What Counts as a TCPA Violation (and Why Lawsuits Are Exploding)

The phone rings at 7:58 a.m. or a text lands at 9:02 p.m. — and suddenly you're on the hook for a federal violation. TCPA lawsuits jumped 63.7% in 2025, hitting 2,858 filings compared to 1,819 the year before, while class actions more than doubled from 239 to 507 in the first quarter alone according to The Blacklist Alliance tracking. ActiveProspect reports that nearly 80% of all TCPA suits filed today are class actions, and the average settlement this year reached $6.6 million.

Every violation carries statutory damages of $500 to $1,500 per call or text, with no requirement to prove actual harm per BCLP's analysis. The five core categories that trigger liability:

• Calling or texting without prior express written consent
• Contacting numbers on the Do Not Call Registry
• Misusing autodialers or prerecorded messages
• Reaching consumers outside the 8 a.m.–9 p.m. local window
• Ignoring opt-out requests across any channel

The rules are shifting fast. The FCC's new Opt-Out Rule took effect April 11, 2025, requiring businesses to honor revocation "in any reasonable manner" — including voicemail, email, or telling a cashier in-store — within 10 business days, and a single "STOP" text now stops both texts and automated calls per BCLP. Meanwhile, the Fifth Circuit ruled in February 2026 that oral consent can satisfy the TCPA for automated calls to cellphones, though only within its jurisdiction per Holland & Knight. CallMyLeads bakes compliance into every workflow: consent is captured explicitly at booking, opt-outs are honored instantly across channels, and quiet-hours enforcement runs automatically so time-zone mistakes never reach a lead.

The Consent Rules Are Shifting — Here's Where They Stand Now

The consent ground is moving under businesses that call or text leads. In April 2025, the FCC's Opt-Out Rule took effect, requiring companies to honor revocation "in any reasonable manner" — whether that's a "STOP" text, a voicemail, an email, or even telling a cashier in-store — and to do it across all channels within 10 business days. Then in February 2026, the Fifth Circuit rejected the FCC's long-standing requirement for prior express written consent for automated calls to cellphones, ruling that oral consent can suffice. The catch: that ruling only binds the Fifth Circuit, while other circuits and many state laws still expect written proof.

• Consumers may revoke consent through recognized keywords like "STOP," "QUIT," "END," "REVOKE," "OPT-OUT," "CANCEL," or "UNSUBSCRIBE" — plus non-traditional methods — with a rebuttable presumption that any method is reasonable
• Revocation crosses channels: a "STOP" text requires ceasing both texts and automated or prerecorded voice calls
• Only one post-revocation clarification message is permitted, within 5 minutes, with no marketing content
• Documentation must be retained for at least 4 years, matching the TCPA statute of limitations

The stakes are real. TCPA lawsuits jumped 63.7% in 2025 to 2,858 filings, and class actions more than doubled year-over-year. With statutory damages of $500–$1,500 per call or text and no requirement to prove actual injury, the average settlement this year reached $6.6 million. Against that backdrop, documented written consent remains the safest posture for any business operating across state lines. CallMyLeads' booking flow already collects explicit consent and honors opt-outs immediately and automatically — a compliance baseline that aligns with both the FCC's cross-channel revocation rule and the Fifth Circuit's demand for "clear, direct and unequivocal" consent that is independently verifiable.

The Five Mistakes That Get Businesses Sued

Most TCPA lawsuits don't come from businesses that set out to break the law. They come from broken processes — a consent record nobody saved, an opt-out that slipped through, a call placed at 8:57 p.m. in the wrong time zone. With TCPA filings up 63.7% in 2025 and statutory damages of $500–$1,500 per call or text, these process failures get expensive fast.

Mistake 1: Missing or invalid consent. This is the top risk factor identified in industry litigation analysis. Even after the Fifth Circuit's recent ruling that oral consent can suffice within its circuit, Holland & Knight notes that consent must still be "clear, direct and unequivocal" and independently verifiable. If you can't produce the record, you don't have the defense.

Mistake 2: Poor lead data quality. Bought lists, stale records, and reassigned phone numbers mean you may be texting someone who never consented — and the person who now holds that number. Scrubbing against the DNC Registry and reassigned numbers is a core prevention step for a reason.

Mistake 3: Failing to honor opt-outs. The FCC's Opt-Out Rule took effect April 11, 2025, and it's strict: consumers can revoke consent "in any reasonable manner," revocation crosses channels (a "STOP" text stops calls too), and there's a rebuttable presumption that any opt-out method is reasonable — the burden is on the business to prove otherwise. Many consent management systems quietly fail these standards.

Mistake 4: No vendor oversight. If a lead vendor or outsourced call center breaks the rules on your behalf, the liability lands on you. Monitoring third-party marketers is essential, which is why services like CallMyLeads treat compliance — immediate, automatic opt-out handling and explicit consent collection at booking — as built-in rather than bolted on.

Mistake 5: Quiet-hours mistakes. Federal rules restrict calls to 8 a.m.–9 p.m. local time, and because the TCPA imposes strict liability, even good-faith errors about time zones or daylight saving time trigger liability. Your intention doesn't matter; your timestamp does.

Then there's the serial-plaintiff problem. A 21-year-old college student filed at least 45 TCPA suits using schemes like placing orders, freezing credit-card payments to trigger callbacks, then suing the same day. These professional filers manufacture violations for a living — and they win on paperwork, not intent.

That's the real lesson across all five mistakes:

• Document consent in writing for every lead, and retain records for at least 4 years — the TCPA statute of limitations.
• Honor opt-outs immediately, across every channel, before the 10-business-day deadline.
• Scrub leads against the DNC Registry and reassigned numbers before the first contact.
• Audit vendors and build quiet-hours enforcement into your workflow automatically.

As ActiveProspect puts it, the businesses that win are the ones that verify consent, control their data, and audit everything before hitting "send." Good intentions don't protect you. Process does.

How to Stay Compliant Without Slowing Down Your Lead Response

Here's the good news: staying TCPA-compliant doesn't mean slowing down. With the right controls built into your lead response workflow, speed and compliance run together — not against each other.

With TCPA lawsuits up 63.7% in 2025 and average settlements hitting $6.6 million, the businesses that win are the ones that, as ActiveProspect puts it, "verify consent, control their data, and audit everything before hitting 'call' or 'send.'" Here's a practical checklist to do exactly that.

• Capture explicit consent at booking. Missing or invalid consent is the top TCPA risk factor. Even under the Fifth Circuit's recent oral-consent ruling, consent must be "clear, direct and unequivocal" and independently verifiable. Written consent collected at the moment of booking remains the safest posture across every circuit.
• Honor opt-outs instantly, across every channel. Under the FCC's Opt-Out Rule effective April 11, 2025, consumers can revoke consent "in any reasonable manner" — and a "STOP" text must stop both texts and automated calls. The burden falls on your business to prove an opt-out method was unreasonable.
• Enforce quiet hours automatically. Federal rules restrict calls and texts to 8 a.m.–9 p.m. local time, and strict liability means even honest time-zone mistakes trigger penalties. Automatic time-zone and daylight-saving handling removes the human error.
• Scrub against DNC and reassigned numbers. Contacting numbers on the Do Not Call Registry is a core violation category, and reassigned numbers are a known trap. Regular scrubbing — plus monitoring your lead vendors — closes the gap.
• Keep a 4-year audit trail. The TCPA statute of limitations runs four years, so retain consent and opt-out documentation for at least that long, across calls, texts, and emails.

Notice what every item has in common: none of them require a human to remember anything. That's the point. Manual compliance breaks down exactly when your lead volume spikes — which is exactly when you can least afford a mistake.

This is why CallMyLeads builds these controls directly into its done-for-you lead response. The booking flow collects explicit consent before any outreach. Opt-outs are honored immediately and automatically across every channel. Quiet hours follow telemarketing law with automatic time-zone handling, and business texting runs under registered A2P 10DLC carrier rules. Every lead is tracked from source to booked appointment, giving you the audit trail without the paperwork.

The result: your leads still get a response in seconds, 24/7 — but every call and text goes out inside the rules. In a litigation environment where class actions more than doubled year-over-year, from 239 filings in Q1 2024 to 507 in Q1 2025, fast and careful isn't a trade-off. It's the only way to grow.