Last updated 2026-07-09
TL;DR
Several dialer and SMS platforms market themselves as TCPA-compliant, but no software makes you compliant on its own. The law sits on your consent records, your opt-out handling, and your calling-time controls, not the vendor's checkbox. This article breaks down what real compliance automation looks like, which platform categories exist, and how to test any vendor before you sign.
What does TCPA compliance actually require from an automated system?
A compliant automated system has to capture timestamped consent, suppress DNC numbers, block calls outside legal hours, and honor opt-outs fast. The Telephone Consumer Protection Act, 47 U.S.C. § 227, bans using an automatic telephone dialing system (ATDS) or a prerecorded voice to call or text a cell phone without prior express written consent. That consent requirement is the core of every problem outbound teams hit. Automation does not sidestep it. Automation just makes the problem faster.
The FCC's one-to-one consent order (released December 2023, originally set for February 2025 enforcement, then vacated by a federal appeals court in January 2025) showed how fast these rules move. [2] The statute text has not changed. A system that stores and dials numbers automatically meets the ATDS definition the FCC has historically applied, even when a human is technically in the loop somewhere.
So what does a compliant automated system actually need to do? Capture and store timestamped proof of prior express written consent before a number gets called or texted. Suppress any number on the National Do Not Call Registry or your internal DNC list. Respect calling-hour windows (8 a.m. to 9 p.m. in the called party's local time zone under 47 C.F.R. § 64.1200). Honor opt-outs within ten business days for voice and within a reasonable time for text (most practitioners treat that as 24 hours to be safe). Keep records that survive litigation discovery. [3][4]
Here is the part vendors gloss over. None of those requirements live inside a dialer or SMS platform by themselves. The platform can support them. The platform cannot guarantee them. Your data, your consent capture flow, and your internal processes are what the plaintiff's attorney actually audits.
What categories of automation tools claim TCPA compliance?
The market splits into four categories, and each carries a different level of exposure. Predictive dialers are the riskiest. Preview and click-to-dial tools are the safest. SMS platforms draw the most litigation. All-in-one CRMs are only as clean as the data you feed them.
Predictive and power dialers dial numbers automatically ahead of agent availability. Predictive dialers are the highest-risk category because abandoned calls and prerecorded messages are explicitly regulated. [1] Platforms like Five9, NICE CXone, and Genesys sit here. They offer DNC scrubbing integrations and consent-flag fields, but whether those fields get populated correctly depends entirely on your upstream lead acquisition and CRM setup.
Preview dialers and click-to-dial tools put a human click in front of every call. This is the safest dial mode for TCPA purposes because a human initiates each call, which removes the ATDS argument for that channel. Tools like Kixie, Salesloft, and HubSpot's built-in sequences fall here for many use cases. Safer does not mean exempt. Prerecorded voicemail drops, even from preview modes, still carry prerecorded-voice risk. [4]
SMS platforms draw the most litigation right now. Twilio, EZTexting, SimpleTexting, Podium, and Attentive all make you certify that you have proper consent before sending. They do not verify your consent records. They terminate accounts that generate too many opt-outs or complaints, which protects the carrier, not you.
All-in-one outreach platforms (Salesforce, HubSpot, Outreach, Apollo.io) layer calling and texting onto a CRM. Their compliance features are only as good as the consent data you pipe into them. Apollo in particular gets used heavily for cold outreach, and its built-in contact data does not count as prior express written consent for cell-phone calling or texting under the TCPA.
None of these platforms indemnify you against TCPA suits. Read the contracts. Almost every vendor agreement shifts liability to the customer for improper use.
How do you evaluate whether a vendor's compliance features are real?
Ask seven questions before you sign, and judge the vendor by how specific the answers get. Vague answers on DNC scrubbing, opt-out timing, and litigation history are the tells. Here is the list I'd actually run through on a demo call.
First: does the platform scrub numbers against the National DNC Registry in real time or on a batch schedule, and who holds the SAN (Subscription Account Number) required to access that data? [3] If the vendor says they scrub but cannot name their SAN or explain how yours plugs in, that is a red flag.
Second: can the system ingest your consent timestamps and mark numbers callable or not callable by consent type? There is a real difference between express consent (informational calls) and prior express written consent (telemarketing). A platform that treats both the same is leaving you exposed.
Third: how does opt-out propagation work? If a contact texts STOP at 11 p.m. on a Friday, when does that number get suppressed, and across which channels? Cross-channel opt-out is a live gap in most platforms.
Fourth: does the platform log call dispositions, timestamps, and opt-out events in a format you can export for litigation? TCPA cases reach back four years under the statute of limitations. [1]
Fifth: does the vendor enforce calling hours as a hard block, or just a warning? A warning a rep can click through is not a compliance control.
Sixth: for SMS, is the platform registered with The Campaign Registry (TCR) for 10DLC, and will they help you register your brand and campaigns? Unregistered 10DLC traffic gets filtered by carriers, and the registration itself forces you to document your consent source. [5]
Seventh: what is the vendor's own litigation history? A platform named in TCPA suits as a co-defendant has skin in the game in a bad way. Several large platforms have settled as named parties or been subpoenaed for call records.
Which specific platforms have built meaningful compliance infrastructure?
No independent audit ranks platforms on TCPA compliance depth, so honest hedging matters here. What follows is based on publicly documented features, FCC filings, and how practitioners in the space actually use these tools. Treat it as a starting map, not a scoreboard.
Convoso and Contact Center Compliance (C3) have co-marketed a consent-based dialing workflow for high-volume outbound. Contact Center Compliance's DNC.com database is one of the better-known third-party DNC scrubbing services, and they maintain their own litigator list alongside the federal and state registries.
LeadConduit by ActiveProspect is not a dialer. It's a consent documentation layer. Their TrustedForm product creates a certificate with a timestamp, session replay, and IP address every time a lead submits a form. [6] That certificate is probably the closest thing to a defensible paper trail for prior express written consent the market currently offers. Defense lawyers reference TrustedForm records regularly.
Twilio powers a huge share of SMS infrastructure. Twilio's compliance tooling includes 10DLC registration support, SHAKEN/STIR attestation for voice, and opt-out keyword handling (STOP, HELP, UNSUBSCRIBE) built into its messaging service. But Twilio is infrastructure. You still own the consent obligation.
Five9 and NICE CXone both offer time-zone controls, DNC list management, consent flagging, and call recording. Both integrate deeply with CRMs so you can pass consent status from Salesforce or HubSpot. Both have run inside compliant outbound operations, and both have shown up in subpoenas where the customer ignored the controls. [7]
Drips is a conversational AI texting platform built for the insurance and financial services lead-gen market. They market direct-to-consumer TCPA tooling, including consent verification before their AI engages. Worth a look if your team is in a regulated industry.
LeadCompliant's free DNC checker and TCPA compliance kit run alongside any of these to verify your suppression lists are current before a campaign touches a new batch of leads. Think of it as a sanity check.
Honest reality: no single platform does everything. Most high-volume compliant operations combine a consent documentation tool (TrustedForm or similar), a DNC scrubbing service (C3 or in-house via FTC SAN access), and a dialer or SMS platform with hard-block controls. The integration between those three layers is where compliance actually lives.
What does prior express written consent look like in an automated workflow?
Prior express written consent means a signed, written agreement from the consumer that authorizes you to contact them with an ATDS or prerecorded voice for telemarketing. [1] The FCC has held that an electronic signature satisfies the signature requirement. [8] So a web form with a clear disclosure and a checkbox the consumer affirmatively checks qualifies, as long as the disclosure names the specific company that will be calling and is not buried in fine print.
The one-to-one consent rule the FCC finalized in December 2023 would have required each company to be individually named in the consent form, killing the practice of one disclosure covering a broad marketplace of callers. [2] The Eleventh Circuit vacated that order in January 2025 (Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277). [9] The pressure toward named consent is still real, and state-level analogs are moving that way anyway. Treating the vacated rule as your standard is not a bad idea.
In a working automated workflow, consent capture runs like this. The lead submits a form. The consent platform (TrustedForm, Jornaya, or similar) captures a certificate. The certificate ID or a consent flag passes to your CRM alongside the phone number. The CRM passes the flag to your dialer or SMS platform. The dialer only fires when the flag is present and the consent type matches the campaign type. Break any step in that chain and you are dialing unconsented leads.
The failure mode is almost always the data pipeline, not the platform. A batch import that skips the consent column. A field mapping that drops the timestamp. A rented lead list where the original consent covered a different company. These are operational failures no platform prevents on its own.
How does DNC scrubbing work inside automated systems, and is it enough?
Federal DNC scrubbing is the legal minimum, and it is not close to enough on its own. The National Do Not Call Registry is maintained by the FTC and open to telemarketers who register and pay a fee based on how many area codes they access. [3] As of 2025 the fee runs from free for the first five area codes up to roughly $17,000 per year for access to all area codes nationwide. Most outbound teams pay well under that because they target specific regions. [3]
Beyond the federal registry you also need to suppress numbers on your internal DNC list (people who already asked you not to call), state-specific DNC lists (states like Indiana, Texas, and Florida run their own registries with stricter rules), and litigator lists (people who register numbers specifically to sue under the TCPA).
Third-party DNC scrubbing services like Contact Center Compliance, DNC.com, and Gryphon Networks aggregate the federal registry, many state registries, wireless-only numbers for certain contexts, and litigator-identified numbers. They charge per-record fees or monthly subscriptions. Gryphon runs around $0.005 to $0.01 per record scrubbed depending on volume. Contact Center Compliance pricing varies by package.
Inside automated platforms, scrubbing happens either in real time (the number is checked at the moment of dial or send) or in batch (a list is scrubbed before a campaign launches). Real-time scrubbing is safer for campaigns that run over days or weeks, because a consumer could register with the DNC after your batch scrub ran. The registry updates daily.
For text message marketing, the scrubbing question shifts a little. The federal DNC registry applies to telemarketing texts exactly as it does to calls, and this is where many teams wrongly assume texting is exempt. It is not. [1]
What are the real financial risks of getting automated outreach wrong?
The TCPA allows statutory damages of $500 per violation and up to $1,500 per willful violation. [1] Those numbers sound manageable until you multiply by the volume of automated outreach.
A campaign that sends 50,000 texts to numbers without valid consent carries theoretical exposure of $25 million at $500 per message, or $75 million if a court finds willfulness. Class actions aggregate those individual violations, and federal courts have repeatedly certified TCPA classes because the statutory-damages structure makes individual litigation economically irrational and class litigation very attractive for plaintiff's attorneys.
Settlement data shows how real those numbers get. UnitedHealthcare paid $2.5 million to resolve TCPA allegations. Truist Bank settled a TCPA class action over automated contact practices. Credit One faced significant TCPA exposure in litigation over its automated calling program. These are not fringe plaintiffs chasing obscure theories. They are mainstream companies with real compliance programs that had gaps in their automated systems.
Small teams face smaller exposure in absolute dollars, but the litigation cost alone (legal fees, discovery, depositions) can hit six figures before any settlement. The TCPA's fee-shifting provisions and plaintiff-friendly venue options mean defendants often settle to cap uncertainty rather than fight on principle.
For more on how these cases play out, see the Albertsons Safeway TCPA settlement and the Cash App TCPA class action settlement, two examples of consumer brands getting caught.
The math almost always favors compliance investment. A good consent documentation tool costs a few thousand dollars a year. A TCPA class action costs that per hour of defense billing.
How do automated calling rules differ from automated text message rules?
The statute treats calls and texts the same in most respects. An automated text to a cell phone using an ATDS needs the same prior express written consent as an automated call. [1] The FCC has consistently held that SMS counts as a "call" under the TCPA for regulatory purposes.
The differences show up in carrier enforcement. Voice calls are policed mainly through the FCC and plaintiff litigation. Text messages face an extra layer through mobile carriers and their anti-spam policies. Carriers run filtering algorithms that flag high opt-out rates, complaint rates, and content patterns. A campaign with a 3 percent opt-out rate gets filtered or terminated regardless of how clean your consent documentation is. Industry benchmarks put compliant opt-out rates below 0.5 percent for well-run programs.
The 10DLC system (10-digit long codes) adds a third layer: brand registration and campaign registration through The Campaign Registry, with approval required before carriers pass your traffic. [5] Approved campaign types include customer care, marketing, and mixed-use, each with content restrictions. Registered campaigns still get filtered if performance metrics slide.
Short codes (5 to 6 digit numbers) carry higher throughput and better deliverability but cost far more: setup fees of $1,000 to $2,000 and monthly fees of $500 to $1,000 depending on shared or dedicated. Carriers largely discontinued shared short codes in 2021 precisely because they made consent attribution impossible.
For a fuller treatment of how text outreach works inside these constraints, see text messaging marketing.
Practical upshot: if you are running automated texts and have not finished 10DLC registration with documented consent sources per campaign, your traffic is both legally and operationally vulnerable.
What operational processes make automation actually safe, beyond the platform?
The platform is maybe 30 percent of your compliance posture. The rest is process, and process is where small teams either save themselves or sink.
Consent hygiene is the biggest lever. Every lead entering your system needs a documented consent path: which form they filled out, when, what the disclosure said, and which number they gave. If you buy leads, get a contract representation that the vendor captured TCPA-compliant consent, plus an audit right to check it. Courts have repeatedly found that leaning on a vendor's verbal assurance does not shield you from liability. [4]
Lead age matters. Consent obtained 18 months ago for a different company's product is not good consent for your campaign today. There is no statutory expiration for consent under the TCPA, but FTC guidance and common litigation patterns suggest leads older than 90 days draw more scrutiny in court, especially if the consumer's circumstances may have changed.
Call recording and disposition logging need to be on and retained. Four years is the TCPA statute of limitations. [1] Most platforms default to 90-day or 1-year retention. You have to configure extended retention or archive to your own system.
Agent training cannot be skipped. Agents need to know exactly what to do when someone says "stop calling me" or "remove me from your list." That verbal request triggers your TCPA obligation even without a formal written opt-out. One agent who re-adds a number after an opt-out creates a willfulness problem.
Monthly internal audits are underrated. Pull a random sample of 50 to 100 leads contacted that month and trace the consent record for each. If you cannot find it for even 5 percent of them, you have a systemic problem. Finding it in an audit beats finding it in discovery.
If you are building these processes from scratch, reviewing recent TCPA news helps, because enforcement patterns tell you which failure modes plaintiffs are hitting right now.
Are there states with stricter automation rules than the federal TCPA?
Yes, several. The TCPA sets a floor, not a ceiling, and states pile requirements on top. Florida, California, Texas, and a handful of others matter most for national campaigns.
Florida's Telephone Solicitation Act (FTSA, amended 2021) is the most aggressive state analog right now. It creates a private right of action for automated texts sent without express written consent that mirrors TCPA exposure, and Florida courts have let it run alongside TCPA claims, which means double exposure. [10] Florida also runs a state DNC list separate from the federal registry.
California's CCPA and its amendment, the CPRA, add a data-rights layer: consumers can opt out of the "sale" of their personal information including phone numbers, which affects how you can use purchased lead lists. That is separate from the TCPA but intersects with it operationally. [11]
Texas has its own telemarketing statute and a state DNC list. Indiana, Tennessee, and Oklahoma also run separate registries. If your campaign touches any of these states, your DNC scrub needs to include the state file.
Washington's Commercial Electronic Mail Act (CEMA) reaches some text-based marketing. Maryland and New York have proposed or enacted additional call-center rules in recent sessions.
Operational reality for small teams: if you run a national outbound campaign, you need to know which states your list covers and scrub accordingly. A national campaign that ignores state lists is a class certification argument waiting to happen.
If you operate in a specific state, resources like tcpa lawyer kentucky help you read regional enforcement patterns and find counsel if you need it.
What should a TCPA compliance checklist for automated outreach cover?
A working checklist for an outbound team running automation has eight categories: consent documentation, DNC suppression, calling hours, opt-out processing, platform configuration, vendor contracts, 10DLC registration, and agent training. Here is what each one means in practice.
Consent documentation: Every number in your call or text queue has a timestamped, certificate-backed record of prior express written consent, matched to the right company and campaign type.
DNC suppression: Your list has been scrubbed against the federal DNC registry (updated within the last 31 days), your internal DNC list, applicable state lists, and a litigator list.
Calling hours: Your dialer enforces time-zone detection with a hard block. Nobody gets called before 8 a.m. or after 9 p.m. in their local time zone. [3]
Opt-out processing: Inbound STOP messages, verbal opt-outs logged by agents, and email unsubscribes all flow to a single suppression list within 24 hours, and that list gets pushed to your dialer before the next campaign run.
Platform configuration: Call recording is on. Retention is set to at least 48 months. Disposition logging captures timestamps, agent ID, and outcome for every contact attempt.
Vendor contracts: Your dialer, SMS platform, and lead vendor contracts all contain representations about TCPA obligations and indemnification language.
10DLC registration: Every SMS campaign has a registered brand and campaign ID in The Campaign Registry with the correct consent type documented.
Agent training: Your team has completed TCPA training in the last 12 months, and there is a written SOP for handling opt-out requests, reassigned numbers, and wrong-number calls.
LeadCompliant offers a one-time compliance kit that walks through each category with templates and a DNC checker to verify list status before a campaign runs. Worth using as a starting audit even if you eventually build your own process.
Want to understand what failure looks like from the other side? Reading up on how to stop robocalls from the consumer's view is genuinely useful. It shows what drives complaint rates and what signals plaintiff attorneys look for.
Frequently asked questions
Does using a TCPA-compliant dialer platform protect me from lawsuits?
No. The platform is a tool. Your liability under the TCPA comes from whether you had valid consent, proper DNC suppression, and correct calling-hour enforcement. A platform with all the right features can still be used wrong. Courts have held companies liable even when they ran major enterprise dialers, because the consent records or opt-out processes were broken on the customer side.
What is TrustedForm and does it actually hold up in TCPA litigation?
TrustedForm by ActiveProspect creates a certificate with a session recording, IP address, timestamp, and form field data for every lead submission. Defense attorneys regularly use TrustedForm records as evidence of prior express written consent. It does not guarantee a win, but it improves your position dramatically over a CRM field that just says 'consented: yes' with no audit trail. Courts care about verifiability.
Is cold texting legal if I use an automated SMS platform?
Generally no. Automated or ATDS-generated texts to cell phones for telemarketing require prior express written consent under 47 U.S.C. § 227. Buying a list of numbers and texting them through an SMS platform without consent is a TCPA violation. The platform's terms of service almost always prohibit this use and will terminate your account, which does nothing to stop the litigation.
How often do I need to re-scrub my lead list against the DNC registry?
The FTC requires telemarketers to access updated DNC data and honor registrations within 31 days of the registration date. In practice, most compliance teams scrub before every campaign run and at least monthly for ongoing campaigns. The registry updates daily, so a list scrubbed 45 days ago may include newly registered numbers you would be calling illegally.
What is 10DLC and why does it matter for TCPA compliance?
10DLC (10-digit long code) is the carrier system for registering business SMS traffic through The Campaign Registry. Registered brands and campaigns get better deliverability and carrier trust scores. Registration requires documenting your consent source for each campaign type, which creates a record that supports TCPA compliance. Unregistered 10DLC traffic gets filtered by carriers and signals a compliance gap to regulators and plaintiffs.
Can I use AI-powered voice agents or chatbots for outbound calls without TCPA issues?
AI voice agents that make outbound calls likely qualify as prerecorded or artificial voice calls under the TCPA, which require prior express written consent for cell phones. The FCC has issued guidance making clear that AI-generated voice calls fall under the same statutory framework as traditional prerecorded messages. Written consent before the call is still required. There is no AI exemption in the statute.
What is a litigator list and should I be scrubbing against one?
Litigator lists are databases of numbers owned by people who file or assist in TCPA lawsuits. Contact Center Compliance and similar vendors maintain them. Calling or texting a number on a litigator list is not itself illegal, but it raises your litigation exposure sharply. Most high-volume outbound teams scrub against a litigator list before every campaign as a risk-reduction step.
How does the one-to-one consent rule affect lead generation platforms?
The FCC's December 2023 one-to-one consent rule would have required each company to be individually named in a consent disclosure, killing broad marketplace consent forms. The Eleventh Circuit vacated that rule in January 2025. Many lead gen platforms already moved toward named consent because marketplace forms carried high legal risk. If you buy leads, asking the vendor which company name appeared in the consent form is a reasonable due-diligence question.
What happens if a phone number gets reassigned to a new person after I got consent from the original owner?
The TCPA creates a reassigned-number problem: if you call a number with valid consent from Person A but Person B now holds it, you may be liable for contacting Person B without consent. The FCC operates a Reassigned Numbers Database that carriers update regularly. Scrubbing against it before campaigns flags recently reassigned numbers. Most major DNC scrubbing services now include this check.
Do I need a different consent form for text messages versus phone calls?
The consent standard is the same: prior express written consent for telemarketing, by call or text. In practice, a single disclosure that clearly states the consumer authorizes automated calls AND text messages from your company covers both channels, as long as it is clear and conspicuous. Separate checkboxes for calls and texts give you more granular control and cleaner records if challenged.
What is the statute of limitations for a TCPA claim?
Four years. Under 28 U.S.C. § 1658, the general federal statute of limitations, TCPA claims must be filed within four years of the violation. So you need to retain call logs, consent records, and opt-out documentation for at least four years from any contact. Some state analogs run shorter or longer, but four years is the federal floor most defense strategies plan around.
Can small businesses with under 10 employees be sued under the TCPA?
Yes. The TCPA has no small-business exemption. A solo agent texting 500 leads from an SMS platform without consent faces the same $500-per-text statutory exposure as a large call center. Class action risk may be lower just because volume is lower, but individual claims and small-class suits absolutely happen against small teams. The plaintiff-friendly fee structures make them viable even at small scale.
What is the FCC's Reassigned Numbers Database and how do I access it?
The Reassigned Numbers Database (RND) is an FCC-managed database that aggregates disconnected number data from carriers. You can access it directly through the FCC's portal or through third-party scrubbing services that include RND data in their suppression checks. Direct access requires registration. The FCC provides a safe harbor from TCPA liability for callers who check the RND and get a 'no record found' result before calling.
Sources
- U.S. Congress, 47 U.S.C. § 227 (Telephone Consumer Protection Act), Cornell Law School LII: TCPA prohibits ATDS or prerecorded calls to cell phones without prior express written consent; allows $500-$1,500 per violation; four-year statute of limitations under 28 U.S.C. § 1658
- FTC, National Do Not Call Registry (business information and fee schedule): Telemarketers must scrub against the DNC registry and honor registrations within 31 days; access fee runs from free for the first five area codes to roughly $17,000 per year for all area codes
- eCFR, 47 C.F.R. § 64.1200 (TCPA implementing regulations): Calling hours restricted to 8 a.m. to 9 p.m. local time; prerecorded voicemail drops and click-to-dial calls carrying artificial or prerecorded voice still carry liability
- ActiveProspect, TrustedForm product documentation: TrustedForm certificates include session replay, IP address, timestamp, and form field data as documented consent evidence
- CourtListener, federal TCPA class action dockets (general reference): Enterprise dialer customers have been named in TCPA suits where platform controls were bypassed or misconfigured
- U.S. Court of Appeals, Eleventh Circuit, Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (January 2025): Eleventh Circuit vacated the FCC's one-to-one consent order in January 2025
- Florida Legislature, Florida Telephone Solicitation Act (FTSA), Fla. Stat. § 501.059: FTSA creates a private right of action for automated text messages sent without express written consent, running alongside TCPA claims
- California Attorney General, California Consumer Privacy Act (CCPA) / CPRA: California CCPA/CPRA allows consumers to opt out of sale of personal information including phone numbers, affecting lead list use in California
- FTC, Telemarketing Sales Rule and Do Not Call program: DNC registry access fee structure runs from free for the first five area codes to approximately $17,000 per year for all area codes