Last updated 2026-07-10
TL;DR
The Telephone Consumer Protection Act (47 U.S.C. 227) restricts automated calls, prerecorded messages, and text messages to consumers. Violations cost $500 to $1,500 per message. The FCC enforces federal rules, but state attorneys general and private plaintiffs can also sue. Written prior express consent is usually required before contacting a cell phone with an autodialer or prerecorded voice.
What is TCPA law?
The Telephone Consumer Protection Act is a federal statute, codified at 47 U.S.C. 227, that Congress passed in 1991 in response to a wave of unwanted telemarketing calls flooding American homes. The FCC has authority to write the implementing regulations, which now run through 47 C.F.R. Part 64. [1]
The TCPA restricts three categories of contact: autodialed or prerecorded calls to cell phones, prerecorded calls to residential landlines, and unsolicited fax advertisements. Text messages sent en masse are treated as calls under the statute. That is why a single SMS blast without proper consent can trigger the same per-message liability as a robocall. [1]
The law has teeth because it creates a private right of action. Any consumer can sue. Class action lawyers love TCPA cases because each violation is a separate statutory damage claim, and no proof of actual harm is required. That combination, strict per-message damages plus easy class certification, explains why TCPA class settlements routinely run into eight figures.
Who does the TCPA apply to?
The TCPA applies to any person or entity making calls or sending texts with the covered technologies: autodialers (equipment with the capacity to store or produce telephone numbers and dial them without human intervention), prerecorded voice messages, or artificial voice systems. [1]
That definition sweeps in most common sales tools. Cloud-based dialers, ringless voicemail drops, SMS platforms that send bulk messages, and even some CRM-integrated click-to-dial systems have all been argued to qualify as autodialers in litigation. The Supreme Court in Facebook, Inc. v. Duguid (2021) narrowed the autodialer definition to systems that use a random or sequential number generator, which gave some businesses breathing room. But the law is still unsettled enough that most compliance advisors treat any high-volume dialing system as potentially covered. [2]
Hiring third-party lead generators, dialers, or telemarketing agencies does not get you off the hook. The FCC has long held that a company can be vicariously liable for TCPA violations committed by vendors acting on its behalf, if it had apparent authority over the vendor's conduct or ratified it. So if you buy leads from someone who collected them without proper consent, that is your problem too.
What does the TCPA actually prohibit?
The statute has four main prohibitions. First, it bans any call using an automatic telephone dialing system or an artificial or prerecorded voice to a cell phone number without the prior express consent of the called party. [1] Second, it bans prerecorded or artificial voice calls to residential landlines for telemarketing without prior express written consent. Third, it bans calls to numbers on the National Do Not Call Registry unless you have an established business relationship or express written invitation from that consumer. [3] Fourth, it bans unsolicited fax ads.
The consent standard trips up most sales teams. For purely informational or non-marketing calls to a cell phone, prior express consent is enough, and that can be oral or implied by providing the number in the course of a transaction. But for telemarketing calls or texts, the FCC requires prior express written consent: a clear and conspicuous disclosure that the person will receive autodialed or prerecorded calls, plus a signature (including an electronic signature) authorizing them. [4] The consent has to run to the specific seller, more than a generic marketing consent buried in terms of service.
The FCC issued a big rule change effective January 27, 2025. Written consent for marketing calls and texts now has to be obtained on a one-to-one basis. A single consent form can no longer authorize calls from multiple sellers. Each seller needs its own separate consent. [5] That change broke the entire multi-seller lead generation model that had been common in insurance, mortgage, and education verticals.
There is also a time restriction. Telemarketing calls, autodialed or otherwise, cannot be made before 8 a.m. or after 9 p.m. in the recipient's local time zone under both federal rules and most state analogs. [3]
What are the penalties for TCPA violations?
The TCPA sets statutory damages at $500 per violation. Courts can triple that to $1,500 per violation if the defendant willfully or knowingly violated the statute. [1] Each individual call or text is a separate violation. A campaign that sends 100,000 unsolicited texts without proper consent could, in theory, carry $150 million in exposure.
Real settlements back that up. In 2017, Capital One settled a TCPA class action for $75.5 million. [6] Papa John's settled for $16.5 million in 2018 over text marketing claims. Several insurance companies have settled for eight figures over the past five years. None of those were fly-by-night operations. They were established businesses whose consent and dialing practices were not tight enough.
The FCC can also assess forfeitures under 47 U.S.C. 503, separate from the private right of action. State attorneys general can bring suits under 47 U.S.C. 227(g). And states with their own mini-TCPA statutes sometimes layer extra penalties on top of federal liability, which we cover below. [7]
One practical note: many TCPA suits settle before trial, often for a few hundred to a few thousand dollars per plaintiff in small cases. Class actions are the real financial threat. If your contact list has any meaningful size and consent was sloppy, a class action is the vehicle that turns a minor procedural slip into a company-ending event.
What TCPA penalties look like by violation type
The table below summarizes the federal TCPA penalty structure. These are statutory minimums and maximums. Actual settlement values vary based on class size, willfulness, and negotiation.
| Violation type | Base penalty | Treble (willful) |
|---|---|---|
| Autodialed/prerecorded call to cell without consent | $500/call | $1,500/call |
| Prerecorded marketing call to residential line without consent | $500/call | $1,500/call |
| Call to National DNC Registry without consent | $500/call | $1,500/call |
| Unsolicited fax advertisement | $500/fax | $1,500/fax |
| Text message treated as call | $500/text | $1,500/text |
Source: 47 U.S.C. 227(b)(3) and 47 U.S.C. 227(c)(5). [1]
How does TCPA consent work in practice?
Consent under the TCPA is not a checkbox you tick once and forget. It is a specific, documented agreement that has to meet FCC requirements at the moment it is collected, be attributable to the actual person you are calling, and survive until it is revoked.
For telemarketing to cell phones, the FCC requires prior express written consent. That means a written or electronic agreement that: (1) clearly authorizes the specific seller to contact the consumer using autodialed or prerecorded calls/texts; (2) includes the phone number to be contacted; (3) is not a condition of purchasing any goods or services; and (4) clearly discloses that consent is not required to make a purchase. [4] The 2025 one-to-one consent rule adds that the consent has to name the specific seller and cannot bundle multiple companies together. [5]
Consent can be revoked at any time, by any reasonable means. The consumer does not have to use a specific opt-out mechanism. If someone texts STOP, calls in to say stop calling, or emails you to opt out, that revocation is legally effective no matter what your terms say about required opt-out methods. You have a reasonable time to honor it, but the FCC has treated anything beyond a business day or two as potentially problematic.
The established business relationship (EBR) defense is narrower than most people think. It applies mainly to the residential landline DNC rules, not to the cell phone autodialer prohibition. An EBR does not give you blanket permission to robocall someone's cell phone. Many businesses misapply this and end up with exposure they did not expect.
Document everything. If you cannot prove consent with a timestamp, the IP address of the submission, the specific language shown to the consumer, and a record linking that to the phone number you called, you are going to have a very bad day in discovery.
What is the National Do Not Call Registry and how does it connect to the TCPA?
The National Do Not Call Registry, run by the FTC under 16 C.F.R. Part 310 (the Telemarketing Sales Rule), is separate from but closely tied to the TCPA. The TCPA at 47 U.S.C. 227(c) and the FCC's rules at 47 C.F.R. 64.1200(c) require telemarketers to honor the Registry and to keep their own internal do not call lists. [3]
Registered numbers cannot be called for telemarketing unless the caller has an existing business relationship with that consumer (a transaction or inquiry within the prior 18 months, or an inquiry within the prior 3 months), or has the consumer's prior express written invitation or permission. [3]
Businesses have to scrub their call lists against the Registry before each campaign. The FTC charges for access to Registry data above the first 5 area codes, though this is a modest operational cost. [8] The practical risk: if you fail to scrub and call a registered number, that is both an FTC and an FCC/TCPA violation, and the private right of action under 47 U.S.C. 227(c)(5) lets the consumer sue you for $500 per call.
You also have to keep your own internal DNC list and honor opt-out requests from people who never registered with the federal list. Many businesses do not realize the internal DNC obligation exists separately from the national registry.
Are there state TCPA laws that add requirements on top of federal rules?
Yes. The federal TCPA is a floor, not a ceiling. States pass their own telemarketing and robocall statutes that stack extra requirements on top of federal law, and some are considerably stricter.
California has several relevant statutes. The Automatic Telephone Dialing Systems Act (California Public Utilities Code sections 2871-2876) and the California Consumer Privacy Act (CCPA) both affect outbound calling and texting programs. California's call recording rules add another dimension: it is an all-party consent state, so you must inform all parties before recording a call. [9] Florida's Telephone Solicitation Act, amended in 2021 (Florida SB 1120), applies to calls using an autodialer or prerecorded message and carries per-call penalties of $500 to $1,500 that stack on top of federal damages. [10] Florida's law also reaches intrastate calls that the federal TCPA might not touch as cleanly.
State TCPA laws and analog statutes vary enough that a national calling program has to be built for the strictest applicable state, more than federal minimums. Texas, Washington, Indiana, Maryland, and Pennsylvania each have their own telemarketing or consumer protection provisions that touch call recording, consent, and solicitation restrictions. telephone-call-recording-laws
For call recording specifically, whether you are in a one-party or all-party consent state changes your obligations for any recorded outbound sales call. States like Maryland, Pennsylvania, and California require all parties to consent to recording, while federal law and many other states only require one party to know about it. is-it-against-the-law-to-record-phone-calls If your team records calls, you need the consent rules for every state where your prospects live, more than where your office sits. recorded-phone-call-laws
How do the 2024-2025 FCC rule changes affect TCPA compliance?
The FCC issued two major rule changes every outbound sales team needs to know.
First, the one-to-one consent rule. In December 2023, the FCC adopted rules requiring that prior express written consent for telemarketing calls and texts go directly to the specific company making the contact, not through a lead generator consent form that bundles multiple companies. The rule took effect January 27, 2025. [5] The FCC's order said consumers must consent to calls from "a single identified seller" at a time, and the consent must be logically and topically related to the website where it was collected. That ended the common practice of a single web form consent covering dozens of insurance, mortgage, or education companies.
Second, the FCC tightened the rules around AI-generated calls. In February 2024, the FCC declared that AI-generated voices in calls are "artificial" voices under the TCPA, so they need the same prior express written consent as any other prerecorded or artificial voice call. [11] That ruling covered voice cloning and AI voice synthesis, more than traditional prerecorded audio.
If your lead acquisition or calling program relied on shared or aggregated consent forms before January 2025, audit your consent collection now. Continuing to call leads under pre-2025 shared consent is not a gray area anymore.
LeadCompliant's free consent checker and compliance kit can help you audit what your current consent forms actually capture and whether they meet the one-to-one standard.
What exemptions exist under the TCPA?
The TCPA has several exemptions, though none are as broad as businesses tend to hope.
Calls made for emergency purposes are exempt. These include calls to 911 or calls from public safety agencies. That exemption does not help commercial callers.
Calls made solely to collect a debt owed to or guaranteed by the United States government are exempt from the cell phone autodialer prohibition, but not from the National DNC rules. Congress added this exemption in 2015. It survived partial Supreme Court review in Barr v. American Association of Political Consultants (2020), though the Court's opinion had complicated implications. [12]
Purely informational, non-telemarketing calls or texts sent with prior express consent (not the higher written consent standard) also have a narrower path. Think appointment reminders, package delivery notifications, and bank fraud alerts. The FCC's rules define these as messages that do not include or introduce an advertisement. The moment an informational message adds a promotion, upsell, or solicitation, it loses the lower consent standard.
Nonprofits calling on behalf of the organization's charitable activities have some added flexibility, but that exemption does not cover commercial fundraising calls made by a for-profit telemarketer on behalf of a charity. Political calls (not for commercial purposes) have historically had more latitude, though state laws sometimes restrict them more.
None of these exemptions cover a standard B2B or B2C outbound sales program. If you are selling something and using an autodialer or prerecorded message to cell phones, you need consent.
What should an outbound sales team actually do to comply with the TCPA?
Compliance is not complicated in theory. The hard part is execution at scale and keeping documentation tight enough to survive a plaintiff's lawyer in discovery.
Start with your consent collection. Every lead source needs a documented consent chain: where the consumer provided their number, what disclosure language they saw at that moment, and proof they affirmatively agreed. Under the post-January 2025 rules, that consent has to name your company specifically. A screenshot of the opt-in form, the timestamp, and the IP address are the minimum viable record. [5]
Scrub your lists before every campaign. Use the National DNC Registry, your internal DNC list, and any state-specific do not call lists that apply to your geography. Wireless number scrubbing (to flag cell phones) is also smart before any prerecorded campaign.
Set your calling hours to 8 a.m. to 9 p.m. in the called party's local time zone, not yours. If you are in California calling someone in New York, New York's time zone governs. [3]
Handle revocations immediately. Build a process that flags opt-outs from any channel (text STOP, phone request, email) and suppresses that number within 24 hours across every calling and texting system you run.
Audit your dialing technology. Know whether your system meets the Facebook v. Duguid definition of an autodialer, or could be argued to. [2] Even if you believe your system is not covered, the cost of litigation to prove that point is high enough that treating it as covered is usually the smarter operational call.
For state-specific call recording obligations, check whether your prospect's state requires all-party consent. Texas, for example, is a one-party consent state for call recording texas-call-recording-laws, while Pennsylvania requires all parties to consent pa-call-recording-laws. New York and Maryland have their own nuances new-york-call-recording-law that matter for any recorded sales conversation.
LeadCompliant's compliance kit covers the core documentation templates and a state-by-state consent and recording reference. Use it as a starting checklist. It does not replace a real attorney for high-volume programs.
This article is for general informational purposes only and is not legal advice. For compliance decisions affecting your business, consult a licensed attorney.
How does TCPA enforcement actually happen?
Most TCPA enforcement is private litigation, not government action. The private right of action means any consumer who receives a violating call or text can sue without proving actual damages. That makes the TCPA the favorite tool of class action plaintiffs' firms.
A typical case starts when a consumer receives a call or text they did not consent to, or keeps getting messages after opting out. They contact a plaintiffs' firm. The firm sends a preservation letter and subpoenas call records. If the records show a pattern, it becomes a class action. Class certification under the TCPA is often easier than in other areas because the statutory violation is common to all class members and damages are fixed by statute.
The FCC can bring enforcement actions for violations of its rules, and state attorneys general can bring parens patriae suits on behalf of state residents. [7] But the volume of private litigation dwarfs government enforcement. The FCC's forfeiture proceedings tend to target the big fish: robocall operations running millions of illegal calls, or companies that ignored prior warnings.
One thing worth knowing: the TCPA has a four-year statute of limitations under 28 U.S.C. 1658 for claims based on the autodialer and prerecorded voice prohibitions. Consumers can also bring state law claims with different limitation periods. So calls you made three years ago can still land you in court today if the consent records from that period are weak.
Frequently asked questions
What is TCPA law in simple terms?
The Telephone Consumer Protection Act (47 U.S.C. 227) is a federal law that limits how businesses can contact consumers by phone or text. It requires prior written consent before using an autodialer or prerecorded message to reach a cell phone for marketing purposes. Violations cost $500 to $1,500 per call or text, with no proof of harm required for a consumer to sue.
Does the TCPA apply to text messages?
Yes. The FCC and courts treat text messages as calls under the TCPA. A mass SMS sent without proper prior express written consent to a cell phone is treated identically to an autodialed voice call. Each individual text message is a separate violation, which is why bulk SMS campaigns without consent carry massive class action exposure.
What is prior express written consent under the TCPA?
Prior express written consent is a documented, affirmative agreement by the consumer to receive autodialed or prerecorded marketing calls or texts from a specifically named seller. The consent must not be required as a condition of purchase, must include the consumer's phone number, and must disclose that consent is not required to buy anything. After January 27, 2025, it must identify one seller at a time.
What counts as an autodialer under the TCPA?
After Facebook, Inc. v. Duguid (2021), the Supreme Court held that an autodialer must use a random or sequential number generator to store or produce numbers to dial. Systems that only dial from a stored list without random or sequential generation may not qualify. However, litigation over what systems meet this definition is ongoing, and most compliance advisors recommend treating any high-volume dialing platform as potentially covered.
Can a consumer sue for TCPA violations without any actual damages?
Yes. The TCPA creates a private right of action with statutory damages of $500 per violation, regardless of whether the consumer suffered any actual financial harm or distress. Courts can triple damages to $1,500 if the violation was willful. This no-harm-needed standard is what makes TCPA class actions so common and so financially dangerous for businesses.
How long do consumers have to file a TCPA lawsuit?
For federal TCPA claims based on the autodialer and prerecorded voice prohibitions, the statute of limitations is four years under 28 U.S.C. 1658. This means a consumer can sue over calls or texts received up to four years ago. Some state law claims filed alongside TCPA claims may have different limitation periods depending on the state.
Does the TCPA apply to B2B calls?
The TCPA's cell phone autodialer restriction applies to any call to a cell phone number regardless of whether it is a personal or business number. The National DNC rules primarily protect residential subscribers, so B2B cold calls to landlines get somewhat more latitude. But if you are calling a businessperson's cell phone using an autodialer or prerecorded message, the TCPA applies.
What are the TCPA calling hour restrictions?
Telephone solicitations may not be made before 8 a.m. or after 9 p.m. in the called party's local time zone. This restriction applies under both the FCC's TCPA regulations at 47 C.F.R. 64.1200(c)(1) and the FTC's Telemarketing Sales Rule. The relevant time zone is the recipient's, not the caller's, so a team calling across time zones must account for where each prospect is located.
Do state tcpa laws differ from federal TCPA requirements?
Yes. Federal TCPA rules are a floor. States like Florida, California, Washington, and Texas have their own telemarketing, robocall, and call recording statutes that can impose stricter requirements or additional penalties. Florida's 2021 Telephone Solicitation Act, for example, adds state-level per-call penalties on top of federal TCPA damages. A national calling program must be designed to the strictest applicable state standard.
What happens if a consumer revokes TCPA consent?
Consent revocation is effective immediately by any reasonable means. A consumer can say stop calling on a phone call, reply STOP to a text, or send an email. You do not have to honor only the opt-out method specified in your terms. The FCC has indicated that revocations should be honored within a reasonable time, generally interpreted as no more than one business day, across all channels and systems.
What changed in the FCC's 2025 TCPA rules?
The FCC's one-to-one consent rule took effect January 27, 2025. It requires that written consent for marketing calls and texts identify a single named seller and be logically related to the website where it was collected. A single lead generation form consent can no longer cover multiple companies. Each company needs its own specific consent from the consumer before contacting them.
Is there a TCPA exemption for established business relationships?
A limited one. The established business relationship (EBR) exemption applies primarily to the residential landline National DNC rules, not to the cell phone autodialer prohibition. An EBR does not give you permission to autodial or prerecorded-message someone's cell phone without written consent. Many businesses misapply this and assume an EBR covers all contact. It does not.
What records should a business keep to defend a TCPA claim?
Keep the consent form text shown to the consumer at the time of opt-in, the timestamp, the IP address, the specific phone number submitted, and which seller was identified. For DNC compliance, keep scrub logs showing your lists were checked against the National Registry before each campaign. Store revocation records with timestamps. These are the documents a plaintiff's lawyer will demand first in discovery.
Can AI-generated voices trigger TCPA liability?
Yes. In February 2024, the FCC declared that AI-generated or voice-cloned calls qualify as artificial voice calls under the TCPA. This means the same prior express written consent requirements that apply to prerecorded calls apply to AI voice calls. Using an AI voice to make outbound sales calls without consent carries the same $500 to $1,500 per-call exposure as any other prerecorded message violation.
Sources
- U.S. Congress, 47 U.S.C. 227 - Telephone Consumer Protection Act (Office of the Law Revision Counsel): TCPA statutory damages of $500 per violation, trebled to $1,500 for willful violations; prohibition on autodialed/prerecorded calls to cell phones without prior express consent
- Supreme Court of the United States, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): Supreme Court held autodialer must use random or sequential number generator to store or produce telephone numbers to dial
- FCC, 47 C.F.R. Part 64 - Miscellaneous Rules Relating to Common Carriers (eCFR): FCC rules prohibiting telemarketing calls before 8 a.m. or after 9 p.m. in called party's local time; National DNC obligations for telemarketers
- FTC, Cases and Proceedings (telemarketing and TCPA enforcement records): Capital One settled a TCPA class action for $75.5 million in 2017 over autodialed calls
- FTC, National Do Not Call Registry: FTC charges fees for access to National DNC Registry data above the first 5 area codes; telemarketers must scrub lists against the Registry
- California Public Utilities Code, Sections 2871-2876 - Automatic Telephone Dialing Systems Act (California Legislative Information): California's Automatic Telephone Dialing Systems Act imposes state-level restrictions on autodialed calls in addition to federal TCPA requirements
- Florida Legislature, Florida Telephone Solicitation Act - SB 1120 (2021), F.S. 501.059: Florida's 2021 Telephone Solicitation Act imposes per-call penalties of $500 to $1,500 stacking on top of federal TCPA damages for autodialed or prerecorded calls
- Supreme Court of the United States, Barr v. American Association of Political Consultants, 591 U.S. 610 (2020): Supreme Court addressed government-debt collection exemption to TCPA cell phone autodialer prohibition; Congress added exemption in 2015 Bipartisan Budget Act