The Honest Answer: U.S. Law Doesn't Codify One 'Five Rights' List

Here's a truth that surprises most people searching for "the five main rights of a consumer": no such list exists in U.S. law. The phrase you'll find everywhere online traces back to President Kennedy's 1962 Consumer Bill of Rights — later expanded by UN Guidelines — not to any American statute.

As the legal reference publication ICLG's analysis of U.S. consumer protection puts it plainly, American consumer protection is "a statute-based system at federal and state levels, not organized around a canonical list of five rights." Any mapping to a tidy five-item framework requires inference, not citation.

Instead of one rights charter, protections live inside dozens of individual laws, each covering a specific slice of commerce. The FTC Act, codified at 15 U.S.C. §§ 41-58, empowers the Federal Trade Commission to prevent unfair methods of competition and deceptive practices. Beyond that, consumers get disclosure rights from TILA, debt-collection protections from the FDCPA, credit-report accuracy rights from the FCRA, and telemarketing protections from the TCPA.

Enforcement is also shared. According to the CFPB's report on state-level protections, "enforcing consumer protection law has long been a state-federal partnership in which the states have often taken the lead." States like California, New York, Illinois, and Massachusetts carry some of the broadest protections in the country.

Because there's no single list, compliance means knowing the specific statutes that govern your customer interactions — not memorizing a framework. For any business that calls or texts leads, the TCPA is the law that matters most. Enacted in 1991, it protects consumers from unwanted telemarketing calls, faxes, and automated messages, with fines running $500 to $1,500 per violating call or text, and willful violations can be tripled.

The TCPA's core consumer protections include:

• Prior express written consent before autodialed or prerecorded marketing contact
• Do-Not-Call registry protection
• Calling restricted to 8 a.m.–9 p.m. in the recipient's local time
• Clear caller identification requirements
• The right to revoke consent at any time, in any reasonable manner, honored within 10 business days

That last point deserves emphasis. As compliance experts note, "consent isn't forever, and failing to act quickly on an opt-out request is one of the fastest ways to invite a TCPA dispute." A single 10,000-contact violation could mean $5–$15 million in potential liability.

Consumers may speak the language of "rights," but courts and regulators speak the language of statutes. The safest businesses build their outreach around statutory rights from day one — collecting explicit consent at booking, honoring opt-outs immediately, and respecting quiet hours automatically.

That's why CallMyLeads bakes TCPA compliance into every lead response workflow: A2P 10DLC-registered texting, immediate automatic opt-out handling, and explicit consent collection in the booking flow. When your follow-up system respects the actual statutes, speed and compliance stop being a trade-off.

The Five Thematic Protections Behind Every Consumer Statute

The classic "five consumer rights" framework — safety, information, choice, redress, and being heard — doesn't appear as a single codified list in U.S. law. But its themes run through nearly every major consumer protection statute, and understanding that mapping helps any business see where its obligations actually live.

Here's the honest caveat first: U.S. consumer protection is a statute-based system at federal and state levels, not a unified rights model. Protections are scattered across the FTC Act, Dodd-Frank Act, FCRA, TCPA, CPSA, FDCA, and dozens more. The five-rights framework is a useful lens — not a legal citation.

Safety shows up in the Consumer Product Safety Act and the Food, Drug, and Cosmetic Act, which give regulators power to pull dangerous products and police what reaches consumers. It's the oldest protection theme in the book.

Information lives in disclosure law. The Truth in Lending Act, implemented by Regulation Z, exists so that "credit terms are disclosed in a meaningful way so consumers can compare credit terms more readily and knowledgeably." Regulation DD does the same for deposit accounts through uniform disclosures. The principle is simple: no informed choice without honest numbers.

Choice and fair dealing fall to the FTC Act, the Commission's primary statute, which empowers it to prevent unfair methods of competition and deceptive practices. Enforcement is very much alive: the FTC recently secured a $2.5 billion settlement with Amazon over deceptive Prime subscription practices — a landmark case centered exactly on consumers' ability to choose freely and exit easily.

Redress means consumers can actually recover when harmed. Key mechanisms include:

• Private rights of action, which the CFPB urges states to make readily available in modernized UDAP statutes
• FDCPA remedies against abusive, deceptive, and unfair debt collection practices
• TCPA damages of $500 to $1,500 per call or text, with willful violations potentially tripled
• Class actions, like the $40 million TCPA settlement a Florida court approved against a real estate company in 2023

That last point matters more than ever. With the CFPB's budget cap cut from 12% to 6.5% of Federal Reserve operating expenses and nearly 70 guidance documents withdrawn in 2025, private litigation is filling the enforcement gap — meaning your compliance risk increasingly comes from consumers themselves, not just regulators.

Finally, being heard. The FTC's Bureau of Consumer Protection collects consumer reports, investigates, and sues lawbreakers — eight divisions and eight regional offices built around stopping unfair, deceptive, and fraudulent business practices. Consumer complaints are the raw fuel of federal enforcement.

For businesses that call and text leads, these themes converge in one statute: the TCPA. Consent, quiet hours, identification, and instant opt-out honoring are the five-rights framework applied to your dialer. That's why CallMyLeads builds explicit consent collection and automatic opt-out handling directly into every lead response flow — because respecting these rights isn't just ethical, it's the law.

The Five Consumer Rights That Matter Most If You Call or Text Leads

If your business calls or texts leads — and speed-to-lead demands that you do — the consumer rights that matter most to you come from one law: the Telephone Consumer Protection Act. Enacted in 1991, the TCPA protects consumers from unwanted telemarketing calls, faxes, and automated messages, and its rules apply to every outbound follow-up you make.

U.S. consumer protection is a statute-based system at the federal and state levels, not a single codified rights list. For businesses doing lead response, the TCPA is the statute that defines day-to-day risk. Here are the five consumer rights it creates that you must respect on every call and text:

• Prior express written consent — before you make autodialed or prerecorded marketing contact, the consumer must have agreed in writing. In 2025, the FCC expanded the definition of "autodialer" to include AI-generated voice systems and certain texting platforms.
• Do-Not-Call registry protection — consumers who register their numbers are off-limits for telemarketing, and scrubbing your lists against the registry is not optional.
• Calling-time limits — telemarketing contact is only permitted between 8:00 a.m. and 9:00 p.m. in the recipient's local time.
• Caller identification — every call must accurately identify who is calling and provide contact information.
• The right to revoke consent — consumers can withdraw consent at any time, in any reasonable manner, and businesses must honor the request within 10 business days.

That last right deserves emphasis. As one TCPA compliance analysis puts it, consent isn't forever, and failing to act quickly on an opt-out request is one of the fastest ways to invite a dispute. Immediate, automatic opt-out handling isn't a courtesy — it's a legal obligation.

The financial stakes explain why. TCPA fines run $500 to $1,500 per call or text, and willful violations can be tripled. A single non-compliant campaign to 10,000 contacts carries potential liability of $5 to $15 million. And these aren't hypothetical numbers: in April 2023, a Florida court approved a $40 million TCPA class-action settlement against a real estate company.

Enforcement pressure is also shifting toward private litigation. While federal agencies have scaled back — the CFPB withdrew nearly 70 guidance documents in 2025 — private rights of action remain what the ICLG's U.S. consumer protection review describes as a critical gap-filling measure for accountability. Class-action attorneys, not regulators, are increasingly the ones policing compliance.

This is why compliance has to be built into the response system itself, not bolted on afterward. At CallMyLeads, that means booking flows that collect explicit consent, quiet-hours rules followed automatically, and opt-outs honored the moment they arrive. Fast lead response and lawful lead response are the same job — the businesses that win are the ones whose speed never outruns their consent records.

Why State Laws and Private Lawsuits Raise the Stakes in 2025

Federal regulators stepped back in 2025 — and that retreat has made the compliance landscape more dangerous, not less, for businesses that call and text leads.

According to legal analysis of the 2025 enforcement shift, the CFPB withdrew nearly 70 guidance documents and saw its budget cap cut from 12% to 6.5% of Federal Reserve operating expenses. The FTC, meanwhile, abandoned broad rulemaking in favor of targeted, case-by-case investigations — though its $2.5 billion settlement with Amazon over deceptive Prime subscription practices shows it can still hit hard when it chooses a target.

Here's the trap: less federal enforcement does not mean less risk. It means the risk moved. Private rights of action now serve as a critical gap-filling measure for accountability, and the TCPA hands every consumer a direct ticket to court — no regulator required. Under the statute, fines run $500 to $1,500 per call or text, with willful violations trebled. A single campaign touching 10,000 contacts without proper consent can carry $5–$15 million in potential liability, and in April 2023 a Florida court approved a $40 million TCPA class-action settlement against a real estate company. Class action attorneys, not agency lawyers, are now the ones watching your dialing practices.

State law stacks a second layer of exposure on top. Consumer protection has long been a state-federal partnership in which states often take the lead, and the states with the broadest protections — California, Connecticut, Hawaii, Illinois, Massachusetts, New York, and Vermont — frequently go further than federal rules. The CFPB has actively encouraged states to refresh their UDAP statutes with abusive-practices bans, stronger investigatory authority, expanded consumer remedies, and readily available private rights of action.

For outbound calling and texting, "mini-TCPA" state laws can be stricter than the federal statute in ways that catch national businesses off guard. A single calling policy built to federal specs can still break state law on:

• Consent definitions — some states demand more than federal prior express written consent for certain calls
• Calling windows — state quiet hours can be narrower than the federal 8 a.m.–9 p.m. local-time rule
• Registration and disclosure duties — several states impose their own telemarketer licensing and identification requirements
• Private rights of action — state statutes can add damages on top of federal TCPA exposure for the same call

The 2025 FCC expansion of the autodialer definition to cover AI-generated voice systems and certain texting platforms makes this especially relevant for any business using automated outreach. AI-driven follow-up is now squarely inside the regulatory perimeter, and consent revocation rules — honor any reasonable opt-out within 10 business days — apply just as strictly to AI agents as to human callers.

The practical takeaway: build your outreach around the strictest rule you touch, not the loosest. That means explicit consent captured before the first call, immediate and automatic opt-out handling, quiet-hours compliance, and clear AI disclosure on every interaction. Done-for-you lead response services like CallMyLeads bake these controls into the booking flow itself — A2P 10DLC-registered texting, explicit consent collection, and instant opt-out honoring — because in a world where private lawsuits carry the enforcement load, compliance is no longer a legal checkbox; it is core infrastructure for any business that responds to leads by phone or text.

How to Respect Consumer Rights Without Slowing Down Your Lead Response

Speed and compliance are not enemies. The businesses that respond to leads in seconds and stay inside the law are simply the ones that build the rules into their process instead of bolting them on afterward.

The stakes are real. Under the TCPA, fines run $500 to $1,500 per call or text, and willful violations can be tripled. A single campaign touching 10,000 contacts without proper consent can create $5–$15 million in potential liability — and private class actions, like the $40 million TCPA settlement approved against a real estate company in 2023, show how quickly exposure adds up.

Here is how to honor consumer rights at full speed:

• Collect explicit consent at the point of capture. Your web forms, ads, and chat widgets should gather prior express written consent before any automated call or text goes out. Consent captured up front means your first response can fire in seconds, legally.
• Register your business texting under A2P 10DLC. US carriers require registration for application-to-person messaging. Registered traffic gets delivered; unregistered traffic gets filtered or blocked.
• Honor opt-outs instantly and automatically. Consumers can revoke consent at any time, in any reasonable manner. As compliance experts note, failing to act quickly on an opt-out is one of the fastest ways to invite a TCPA dispute. Automation removes the human delay that causes violations.
• Respect quiet hours. Telemarketing contact is permitted only between 8:00 a.m. and 9:00 p.m. in the recipient's local time. Your system should know the lead's time zone and hold messages that fall outside the window.
• Disclose AI identity on every call. The FCC's 2025 expansion of the autodialer definition now covers AI-generated voice systems, making clear identification both an ethical and legal necessity.

One more safeguard matters: screen known spam and robocall numbers before they reach your team. The FTC reports that auto-dialers now send thousands of calls every minute at incredibly low cost, so filtering junk protects both your budget and your response quality.

Remember also that federal rules are the floor, not the ceiling. States like California, New York, and Illinois maintain some of the broadest consumer protections in the country, and state mini-TCPA laws can be more restrictive than federal law. A response system built for nationwide use must account for the strictest applicable rule, not just the easiest one.

This is exactly how CallMyLeads operates. Every lead response runs through the same built-in guardrails: explicit consent collected during booking, A2P 10DLC-registered texting, automatic opt-out handling, quiet-hours enforcement, clear AI disclosure on every call, and spam screening that never bills you for junk minutes. The result is a first reply in under ten seconds — with zero TCPA shortcuts taken to get there.

Compliance done manually slows you down. Compliance built into the system disappears — and all that's left is speed.