What Is the TCPA? A Guide for Businesses That Call and Text
The Telephone Consumer Protection Act is the 1991 federal law that governs robocalls and telemarketing calls and texts. It requires consent for robocalls and robotexts to cell phones, and it limits telemarketing, including sales calls to numbers on the National Do Not Call Registry and calls after a request to stop. Recipients can sue for $500 or up to $500 per violation, depending on the provision, and a court may triple that for willful or knowing conduct. That per-call structure is why the TCPA drives so much class litigation.
Why the TCPA exists
The statute opens with congressional findings, and they explain how courts still read it. Among them: “Unrestricted telemarketing, however, can be an intrusive invasion of privacy and, when an emergency or medical assistance telephone line is seized, a risk to public safety,” in the findings published with 47 U.S.C. § 227. Courts treat the TCPA as a privacy statute, and its statutory damages don’t depend on proof of financial loss.
What does the TCPA require of businesses?
Five obligations cover nearly every claim. The first is consent before calling a cell phone with “an artificial or prerecorded voice,” under § 227(b)(1)(A). A related rule covers home lines. The second is consent before using an automatic telephone dialing system, a term the Supreme Court has narrowed sharply. The other three apply to sales calls: no calls to Registry numbers without an exemption, honoring requests to stop within ten business days, and no calls before 8 a.m. or after 9 p.m. at the recipient’s location.
The first two come from the statute. The last three come from FCC rules at 47 C.F.R. § 64.1200. A separate section bars caller ID spoofing “with the intent to defraud, cause harm, or wrongfully obtain anything of value,” under § 227(e).
A few terms recur. A prerecorded call plays a recording instead of a live person, and AI-generated voices count. An autodialer, in the statute’s words an “automatic telephone dialing system,” is equipment that generates numbers randomly or sequentially. Prior express written consent is a signed agreement, which can be electronic, authorizing a seller to send automated or prerecorded marketing to a specific number. The National Do Not Call Registry is the federal list of personal numbers telemarketers must skip.
Who enforces it?
Regulators and private plaintiffs. The FCC can impose forfeiture penalties under § 227(b)(4). State attorneys general can sue on behalf of residents to “recover for actual monetary loss or receive $500 in damages for each violation” under § 227(g). The FTC runs the Registry and enforces its own Telemarketing Sales Rule, and its Do Not Call FAQs say violators “can currently be fined up to $50,120 per call.”
Private suits are where most businesses meet the TCPA. Individuals and class representatives bring them in state and federal court, and they’re the reason compliance records matter.
What can a TCPA claim cost?
| Claim | Source | Exposure per violation | Key condition |
|---|---|---|---|
| Recorded-voice or autodialed calls without consent | 47 U.S.C. § 227(b)(3) | $500 or actual loss, whichever is greater, up to $1,500 if willful or knowing | One call can be enough |
| Do Not Call violations, including ignored stop requests and late-night sales calls | 47 U.S.C. § 227(c)(5) | Up to $500, up to $1,500 if willful or knowing | More than one violating call from the same company in 12 months |
The Do Not Call claim requires “more than one telephone call within any 12-month period by or on behalf of the same entity,” under § 227(c)(5). Every call counts separately, which is how modest per-call figures become large class numbers.
How the TCPA changed between 2021 and 2026
More changed in these five years than in the previous thirty, and much of it favors defendants. I’d treat any TCPA compliance advice written before 2021 as wrong on at least one major point.
2021, autodialers. In Facebook, Inc. v. Duguid, the Supreme Court held that an autodialer must have “the capacity to use a random or sequential number generator to either store or produce phone numbers to be called.” Most list-based platforms fall outside that.
2024, AI voices. The FCC ruled in FCC 24-17 that the TCPA’s limits on artificial voices “encompass current AI technologies that generate human voices.” AI calling programs need the same consent as recordings.
2025, the FCC loses its final say. In McLaughlin Chiropractic Associates v. McKesson Corp., the Supreme Court told district courts to “interpret the TCPA under ordinary principles of statutory interpretation, affording appropriate respect to the agency’s interpretation.” FCC orders no longer bind courts in private suits. The Eleventh Circuit also vacated the FCC’s one-seller-at-a-time consent rule in Insurance Marketing Coalition v. FCC before it took effect.
2026, texts and opt-outs. The Seventh Circuit held in Steidinger v. Blackstone Medical Services that texts aren’t telephone calls for Do Not Call lawsuits, a ruling that doesn’t bind California courts. On September 30, the FCC adopted FCC 26-67, which will let companies designate a single, disclosed opt-out method once it takes effect.
What the TCPA doesn’t cover
Not every call is a sales call. The FTC’s FAQ lists political calls, charitable calls, debt collection calls, informational calls, and surveys among those allowed to registered numbers, as long as they don’t include a sales pitch. Recorded-voice rules can still apply to some of them.
The TCPA also doesn’t displace state law. The statute preserves state laws that impose “more restrictive intrastate requirements,” under § 227(f), which is why states such as California and Florida layer their own rules on top.
My view is that most TCPA exposure comes from ordinary operational gaps, not exotic legal theories: a consent record nobody kept, an opt-out the system didn’t recognize, a vendor that called without the company’s knowledge. Those gaps are fixable before a claim arrives.
A compliance baseline worth documenting
- Keep call and text logs, platform data, and consent records for as long as claims could be brought, and know how to put them under a litigation hold.
- Log every opt-out and internal do-not-call request with the date received and the date suppression took effect.
- Keep Registry scrub records and version dates for each sales campaign, and maintain written Do Not Call procedures.
- Keep vendor and lead-source contracts, call scripts, and recorded or AI message files, and require vendors to prohibit unlawful calling.
- Talk to a lawyer before launching AI-voice or recorded-message campaigns, and before responding to any demand letter.
TCPA basics for businesses
Does the TCPA apply to text messages?
For recorded-voice and autodialer claims, courts generally treat texts as calls, and the Ninth Circuit, which covers California, said so again in January 2026 in Howard v. Republican National Committee. For Do Not Call claims, the Seventh Circuit held in July 2026 that texts don’t count. California courts aren’t bound by that ruling.
Does the TCPA apply to calls to business numbers?
The Do Not Call rules protect residential subscribers, and the FTC says business numbers aren’t covered by the Registry. The recorded-voice and autodialer rules for cell phones aren’t limited to personal numbers, so calls to a business owner’s cell phone can still create exposure.
Can a company be liable for calls a vendor made?
Yes, if the plaintiff proves the vendor acted as the company’s agent. Courts in the Ninth Circuit apply federal common-law agency principles, and contracts that prohibit unlawful calling, combined with a real lack of control over the vendor’s methods, have defeated liability.
Is following the FCC’s rules enough?
Usually, but not always. After McLaughlin, courts read the statute for themselves, so a rule the FCC adopted can be challenged in either direction. Following current FCC rules is still the best evidence of good faith, and it matters most when a plaintiff seeks treble damages.
Talking to a lawyer about a TCPA claim against your company
If your company has received a TCPA demand letter or been sued, the 2025 and 2026 changes described above may give it defenses that didn’t exist a few years ago. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving robocalls and marketing texts. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.
Sources
The statute and its congressional findings are at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR through October 7, 2026. FCC rulings cited are FCC 24-17 (Feb. 8, 2024) and FCC 26-67 (adopted Sept. 30, 2026). The FTC’s guidance is its National Do Not Call Registry FAQs. The court decisions are Facebook, Inc. v. Duguid, 592 U.S. 395 (2021); McLaughlin Chiropractic Associates v. McKesson Corp., 606 U.S. 146 (2025); Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. Jan. 24, 2025); Howard v. Republican National Committee, No. 23-3826 (9th Cir. Jan. 13, 2026); and Steidinger v. Blackstone Medical Services, No. 25-2398 (7th Cir. July 14, 2026).
This post is general information about the Telephone Consumer Protection Act and related laws as of October 10, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.