Yes, You Can Sue — Here's What the Law Says

The short answer is yes — and the law is getting stronger, not weaker. The Telephone Consumer Protection Act (TCPA) gives every consumer a private right of action against senders of unsolicited texts, and you don't need to prove you lost money. According to TCPA litigation guidance, statutory damages run from $500 to $1,500 per violation — "the intrusion itself is the damage." A dozen texts sent after you asked a sender to stop could add up to an $18,000 claim.

In June 2026, a federal court in Pennsylvania handed consumers a significant win. In Pero v. Brown-Daub Chevrolet of Nazareth, Judge Timothy J. Savage ruled that unwanted marketing texts constitute "calls" under the TCPA's Do-Not-Call provisions, denying the dealership's motion to dismiss. As the case report notes, the decision aligns with six federal circuits — and it confirms that registering your number on the Do Not Call list protects you from unwanted texts, not just calls.

The plaintiff in Pero had registered on the DNC Registry in 2021 and asked the dealership to stop texting. An employee allegedly overrode her opt-out, resulting in eight unwanted marketing texts — each one a potential statutory damages claim.

Regulators have been busy on the texting front. The FCC codified in its Final Rule that National Do-Not-Call Registry protections extend to text messages, and it closed the so-called "lead generator loophole" by requiring comparison-shopping websites to obtain consumer consent one seller at a time.

That means the days of one broad consent form covering dozens of marketing partners are over. Under the One-to-One Consent Rule effective January 26, 2026, consent must be individual, written, and clearly and conspicuously obtained per seller — and it cannot be shared with partners.

For consumers and businesses alike, the legal landscape now rests on a few firm pillars:

• Texts are legally "calls" under the TCPA's Do-Not-Call provisions, per the 2026 *Pero* ruling.
• Statutory damages of $500–$1,500 apply per violation, with no proof of monetary loss required.
• Consent must be written, specific, and given one seller at a time.
• Opt-outs must be honored within 10 business days — though legal experts note that claims of needing "24 to 48 hours" are false, since modern systems can process revocations instantly.

For businesses that text leads and customers, this is why compliance can't be an afterthought. The FCC has made clear that companies cannot avoid TCPA liability by outsourcing communications to third parties — which is why services like CallMyLeads treat immediate, automatic opt-out handling and explicit consent collection as core system features, not add-ons. Texting fast is good business; texting without consent is a lawsuit waiting to happen.

What Counts as a Violation: Consent, Opt-Outs, and Quiet Hours

Most business owners assume a customer has to prove they asked to be left alone. Under the Telephone Consumer Protection Act, it's the opposite: the sender must prove they had the right to contact you, not the other way around.

Consent comes in two tiers, and mixing them up is where lawsuits start. Informational texts — appointment reminders, confirmations — need express consent. Marketing texts like flash-sale alerts demand prior express written consent that is unambiguous and specific to automated marketing messages. A past purchase or a phone number on a form doesn't count.

Once a consumer revokes consent, the rules got stricter. As of April 2025, consumers can opt out through any reasonable means — not just the word STOP. Seven keywords are automatically treated as valid opt-outs:

• STOP
• QUIT
• END
• REVOKE
• OPT OUT, CANCEL, or UNSUBSCRIBE

Businesses then have 10 business days to honor the revocation — down from the old 30-day window — and a STOP sent to one campaign must be honored across every platform the company uses. The only exception: one confirmation text, sent within 5 minutes, containing no promotional content.

Here's the myth to kill: companies often claim they need "24 to 48 hours" to process an opt-out. That's false — modern systems can process revocations instantly. Any text sent after revocation is illegal, and texts sent after a STOP reply count as willful violations at $1,500 each instead of $500. Twelve post-STOP texts can mean $18,000 in statutory damages, with no proof of financial loss required.

Quiet hours apply too. Texts are permitted only 8 AM to 9 PM in the customer's local time zone — a 9 PM text in New York is a violation even if it's 6 PM where you send it.

For consumers, each of these rules is a separate path to suing. For businesses, each is a separate exposure — and courts have held that outsourcing to third parties doesn't shield anyone from TCPA liability. That's why we built CallMyLeads to honor opt-outs immediately and automatically, collect explicit consent in the booking flow, and follow quiet-hours rules — so a fast reply never turns into a federal lawsuit.

Vicarious Liability: Why Buying Leads Doesn't Shield You

Many businesses assume buying leads from a reputable vendor shifts TCPA risk to the seller. Courts have rejected that assumption. Lead buyers and sellers can be held vicariously liable for each other's violations, and contractual indemnification does not insulate either party from statutory damages. As the FCC has made clear, companies cannot avoid TCPA liability by outsourcing communications to third parties.

The "TCPA-compliant lead" is a myth. No lead can be guaranteed compliant because verifying whether a consumer gave proper, written, one-seller-at-a-time consent is difficult. The FCC's 2024 final rule closed the lead-generator loophole by requiring comparison-shopping sites to obtain consent for each seller individually, and the One-to-One Consent Rule taking effect January 26, 2026, codifies that consent given to one company cannot be shared with partners. A federal court in Pero v. Brown-Daub Chevrolet of Nazareth recently confirmed that text messages are "calls" under the TCPA's Do-Not-Call provisions, aligning with six federal circuits and expanding the exposure for any non-compliant outreach.

State laws add another layer. Florida restricts telemarketing to 8 a.m.–8 p.m. local time and caps same-topic calls at three per 24 hours; California imposes stricter consent standards; and Florida, California, and Washington are particularly aggressive enforcers. Multi-state operators must comply with the most restrictive applicable standard.

• Verify the exact scope of consent on every lead before messaging
• Scrub all lists against the National DNC Registry and the FCC's Reassigned Numbers Database
• Honor opt-outs instantly and across every campaign — not in 24 to 48 hours
• Audit lead sources regularly and document consent records

CallMyLeads helps businesses meet these obligations by collecting explicit consent during the booking flow, honoring opt-outs immediately and automatically, and respecting quiet-hours laws across every channel.

How CallMyLeads Builds Compliance Into Every Message

If a lead-response system cuts corners on compliance, the business that hired it still writes the check. The FCC has made clear that companies cannot avoid TCPA liability by outsourcing communications to third parties, and courts have held lead buyers and sellers vicariously liable for each other's actions — meaning the tools you use to follow up on leads matter as much as the leads themselves.

That's why CallMyLeads treats compliance as an operational default, not a marketing claim. Every business texting campaign runs through A2P 10DLC registration under US carrier rules, so messages come from a verified, accountable sender rather than an unregistered line carriers might filter or flag.

Opt-out handling is where most systems fail, and where the stakes are highest. Some companies claim they need 24 to 48 hours to process an opt-out — legal analysis calls this false, noting that modern systems can process revocations instantly, and that any text sent after revocation is a willful violation carrying damages of up to $1,500 per message. CallMyLeads honors opt-outs immediately and automatically, with no human lag in the loop.

Consent gets the same treatment. The FCC's 2024 rules closed the lead generator loophole, requiring consent one seller at a time. The booking flow collects explicit consent before any automated messaging begins, so there's a documented record of who agreed to what, and when.

The system also enforces the rules that are easiest to break by accident:

• Quiet-hours adherence — texts only within the legally permitted 8 AM–9 PM window in the customer's time zone
• HIPAA-aligned configuration for dental and medical clients — approved scripts only, no diagnosis or treatment advice
• Spam screening before messages are sent, so known spam numbers never trigger outbound contact

None of this requires the business owner to become a compliance expert. The setup is done-for-you: lead sources get connected, the client sets their response rules, and everything runs automatically into their existing CRM and calendar. Your leads, your data, and your consent records stay yours.

Given that TCPA class actions have become increasingly common in recent years, and settlements have reached into the millions, a follow-up system built with these defaults baked in isn't a convenience — it's liability reduction that runs in the background while you focus on the leads worth talking to.

What to Do If You're Receiving Illegal Texts — and What to Do If You're Sending Them

Whether you're getting spam texts or sending marketing texts, the rules cut both ways — and the stakes are higher than most people realize. With statutory damages running $500 to $1,500 per text, a sloppy text campaign can turn into a multimillion-dollar liability, as DSW learned when it paid $4.42 million over unwanted marketing messages.

If you're receiving illegal texts, evidence is everything. The TCPA puts the burden of proof on the sender — they must show they had the right to contact you, not the other way around, according to TCPA attorneys. Your job is simply to preserve a clean record.

Follow this checklist:

• Keep the original messages — metadata helps trace the sender
• Screenshot the content, number, and date-time of each text
• Reply "STOP" exactly once, then keep a written log of anything that follows
• Never click links in spam texts
• Report violations to the FTC complaint website, or consult a TCPA attorney

That "exactly once" instruction matters. Any text sent after you revoke consent is illegal, and texts sent after a STOP request count as willful violations that can triple damages to $1,500 each.

If you're a business sending texts, the compliance picture is just as concrete. Start by auditing your consent records — the FCC now requires one-seller-at-a-time consent from lead generators, so shared consent is no longer enough.

Next, process opt-outs instantly and across every campaign. The claim that companies need "24 to 48 hours" to process a STOP is false — modern systems handle revocations in real time, and a STOP sent to one campaign must be honored across all of them within 10 business days.

Also scrub your lists every 31 days against the National Do Not Call Registry and the FCC's Reassigned Numbers Database, and enforce quiet hours — texts are only permitted 8 AM to 9 PM in the recipient's time zone, not yours.

Finally, verify your vendors. The "TCPA-compliant lead" is a myth — you can't outsource your way out of liability, and courts have held lead buyers responsible for texts sent on purchased leads. This is why CallMyLeads builds compliance into its lead response system from the start: registered business texting, explicit consent collected at booking, and opt-outs honored immediately and automatically.

Want your leads answered in seconds without the legal exposure? Book a free 15-minute scoping call and see how it works.