TCPA

The Telephone Consumer Protection Act (TCPA) is the US federal law that governs how businesses may call and text consumers. Passed in 1991 and codified at 47 U.S.C. § 227, it was written for an era of telemarketing cold calls and junk faxes, but its reach now extends to nearly every automated SMS campaign, appointment reminder, and dialer-driven outreach programme running today.

What makes the TCPA unusual among privacy statutes is that it carries a private right of action with statutory damages. A consumer does not have to prove financial harm to sue, and damages are set per message rather than per campaign. That structure is why TCPA exposure scales so badly across a large contact list, and why knowing the line type behind each number is a compliance question rather than a deliverability preference.

The TCPA also sits alongside a patchwork of state telemarketing statutes, several of which impose tighter restrictions than the federal baseline. Florida and Oklahoma in particular have passed mini-TCPA laws with their own private rights of action, which means a campaign that satisfies federal requirements can still generate claims in a specific state.

Related reading

• Phone validation for debt collection
• Phone validation for insurance leads
• How to clean a phone list for SMS

What is the TCPA?

The TCPA is a consumer protection statute administered by the Federal Communications Commission. It restricts calls and texts made using an automatic telephone dialling system (ATDS), calls using an artificial or prerecorded voice, unsolicited fax advertisements, and calls to numbers on the National Do Not Call Registry.

• ✓Calls and texts placed using an automatic telephone dialling system to a mobile number.
• ✓Calls delivering an artificial or prerecorded voice message.
• ✓Marketing calls to any number listed on the National Do Not Call Registry.
• ✓Calls placed outside the permitted window of 8am to 9pm in the recipient's local time.
• ✓Unsolicited advertisements sent by fax, the restriction the statute was originally written around.

Courts have long treated a text message as a call for TCPA purposes. That interpretation is what pulled modern SMS marketing squarely inside a statute drafted before text messaging was in common use, and it is the reason an SMS programme carries the same consent obligations as an outbound dialling programme.

The statute is enforced along three separate tracks. The FCC issues rules and can levy forfeitures. State attorneys general can bring actions on behalf of residents. And private individuals can sue directly, which in practice generates the largest share of TCPA litigation because plaintiffs do not need to demonstrate any actual loss.

Statutory damages are set at 500 dollars per violation, rising to as much as 1,500 dollars where a court finds the violation was wilful or knowing. Because the unit of violation is the individual message, a single misdirected campaign against a list of any size can produce an exposure figure far larger than the revenue the campaign was meant to generate.

The statute also carves out a narrow set of exemptions. Calls made for emergency purposes fall outside it entirely, and some non-marketing informational calls to landlines are treated more permissively than the same content sent to a mobile. Established business relationships can permit certain marketing calls that would otherwise be barred by the national registry, though that relationship has a defined lifespan and does not override a direct request to stop.

Because the statute predates modern outreach tooling, much of its practical shape comes from FCC rulemaking and case law rather than the text itself. That is worth understanding before relying on any summary, including this one: the operative question in a dispute is usually how a specific court has read a specific provision, not what the 1991 language appears to say on its face.

How the TCPA works

The obligations that attach to a given message depend on three things: who is being contacted, what technology is placing the call, and what the message is for. Get any of the three wrong and the analysis changes.

Consent is the central requirement. Autodialled or prerecorded calls and texts to a mobile number generally require prior express consent. Where the message is marketing, the standard rises to prior express written consent, meaning a signed agreement that clearly discloses what the consumer is agreeing to receive. Consent must be obtained before the first message, not inferred from a lack of objection afterwards.

• ✓Prior express consent — the baseline for autodialled or prerecorded contact with a mobile number.
• ✓Prior express written consent — required where the message is marketing, and it cannot be a condition of purchase.
• ✓Established business relationship — permits some marketing calls the Do Not Call Registry would otherwise bar, for a limited period.
• ✓Revocation — a consumer may withdraw consent by any reasonable means, and sending must stop.

The definition of an automatic telephone dialling system was narrowed substantially by the Supreme Court in Facebook v. Duguid in 2021, which held that a system qualifies only if it uses a random or sequential number generator to store or produce numbers. That decision reduced exposure for some platforms, but it did not touch the separate restrictions on prerecorded and artificial voice calls, nor the Do Not Call rules, nor any applicable state law.

Do Not Call obligations run in parallel with consent. Marketing calls to numbers on the national registry are prohibited absent an established business relationship or express permission, and organisations must also maintain and honour their own internal suppression list when someone asks them specifically to stop.

Timing rules apply as well. Telemarketing calls are restricted to the window between 8am and 9pm in the recipient's local time zone, which means the area code alone is an unreliable guide once number portability has moved a number away from its original geography.

Consent is also revocable. A consumer may withdraw consent through any reasonable means, and a business must stop sending once that happens. Systems that capture opt-outs in one channel but continue sending from another are a recurring source of claims.

Liability can also attach vicariously. A business that hires a lead generator or an outbound calling vendor may be held responsible for calls that vendor makes on its behalf, even where the business never touched the list. Contractual indemnities are common but do not prevent a plaintiff from naming the brand, which is why diligence over how purchased leads were collected matters as much as diligence over your own forms.

Record keeping is what makes a defence possible. Where a dispute arises, the business generally carries the burden of demonstrating that consent existed, and a consent record that cannot show the wording presented, the timestamp, and the capture mechanism is difficult to rely on. Retention periods should outlast the limitations window for claims.

Why the TCPA matters for SMS and outreach teams

For anyone running outreach at volume, the TCPA converts list quality from an efficiency concern into a legal one. The same list hygiene work that reduces wasted spend also reduces the number of messages that could form the basis of a claim.

• ✓Line type decides which consent rules apply, so a list that mixes mobiles and landlines cannot be routed correctly.
• ✓Reassigned numbers silently void the consent you hold, and nothing notifies you when a number changes hands.
• ✓Disconnected numbers do not create claims directly, but they signal a list whose consent records are equally stale.
• ✓Damages accrue per message, so exposure scales with list size rather than with the number of campaigns you run.

The clearest example is line type. The consent rules that apply to a mobile number are stricter than those for a landline, because the statute was written partly to protect consumers from bearing the cost of unwanted calls to a device they pay for per use. A list that mixes mobiles and landlines without distinguishing them cannot be routed correctly, which means a business is either over-restricting its landline outreach or under-protecting its mobile outreach.

Reassigned numbers are the second exposure. A number captured with valid consent two years ago may now belong to someone who never agreed to anything. Because damages accrue per message, a campaign that repeatedly contacts a block of reassigned numbers compounds quietly until a complaint surfaces.

Disconnected and invalid numbers matter for a related reason. They do not generate TCPA claims directly, since nobody receives the message, but they are a reliable indicator that a list has not been maintained. A list carrying a high proportion of dead numbers is usually carrying stale consent records too.

There is a deliverability dimension as well. Carriers filter aggressively on sender behaviour, and a sender pushing volume at numbers that cannot receive messages accumulates the failure signals that degrade delivery for the traffic that would otherwise land. Compliance hygiene and deliverability hygiene are largely the same work.

There is also a purely commercial argument. Outreach programmes that route by line type convert better, because the channel matches the device. Sending an SMS to a number that reaches a desk phone produces nothing, while placing a voice call to a mobile that would have responded to a text wastes an agent's time. The compliance work and the performance work point in the same direction.

Getting started with the TCPA

Start by establishing what you actually hold. For each contact, you want the line type, whether the number is currently assigned and active, and a consent record showing what the person agreed to, when, and through what mechanism. Most lists are missing at least one of the three.

1. 1
   Audit what you hold — Export your contact list and check which rows have a consent record you could actually produce in a dispute, including the wording shown and the timestamp.
2. 2
   Append line type — Run a validation pass so every number carries a mobile, landline, VOIP or invalid classification before you decide how to contact it.
3. 3
   Segment before sending — Route mobiles, landlines and VOIP numbers into different treatments, because what you may send and what can arrive differ across them.
4. 4
   Enforce suppression at send time — Opt-outs and internal do-not-call entries belong in the sending path across every channel, not in a spreadsheet alongside it.
5. 5
   Revalidate on a schedule — Contact data decays continuously, so check before each significant campaign rather than once at import.

Finally, treat this as a starting point rather than legal advice. The TCPA interacts with state telemarketing statutes, some of which are stricter than the federal baseline, and the regulatory position moves. Anyone running outreach at scale should have counsel review their consent flow and retention practices.

Key takeaways: the TCPA

• ✓The TCPA is the US federal law governing automated calls and texts, and courts treat an SMS message as a call for its purposes.
• ✓Damages are statutory and per message, at 500 dollars rising to 1,500 for wilful violations, so exposure scales with list size rather than campaign count.
• ✓Autodialled or prerecorded contact with a mobile number generally requires prior express consent, and marketing requires prior express written consent.
• ✓Facebook v. Duguid narrowed what counts as an autodialer in 2021, but left the prerecorded voice, Do Not Call, and state law restrictions untouched.
• ✓Consent belongs to the person rather than the number, so a reassigned number silently invalidates whatever permission you previously held.
• ✓Knowing the line type behind each number is a prerequisite for routing outreach compliantly, not an optimisation applied afterwards.
• ✓Several states, notably Florida and Oklahoma, run mini-TCPA statutes that are stricter than the federal rule and carry their own private rights of action.
• ✓Liability can attach vicariously to the brand for calls made by a lead generator or outbound vendor on its behalf.

Frequently asked questions about the TCPA

• Does the TCPA apply to text messages or only to phone calls?

• What is the difference between prior express consent and prior express written consent?

• How much can a business be sued for under the TCPA per message?

• Do I still need consent if someone gave me their number on a form?

• What happens to consent when a phone number is reassigned to someone else?

• Does validating my phone list make my campaign TCPA compliant?

• Are there state laws that are stricter than the federal TCPA?

• Can my business be liable for TCPA violations by a lead vendor?

Related terms and concepts

• DNC list — A registry of phone numbers that must not be contacted for marketing purposes.
• Opt-in — A recipient explicitly granting permission to be contacted by call or text.
• Line type — The classification of a phone number as mobile, landline, VOIP, or invalid.
• Reassigned number — A number reissued to a new subscriber after the previous holder gave it up.
• A2P messaging — Application-to-person SMS — messages sent by software to a person, rather than between two people.