The Real Cost of One Wrong Call: TCPA Penalties Explained

One wrong number, one recycled phone line, one missed "STOP" text — that's all it takes. Under the TCPA, a single violation carries three separate penalty layers, and they can stack against the same conduct.

The first layer is private lawsuits. Plaintiffs can collect $500 per violation, trebled to $1,500 for willful or knowing violations, with no requirement to prove actual injury. Since the TCPA is primarily enforced through its private right of action, these suits — not government action — drive most of the risk. Class action filings rose 21% year-over-year, and the average TCPA settlement hit $6.6 million, according to Institute for Legal Reform analysis.

The second and third layers come from regulators. FCC forfeitures run up to $23,727 per violation, while FTC penalties under the Telemarketing Sales Rule reach $53,088 per violation on a 2025 inflation-adjusted basis, as industry penalty research details. Calling numbers on the National Do Not Call Registry adds fines of $43,792 per violation.

Here's what makes the math brutal: damages are assessed per call or text and are uncapped in aggregate. A 10,000-call campaign to non-consenting numbers means $5 million to $15 million in exposure. A text blast to 500,000 opted-out consumers at $1,500 each theoretically reaches $750 million. Real cases back this up — a $925 million jury verdict was affirmed against one company for 1.8 million+ unlawful calls, and one CEO was held personally liable for $7.8 million.

Intent is no defense, either. The TCPA is a strict liability statute — plaintiffs only need to prove the violation happened. And "willful" doesn't require meaning to break the law; knowing the general requirements and proceeding without confirming compliance is enough to trigger the $1,500 rate.

The most common violations are accidental:

• Calls or texts to reassigned numbers — consent attaches to the person, not the phone number, and roughly 35 million numbers are recycled each year
• Contacting consumers after they revoked consent, which since April 11, 2025 can be done in any reasonable manner and must be honored within 10 business days
• Calling the National DNC Registry or texting outside permitted hours
• An "orphaned opt-out" — a revocation one party received that never reached the downstream caller, who then inherits the liability

For businesses running fast lead response — especially home services, dental, and legal teams where every missed call costs a job — the fix is automation, not hope. That's why CallMyLeads honors opt-outs immediately and automatically, follows telemarketing quiet-hours rules, and screens known spam numbers before they ever reach your team. Treat every call and text as a potential $500–$1,500 liability, and build your consent capture accordingly.

Why Ordinary Businesses Get Sued: The Five Most Common Violations

Most TCPA lawsuits don't target scammers — they target ordinary businesses that followed up on leads the wrong way. The law is strict liability, meaning intent is not a defense; plaintiffs only need to prove the call or text happened, according to legal analysis of the statute.

Five violation types drive the bulk of litigation: robocalls without consent, autodialed texts, calls to National Do Not Call Registry numbers, calls after consent revocation, and calls to reassigned numbers. Here's what each looks like in practice — and what it costs.

Robocalls and autodialed texts without consent. A jury affirmed a $925 million verdict against a multi-level marketing company for more than 1.8 million autodialed calls; the court declined to treble the damages into the billions, but the award stood. A satellite TV provider faced a $61 million class action after $400 per call was trebled to $1,200 per violation.

DNC registry violations. Calling a number on the National Do Not Call Registry carries fines of $43,792 per violation, and a single call can technically breach multiple provisions. List scrubbing is the only reliable defense.

Calls after revocation. Since April 11, 2025, businesses must honor consent revocation made in any reasonable manner — a voicemail, a reply text, even telling a cashier — within 10 business days, per the FCC's Opt-Out Rule. The deadliest failure mode in lead-gen supply chains is an orphaned opt-out: a revocation one party receives that never reaches the downstream caller, who keeps dialing and inherits the liability.

Reassigned numbers. This is the biggest accidental risk. Consent attaches to the person, not the phone number, so prior consent vanishes when a number is recycled — and the FCC estimates roughly 35 million numbers are disconnected and reassigned annually.

The numbers explain why exposure scales so fast:

• Average TCPA settlement: $6.6 million, with class filings up 21% year-over-year
• 10,000 non-consenting calls create $5M–$15M in theoretical exposure
• One CEO was held personally liable for $7.8 million in an Illinois federal court

Because the average settlement runs $6.6 million and class action filings rose 21% in one year, per WebRecon litigation data, even well-meaning follow-up programs need guardrails. Services like CallMyLeads handle opt-outs immediately and automatically, so a "STOP" reply never becomes an orphaned revocation.

The New Opt-Out Rules That Changed the Game in 2025

On April 11, 2025, the FCC's new Opt-Out Rule took effect, and it quietly rewired how every US business must handle consumers who say "stop calling." Under the rule, a consumer can revoke consent in any reasonable manner — a text saying "STOP," a voicemail, even telling a cashier — and the business must honor it within 10 business days, with a rebuttable presumption that the consumer's method was reasonable, according to BCLP attorneys.

The rule does allow one narrow exception: a single clarification message within 5 minutes of the revocation, so a business can confirm scope — for example, whether "stop" applies to texts only or all communications. The FCC has also endorsed specific revocation keywords, including "STOP," "QUIT," "END," "REVOKE," "OPT-OUT," "CANCEL," and "UNSUBSCRIBE." Because the TCPA is a strict liability statute carrying $500 to $1,500 per violation, a mishandled opt-out that keeps a campaign running is a direct path to statutory damages, as TCPA penalty analyses make clear.

The problem is sharpest in lead-generation supply chains. Industry commentary describes the "orphaned opt-out" as the deadliest failure mode: a valid revocation received by one party that never travels downstream to the caller who keeps dialing — and the caller placing the call inherits the liability. Any business buying leads, or using an outside response service, should verify that opt-out data flows automatically to every party touching that consumer.

One major requirement, however, did not survive. In January 2025, the Eleventh Circuit vacated the FCC's One-to-One Consent Rule in Insurance Marketing Coalition Ltd. v. FCC, so no federal one-to-one consent requirement is currently in effect, per legal industry reporting. Businesses relying on lead-gen partners still face exposure — just under the general consent framework rather than the vacated rule.

A second trend is quietly building: quiet-hours lawsuits. Telemarketing calls and texts are prohibited between 9 p.m. and 8 a.m. in the recipient's local time, and law firm Hunton reports that "quiet time" suits — particularly against retail rewards programs — have grown increasingly popular. Key compliance steps:

• Honor revocation requests in any reasonable form within 10 business days.
• Propagate opt-outs instantly through every vendor and downstream caller.
• Restrict outbound calls and texts to 8 a.m.–9 p.m. recipient's local time.
• Retain opt-out records for at least four years to match the TCPA's statute of limitations.

Automated systems like CallMyLeads handle opt-outs immediately and automatically, which removes the human lag that turns a routine "STOP" text into a five-figure problem. In a strict liability regime where intent is not a defense, the cheapest compliance is the kind that happens before anyone has to think about it.

How to Cut Your TCPA Risk Without Slowing Down Lead Response

Every call and text you send carries a potential $500 to $1,500 price tag, and those amounts stack with no cap. The good news: the same automation that speeds up lead response can carry the compliance load too, if you set it up right.

Start with consent at every intake point. Capture explicit written consent wherever a lead enters your system — forms, chat, missed-call text-backs, referral follow-ups. Because the TCPA is a strict liability statute, intent is not a defense; plaintiffs only need to prove the violation happened, according to legal analysis of the statute. Building consent capture into the intake flow means speed never has to outrun permission.

Next, keep your lists clean. Roughly 35 million numbers are disconnected and reassigned every year, and consent attaches to the person, not the phone — so prior consent does not transfer when a number gets recycled. Scrub against the National Do Not Call Registry and the Reassigned Numbers Database before any campaign goes out, as compliance attorneys recommend.

Opt-outs deserve the same urgency as new leads. Since April 11, 2025, businesses must honor revocation made in any reasonable manner — a text saying "STOP," a voicemail, even telling a cashier — within 10 business days, per the FCC's new opt-out rules. The safest approach is instant, automatic opt-out handling, with records retained at least four years to match the TCPA's statute of limitations.

The most dangerous failure mode in lead generation is the orphaned opt-out:

• A revocation reaches one vendor but never travels to the downstream caller who keeps dialing.
• The party placing the call inherits the liability, not the party that received the opt-out.
• Verify that revocations propagate automatically to every system and partner touching that lead.

This is where automated response systems earn their keep. CallMyLeads, for example, honors opt-outs immediately and automatically, collects explicit consent in the booking flow, and screens known spam numbers before they waste anyone's time — compliance work happening in the background while leads get answered in seconds. Quiet-hours rules, no texts between 9 p.m. and 8 a.m. local time, get enforced by the system rather than by a rep working late.

Done right, compliance and speed are not a trade-off. A lead answered in ten seconds with consent on file beats a lead answered in an hour with none — and it costs a lot less than $6.6 million, the average TCPA settlement.