TCPA penalties are $500 per violating call or text, rising to $1,500 when a court finds the violation willful or knowing, and every call counts separately. Consumers can sue directly, and the FCC, the FTC (under the Telemarketing Sales Rule) and state attorneys general can pursue their own penalties on top. Class actions are how a single campaign defect becomes a seven- or eight-figure settlement.
In This Article
Most TCPA problems do not arrive with a label on them. They show up as a consumer saying “I already told you to stop calling” for the second time, a purchased list throwing more wrong-number dispositions than usual, or a law firm’s letter claiming a call count nobody can confirm because the call history sits in two systems. From inside a campaign, each looks like a list-quality issue or an unhappy customer. The statute reads them as violations, one per call.
What follows: what each violation costs, who can pursue it, how one defect spreads across a list, what companies actually paid in the last two years, and what to do when a claim lands.
What is the penalty for violating the TCPA?
The TCPA sets statutory damages of $500 per violation, and a court can raise that to $1,500 per violation if it finds the company acted willfully or knowingly. Each call or text message is a separate violation, the person suing does not have to show they lost any money, and there is no ceiling on the total.
Two provisions do most of the work. The first, 47 U.S.C. § 227(b)(3), covers calls or texts made with an autodialer or an artificial or prerecorded voice (the FCC has confirmed that includes AI-generated voices) without the right form of consent. Damages there are $500 per call, full stop, or actual losses if higher. The second, § 227(c)(5), covers Do Not Call violations. Two differences matter: the person must have received more than one call in a 12-month period from or on behalf of the same company, and the statute says “up to” $500 per call, which at least one federal court has read to allow a lower award.
“Willfully or knowingly” is where $500 becomes $1,500, and courts are split on what it takes: some require proof the company knew it was breaking the law, others hold that intentionally placing the call is enough. Ignoring a documented opt-out or continuing after a warning is the fact pattern that moves a court toward the higher figure.
The arithmetic is what makes this a compliance problem rather than a customer-service one. A prerecorded telemarketing campaign to cell phones without prior express written consent settled in January 2026 for $6.5 million (Walston v. National Retail Solutions, Illinois circuit court). Nothing in that complaint was exotic: a common campaign configuration pointed at a list that had not been cleared for it.
To see how your own campaign would hold up to that arithmetic, the TCPA compliance consulting service page describes what a campaign compliance audit examines: consent records by contact, DNC and opt-out handling, scripts and call recordings. If you need the statute itself explained before the penalties, the plain-English guide to the TCPA covers what it prohibits, who enforces it and the calling-hour rules.
Who enforces TCPA penalties, and can consumers sue directly?
Four separate tracks can enforce, and they stack: private plaintiffs (individually or as a class), the Federal Communications Commission through forfeiture orders, the Federal Trade Commission through the Telemarketing Sales Rule, and state attorneys general under the TCPA and their own statutes.
The vocabulary matters because search results blur it. Damages are what private plaintiffs recover; forfeitures and civil penalties (“fines”) are what regulators impose. When a headline says a company was “fined” $28 million under the TCPA, it almost always means a class action settled.
Private plaintiffs produce most of the dollars. WebRecon’s litigation tracking, which counts consumer-statute filings monthly, recorded 1,532 TCPA suits in the first half of 2026, up 34 percent on the same period a year earlier, with roughly three quarters of them filed as class actions. A consumer needs no regulator’s permission to sue.
The FCC holds forfeiture authority for robocall violations and, since the TRACED Act, can propose one without a prior warning. What the record shows, though, is that this track rarely reaches a legitimate business that made a compliance mistake. The FCC’s December 2025 report to Congress on robocall enforcement lists one notice of apparent liability and one forfeiture order for all of 2024, both against the consultant behind the New Hampshire deepfake primary robocalls and both under the caller-ID spoofing provision, not the consent rules. It also records that no § 227 forfeiture penalties were collected that year. The FCC’s 2025 and 2026 proposed fines, $4.5 million apiece, targeted voice providers that let fraudulent traffic onto their networks. Where the FCC touches your campaign is complaint data: the same report logs 73,028 Do Not Call complaints and 33,137 robocall complaints for 2024, and plaintiffs’ firms and state regulators mine them.
The FTC enforces the Telemarketing Sales Rule, and any violation of the Telemarketing Sales Rule is regarded as an unfair or deceptive act or practice under the FTC Act. That classification carries civil penalties of up to $53,088 per violation under 16 CFR § 1.98, set in January 2025 and unchanged for 2026. The FTC and state attorneys general bring these cases, and each call, each misrepresentation and each missing record can count as its own violation. What the Rule actually requires, and which business-to-business calls are exempt from most of it, is covered in our guide to the Telemarketing Sales Rule.
State attorneys general can sue under the TCPA itself for $500 per violation on behalf of residents, and many states have their own telemarketing statutes with separate penalties and consent standards; Florida’s appears alongside the TCPA in one of the 2026 settlements below. The state-by-state mini-TCPA reference guide maps which statutes apply where.
How does one TCPA violation turn into a class action settlement?
It multiplies. A defect that touches every record on a list (a missing consent field, an unscrubbed segment, a dialer that plays a recording before an agent connects) repeats on every call, and a class action adds those calls up across everyone who received one.
Stated once, plainly: a 10,000-record list dialed twice with one shared defect is 20,000 violations. At $500 each that is $10 million of statutory exposure before anyone argues about willfulness, and $30 million if a court finds it. That is the number in the demand letter. It is not usually the number paid. Duane Morris’s mid-year 2026 class action settlement review, which ranks the year’s TCPA settlements with their dockets, puts the combined value of the ten largest at $69.1 million in 2025, down from $134.1 million in 2022, even as filing counts climbed. More cases, smaller recoveries, more companies touched: the exposure is real, and settlements land well below the arithmetic because due-process limits, class-size disputes and negotiation pull the figure down. Both facts belong in the same sentence when you brief leadership.
The second multiplier is who else’s calls you own. Under agency principles the FCC laid out in its 2013 declaratory ruling on seller liability, a seller can be liable for calls a vendor places on its behalf. The defining case is Dish Network. A federal court found Dish and its order-entry retailers responsible for more than 66 million violations of the Telemarketing Sales Rule, the TCPA and state law, and entered a $280 million judgment in 2017. Dish argued its retailer contracts disclaimed agency and required the retailers to follow the law. The Seventh Circuit’s 2020 Dish Network opinion held that those clauses did not prevent an agency relationship, affirmed liability and remanded the penalty; the Department of Justice’s announcement of the Dish settlement records the result at $210 million, split between the United States and four states.
Regulators now write the lesson into their orders: the FTC’s September 2025 Citizens Disability settlement, in the next section, requires due diligence on and monitoring of lead generators. For your campaign, indemnification moves money between you and a vendor after the fact; it does not remove your name from the complaint. What does is the ability to show consent proof, scrub logs and recordings for calls you did not personally place. If an outside call center places your calls, the compliance section of the telemarketing outsourcing service page lists the controls that run on every campaign there (DNC scrubbing, calling-hour enforcement, consent tracking and call recording compliance), which is a fair checklist to hold any vendor to.
Recent TCPA and TSR enforcement cases and what they cost companies
In the last two years, resolved cases have run from a $1 million FTC civil penalty to a $28 million class settlement, and the conduct behind them is ordinary: calling numbers on a Do Not Call list, texting after someone replied “stop,” playing a prerecorded message without written consent, calling a number that now belongs to someone else.
Case | Resolved | Enforcer or court | Conduct alleged | Amount |
|---|---|---|---|---|
Campbell v. Sirius XM Radio | Final approval July 2026; appeal filed Aug. 27, 2026 | C.D. Ill. (class action) | More than one solicitation call in 12 months to numbers on the National DNC Registry or Sirius XM’s internal DNC list, 2019–2025 | $28,000,000 plus list-scrubbing and calling-policy changes |
Fried v. Kaiser Foundation Health Plan | Final approval Jan. 2026 | State court (class action) | Text messages sent after recipients replied “stop”; TCPA and Florida Telephone Solicitation Act | $10,500,000 |
Walston v. National Retail Solutions (NRS Pay) | Preliminary approval Jan. 2026 | Ill. Cir. Ct. (class action) | Prerecorded telemarketing calls to cell phones without prior express written consent | $6,500,000 |
Ryan v. Wilshire Law Firm | Final approval June 2026 | June 2026 Fla. Cir. Ct. (class action) | Prerecorded messages to cell phones | $5,975,000 |
U.S. v. Citizens Disability and CD Media | Consent order announced Sept. 30, 2025 | FTC via DOJ, D. Mass. | 109 million+ telemarketing calls, 25.7 million of them to DNC-registered numbers; leads sourced from prize and coupon sites; misrepresenting that calls answered a consumer inquiry | $2,000,000 civil penalty, suspended to $1,000,000; ban on certain prerecorded calls; required monitoring of lead generators |
U.S. v. Day Pacer and EduTrek | Final orders Jan. 2024 | FTC, N.D. Ill. | Millions of calls to DNC-registered numbers using contact data collected from job-search websites | $28,700,000 civil penalties; permanent telemarketing ban |
$69.1 million: combined value of the ten largest TCPA class settlements in 2025, down from $134.1 million in 2022, while filings rose.
Three things stand out when you read the table as an operator rather than a headline. None of these defendants was a scam operation: a satellite radio company, a health plan, a software company, a payment processor, a law firm, a disability-benefits advocate. The dollar figures scale with list size, not with how egregious the conduct was. And the remedies have moved past money: Sirius XM’s settlement writes in list scrubbing and new calling policies; the FTC’s Citizens Disability announcement describes an order that writes in vendor oversight. Courts and regulators are prescribing operations.
Find out how your campaign would hold up
A campaign compliance audit looks at the same things a plaintiff’s attorney would ask for: consent records by contact, DNC and opt-out handling, scripts and recordings. Built on 115M+ third-party verifications.
Which TCPA violations generate the most penalties?
The claims that get filed cluster around five patterns: autodialed or prerecorded calls and texts without the right consent, calls to numbers on the National or an internal Do Not Call list, contact after revocation, calls to reassigned numbers, and calls placed by an unsupervised vendor. Every row in the table above is one of the five.
Consent failures are the largest category and the one with the most moving parts. Marketing calls and texts to cell phones made with an autodialer or a recorded or AI-generated voice require prior express written consent under 47 CFR § 64.1200. The FCC’s one-to-one consent rule never took effect; the Eleventh Circuit’s January 2025 decision vacated it, so the pre-2023 written-consent standard applies. Inside a campaign, a consent failure usually looks like a lead file with a “consent: yes” column and nothing behind it; the NRS Pay and Wilshire settlements are what that column costs when a plaintiff asks for the record. The safeguard is a consent record retrievable per contact, with the disclosure text, timestamp and number agreed to. What it must contain, and how to store it, is covered in the prior express written consent guide.
Do Not Call failures are older and simpler, and they produced the largest settlement in the table. Sirius XM’s $28 million resolved claims that it called people on the National Registry or people who had asked, on a prior call, to go on the company’s own list. That second half is what campaigns miss: the internal list has to capture a request made to an agent in the moment, and the record has to leave the dialer before the next pass. How often to scrub, and against which lists (national, state, internal, litigator), is covered in the DNC scrubbing guide.
Revocation is the newest exposure. Since April 11, 2025, callers must honor a revocation made by any reasonable means within a reasonable time not exceeding 10 business days, per the FCC’s revocation-rule effective-date notice. The Kaiser settlement, $10.5 million for texts sent after people replied “stop,” is that rule’s price tag. One piece is on hold: treating a single revocation as covering all future calls and texts from the company on unrelated matters is waived until January 31, 2027 while the FCC decides whether to change it, per the FCC’s January 2026 waiver order. The operational question: when someone says stop, how many business days pass before every system that could dial or text them knows?
Reassigned numbers are how a company ends up calling a stranger. Gen Digital’s $9.95 million settlement resolved claims over prerecorded account calls to people with no Norton or LifeLock account, the signature of a number that changed hands after consent was given. Callers who query the FCC’s Reassigned Numbers Database before dialing, and keep the query records, have a safe harbor if the database was wrong.
Vendor-placed calls carry everything above plus the agency question from the previous section. The kind of control a court looks for, when deciding whether a seller directed its vendor’s conduct, is the kind that shows up in QA records: scripts that were read as written, and consequences when they were not.
What should you do when a TCPA penalty claim or demand letter arrives?
Preserve everything first, then size the problem before anyone responds. Pull the specific contact’s consent record, call history and dispositions, stop contacting that number across every channel, and run the same defect across the rest of the list to find out whether you have one call or a class.
Preservation means what a plaintiff’s attorney will ask for in discovery: call recordings, dialer logs with timestamps, consent records with the disclosure text as shown, opt-out and DNC records, list-vendor files and the contracts behind them. Retention schedules that would delete any of these get suspended the day the letter arrives.
Diagnosis is an operational job. The letter names a person and a call count. Your systems say whether the count is right, whether consent existed and in what form, whether the number was on a DNC list at the time, and whether the same condition applies to 10 other records or 10,000. That answer sets the scale of everything that follows.
Response is a legal decision, and this post does not give legal advice. Whether to answer, how to characterize the calls, whether to negotiate: those belong with counsel who handles TCPA matters. The operational work makes counsel’s job possible. A documented incident with a known cause, a contained population and a fix in place resolves very differently from one where the first question (“do we have consent for this number?”) takes three weeks to answer. Deciding which kind of help you need first, and what each one can actually do for you, is the subject of when to hire a compliance consultant vs. a TCPA attorney.
Frequently asked questions
What penalties are associated with violations of the TCPA?
Statutory damages of $500 per violating call or text, which a court can increase to $1,500 per violation for willful or knowing conduct; injunctions ordering the calls to stop; FCC forfeiture penalties; and enforcement by state attorneys general under the TCPA and state telemarketing statutes. Telemarketing that also falls under the FTC’s Telemarketing Sales Rule can draw civil penalties of up to $53,088 per violation (the figure set in January 2025 and unchanged for 2026).
How much can a company be fined for TCPA violations?
Regulators impose the fines: FCC forfeitures under the Communications Act and FTC civil penalties of up to $53,088 per violation under the Telemarketing Sales Rule. Most of the large dollar figures reported as TCPA “fines” are private class action settlements, which have no statutory cap because they are $500 to $1,500 multiplied across every call in the class. The largest TCPA class settlement approved in 2026 was $28 million; the largest recent FTC telemarketing civil penalty judgment was $28.7 million.
Any violations of the Telemarketing Sales Rule are regarded as what?
Under the Telemarketing Act, a violation of the Telemarketing Sales Rule is treated as an unfair or deceptive act or practice under Section 5 of the FTC Act. That is what lets the FTC seek civil penalties of up to $53,088 per violation, injunctions and consumer redress, and it lets state attorneys general enforce the Rule as well. There is no general private right of action under the Rule itself.
Is a company liable for TCPA violations made by a call center or vendor calling on its behalf?
It can be. The FCC’s 2013 declaratory ruling applied federal common-law agency principles, so a seller can be vicariously liable when it controlled, authorized or ratified the vendor’s calling. In the Dish Network litigation, contract clauses disclaiming agency and requiring legal compliance did not prevent liability for retailers’ calls. Indemnification shifts money between the parties afterward; it does not take the seller out of the case.
Do TCPA penalties apply to text messages the same way as calls?
Yes. The FCC has treated a text message as a “call” under the TCPA since 2003, so an autodialed marketing text sent without the required consent carries the same $500 to $1,500 per-message statutory damages. Because texts are cheap to send in volume, text campaigns tend to produce larger classes than voice campaigns; the $10.5 million Kaiser settlement in January 2026 involved texts sent after recipients replied “stop.”
Not sure whether you need a lawyer or an operations fix?
We don’t provide legal advice. We can walk through what your call records, consent logs and scrub history actually show, so you know what kind of help you need.
