Compliance Guide
TCPA Compliance: Rules, Consent & Penalties
· 12 min read
What is TCPA compliance?
Short answerTCPA compliance means following the Telephone Consumer Protection Act (47 U.S.C. § 227) when you call or text consumers. In practice it requires documented prior express written consent before marketing to a mobile number with an autodialer or prerecorded voice (the FCC's rule, which the Fifth Circuit no longer enforces), honouring opt-outs within 10 business days, and scrubbing your list against the National Do Not Call Registry at least every 31 days. Damages run up to $1,500 per violation.
Checking a whole list? Preview 20 rows of it free →
On this page
The Telephone Consumer Protection Act is the single largest legal risk in outbound calling, and the reason is structural: it grants consumers a private right of action with fixed statutory damages. A plaintiff does not have to prove they lost money. They have to prove you called, and that you lacked consent.
That design has produced an industry of serial filers, and it means the cost of a sloppy lead list is not theoretical. This page covers what the rules actually require in 2026, including two recent changes that most vendor content still reports incorrectly.
What changed recently
The one-to-one consent rule was vacated in January 2025 and never took effect. New revocation rules did take effect on April 11, 2025, cutting the opt-out window to 10 business days. The separate "revoke-all" provision is waived until January 31, 2027, and an order the FCC adopted on September 30, 2026 (FCC 26-67), released October 1, 2026, narrows it so an opt-out covers only the category of informational message it answered. That order takes effect 30 days after it is published in the Federal Register, which had not happened as of October 8, 2026. Two appeals rulings also narrowed the statute in 2026: the Fifth Circuit held that the statute asks only for prior express consent, oral or written, so it does not enforce the FCC's written-consent rule, and the Seventh Circuit held that the Do Not Call claim does not reach text messages. Each binds its own circuit only. Details in the sections below.
What the TCPA actually restricts
The statute targets a specific combination: the technology used, the type of number called, and the purpose of the call. Miss any of the three and you can misjudge your exposure.
| You are doing this | To this kind of number | You need |
|---|---|---|
| Marketing, using an autodialer or prerecorded voice | Mobile | Prior express written consent under the FCC's rule (prior express consent, oral or written, in the Fifth Circuit) |
| Marketing, manually dialled | Mobile | No autodialer consent needed, but DNC rules still apply |
| Informational or transactional, autodialled | Mobile | Prior express consent (a lower bar -- providing the number can suffice) |
| Marketing, prerecorded voice | Residential landline | Prior express written consent, subject to exemptions |
| Any marketing call or text | Number on the National DNC Registry | Consent, or an established business relationship |
Under the autodialer and prerecorded-voice provision, § 227(b), a text counts as a call: the FCC has consistently said so, and the Ninth Circuit held it in Howard v. RNC (January 2026). So every consent rule above applies to your SMS campaigns as written. The Do Not Call claim is different. The Seventh Circuit held in Steidinger v. Blackstone (July 2026) that § 227(c)(5) "does not permit plaintiffs to sue for the receipt of unwanted texts", while a federal court in Oregon held the opposite in Wilson v. Skopos (2025). Where a plaintiff files now changes the answer, and the FCC's own Do Not Call rules still name text messages.
Consent: the part that decides your case
Almost every TCPA dispute turns on consent -- whether it existed, whether it covered this seller and this number, and whether you can prove it. The burden of proof is yours, not the plaintiff's. A consent record you cannot produce is functionally the same as no consent at all.
Prior express written consent
The FCC's rule, 47 C.F.R. § 64.1200(a)(2), requires prior express written consent for marketing robocalls and robotexts to mobile numbers: a signed written agreement that:
- identifies the specific seller authorised to make the calls;
- identifies the specific number being consented to;
- states that the consumer agrees to receive autodialed or prerecorded marketing;
- discloses that consent is not a condition of any purchase.
Electronic signatures are valid under the E-SIGN Act. What matters operationally is retention: keep the form, the timestamp, the IP address, and the exact page or script the consumer saw.
The Fifth Circuit's exception
In Bradford v. Sovereign Pest Control of TX, No. 24-20379, decided February 25, 2026, the Fifth Circuit read the statute without deferring to the FCC, as the Supreme Court's 2025 ruling in McLaughlin Chiropractic v. McKesson allows, and held that "prior express consent" means consent given orally or in writing: "The statute provides no basis for concluding that telemarketing calls require prior express written consent but not oral consent." The ruling binds courts in Texas, Louisiana and Mississippi only. The written-consent rule is still in the FCC's regulations, and other circuits are free to apply it. A national list reaches every circuit and a plaintiff chooses where to file, so written consent remains the safe operating standard. TCPA lawsuits sets out how the 2025 and 2026 rulings change what a plaintiff can claim, and where.
The one-to-one consent rule that never happened
In December 2023 the FCC adopted a rule requiring consent to be given to one seller at a time, and limiting calls to subjects "logically and topically associated" with the interaction that produced the consent. It was aimed at the lead-generation practice of one form authorising dozens of buyers.
On January 24, 2025, the Eleventh Circuit vacated it in Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277, holding that the FCC had exceeded its statutory authority because the rule conflicted with the ordinary meaning of "prior express consent." The court remanded to the agency, which has no deadline to act.
Why this matters when you read other guides
A great deal of published TCPA content -- including pages from established vendors -- still describes one-to-one consent as a live or upcoming requirement. It is not. It was vacated before its effective date. If a compliance article you are relying on has not been updated since January 2025, treat its consent section as unreliable.
Revocation, as of April 2025
The FCC's revocation order did take effect on April 11, 2025, and it tightened things meaningfully:
- 10 business days to process an opt-out. Company-specific do-not-call requests, which used to get 30 days, now get the same 10 business days.
- Consumers may revoke by any reasonable means. The keywords
stop,quit,revoke,opt out,cancel,unsubscribeandendare reasonable per se when sent in reply to a text; a reply in other words must be honoured if a reasonable person would read it as a revocation, and any other route, such as a voicemail or email, creates a rebuttable presumption that consent was revoked. An order the FCC adopted on September 30, 2026 (FCC 26-67) lets callers designate an exclusive opt-out method once it takes effect; until then, they may not. - Revocation crosses channels: an opt-out sent by text also ends calls, and vice versa.
- If your platform cannot receive reply texts, you must disclose that and offer another reasonable route.
- You may send one confirmation text, within 5 minutes, containing no marketing content.
One provision is not in force. Section 64.1200(a)(10) would require a revocation given in response to one kind of informational message to end all future messages on unrelated topics. The FCC's Consumer and Governmental Affairs Bureau waived it in April 2025 and, in January 2026, extended the waiver to January 31, 2027. An October 2025 notice (FCC 25-76) asked how the rule should be modified, and on September 30, 2026, the Commission adopted an order (FCC 26-67) that lets a caller treat an opt-out from an informational robocall as covering only the category it answered. That order replaces the waiver 30 days after it is published in the Federal Register, which had not happened as of October 8, 2026, so until then the waiver still governs. See the FCC's TCPA opt-out order.
Do Not Call obligations
DNC rules run alongside the consent rules -- satisfying one does not satisfy the other.
- Scrub against the National Do Not Call Registry at least every 31 days. The FTC tightened this from quarterly effective January 1, 2005; it has been the standard for two decades.
- Every seller needs its own Subscription Account Number (SAN). If a telemarketer or service provider scrubs on your behalf, you share your SAN with them -- you do not rely on theirs.
- Maintain an internal do-not-call list. It is independent of the federal registry, covers every telemarketing call and every exempted prerecorded call to a residential line, and each request must be honoured within 10 business days and kept for five years.
- Consumer registrations do not expire. A number stays on the registry until it is disconnected and reassigned, or the consumer removes it.
- State registries exist too, and several impose stricter rules than the federal baseline.
Reassigned numbers: the trap that catches careful callers
Consent attaches to the person, not the digits. When a consumer gives you consent and later gives up the number, that number is aged for at least 45 days and then reassigned to someone new -- and your consent is worthless the moment it changes hands. The FCC estimates roughly 35 million numbers are disconnected and made available for reassignment each year.
The FCC's Reassigned Numbers Database (live since November 2021, at reassigned.us) exists for this. You query a number plus the date you obtained consent, and get one of three answers:
| Response | Meaning | What to do |
|---|---|---|
| Yes | Permanently disconnected since your consent date | Do not call without fresh consent |
| No | Not disconnected since that date | Safe to call, and the safe harbour applies |
| No Data | Insufficient records to answer | Your judgement -- no safe harbour either way |
The safe harbour protects you from liability if you call a reassigned number in reliance on an erroneous "no". It has four elements: you held consent before reassignment; you called after it; you checked the most recent database data and received "no"; and that "no" was wrong. Note the first element -- the safe harbour cannot rescue a call you never had consent to make.
Two limits worth internalising. Carriers report disconnections on the 15th of each month, so "most recent data" effectively means re-scrubbing monthly. And the database says nothing about wrong numbers -- digits that never belonged to your consumer at all. For those you need commercial phone-intelligence data, not the RND.
What violations cost
| Route | Amount | Who brings it |
|---|---|---|
| TCPA autodialer or prerecorded voice, § 227(b)(3) | $500 per violation, or actual loss if greater | Private plaintiff or class |
| TCPA Do Not Call, § 227(c)(5) | Up to $500 per violation | Private plaintiff or class |
| Either, willful or knowing | Up to $1,500 per violation | Private plaintiff or class |
| TSR civil penalties | Up to $53,088 per violation | FTC (2025 level, unchanged for 2026) |
| State telemarketing laws | Varies; some exceed federal | State attorneys general, private suits |
The absence of a damages cap is what makes this a business risk rather than a compliance line item. Per-violation damages multiplied by a campaign-sized list is how a routine SMS blast becomes an existential number. TCPA violations and fines works through the arithmetic, and the FTC's separate penalties under the Telemarketing Sales Rule.
Serial litigators
A small, organised population files TCPA lawsuits as a business. Their methods are deliberate: seeding numbers into lead-generation forms, maintaining many lines, documenting every contact, and -- as compliance practitioners have reported -- coordinating so that a number changes hands after consent is given, defeating the consent on file.
You cannot identify these numbers by looking at them. They are valid, active mobile numbers that pass every technical check. The only practical defence is to compare your list against a court-sourced database of known filers before the campaign runs, which is what a batch litigator scrub does.
Quick check: TCPA compliance in 2026
Pick an answer to see whether it is right, and why.
TCPA compliance checklist
A working list. It is not a substitute for counsel, and it will not fit every business.
Before you collect a lead
- Consent language names your company specifically, not a category of "partners".
- The form discloses that consent is not a condition of purchase.
- You capture and retain the timestamp, IP address, and the exact wording shown.
- If you buy leads, your contract obliges the vendor to produce consent records on demand -- and you have tested that they can.
Before every campaign
- Scrub against the National DNC Registry, within the last 31 days.
- Scrub against your internal do-not-call list.
- Scrub against applicable state registries.
- Check line type, so marketing texts are not sent to landlines and disconnected numbers are dropped.
- Run a known-litigator check.
- For aged leads, query the Reassigned Numbers Database.
Operationally, all the time
- Opt-outs processed within 10 business days, across every channel.
- All seven FCC revocation keywords recognised by your platform.
- Calling hours respected -- 8am to 9pm in the consumer's time zone, not yours, and stricter rules in several states (see telemarketing calling hours by state).
- Caller ID transmits an accurate name and a callable number.
- Consent records retained at least four years, matching the TCPA statute of limitations.
- Written policies exist, staff are trained, and both are documented.
Where NumberBroom fits
NumberBroom covers the list-hygiene rows above: carrier-level validation to establish line type, and a court-sourced litigator check, in one pass over your CSV at $0.20 per number, $5 minimum, with no subscription. It does not manage consent, and no scrubbing tool can -- consent is a process you own. See how the different categories of TCPA tooling fit together, TCPA compliance software compared vendor by vendor, or check a single number with the free carrier lookup to see the output format.
TCPA questions people actually ask
What does TCPA stand for?
TCPA stands for the Telephone Consumer Protection Act, a federal law passed in 1991 and codified at 47 U.S.C. § 227. It restricts telemarketing calls, texts, and faxes, and it is enforced both by the FCC and by private plaintiffs who can sue directly.
How much is a TCPA violation?
Statutory damages are $500 per violation for an autodialed or prerecorded call or text without the required consent (§ 227(b)(3)) and up to $500 for a Do Not Call violation (§ 227(c)(5)). A court may raise either to up to $1,500 where the conduct was willful or knowing. There is no cap on the total, which is why class actions reach eight figures -- 20,000 improper autodialed texts is a $10 million exposure at the base rate, and $30 million trebled.
Separately, the FTC can pursue civil penalties of up to $53,088 per violation of the Telemarketing Sales Rule. It is normally adjusted for inflation each year, but the FTC held 2026 penalties at the 2025 level.
Is the one-to-one consent rule in effect?
No. The FCC's one-to-one consent rule was vacated by the Eleventh Circuit in Insurance Marketing Coalition Ltd. v. FCC on January 24, 2025. The court held the FCC exceeded its statutory authority because the rule conflicted with the ordinary meaning of "prior express consent." It never took effect.
A single consent form naming multiple sellers can still be valid. The FCC's pre-existing prior-express-written-consent requirement is still in its rules, though the Fifth Circuit no longer enforces it (see the next question). Be careful with older articles -- a lot of vendor content still describes this rule as upcoming.
What is prior express written consent?
A written agreement, signed by the consumer, that clearly authorises the specific seller to deliver marketing calls or texts to a specific number using an autodialer or prerecorded voice. It must disclose that consent is not a condition of purchase. An electronic signature counts.
The FCC's rule, 47 C.F.R. § 64.1200(a)(2), requires it for autodialed or prerecorded marketing to mobile numbers. Purely informational or transactional calls sit under a lower standard.
The Fifth Circuit held in Bradford v. Sovereign Pest Control (February 2026) that the statute asks only for prior express consent, oral or written, so courts in Texas, Louisiana and Mississippi do not enforce the written requirement. Elsewhere the rule still applies.
How quickly must I honour an opt-out?
Within 10 business days. The FCC's revocation rules, effective April 11, 2025, set that as the outer limit for honouring a revocation, and cut the limit for company-specific do-not-call requests from the previous 30 days.
Consumers may revoke using any reasonable method. The words stop, quit, revoke, opt out, cancel, unsubscribe, and end are reasonable per se when sent in reply to a text; a reply in other words must be honoured if a reasonable person would read it as a revocation, and any other route, such as a voicemail or email, creates a rebuttable presumption that consent was revoked.
Who is exempt from TCPA rules?
No one is fully exempt, but several categories face lighter requirements. Calls made with the consumer's prior express written consent are permitted. Purely informational and transactional calls, calls from tax-exempt non-profits, political calls, and calls to a consumer with whom you have an established business relationship are treated differently from marketing robocalls.
Two cautions. Exemptions from the Do Not Call Registry rules are not exemptions from the TCPA's autodialer and consent rules -- they are separate requirements. And on any telemarketing call, or exempted prerecorded call to a residential line, an internal do-not-call request must be honoured whatever else you qualify for.
Collections is the case most often misread in both directions: calls made solely to collect a debt sit outside the registry rules, but autodialed and prerecorded calls to wireless numbers still need consent. TCPA compliance for debt collection separates the TCPA's rules from Regulation F's.
Do TCPA rules apply to text messages?
Yes, with one open question. Under § 227(b), the autodialer and prerecorded-voice provision, courts generally treat a text as a call (the Ninth Circuit held it in Howard v. RNC, January 2026), so the consent rules for calls apply to texts. Whether the Do Not Call claim in § 227(c)(5) covers texts is split: the Seventh Circuit held it does not in Steidinger v. Blackstone (July 2026), a federal court in Oregon held it does. The FCC's Do Not Call rules still name texts, so scrub an SMS list as you would a call list.
Practical consequence: sending a marketing text to a landline fails silently and wastes spend, while sending one to a mobile without documented consent creates $500–$1,500 of exposure per message. Line type matters for both reasons. See the full SMS compliance breakdown, including why A2P 10DLC registration is a separate requirement from TCPA consent.
Does scrubbing my list make me TCPA compliant?
No. Scrubbing removes known risk from a list -- invalid numbers, wrong line types, registry matches, known serial litigators -- but it cannot manufacture consent you never obtained. Consent is the foundation; scrubbing is risk reduction on top of it.
Treat them as two separate obligations: get and document consent, then scrub before every campaign.
What is the TCPA safe harbor?
The clearest safe harbor in the TCPA rules applies to reassigned numbers. If you held valid consent, the number was later reassigned to someone else without your knowledge, and you checked the FCC's Reassigned Numbers Database before calling and received a "no" answer, you are protected from liability for that one call -- even though the "no" turned out to be wrong. The four elements all have to be met; there is no general TCPA safe harbor that excuses a call made without consent in the first place.
Some state mini-TCPA statutes define their own, separate safe harbors -- for example, a cure period for isolated technical violations. Those are state-specific and do not apply to the federal TCPA.
What are TCPA disclosure requirements?
Three disclosure obligations run in parallel, and they attach at different points in the relationship:
- At the point of consent. A written consent agreement must state that consent is not a condition of purchase.
- During the call, promptly. Under the Telemarketing Sales Rule (16 C.F.R. § 310.4(d)), a telemarketer must promptly disclose the identity of the seller, that the call's purpose is to sell something, and the nature of the goods or services.
- On every marketing text. A clear way to opt out -- reply STOP or equivalent -- has to be available, and an opt-out request must be honored within 10 business days.
None of these substitute for the underlying consent requirement; they are obligations on top of it.
Does the TCPA have a healthcare exemption?
Two narrow ones, and they are often merged. Under 47 C.F.R. § 64.1200(a)(2), a HIPAA-covered entity or its business associate may deliver a "health care" message to a mobile with ordinary prior express consent rather than written consent; to a residential line, § 64.1200(a)(3)(v) caps such prerecorded calls at one a day and three a week per patient. Separately, § 64.1200(a)(9)(iv) exempts healthcare providers from the consent requirement altogether for calls and texts to the wireless number the patient provided -- appointment and exam reminders, wellness checkups, hospital pre-registration and pre-operative instructions, lab results, post-discharge follow-up, prescription notifications and home healthcare instructions -- provided the message is free to the patient.
That second exemption has hard limits: no telemarketing, solicitation or advertising, and no billing, debt-collection or other financial content; one message a day and three a week per patient; and an opt-out in every message, honoured immediately. Neither exemption covers marketing calls from a healthcare business.
Does TCPA apply to email marketing?
No. The TCPA governs calls, and the FCC and most courts treat text messages as calls for this purpose, but not email. Commercial email is regulated separately, primarily by the CAN-SPAM Act, which has its own requirements (accurate header information, a functioning opt-out, a postal address) and its own penalty structure.
If a campaign mixes channels -- email plus SMS follow-up, for example -- the SMS leg still needs TCPA-compliant consent even though the email leg does not.
- 47 U.S.C. § 227 -- Restrictions on use of telephone equipment (Cornell LII)
- FCC -- TCPA rules on revoking consent, effective April 11, 2025
- FCC -- CGB extends the effective date of the TCPA's consent revocation rule (DA 26-12, January 6, 2026)
- FCC -- Report and Order and FNPRM on consent revocation, adopted September 30, 2026 (FCC 26-67)
- Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. 2025)
- McLaughlin Chiropractic Assocs. v. McKesson Corp., 606 U.S. 146 (2025)
- Bradford v. Sovereign Pest Control of TX, No. 24-20379 (5th Cir. 2026)
- Steidinger v. Blackstone Medical Services, No. 25-2398 (7th Cir. 2026)
- Wilson v. Skopos Financial, No. 6:25-cv-00376 (D. Or. 2025)
- Howard v. Republican National Committee, 164 F.4th 1119 (9th Cir. 2026)
- FTC -- Complying with the Telemarketing Sales Rule
- FTC -- Q&A for Telemarketers & Sellers About DNC Provisions in the TSR
- FCC -- Reassigned Numbers Database
- 47 C.F.R. § 64.1200(a)(2) -- healthcare message exemption (eCFR)
- 16 C.F.R. § 310.4(d) -- required telemarketing disclosures (Cornell LII)