TCPA Explained: The Law Behind Every Call and Text You Send

Every time your business dials a lead or fires off a follow-up text, a 34-year-old federal law is watching. Get it wrong, and a single unwanted message can cost more than the job was ever worth.

TCPA stands for the Telephone Consumer Protection Act, a federal law enacted in 1991 that protects consumers from unwanted telemarketing calls, robocalls, and texts, according to Varnum's legal advisory. It is codified at 47 U.S.C. § 227 and implemented through FCC regulations.

The law governs what regulators call "robocalls" and "robotexts" — calls and texts made with an automatic telephone dialing system or an artificial or prerecorded voice, per Cooley's analysis of FCC rules. In plain terms: if your outreach is automated, the TCPA almost certainly applies.

The core requirement is consent. Businesses must obtain "prior express written consent" before sending marketing texts or making marketing robocalls, as BCLP's compliance brief explains. Informational messages — like an appointment confirmation — follow lighter rules, but the line between the two matters enormously.

Why should an HVAC company, dental office, law firm, or insurance agency care? Because the moment you respond to a lead by phone or text, you step into TCPA territory. The rules that apply include:

• Written consent before any automated marketing call or text
• One-to-one consent per seller, effective January 27, 2025 — a single checkbox covering multiple "partners" no longer counts
• Honoring opt-outs within 10 business days, through any reasonable method, under the Opt-Out Rule effective April 11, 2025
• Respecting telemarketing quiet hours on every automated touch

Now the financial stakes. The TCPA carries statutory damages of $500 to $1,500 per violation — with no requirement that the consumer prove any actual injury, according to BCLP. Courts can treble damages for willful violations, and litigation data from ClassAction.com shows major settlements reaching tens of millions, including Caribbean Cruise Line at up to $76 million.

Those numbers scale fast. A lead follow-up campaign touching 1,000 contacts without proper consent is not a marketing asset — it is a seven-figure liability. And with a four-year statute of limitations, mistakes made today can surface in a lawsuit years from now.

This is exactly why compliance sits at the center of how CallMyLeads handles lead response. The booking flow collects explicit consent before outreach begins, opt-outs are honored immediately and automatically, telemarketing quiet hours are followed, and business texting is registered under US carrier A2P 10DLC rules. Speed only wins jobs when it stays on the right side of the law.

The short version: the TCPA governs every automated call and text your business sends. Knowing what the acronym stands for is step one — knowing what it demands of your lead follow-up is what keeps growth from turning into litigation.

The Consent Rules That Changed in 2025 — and Why They Matter for Lead Follow-Up

What TCPA Compliance Looks Like in Practice

Knowing the rules is one thing. Following them — every day, on every call and text — is where most businesses get into trouble, especially with statutory damages of $500 to $1,500 per violation and no requirement to prove actual harm.

The first pillar is consent. Before you send marketing texts or make automated marketing calls, you need prior express written consent from each person. And since January 27, 2025, that consent has to be one-to-one: a single signup that quietly links to multiple sellers no longer counts. The FCC has been blunt on this point, stating that sharing lead information with a daisy-chain of "partners" is not permitted. If you buy leads, vet your sources and confirm they capture compliant, per-seller consent — otherwise their gap becomes your liability.

The second pillar is opt-outs. Under the FCC's Opt-Out Rule, which took effect April 11, 2025, consumers can revoke consent in any reasonable manner — texting STOP, QUIT, END, CANCEL, or UNSUBSCRIBE, or even by voicemail, email, or in person. You cannot force them to use one specific method. Revocation must be honored within 10 business days, down from the old 30-day window, and only one non-marketing clarification message is allowed, sent within five minutes. The safest practice is simpler: honor opt-outs immediately and automatically, which is how we've built opt-out handling at CallMyLeads.

The third pillar is timing and recordkeeping. Automated outreach has to follow telemarketing quiet-hours rules, and your records have to prove it. Keep consent records and opt-out documentation for at least four years — that matches the TCPA's statute of limitations, so if a claim surfaces in year three, your paperwork is what defends you.

A practical checklist for any business that texts or calls leads:

• Collect explicit written consent from each individual lead, tied to the specific website where it was captured.
• Honor STOP and similar requests immediately, across both calls and texts, regardless of how the request arrives.
• Keep all outreach within quiet-hours windows.
• Retain consent and opt-out records for at least four years.
• Confirm every purchased lead source captures compliant, per-seller consent.

One more wrinkle: the TCPA overlaps with the National Do Not Call Registry, which is actually broader in reach because it governs almost all commercial telephone solicitations to numbers on the list. And the law is still evolving — a developing court trend, including the Seventh Circuit's decision in Steidinger v. Blackstone Medical Services, holds that texts may not fall within the TCPA's private right of action for DNC claims. Attorneys advising on that trend still recommend treating texting law as unsettled, minding state laws, and consulting counsel before relying on it.

The bottom line: build consent, opt-out, and recordkeeping into your lead response process from day one — not after a complaint arrives.

How to Stay Fast on Leads Without Breaking the Rules

Speed-to-lead and TCPA compliance are often framed as enemies — move fast and risk a violation, or slow down and lose the job. In practice, the opposite is true: the fastest response is usually the safest one.

Here's why. When a lead fills out your form, calls your business, or requests a booking, they raised their hand first. Responding to that inbound inquiry is a fundamentally different risk profile than cold-calling a purchased list. The TCPA's sharpest teeth — statutory damages of $500 to $1,500 per violation, with no need to prove actual injury — target unwanted robocalls, robotexts, and marketing messages sent without consent. A lead who just asked you to contact them is not that scenario.

That said, "inbound" is not a blanket exemption. The smart move is to build compliance into the response system itself, so speed never depends on someone remembering the rules at 9 p.m. on a Saturday:

• Capture explicit consent at the moment of inquiry. Since the FCC's one-to-one consent rule took effect January 27, 2025, consent must be obtained separately for each identified seller — a shared "partner list" consent no longer counts, and your follow-up must be logically related to where the lead signed up (Varnum's 2025 TCPA advisory).
• Automate opt-out handling. Under the Opt-Out Rule effective April 11, 2025, consumers can revoke consent "in any reasonable manner" — STOP, a voicemail, even an in-person request — and revocation must be honored within 10 business days (BCLP's rule breakdown). Honoring it instantly and automatically exceeds the requirement and removes human error.
• Respect quiet hours and screen spam. Automated outreach should follow telemarketing quiet-hours laws, and known spam numbers should be filtered before they waste anyone's time.
• Keep records. With a four-year statute of limitations, retaining consent and opt-out documentation for at least four years is the recommended practice (per BCLP).

This is exactly how CallMyLeads runs lead response. Every new lead gets a reply in seconds, 24/7/365 — but the booking flow collects explicit consent, opt-outs are honored immediately and automatically, quiet-hours rules are followed, and spam is screened out before it ever bills a minute. Speed and compliance live in the same workflow, not in tension.

The stakes for getting this wrong keep climbing — TCPA lawsuits grew tenfold from 2010 to 2015, and courts can treble damages for willful violations. The stakes for getting it right are simpler: you answer fast, you book the job, and you never worry about the fine print because it's handled.

Stop paying for leads you never get to talk to. Every new lead answered in seconds, around the clock, with consent captured and opt-outs automatic — that's what a compliant speed-to-lead system looks like.