TCPA Compliance

TCPA compliance is how a US call center obeys the Telephone Consumer Protection Act (TCPA) of 1991, a law that limits telemarketing calls, recorded voice, autodialed texts, and junk faxes. It also sets consent, calling hours, and Do Not Call rules.

Statutory damages are what give the law teeth — every unlawful call carries $500, and a willful violation triples that to $1,500. Because the figures multiply per call, one sloppy campaign can become a class action worth millions.

The Federal Communications Commission (FCC) enforces the act, and the Federal Trade Commission (FTC) polices adjacent telemarketing rules. Both agencies share the National Do Not Call Registry, and both treat consumer complaints as their audit trail.

Outsourced call center programs inherit that exposure the moment they dial a US number. That’s why every serious BPO with US-facing voice work runs a live TCPA control layer under contract with its client.

Key takeaways

• The TCPA (1991) governs telemarketing calls, prerecorded voice, autodialed texts, and junk faxes to US consumers.
• Statutory damages run $500 per unintentional call and up to $1,500 per willful violation, so class-action risk is real.
• Prior express written consent is required before autodialed or prerecorded marketing calls reach mobile numbers.
• Calls to US residences are barred before 8 a.m. and after 9 p.m. in the consumer’s local time, with no exceptions.
• The FCC’s one-to-one consent rule reset how lead forms and outbound marketing partners work together.

How it works

TCPA compliance runs on three overlapping controls — prior express consent, calling time windows, and Do Not Call scrubbing. Every outbound campaign is checked against the national registry, an internal suppression list, and a signed consent record kept four years.

The FCC drafts the rules and federal courts enforce them. Because the statute carries a private right of action, most TCPA claims arrive as class actions rather than agency fines. That civil route makes TCPA the sharpest tooth in US contact center compliance.

Consent is the linchpin — for informational autodialed or prerecorded calls to a mobile phone, prior express consent is enough. For marketing calls to a mobile, the bar rises to prior express written consent, a signed disclosure naming one specific seller.

The FCC’s one-to-one consent rule, finalized in December 2023 and phased in through 2025, requires that consent go to a single seller at a time. It hit lead generation hardest, because one bundled form can no longer feed dozens of partners.

Calling hours are the easiest rule to break and the easiest to prove. US residences cannot be dialed before 8 a.m. or after 9 p.m. in the consumer’s own local time, which sounds simple until numbers start moving between states.

Mobile numbers travel with their owners, so an area code is a weak proxy for time zone. A verified billing address or a self-reported zone is the safer trigger, and quality assurance should sample calls near both edges of the window.

Treat that table as the control sheet, not the whole job. Consent hygiene is customer experience work too, because a consumer who asked to stop and got dialed anyway is already lost as a buyer.

Examples

TCPA class actions have produced some of the largest privacy settlements on record. Three named cases show how the statute lands on outbound programs, from bank collections to satellite television telemarketing to unsolicited fax marketing aimed at medical practices.

• Capital One (2014): $75.5 million class settlement over autodialed collection calls placed without prior express consent. It remains one of the largest TCPA settlements ever certified.
• Dish Network (2017): $280 million judgment in a joint federal and state action combining TCPA counts with the FTC’s Telemarketing Sales Rule. The calls came from authorized retailers.
• Rising Medical Solutions (2022): $10.5 million settlement over fax marketing to physicians with no opt-out language, a reminder that the act reaches broadcasts and faxes as firmly as it reaches voice.

The Dish outcome is the one every buyer should read twice. A seller can answer for calls its contractors place, so the retailer’s dialer became the brand’s liability and its price tag.

The pattern is consistent — plaintiffs’ firms mine dialer logs, cross-check them against the National Do Not Call Registry, and file class complaints in federal court. Discovery then turns your own call detail records into the evidence.

Offshore partners that dial back into US numbers carry the same exposure through their client’s indemnity clauses. A Manila or Bogota floor is judged by US rules, not by local ones, whatever the contract says about jurisdiction.

So dialer settings and the consent database matter far more than the seat rate. Buyers who audit only price tend to pay the difference back in settlements, legal fees, and a suspended campaign.

Related terms

Each term below touches a different control in the same compliance chain. Some define the dialing technology that triggers consent duties, others define the review layer that catches a script drifting out of policy before a plaintiff does.

• Automatic Dialer: any device that dials without human intervention, the trigger for most prior consent duties.
• Preview Dialer: a dialer that shows the agent each record before connect, often used to sidestep autodialer classification.
• HIPAA Compliance: the parallel US privacy framework for health information, which many contact centers must clear as well.
• Quality Assurance: the internal review layer that catches consent and script drift before a plaintiff finds it.
• Lead Generation: the upstream stage where one-to-one consent bites hardest, because bundled opt-ins no longer pass muster.
• Customer Experience: the discipline that shares the same core instinct, which is to respect a stated preference.

FAQ

What does TCPA stand for?

TCPA stands for the Telephone Consumer Protection Act, a 1991 US federal law. It restricts telemarketing calls, autodialed and prerecorded messages, text broadcasts, and unsolicited faxes sent to consumers.

What are TCPA penalties per violation?

Statutory damages run $500 for each unintentional violation and up to $1,500 for each willful or knowing one. Because calls are counted one by one, class actions can push aggregate exposure into the tens of millions.

Does TCPA compliance apply to text messages?

Yes. Courts treat SMS the same as voice, so prior express written consent is required before autodialed marketing texts reach a mobile number. Ringless voicemail drops have drawn the same treatment.

What is prior express written consent?

It is a signed disclosure, on paper or electronic, in which the consumer agrees to receive autodialed or prerecorded marketing calls or texts from one named seller. Electronic signatures and clear web opt-ins qualify when the wording is compliant.

How long should you keep TCPA consent records?

Most compliance counsel recommend at least four years, matching the federal statute of limitations for TCPA claims. Each record should carry the timestamp, IP address, the exact opt-in language shown, and the seller named.

What changed with the FCC’s one-to-one consent rule?

It requires consent to name a single seller per submission and to be logically and topically related to the interaction where the consumer gave it.

Ready to outsource US customer contact work to a partner that already runs clean dialers and consent audits? Compare vetted providers on the Outsource Accelerator hubs page.