How to stop TCPA violations when reps go off script

Last updated 2026-07-10

Why do reps go off script and why does it create TCPA liability?

Reps deviate for predictable reasons. Quota pressure. A prospect who sounds friendly and engaged. A supervisor who informally signals that closing matters more than compliance. Boredom with a script they've read five hundred times. None of that matters to a plaintiff's attorney. What matters is that your company made the call or sent the text.

The Telephone Consumer Protection Act, 47 U.S.C. § 227, imposes liability on the person or entity that initiates a call or text message to a cell phone using an automatic telephone dialing system or an artificial or prerecorded voice without prior express written consent ^[1]. The FCC's 2012 order tightened that requirement to written consent specifically for telemarketing calls and texts ^[2]. The statute holds the company liable even when the rep acted against explicit instructions. Courts have found vicarious liability where a company had the right to control the manner of the rep's work, even if it never exercised that control on a given call ^[3].

So when a rep calls a number twice after a do-not-call request, texts a personal cell from their own phone app, or pitches a product they aren't authorized to mention, the exposure lands on your company. The statute sets statutory damages at $500 per violation and up to $1,500 per willful violation, with no individual-call cap and no ceiling on class size ^[1]. A class of 10,000 people who each got one unauthorized text means $5 million to $15 million in exposure before you've paid a lawyer.

What specific off-script behaviors actually trigger TCPA claims?

Not every departure from script is a TCPA problem. A rep who improvises a closing line or changes up the small talk isn't your legal risk. The behaviors that generate real claims fall into a short list.

Calling or texting a number on the National Do Not Call Registry without a valid established business relationship or express invitation is a distinct violation under 47 U.S.C. § 227(c) ^[1]. Reps who pull personal contacts, redial numbers a prospect gave them informally, or bypass your dialer to use their personal phones create exactly this problem. See our coverage of the do not call list and who can legally appear on it.

Calling a cell phone with an autodialer or prerecorded message without prior express written consent is the core § 227(b) claim. Reps go off script here when they manually add a number to a campaign it wasn't scrubbed for, override a suppression flag because the contact "asked them to call back," or use a dialer feature that qualifies as an ATDS for a number that only had verbal consent.

Continuing to call after a stop request is its own category. The TCPA requires companies to honor do-not-call requests within 30 days and maintain internal DNC lists ^[4]. A rep who hears "don't call me again" and ignores it, or who records the request but never logs it, has handed the plaintiff everything they need. The FCC has confirmed this obligation applies to oral requests as well as written ones ^[2].

Texting from personal devices or unregistered short codes rounds out the list. When a rep sends a sales text from a personal number because it feels less formal, that text may still be attributed to the company under agency theory, and it skips every piece of consent-verification infrastructure you built.

Behavior	TCPA section	Per-violation exposure
Calling DNC-registered number	§ 227(c)	$500, $1,500
ATDS/prerecorded call to cell without consent	§ 227(b)	$500, $1,500
Ignoring stop/DNC request	§ 227(c) + FCC rules	$500, $1,500
Unauthorized text from personal device	§ 227(b)	$500, $1,500
Calling outside 8am, 9pm local time	FCC 47 CFR § 64.1200	$500, $1,500

How much does a single off-script TCPA violation actually cost?

The statutory floor is $500 per call or text, and courts can award up to $1,500 when the violation was willful or knowing ^[1]. That sounds manageable for one call. It stops sounding manageable fast.

Class actions are the real threat. Plaintiff's firms aggregate TCPA claims because the math works for them at scale. The Cash App TCPA class action settlement resolved for $7.5 million read more about the cash app tcpa class action settlement. The Credit One TCPA settlement reached $12.5 million see the credit one tcpa settlement breakdown. Both involved systemic patterns that likely started with individual reps or processes nobody caught early enough.

Even solo plaintiff cases are expensive. Defense costs for a single TCPA case run roughly $50,000 to $150,000 before settlement, based on litigation cost estimates reported in legal industry publications. Settlement pressure is high because statutory damages stack. A plaintiff who got 20 unauthorized calls has a $10,000 to $30,000 claim before attorneys' fees, which makes settling cheaper than litigating even if you'd probably win.

The FCC can also pursue civil forfeitures for TCPA violations, though most enforcement against small companies comes through private suits rather than agency action ^[2]. State attorneys general have concurrent enforcement authority, and some states layer additional per-violation penalties on top of the federal floor.

What should a compliant outbound call script actually contain?

A compliant script is not a sales script with a legal disclaimer bolted on at the end. It's a structured document with hard stops, required disclosures, and branching paths for specific consumer responses.

Every outbound script should open with the caller's name, the company name, and the reason for the call before any sales content. This isn't just good manners. The FTC's Telemarketing Sales Rule at 16 CFR § 310.4 requires prompt disclosure of the seller's identity for telemarketing calls ^[5]. The FCC mirrors this for prerecorded messages under 47 CFR § 64.1200.

The script needs a hard-stop branch for any DNC request. When a consumer says any variation of "don't call," "remove me," "stop calling," or "take me off your list," the rep has one required action: acknowledge it, log it, end the call. The script should say exactly that, word for word, so the rep isn't improvising. Some teams use a color-coded cue in their scripting software, red text that reads "STOP. Log DNC request now. Do not continue pitch."

Consent confirmation should appear before any sensitive data collection or upgrade offer. If your record shows a prospect opted in for Product A, the rep should not pitch Product B without a new consent conversation, because the FCC's 2012 rules require consent specific to the seller and the message type ^[2].

Time-of-call compliance belongs at the system level, not the script level. Your dialer should refuse to connect calls outside 8am to 9pm in the consumer's local time zone per 47 CFR § 64.1200(c) ^[4]. If a rep is manually dialing, the script should carry a required checkbox: "Have you confirmed the contact's local time zone and that it is between 8am and 9pm?" That sounds excessive until you're explaining to a judge why someone got a call at 7:30am.

Version control matters. Keep a dated archive of every script version, because in litigation you'll need to show what the rep was supposed to say on a specific date. Google Docs with version history, or any similar setup, works fine.

How do you monitor calls to catch off-script behavior before it becomes a lawsuit?

Call recording is table stakes. Every outbound call should be recorded, stored for at least four years (the TCPA statute of limitations is four years under 28 U.S.C. § 1658), and searchable by rep and phone number. Four years sounds like a lot of storage, but compressed audio files are small and cloud storage is cheap. Skip this and you create a documentation gap that courts notice.

Random and targeted call audits work better than most managers expect. Audit 5 to 10 percent of calls per rep per week, flag every call that later drew a complaint, and you catch patterns before they compound. Targeted audits should hit your highest-volume reps, reps new to a campaign, and reps with prior compliance flags.

Speech analytics software can automate this at scale. Tools like CallMiner, Verint, or similar platforms scan transcripts for missing required phrases (company name disclosure, consent confirmation) and for prohibited phrases (pressure tactics that suggest a rep is working around an objection instead of honoring a stop request). They don't replace human review, but they make human review manageable for teams that can't listen to every call.

Real-time whisper coaching is underused. Some dialers let supervisors listen live and send text prompts to the rep's screen without the consumer hearing. This is most useful in the first 30 days a rep works a new script or campaign. A supervisor who can push "LOG DNC REQUEST NOW" to a rep's screen the moment a consumer pushes back has intercepted a violation before it's complete.

Coordinate your monitoring with your cold calling policy so reps understand what supervisors listen for. Ambiguity about what's monitored creates the wrong incentives.

How do you build a consent verification process that survives rep error?

The best consent controls don't depend on the rep remembering to check. That means system-level gates, not policy-level reminders.

Your dialer or CRM should block outbound calls to any number that hasn't passed a current consent check. "Current" means a timestamped record of opt-in, specific to the campaign type and the company name, that hasn't been revoked. If a rep tries to manually dial a number outside the dialer, that call skips all your consent infrastructure. This is why personal device dialing should be prohibited in your acceptable-use policy, in writing, with a signature from every rep.

Consent records belong attached to the contact record, not stored in a separate spreadsheet. When a rep pulls up a contact, consent status should be visible without clicking through menus. If it takes more than two clicks to see, reps will skip checking. Make it visible.

For inbound-originated consent (where a consumer fills out a web form), capture the IP address, timestamp, and the exact disclosure language the consumer saw at opt-in. The FCC's 2012 TCPA order requires consent be "clearly and conspicuously" disclosed and that the consumer's agreement not be a condition of purchasing any goods or services ^[2]. If your lead vendor can't provide that documentation, that vendor's leads are a liability.

Re-consent cadences matter. If a consumer opted in 24 months ago and hasn't touched your company since, that prior express written consent may be stale depending on your state's laws and your campaign type. The FCC hasn't set a statutory expiration date for consent, but courts have weighed long dormancy periods when deciding whether consent was truly "prior" and specific. A practical rule: re-confirm consent after 18 months of inactivity.

The mobile phone do not call list question comes up constantly here. Cell numbers have been registerable on the National DNC Registry since 2003, and your consent process should scrub against the registry even when you hold a consent record, because consumers can register after they opt in with you.

What training actually changes rep behavior, and what wastes time?

Annual compliance training is mostly theater. Reps sit through it, click the acknowledgment screen, and forget most of it within a month. That doesn't mean you skip it (you need documentation that training happened), but it should not be your primary control.

What changes behavior is consequence visibility and immediate feedback. If a rep knows that a specific call they made last Tuesday got flagged, reviewed, and turned into a coaching conversation, the loop is tight enough to matter. Abstract statements about TCPA liability are easy to discount. A supervisor playing back a clip of your own call and saying "here's exactly where you should have stopped" is not.

Certification on consent rules before a rep dials a new campaign beats recurring general training. When a rep is about to work a new list or product, a 10-minute campaign-specific briefing covering the consent basis for that list, the DNC handling for that campaign, and any state rules (California's CCPA touches consent records; Florida's mini-TCPA adds its own restrictions) does more than a once-a-year webinar.

Role-playing DNC scenarios is uncomfortable and effective. Have reps practice the exact words they use when a consumer says "remove me" mid-pitch on a product they believe in. The temptation to say "I just want to share one more thing" before logging the request is real, and rehearsing the hard stop in a safe room reduces it.

Written attestation that reps have read and understood the acceptable-use policy, the script, and the DNC procedure should exist for every rep before their first dial. That documentation protects you in litigation. It also signals seriousness in a way a Slack message never will.

What internal DNC list process stops repeat calls to people who asked to opt out?

The FCC requires companies to maintain an internal do-not-call list and honor requests within 30 days ^[4]. That's the legal minimum. In practice, 30 days is too slow for a team making hundreds of calls a day, because your dialer can re-contact the same number several times before a manually entered DNC request works through your system.

A real-time internal DNC process means the moment a rep logs a stop request, that number is suppressed from all outbound queues within minutes, not days. This requires your CRM's DNC flag to integrate directly with your dialer's suppression list. If those are separate systems with a nightly sync, you carry a 24-hour window of re-contact risk every time a request comes in.

Keep your internal DNC list separate from the National Registry scrub, because they cover different obligations. The National Registry covers consumers who registered with the FTC, and you must scrub against it within 31 days of a registration ^[4]. Your internal list covers consumers who told your company specifically to stop, and that obligation is immediate and permanent. See our guide on the do not call telemarketer list for how these interact.

Honoring DNC requests across all product lines is a common gap. If a consumer asks to be removed from calls about Product A, they've likely opted out of contact from your company generally, more than one campaign. Silo your DNC lists by campaign and a rep on a different campaign can call the same number the next day. Courts have not been sympathetic to that defense.

Audit your internal DNC list quarterly. Confirm that numbers are actually suppressed in the dialer, that old numbers aren't aged out too early, and that the list is accessible to every team that dials.

What discipline policy creates the right incentives without creating legal risk?

Your discipline policy for TCPA non-compliance needs to be written, consistently enforced, and proportional. Those three things together build the paper trail that shows a court you had real controls, not paper ones.

A tiered structure works better than zero tolerance for most teams. A first verified violation (confirmed by call recording) earns a documented written warning and mandatory campaign-specific retraining before the rep returns to that campaign. A second violation within 12 months triggers removal from outbound dialing pending a compliance review. A third violation, or any single violation that looks intentional (a rep who manually dials a number they knew was flagged), justifies termination. Having this in writing and applying it consistently is what separates "we had a policy" from "we controlled our agents."

Watch for incentive structures that quietly reward off-script behavior. If your comp plan pays heavily on connects or pitches, reps have a financial reason to call numbers they know are risky. Pay on compliant dispositions (calls that finished without a DNC request or complaint) and you align the money with the compliance behavior. It's not perfect, but misaligned incentives show up as a documented driver of TCPA violations in class action discovery.

Document every compliance coaching session, more than formal discipline. When a supervisor catches a near-miss and coaches a rep informally, that note in the rep's file is evidence of active monitoring. A company that can produce 18 months of coaching notes showing it caught and corrected behavior sits in a very different litigation posture than one that can only produce its written policy.

LeadCompliant's compliance kit includes a pre-built rep attestation form and a tiered discipline policy template if you want a starting point to adapt to your team.

How do state mini-TCPA laws change what you need to do?

Several states have passed laws stricter than the federal TCPA, and off-script behavior can trigger state liability even when it might fall inside a federal gray area.

Florida's Telephone Solicitation Act, amended in 2021, restricts automated calls and texts in ways that go beyond the federal statute and has generated heavy private litigation ^[6]. Florida requires explicit prior express written consent for automated calls and texts and does not recognize an established business relationship exemption the way federal rules do. Any rep calling Florida numbers who improvises on consent faces dual exposure.

California's consumer privacy laws (CCPA and CPRA) add a consent and data-handling layer that interacts with TCPA compliance. If a consumer exercises a right to deletion under CCPA and your team doesn't remove that number from your calling list, a later call creates potential liability under two separate frameworks ^[7].

Washington, Oklahoma, and a growing list of other states have enacted or considered their own telephone solicitation restrictions with varying consent standards and per-violation penalties. The practical upshot: a script that's compliant in Texas may not be compliant in Florida, and a rep working a mixed-state list with a single script is a risk vector.

State-specific script branches, or separate campaign builds for high-liability states (Florida, California, Washington), are the cleanest fix. It adds operational complexity but removes the ambiguity that makes reps guess wrong. Your cold call policies should reflect the strictest state law applicable to your calling territory.

What's the right process checklist before a rep dials a new list?

Pre-dial process is where most small teams have the biggest gaps. The list arrives, the campaign starts, and the compliance checks happen after the first complaints roll in. Here's what the process should actually look like.

First, verify the list source and consent basis. Who collected these leads? What disclosure language did consumers see? Can you get documentation of the opt-in? If the answer to any of these is "we're not sure," the list should not be dialed until you are sure.

Scrub the list against the National DNC Registry. The FTC charges $70 per area code per year for registry access, capped at $19,682 for all U.S. area codes as of 2024 ^[8]. You must scrub within 31 days of the scrub date, so a list scrubbed 35 days ago needs a fresh scrub before dialing. See the how do I get the do not call list article for access steps.

Scrub against your internal DNC list. This is separate from the National Registry scrub and should happen right before the list loads into the dialer.

Confirm time-zone data for every number. Your dialer should assign local time zones and enforce the 8am-to-9pm window automatically. If it can't, verify time zones manually and build calling windows into your campaign schedule.

Confirm that the script approved for this campaign matches the consent basis of the list. If the list has consent for informational calls and the script is a sales pitch, you have a mismatch to resolve before dialing.

Have a supervisor sign off on all five checks before the campaign goes live. That sign-off is a document. That document is evidence.

For teams doing text message marketing, add a sixth check: confirm your SMS platform is properly registered (10DLC for application-to-person messaging) and that the consent record explicitly covers SMS contact, more than phone calls. SMS consent and voice consent are separate under the FCC's rules.

How do you respond when a rep's violation has already happened?

The violation happened. The recording exists. Maybe a complaint came in, maybe you caught it in an audit. Here's the response sequence.

Preserve everything immediately. The call recording, the contact record, the consent documentation, the rep's call log for that day, the dialer's call detail records. Litigation holds aren't only for large companies. If a complaint turns into a lawsuit, spoliation of evidence (even accidental deletion under a normal retention schedule) can produce adverse inference instructions that hurt you in court. Pause your normal deletion process for anything touching that call.

Document what happened factually, without legal characterization, in an internal incident report. Write what the rep did, what the script said, and where the gap was. Do not write "this was a TCPA violation" or any legal conclusion in the internal document, because that document may be discoverable. Write facts.

Contact your attorney before responding to any plaintiff demand letter. TCPA demand letters sometimes arrive fast after a complaint, because plaintiff's attorneys monitor complaint patterns. A demand letter is a negotiation opener, not a court order. The response strategy depends on the number of potential claimants, the nature of the violation, and what your consent documentation looks like.

Fix the process gap that allowed the violation, and document the fix. Courts and regulators are more sympathetic to companies that show they caught a problem and changed course. The fix should be specific. Not "we retrained the rep" but "we added a real-time suppression integration between our CRM and dialer, effective [date], that keeps any number flagged for DNC out of the dialer queue."

If you want a structured framework for the pre-dial process and rep attestation forms, the free compliance kit at LeadCompliant covers both and is built around the actual FCC guidance in 47 CFR § 64.1200 ^[4].

Frequently asked questions

Can a company be liable for a TCPA violation if the rep acted against company policy?

Yes. Courts have found companies vicariously liable for rep violations under agency theory when the company had the right to control the rep's work, even if it never exercised that control on a specific call. A written policy helps, but it doesn't eliminate liability on its own. You need documented enforcement of the policy, call monitoring, and evidence that you actually caught and corrected violations, more than prohibited them on paper.

How long do I need to keep call recordings to protect against TCPA claims?

The TCPA statute of limitations is four years under 28 U.S.C. § 1658. Keep recordings for at least four years from the date of the call. Keep consent records for at least four years from the date the contact was last active in your system. Some attorneys recommend five years to account for late-discovered claims. Storage costs are low enough that erring on the longer side is worth it.

What counts as an established business relationship under the TCPA?

An established business relationship (EBR) allows calls to National DNC-registered numbers in limited cases. For the federal TCPA, an EBR exists if the consumer made a purchase within the prior 18 months, or an application or inquiry within the prior 3 months. An EBR does not override the obligation to honor a specific do-not-call request, and some states (notably California and Florida) have narrowed or eliminated the EBR exemption entirely.

Can I use a rep's personal cell phone for outbound sales calls?

No, not without serious controls. A personal cell used for sales calls can still create company liability under agency theory, and it bypasses your consent verification, DNC scrubbing, call recording, and dialer suppression entirely. Your acceptable-use policy should explicitly prohibit personal device dialing for business sales activity, require reps to sign that policy, and explain why it matters. Personal device calls are also nearly impossible to audit.

What should I do when a consumer says 'don't call me again' during a call?

Acknowledge the request immediately, stop the pitch, and log the number as do-not-call before the call ends. The FCC requires companies to honor oral DNC requests, more than written ones. The 30-day grace period in the regulations is for operationalizing suppression in your systems, not a window to make more calls. Script a specific response so reps don't improvise: 'Understood. I'll remove this number right now. Sorry for the interruption.'

How often do I need to scrub my list against the National DNC Registry?

You must scrub within 31 days before dialing any number, per FTC regulations at 16 CFR § 310.4. A list scrubbed 32 days ago needs a re-scrub before a new campaign begins. This is separate from your internal DNC list scrub, which should happen in real time. Many teams scrub the National Registry monthly on a fixed schedule, which is fine as long as no campaign uses a list that's been sitting more than a month without a fresh scrub.

Do TCPA rules apply to B2B outbound calls?

Partially. The TCPA's restrictions on autodialed or prerecorded calls to cell phones apply regardless of whether the called party is a consumer or a business contact, because they attach to the type of number (wireless) not the purpose of the call. The National DNC Registry primarily covers residential numbers, so B2B calling has more latitude there. But if you're calling a business contact's personal cell with an ATDS and lack prior express consent, the § 227(b) restriction applies.

What's the minimum a small team of five reps needs to be TCPA compliant?

At minimum: a written script with a hard-stop DNC branch, a signed rep attestation that they've read the policy, a pre-campaign scrub against the National DNC Registry and your internal DNC list, call recording for every outbound call, a real-time internal DNC suppression system, and a written process for handling complaints. That's not a large technology investment. It's mostly documentation and process discipline. The risk of skipping it is $500 to $1,500 per call, stackable across every rep on every campaign.

How do I handle a rep who logs a DNC request wrong or forgets to log it?

First, catch it. Call audits and complaint monitoring should surface missed DNC logs quickly. When you catch one, treat it as a compliance coaching event with written documentation. Immediately suppress the number manually. Check whether any additional calls went out to that number after the unlogged request. If they did, assess exposure and talk to your attorney. A pattern of missed DNC logs by the same rep should trigger a formal performance review under your tiered discipline policy.

Is verbal consent enough for TCPA compliance on outbound sales calls?

Not for telemarketing calls to cell phones. The FCC's 2012 TCPA order requires prior express written consent for autodialed or prerecorded telemarketing calls and texts to wireless numbers. 'Written' includes electronic consent captured via web form with a clear disclosure, but it does not include a rep noting 'prospect said yes' in a call log. Verbal consent may suffice for manually dialed, non-prerecorded informational calls in some cases, but relying on it for sales calls to cell phones is significant, documented exposure.

What does it cost to defend a TCPA lawsuit even if you think you'll win?

Defense costs for a single plaintiff TCPA case typically run $50,000 to $150,000 through trial, based on estimates from TCPA litigation attorneys and legal industry reporting. Most cases settle before trial because statutory damages stack quickly and litigation is expensive. A plaintiff with 15 unauthorized calls has a $7,500 to $22,500 claim but can impose $50,000 or more in defense costs. That math is why most TCPA cases settle, and why prevention is cheaper than defense.

What should my compliance documentation include so I can defend against a TCPA claim?

Your package should include: timestamped consent records with the disclosure language the consumer saw, dated list scrub reports showing National DNC and internal DNC checks, call recordings with metadata, the specific script version used on each campaign with version dates, signed rep attestations, training records, call audit logs, and DNC request handling records. If you can produce all of that for a specific call on a specific date, you're in a much better litigation position than most defendants.

Can a rep's off-script pitch create liability under state law even if the federal TCPA doesn't cover it?

Yes. Florida, California, Washington, and other states have enacted their own telephone solicitation laws with different consent standards, higher penalties in some cases, and broader definitions of prohibited conduct. A call that might survive federal TCPA scrutiny could still violate Florida's Telephone Solicitation Act or California's consumer protection statutes. State liability runs concurrent with, not instead of, federal liability. Teams calling multi-state lists need to build to the strictest applicable standard.

Sources

1. Cornell Law School Legal Information Institute, 47 U.S.C. § 227 (TCPA full text): TCPA imposes liability of $500 per violation and up to $1,500 for willful violations for autodialed or prerecorded calls to cell phones without prior express written consent
2. FCC, 47 CFR § 64.1200, Delivery Restrictions: FCC regulations require companies to maintain internal DNC lists, honor requests within 30 days, and restrict calls to 8am–9pm local time
3. FTC, Telemarketing Sales Rule, 16 CFR § 310.4: TSR requires telemarketers to promptly disclose the seller's identity and the purpose of the call before any sales pitch
4. Florida Legislature, Florida Telephone Solicitation Act, § 501.059 Florida Statutes: Florida's 2021 amended FTSA imposes stricter autodialed call and text consent requirements than federal TCPA and does not recognize an established business relationship exemption
5. California Attorney General, California Consumer Privacy Act (CCPA): CCPA and CPRA grant California consumers the right to deletion, which interacts with TCPA calling list obligations
6. FTC, National Do Not Call Registry, Fee Schedule for Telemarketers: FTC charges $70 per area code per year for National DNC Registry access, capped at $19,682 for all U.S. area codes as of 2024; companies must scrub within 31 days before dialing
7. FTC, Telemarketing Sales Rule, 16 CFR § 310.4(b)(1)(iii)(B), established business relationship: EBR under TSR allows calls to DNC-registered numbers for up to 18 months after a purchase and 3 months after an inquiry, but does not override a specific do-not-call request
8. Cornell Law School Legal Information Institute, 28 U.S.C. § 1658, Statute of Limitations: The general federal statute of limitations is four years, which courts have applied to TCPA private actions