The Telephone Consumer Protection Act is the federal law that controls how businesses call and text people. It requires consent before a business reaches someone with an autodialer or a prerecorded or artificial voice, bans telemarketing calls and texts to Do Not Call numbers and outside 8 a.m. to 9 p.m. local time, and lets each recipient sue for $500 per violation.
In This Article
Congress passed the law in 1991. The text has barely moved since, but the FCC rewrites its rules every few years and courts stopped deferring to them in 2025. This guide answers a launching team’s questions in the order they come up. For an outside read on your own program, the TCPA compliance consulting service page explains how a campaign audit scores scripts, consent records, and DNC processes by risk.
What is the Telephone Consumer Protection Act?
The Telephone Consumer Protection Act (TCPA) is a 1991 federal statute, codified at 47 U.S.C. § 227. It restricts telemarketing calls, autodialed and prerecorded calls, marketing texts, and unsolicited faxes to protect consumers from unwanted contact.
The statute is short. The operating detail lives in the FCC’s rules at 47 CFR § 64.1200, which set consent standards, calling hours, Do Not Call duties, and opt-out deadlines. TCPA compliance means satisfying both layers at once. Since 2025, courts read the statute for themselves and discard FCC rules that stretch it.
A second federal regime sits beside it. The FTC’s Telemarketing Sales Rule governs sales disclosures and runs the National Do Not Call Registry. Most outbound campaigns answer to both.
Does the TCPA apply to your outbound campaign?
Yes, if your campaign reaches consumers or cell phones. The rules that attach depend on three variables: how the call is placed, what kind of line it reaches, and whether the message sells something.
Dialing method matters first. Section 227(b), the statute’s strictest provision, targets autodialers and artificial or prerecorded voices. The Supreme Court narrowed autodialer to random or sequential number generators in Facebook v. Duguid (2021). Prerecorded voices got no such relief. The FCC treats AI-generated voices as artificial.
Line type matters next. Do Not Call and calling-hour rules protect residential subscribers, personal cell phones included. A live agent calling a company switchboard sits outside both rules, while the same agent dialing a buyer’s personal cell phone sits squarely inside them.
The table maps six common outbound scenarios to the federal rules that apply.
Call scenario | Consent needed before contact | Consent needed before contact | 8 a.m.–9 p.m. window applies |
|---|---|---|---|
Live agent, manually dialed, to a consumer’s landline or cell | None, unless the number is on the DNC Registry (then an established business relationship or signed permission) | Yes | Yes |
Prerecorded or artificial-voice telemarketing (AI voices included) to any consumer line | Prior express written consent | Yes | Yes |
Autodialed telemarketing call or text to a cell phone | Prior express written consent | Yes | Yes |
Marketing text sent without an autodialer to a cell phone | None for the technology; DNC permission if the number is registered | Yes under FCC rules; private suits barred in the Seventh Circuit | Yes |
Informational prerecorded call (reminder, fraud alert) to a cell phone | call (reminder, fraud alert) to a cell phone Prior express consent, oral or written | No | No |
Live agent call to a business landline | None under federal TCPA rules | No | No |
Most campaigns occupy two or three rows at once. A live-agent program sends follow-up texts. An appointment line drifts into upsell language and becomes telemarketing. That overlap is why the engagement process on the TCPA compliance consulting page starts with an inventory mapping each active campaign to its governing rules.
What does TCPA compliance require before the first dial?
Two controls must exist before dialing starts: consent records that match your calling technology, and a suppression process that strips Do Not Call numbers from every list. Every other control depends on these two.
Consent that matches the technology
The FCC rule at 47 CFR § 64.1200(a)(2) requires prior express written consent before autodialed or prerecorded telemarketing to a cell phone. Written means signed, e-signatures included. The agreement names the seller, identifies the number, and states that consent is not a condition of purchase.
Here is how the gap looks on a real floor. A web-form lead arrives carrying consent language that names a different brand, plus a checkbox with no timestamp and no page capture. Inside the dialer, it looks clean.
Ringless voicemail is where these gaps get expensive. It lands like a voicemail but counts as a prerecorded call. ClassAction.org’s summary of the NRS Pay settlement reports a 2026 deal of up to $6.51 million to resolve claims over vendor-sent ringless voicemails to cell phones without consent.
One 2026 ruling moves the legal floor. The Fifth Circuit’s Bradford v. Sovereign Pest Control opinion holds that the statute accepts oral or written consent, rejecting the FCC’s written-consent rule. It binds federal courts in Texas, Louisiana, and Mississippi only. Written, timestamped consent satisfies both readings.
The safeguard is a consent record built to survive discovery: disclosure text, timestamp, source URL or recording, and the seller named. On a consumer-furniture consent campaign we ran, any deviation from the word-for-word verbal disclaimer was an automatic QA fail. Every record logged opt-out and SMS-consent status.
Do Not Call lists: federal, state, and your own
The rules at 47 CFR § 64.1200(c) and (d) require three separate suppressions. Scrub the National Do Not Call Registry using a copy no more than 31 days old. Log every stop request internally, honor it within 10 business days, and keep it five years. Then add state registries, which Texas, Florida, and Pennsylvania each maintain.
Internal lists fail first. They depend on an agent hearing a stop request and a system recording it. Top Class Actions’ summary of the SiriusXM settlement describes a $28 million resolution covering calls to people who had already asked the company to stop.
Liability follows the brand, too. ClassAction.org’s report on the Farmers Insurance settlement details a $2.875 million settlement over calls an independent agency placed to registered numbers. A vendor’s scrub is your scrub.
What are the TCPA calling hours?
Federal TCPA calling hours run from 8 a.m. to 9 p.m. in the recipient’s local time. The window covers telemarketing calls and marketing texts alike, and it follows the consumer’s location, not your call center’s.
The rule sits at 47 CFR § 64.1200(c)(1). It breaks on a phone number. An area code shows where a number was issued, not where its owner sleeps. Your 6:30 p.m. Pacific text reaches a transplanted 415 number in Boston at 9:30 p.m.
That gap fueled a wave of quiet-hours class actions. ClassAction.org’s TCPA case tracker lists 2026 complaints against national retail brands over texts sent at unlawful hours. Consent is the strongest defense: Nixon Peabody’s analysis of King v. Bon Charge explains an April 2026 Delaware dismissal on exactly that ground. One district court binds no other, so send inside the window.
State windows run tighter. Receivables Info’s summary of Pennsylvania SB 992 covers a law effective October 18, 2026: telemarketing only from 9 a.m. to 7 p.m., none on Sundays, texts and ringless voicemail included.
The safeguard is a dialer rule that applies the strictest window available. Use the address when you have it and the area code when you don’t.
Who enforces the Telephone Consumer Protection Act, and what does a violation cost?
Three parties enforce the TCPA. The FCC writes rules and issues fines, state attorneys general sue, and consumers bring private suits worth $500 per violation and up to $1,500 when willful.
The private right shapes campaigns. Damages sit in sections 227(b)(3) and 227(c)(5) of the statute. Each call or text counts as a separate violation, and plaintiffs need no proof of financial harm. One list error becomes a class action.
2,810 federal TCPA lawsuits were filed in 2025.
Volume keeps rising. WebRecon’s June 2026 litigation report counted 1,532 TCPA suits in the first half of 2026, up 34.3% year over year. In June, 76.4% of new TCPA filings were putative class actions.
The upside is just as concrete. Consent records and scrub logs produced on request give defense counsel an early answer, and they let a team enter a new state by adding a rule set.
What changed in TCPA compliance in 2025 and 2026?
Three forces reshaped TCPA compliance: courts stopped deferring to FCC interpretations, the FCC rewrote its opt-out rules, and more states passed their own telemarketing laws. The statute itself did not change.
Courts now read the statute for themselves
Loper Bright ended Chevron deference in 2024. In June 2025, McLaughlin Chiropractic v. McKesson applied that logic to TCPA suits: district courts are not bound by FCC interpretations. The Eleventh Circuit had already vacated the FCC’s one-to-one consent rule in January 2025. The Fifth Circuit rejected the written-consent rule in February 2026.
Texts produced the sharpest split. Holland & Knight’s analysis of Steidinger v. Blackstone Medical Services covers the Seventh Circuit’s July 2026 holding that texts are not calls for private Do Not Call suits. The Ninth Circuit held in January that texts are calls under the autodialer provision.
The rules now differ by circuit. An Illinois texting program carries different private-suit risk than the identical program aimed at California. Build to the strictest reading. Favorable rulings are defenses, not design specs.
The FCC is rewriting how opt-outs work
Since April 11, 2025, callers must honor any reasonable revocation within 10 business days. The broader revoke-all provision was pushed to January 31, 2027. Troutman Pepper Locke’s summary of the FCC’s September 2026 draft order describes its replacement, set for a September 30 vote. Telemarketing opt-outs still cover all telemarketing. Informational opt-outs cover one category, and callers can designate an exclusive, clearly disclosed opt-out method.
States keep adding their own rules
Texas extended its telemarketing law to texts, with a private right of action, on September 1, 2025. Virginia began requiring text STOP requests to be honored for 10 years on January 1, 2026, per Kaufman Dolowich’s state mini-TCPA roundup. Pennsylvania follows on October 18, and each law stacks on top of federal rules rather than replacing them.
Multi-state programs feel this first. Our insurance campaigns across California, Connecticut, Maryland, and Ohio run four state rulebooks in parallel.
How do you keep a campaign TCPA-compliant as the rules shift?
Build to the strictest current reading, document every consent and suppression event, and review the rules on a fixed calendar instead of after a lawsuit. Those three habits absorb most rule changes without a rebuild.
The two futures are plain. A team without records spends every new ruling asking whether last quarter’s calls were legal. A team with records changes a setting.
For the control-by-control version, the TCPA compliance checklist for outbound campaigns turns each requirement above into an auditable line item. Review consent language and scrub cadence quarterly. Re-check state rules before entering any new state.
Evaluate your SaaS outbound legal risk profile
Outbound calling carries severe legal risks if executed without verified consent protocols, proper scrubbing infrastructure, and trained agent oversight.
Frequently asked questions
Who enforces the Telephone Consumer Protection Act?
The FCC writes the TCPA’s rules and issues fines, state attorneys general sue on behalf of residents, and consumers sue directly for $500 per violation, or up to $1,500 when the violation is willful. The FTC enforces the separate Telemarketing Sales Rule and runs the National Do Not Call Registry.
Does the TCPA apply to B2B cold calls?
Partly. Live, manually dialed calls to business landlines fall outside the federal Do Not Call and calling-hours rules, which protect residential subscribers. Autodialed or prerecorded calls to a business contact’s cell phone still require consent, and Pennsylvania’s 2026 law requires written consent for robocalls to business lines.
Do TCPA rules apply to text messages in 2026?
Yes. The FCC treats texts as calls, so autodialer consent, Do Not Call, and calling-hour rules apply to marketing texts. In July 2026 the Seventh Circuit barred private Do Not Call suits over texts in Illinois, Indiana, and Wisconsin, but FCC enforcement, autodialer claims, and state texting laws still apply there.
How fast do you have to honor an opt-out under the TCPA?
Within 10 business days of receipt, under FCC rules in force since April 2025, and the request stays on your internal list for five years. A stop request on a telemarketing call or text covers all future telemarketing from that caller. A pending FCC proposal would shorten the deadline to seven business days.
Is written consent still required for telemarketing calls?
Under FCC rules, yes: autodialed or prerecorded telemarketing to cell phones, and prerecorded telemarketing to landlines, require prior express written consent. The Fifth Circuit held in February 2026 that the statute accepts oral consent, but that ruling applies only in Texas, Louisiana, and Mississippi. Written, timestamped consent satisfies both standards.
Model your campaign's compliance exposure
The outreach compliance risk calculator applies the statutory per-violation amounts to your monthly volume and error rate, so you can see which controls carry the most weight for your program before launch.
