Why TCPA Compliance Can Make or Break Your Lead Follow-Up

Every call or text your business makes to a lead carries a price tag — and if you get it wrong, that price starts at $500. Under the TCPA, each illegal call or text triggers damages of $500 to $1,500 per violation, with no cap on the total a single lawsuit can reach, according to compliance analysts tracking TCPA enforcement.

That math turns ugly fast. A follow-up campaign touching 1,000 leads without valid consent is a seven-figure exposure. And plaintiffs' attorneys know it: TCPA class-action filings are up 95% year over year, with aggregate verdicts exceeding $925 million, per voice-AI compliance research.

The settlements tell the same story. Typical 2025–2026 class settlements land between $5 million and $20 million, and even small businesses facing nuisance class actions commonly pay $200,000 to $500,000 to make them go away. Named examples include QuoteWizard at $19 million and UnitedHealthcare at $2.5 million.

AI follow-up does not reduce this risk — it defines it. In February 2024, the FCC ruled that AI-generated voices count as "artificial or prerecorded voice" under the TCPA, meaning every AI call requires prior express consent, per the FCC's declaratory ruling. There is no carve-out for technology that sounds like a live agent — and the Established Business Relationship exemption that protects your human reps does not cover AI callers.

Perhaps the most dangerous misconception: outsourcing protects you. It doesn't. The compliance burden falls on the business that calls or texts — not the lead generator, not the software vendor — as compliance guidance for lead buyers makes clear. Courts have extended liability to the entity on whose behalf calls are made, regardless of who dialed.

That means your business is on the hook for:

• Consent quality from every lead source you buy or capture from
• Every AI or human call and text made on your behalf
• Honoring opt-outs within 10 business days, across all channels, per the revocation rules effective April 11, 2025
• State laws that stack on top of federal rules, including AI disclosure requirements in states like Texas
• Consent records retained for the four-year statute of limitations

This is why the way you respond to leads matters as much as how fast you respond. Speed wins the job — but only compliant speed keeps the revenue. Services like CallMyLeads build this into the follow-up itself: explicit consent collected in the booking flow, opt-outs honored immediately and automatically across every channel, A2P 10DLC registration for business texting, and AI that discloses itself to every caller. The liability always follows the business, so the businesses that survive are the ones whose follow-up was built for the rules from day one.

The Core TCPA Requirements: Consent, Disclosure, and AI Voices

Everything in TCPA compliance comes down to three pillars: getting the right kind of consent, disclosing it properly, and respecting the rules around how and when you reach people. Here's how each one works.

Two tiers of consent. The TCPA splits consent into two levels. For marketing calls and texts to wireless numbers, you need Prior Express Written Consent (PEWC) — an affirmative signature, disclosure naming the specific business, the authorized phone number, and a statement that consent is not a condition of purchase. For informational or transactional calls like appointment reminders, Prior Express Consent (PEC) is enough, and it can be oral, according to a voice AI compliance playbook.

What "clear and conspicuous" actually means. A valid consent form isn't a buried checkbox. Per a Cooley analysis of the FCC's lead-generation rules, consent must be clear and conspicuous, and the resulting calls or texts must be logically and topically tied to the interaction that prompted consent — a car-loan inquiry doesn't authorize loan-consolidation pitches. The agreement must also state that the consumer authorizes telemarketing via autodialer or artificial/prerecorded voice.

A defensible consent capture covers these elements:

• The specific business named in the disclosure
• The phone number being authorized
• Affirmative signature or action (never pre-checked boxes)
• A statement that consent is not a condition of purchase
• Language covering autodialer and AI/prerecorded voice contact

This is why CallMyLeads collects explicit consent inside its booking flow — each element above gets captured at the moment a lead engages, not assumed after the fact.

AI voices changed the game in 2024. In a February 2024 Declaratory Ruling (FCC-24-17), the FCC confirmed that AI-generated voices count as "artificial or prerecorded voice" under the TCPA, so calls using them require prior express consent. Critically, there's no Established Business Relationship carve-out: a live rep can call a past customer under EBR, but an AI agent cannot dial that same person without separate consent. The FCC stated the statute allows no carve-out for technologies claiming to be "the equivalent of a live agent."

The DNC Registry now covers texting. The FCC extended Do Not Call Registry protections to text messages, meaning texters need the consumer's prior express invitation or permission, and wireless providers must block texts from numbers the FCC flags, per the same FCC rulemaking. Your SMS follow-up is now held to the same standard as your calls.

The stakes for getting this wrong are steep: $500 per violating call or text, rising to $1,500 for willful violations, with no aggregate cap per lawsuit, according to LeadCompliant's TCPA updates tracker. One industry analysis notes TCPA class-action filings rose 95% year over year, with aggregate verdicts exceeding $925 million, per Retell AI's compliance research.

The practical takeaway: consent is not a formality. It's the foundation every call and text stands on — and with AI voices now explicitly regulated, businesses using automated lead response need documented, specific, honest consent before the first dial ever happens.

What's New: One-to-One Consent Confusion and the 2025 Revocation Rules

If you run a business that calls or texts leads, 2025 has been a legal whiplash year — and the confusion is costing companies real money. Penalties run $500 to $1,500 per call or text with no cap, and class-action filings are up 95% year over year.

Here's the one-to-one consent story in plain terms. The FCC's rule required a separate written consent for each seller — no more blanket "I agree to be contacted by our partners" checkboxes. It took effect January 27, 2025. Days later, the Eleventh Circuit struck it down, holding the FCC had expanded the law beyond its authority without Congress. The rule is not currently in effect, though the FCC may propose a revised version.

So what should you actually do? Treat the rule's spirit as your floor anyway. The compliance burden falls on the caller, not the lead generator — and courts extend liability to the business on whose behalf calls are made, regardless of which vendor dialed. That means the defensible approach is seller-specific, documented consent you can prove, not vague blanket permissions. CallMyLeads collects explicit consent in its booking flow, naming the business and what the consent covers, so the record exists when you need it.

The revocation rules are different — those are binding and already in force. Since April 11, 2025:

• Consumers can revoke consent by any reasonable means, oral or written. You cannot demand "STOP only" — misspellings, "take me off your list," other languages, even emojis count.
• Opt-outs must be honored within 10 business days, down from 30. As one compliance publication put it, that window is not a grace period to keep texting — it's the maximum time to update your systems.
• Revocations propagate across all channels. A text opt-out also stops IVR calls and prerecorded voice, and it must reach your CRM, texting, and calling systems.

CallMyLeads honors opt-outs immediately and automatically, and the suppression spreads across every channel it runs — which is the standard the new rules effectively demand.

One more layer: state laws stack on top. Florida's FTSA has a broader autodialer definition, $500 per text in damages, and a double opt-in requirement. Texas requires AI disclosure within 30 seconds of a call. "We're TCPA-compliant" doesn't mean you're state-law-compliant.

The practical takeaway: keep consent records for the four-year TCPA statute of limitations (defense counsel recommend seven years), verify your lead sources' consent quality, and build your opt-out handling to exceed the 10-day rule rather than meet it. When the legal ground shifts again — and it will — the businesses with documented, seller-specific consent and fast, automatic revocation are the ones that stay standing.

Stop paying for leads you never get to talk to. Every new lead answered in seconds, 24/7/365 — with opt-outs honored the moment they come in.

How CallMyLeads Meets Each Requirement — and Where You Stay in Control

Knowing the rules is one thing — building them into every call and text, automatically, is another. Here's how CallMyLeads maps to each TCPA requirement, and where you stay in the driver's seat.

Explicit consent starts at the booking flow. The TCPA's strictest tier — prior express written consent for marketing calls and texts — requires clear and conspicuous disclosure naming the specific business, the authorized number, and a statement that consent is not a condition of purchase, according to Cooley's analysis of the FCC's lead-generation rules. CallMyLeads' booking flow collects explicit consent before any outreach runs, and you set the response rules that define what that consent covers.

AI disclosure happens on every call. The FCC's February 2024 declaratory ruling confirmed that AI-generated voices count as "artificial or prerecorded voice" under the TCPA — and the Established Business Relationship exemption doesn't cover them. CallMyLeads' honest-AI approach means callers always know they're talking to AI, and every caller can reach a human, use text, or book online. Compliance experts recommend exactly this kind of upfront disclosure, per the Retell AI TCPA compliance playbook.

Opt-outs are honored instantly — not in 10 days. Revocation rules effective April 11, 2025 require businesses to honor opt-outs made by any reasonable means within 10 business days, across all channels, per Cheng Cohen's TCPA landscape analysis. CallMyLeads beats that standard: opt-outs are honored immediately and automatically, propagating across CRM, SMS, and calling — the cross-channel propagation LeadCompliant identifies as a core requirement.

Beyond those three pillars, the compliance infrastructure runs in the background:

• A2P 10DLC registration for all business texting, meeting US carrier rules so messages aren't flagged or blocked.
• Quiet-hours compliance built into outreach timing.
• Spam screening that filters known spam and robocall numbers — and those minutes are never billed.
• HIPAA-aligned configuration for dental and medical clients, with approved scripts only.

Here's where you stay in control: you set the response rules — the first message, qualification questions, and when leads route to your team. And because liability follows the caller, not the lead generator, you remain responsible for verifying that your lead sources collected valid consent. With TCPA class-action filings up 95% year over year, per industry compliance research, that verification step matters.

Stop paying for leads you never get to talk to. Every new lead answered in seconds, 24/7/365 — with consent, disclosure, and opt-out handling built in. Book a free 15-minute scoping call at callmyleads.app and see how it fits your lead flow.