks.
The interaction between TCPA consent and 10DLC registration matters. Registration does not substitute for legal consent, and legal consent does not substitute for registration. You need both. A campaign that clears TCR review but lacks valid TCPA consent is still exposed to lawsuits. A campaign with valid consent but no 10DLC registration gets filtered before it reaches anyone.
Honor opt-outs within 10 business days under federal rules, but build your system to process them in minutes. There is no good reason to wait. Waiting only creates a paper trail problem.
How do you build a TCPA compliance program on a small team budget?
Most small outbound teams do not need a dedicated compliance officer. They need a documented process, one accountable owner, and a quarterly review habit. Here is what works without a big budget.
Assign a compliance owner. It does not have to be a full-time job. The ops manager or a senior rep can be the point person for TCPA questions. What matters is that one person owns the checklist and answers for the quarterly review.
Build a consent audit trail from day one. Every platform you use to collect opt-ins should log timestamp, IP, and disclosure text automatically. If yours does not, switch platforms or add a middleware logging layer before you scale. A $30-a-month logging tool is nothing against $500-per-message exposure.
Set a calendar scrub. Block a recurring event on the last business day of every month: scrub your active calling list against the federal DNC registry and any state lists your market touches. Log the date and record count in a plain spreadsheet.
Train your callers twice a year. Thirty minutes covers it: what the TCPA is, calling hours, what to do when a consumer says "don't call me again," and how to report a complaint internally. Everyone signs a dated acknowledgment.
LeadCompliant's free TCPA compliance kit includes a sample consent disclosure template, a DNC scrub log, and a training acknowledgment form. It is a reasonable starting point for teams building from scratch.
Audit your lead vendors once a quarter. Pull a random 50-record sample, verify consent, document the audit. If a vendor fails two audits in a row, stop buying from them.
An honest benchmark: a well-run team under 20 reps can hold a defensible TCPA program for roughly $200 to $500 a month in tool costs plus 3 to 5 hours a month of staff time. That climbs if you buy high volumes of third-party leads. It drops if you call only warm inbound leads where you already have documented consent.
Frequently asked questions
Does the TCPA apply to B2B calls?
Mostly not for calls to business landlines, but the exemptions are narrower than people assume. A call to a business employee's personal cell phone is not automatically exempt just because the purpose is commercial. Florida's FTSA has no B2B exemption at all. And prerecorded voice messages to business lines still require caller identification under FCC rules. If your reps dial personal cell numbers of business prospects, treat those as consumer lines.
What is the statute of limitations for a TCPA lawsuit?
Under 28 U.S.C. § 1658, the general federal catch-all limitations period is 4 years, and most courts apply it to TCPA claims. A plaintiff can sue over a call made up to 4 years ago. Some state mini-TCPA claims run on their own clock; Florida's FTSA also uses a 4-year period. This is why you keep consent and call records at least 4 to 5 years.
Can I send a text without written consent if it's just a one-time confirmation?
A single transactional text (order confirmation, appointment reminder, fraud alert) sent to a number the consumer gave you for that purpose generally needs only prior express consent, not the written form required for marketing. The line breaks the moment you add promotional content. "Your appointment is confirmed. Reply YES to learn about our spring sale" is a marketing text and needs written consent. Keep transactional messages purely informational.
How long does it take for a DNC registration to take effect?
Consumers who register on the National Do Not Call Registry are protected from most telemarketing calls after 31 days. From the date of registration, you have 31 days before calling that number becomes a violation. Once the window closes, the registration is permanent with no expiration. That is why monthly scrubbing is the minimum: the freshest registrations are exactly the ones your last scrub might have missed.
What is 10DLC and do I need it for business texting in 2026?
10DLC means 10-digit long code, the carrier-mandated registration system for A2P business texting from standard 10-digit numbers. If your business sends marketing or automated texts from a local-looking number through a platform like Twilio or Bandwidth, you must register your brand and campaigns through The Campaign Registry. Without registration, carriers filter your messages hard. Registration does not replace TCPA consent; it runs in parallel.
Does texting someone who gave me their number on a paper form count as consent?
Possibly, but paper forms create documentation problems. The FCC's consent regulation allows written consent in electronic or non-electronic form, so a signed paper form can qualify. The trouble is proving the exact disclosure language the person saw and the timestamp. If you use paper opt-ins, scan and store them immediately with a note of the date and context. A form without a date or without visible disclosure language is weak evidence in litigation.
What happens if a lead vendor sold me a number that was on the DNC list?
You are still potentially liable for calling it. TCPA liability largely runs to the caller, not the lead source. You can sue the vendor for indemnification if your contract includes that clause, but the plaintiff can come after you directly regardless. This is why scrubbing every purchased list against the DNC registry before dialing is non-negotiable, even when the vendor certifies the list is clean. Verify it yourself.
Can I call a number the consumer gave me but did not specifically consent to autodialed calls?
If you use an ATDS or a prerecorded voice, you need the right level of consent for that call type. Giving you a number in a general context (filling out a callback request, say) may count as prior express consent for a live-agent informational call. It generally does not count as prior express written consent for autodialed marketing calls. The type of call and the type of consent have to match.
How did Facebook v. Duguid change TCPA exposure for outbound sales teams?
The Supreme Court's 2021 decision narrowed the ATDS definition to systems using random or sequential number generation, not any dialer. Many power dialers and preview dialers that work from uploaded lists may not qualify as an ATDS under this reading, which shrinks federal exposure for those systems. But prerecorded voice rules apply independently of ATDS status, DNC rules apply regardless, and state laws like Florida's FTSA use broader definitions that still reach list-based dialers.
What should my opt-in disclosure language actually say?
At minimum it needs to name your company specifically, state that the consumer agrees to receive autodialed or prerecorded calls or texts (depending on your channel) at the number provided, place the phone number field next to the disclosure, and state that consent is not required to buy anything. Put the disclosure directly above or beside the submit button, not buried in a terms link. Plain-language text outperforms fine print in both audits and litigation.
Are there TCPA exemptions for calls from healthcare providers or nonprofits?
Yes, with limits. The FCC has granted healthcare exemptions for calls delivering urgent health and safety information, subject to conditions. Nonprofits soliciting donations are exempt from National DNC Registry rules but must still honor company-specific DNC requests and cannot use prerecorded messages to cell phones without consent. These exemptions are narrow and conditional. Relying on one without confirming the specific conditions apply to your use case is risky.
What is the difference between the National DNC Registry and a company-specific DNC list?
The National DNC Registry is the FTC-maintained federal list where consumers register to stop most telemarketing calls, and you must scrub it at least every 31 days. A company-specific DNC list is your internal suppression file of people who asked your company specifically to stop calling. Both are required. Someone can be on your internal list but not the national one, and vice versa. Honor both independently.
How do I handle a TCPA demand letter without a lawyer?
Short answer: don't, at least not alone. Demand letters from TCPA plaintiffs' attorneys are almost always the opening move in a settlement negotiation, and responding without counsel can create admissions or waive defenses. Immediately preserve every record tied to the number: consent file, call logs, DNC scrub history, and any opt-out record. Then find a TCPA defense attorney. Many handle demand-letter responses on a fixed fee.
Sources
- Cornell Legal Information Institute, 47 U.S.C. § 227 (TCPA statute text): $500 per violation / $1,500 willful; 8 a.m. to 9 p.m. calling hours; identification requirements for prerecorded messages
- U.S. Court of Appeals for the Eleventh Circuit, Insurance Marketing Coalition v. FCC (2025), vacating one-to-one portion of FCC 23-107: Federal appeals court vacated the one-to-one consent portion of the FCC order in early 2025
- FCC, 47 C.F.R. § 64.1200, Code of Federal Regulations (FCC TCPA implementing rules): Prior express written consent definition including named company, phone number, non-condition-of-purchase requirement; opt-out must be included in marketing texts
- Supreme Court of the United States, Facebook, Inc. v. Duguid (2021), SupremeCourt.gov: ATDS requires equipment that uses a random or sequential number generator to store or produce numbers dialed
- FTC, Complying with the Telemarketing Sales Rule (National Do Not Call Registry guidance): 31-day scrubbing requirement; 18-month existing customer exemption; 30-day internal DNC honor requirement; 5-year suppression retention
- Florida Statutes § 501.059, Florida Telephone Solicitation Act (FTSA): Florida FTSA private right of action $500/$1,500 per violation; 8 a.m. to 8 p.m. calling hours; written consent for texts; broader ATDS definition than post-Duguid federal standard
- Washington State Legislature, RCW 80.36.390, Commercial Telephone Solicitation (Washington robocall law): Washington robocall law prohibits autodialed calls to cell phones without consent using a broader definition; $500 to $25,000 per violation
- FTC, Telemarketing Sales Rule Compliance Guide for Businesses: Burden of proving consent lies with the party claiming it in TCPA/TSR enforcement contexts
- 28 U.S.C. § 1658, Cornell Legal Information Institute (federal statute of limitations): General federal catch-all limitations period of 4 years applies to TCPA claims in most circuits