The TCPA, Telephone Consumer Protection Act of 1991, is the federal law governing automated calling and texting, and it has real teeth: statutory damages of $500 per violation, tripled to $1,500 for willful ones, per call or text, with no cap and a healthy class-action bar. A campaign of ten thousand noncompliant texts is, arithmetically, a company-ending exposure. Most TCPA defendants are not boiler rooms; they are ordinary businesses that automated communication without reading the rules.
What the law actually restricts
The TCPA does not ban calling people. It restricts specific technologies and content aimed at consumers without the right consent: autodialed calls and texts to cell phones, prerecorded or artificial-voice calls (which includes modern AI voices), and telemarketing generally. A human manually dialing a customer is largely outside its core provisions; software blasting a list is squarely inside them. Texts are treated as calls, every marketing SMS is a TCPA event.
The consent tiers that decide everything
- Prior express consent (a customer gave you their number for a purpose): sufficient for informational automated contact, appointment reminders, order updates, service alerts, related to that purpose.
- Prior express written consent (a signed/checked disclosure agreeing to marketing): required for telemarketing via autodialer or prerecorded voice. A number on an intake form does not authorize promotions.
- No consent: manual, human-dialed, non-marketing contact remains the safe channel, plus whatever the Do-Not-Call rules allow, covered separately in the DNC guide.
Operating rules worth engraving
Honor opt-outs immediately and across channels: a STOP text or a "stop calling me" ends automated contact, and revocation can arrive by any reasonable method. Keep consent records, when, how, and what was agreed to, because in a dispute the burden of proving consent lands on the business. Respect quiet hours: telemarketing calls are restricted to 8 AM to 9 PM in the recipient's local time. Identify yourself in messages. And reassess whenever you add automation: the AI voice agent, the reminder campaign, the "quick blast to old leads" each change your legal posture, usually more than anyone in the meeting assumed.
Where the risk actually concentrates
Three patterns generate most exposure: marketing to purchased or scraped lists (no consent, autodialed, catastrophic), reactivating old lists whose consent has gone stale or whose numbers were reassigned to strangers, and treating informational consent as marketing consent. Reassigned numbers deserve special fear: the customer who consented moved on, the number now belongs to someone else, and calls to them are unconsented. Periodic list hygiene against reassigned-number data is a real defense the FCC has formalized.
This is orientation, not legal advice: TCPA doctrine shifts with FCC orders and court decisions, sometimes dramatically. Before launching automated campaigns at scale, spend an hour with counsel; it is the cheapest insurance in this entire field.
Still have a question?
Real people answer our phones. Ask anything about business phone systems, no pitch attached.
Ask a human