The Core TCPA Prohibitions: Calls and Texts You Can't Make Without Consent

One wrong call can cost $1,500 — and a single campaign can rack up thousands of violations before anyone notices. That's why understanding exactly what the Telephone Consumer Protection Act prohibits matters for any business that calls or texts leads.

The TCPA (47 U.S.C. § 227) prohibits using an automatic telephone dialing system or artificial or prerecorded voices to contact cell phones without the required consent, and bars prerecorded telemarketing calls to residential landlines unless the consumer has agreed in writing. Violations carry statutory damages of $500 to $1,500 per call with no need to prove actual harm, and TCPA judgments have exceeded $925 million in recent years, according to legal guidance on TCPA requirements.

The consent rules are use-case specific. Marketing calls and texts require prior express written consent — a signed agreement with clear disclosure that consent is not a condition of purchase. Non-marketing calls need only prior express consent. And the definition of telemarketing is broader than most businesses assume: a dual-purpose call counts as telemarketing even if no sale happens on that call.

The FCC keeps expanding what counts as regulated contact, too. In 2022, it declared ringless voicemail a "call" made with an artificial or prerecorded voice, meaning it requires consent like any other robocall.

The Facebook v. Duguid decision narrowed the ATDS definition in April 2021. To qualify, a device must be able to store or produce numbers using a random or sequential number generator — the broader "dialing from stored lists" reading was rejected. Courts still split on the edges, but the practical effect is clear: plaintiffs have shifted their focus toward prerecorded-voice and Do Not Call violations, which don't depend on winning the ATDS argument.

For businesses running lead response and appointment-setting workflows, the practical takeaway is simple:

• Collect signed written consent with clear disclosure at every lead touchpoint — CallMyLeads' booking flow, for example, collects explicit consent before any messaging begins.
• Treat every call that mentions your services as telemarketing, even if it's also informational.
• Assume prerecorded and AI-generated voices are fully regulated — avatar technology counts as a prerecorded call under FCC guidance.
• Remember that state "mini-TCPA" laws in Florida, Oklahoma, and elsewhere define autodialers more broadly than federal law, some with criminal penalties.

Honest disclosure helps here. Callers should always know whether they're talking to a person or AI, and every automated system should offer a path to a human, a text option, or online booking. Building consent collection and clear disclosure into your lead flow from day one costs far less than defending a class action with a four-year statute of limitations.

Do Not Call Rules: The National Registry and Your Internal List

A number on the National Do Not Call Registry is one of the clearest "do not touch" signals in telemarketing law — and ignoring it is one of the fastest ways to land in a TCPA lawsuit. After the Supreme Court narrowed the definition of an autodialer in Facebook v. Duguid, plaintiffs' attorneys shifted their litigation focus heavily toward Do Not Call violations, making this area especially dangerous for businesses that call prospects.

The TCPA prohibits unsolicited marketing calls to residential numbers listed on the National Do Not Call Registry. Telemarketers must scrub their call lists against the Registry at least every 31 days, meaning a list checked in January can be stale — and non-compliant — by March. Each prohibited call carries statutory damages of $500 to $1,500 per violation, with no need for the consumer to prove actual injury, and a four-year statute of limitations means every call can trigger proceedings years later.

Not every call to a DNC-listed number is prohibited. An Established Business Relationship (EBR) exempts calls to customers and recent prospects, per the FCC's rules:

• A purchase or transaction creates an EBR lasting 18 months
• An inquiry or application creates an EBR lasting 3 months
• The consumer's prior written consent also exempts the call

For home services, dental, or legal businesses, this means a past customer is callable — but only on the residential line they provided, and only while the EBR window stays open.

Here is the part most businesses miss. Beyond the national Registry, the law requires every company to maintain its own internal Do Not Call list. When someone asks your business to stop calling, that request must be honored for at least 5 years — and it overrides both the EBR exemption and even prior written consent, according to FCC requirements.

This is why automated opt-out handling matters so much. CallMyLeads honors opt-outs immediately and automatically on every campaign, because a manual process that takes even a few days risks calling someone who already said no. And since April 11, 2025, consumers can revoke consent "in any reasonable manner," with businesses required to comply within 10 business days.

Federal DNC rules do not apply to business-to-business calls, with one narrow exception: calls selling nondurable office or cleaning supplies remain covered, per FCC guidance. A commercial line is fair game for marketing outreach — but remember that many people list cell phones as their business line, and cell numbers fall under the separate consent rules covered elsewhere in this article.

The safest posture: scrub every 31 days, log every opt-out, and treat "stop calling me" as the final word — every time.

The 2025 Opt-Out Shift: Revoking Consent 'In Any Reasonable Manner'

The rules around consent revocation just changed in a way that catches most businesses off guard. Starting April 11, 2025, consumers can revoke consent "in any reasonable manner" — texting STOP, pressing a key, leaving a voicemail, sending an email, or even telling a cashier in person — and businesses can no longer dictate a single exclusive opt-out method. The FCC created a rebuttable presumption that any consumer revocation method is reasonable, placing the burden on the business to prove otherwise, according to BCLP's analysis of the new opt-out rules.

• Processing window cut from 30 days to 10 business days
• Only one clarification text allowed, sent within 5 minutes, with zero marketing content
• An opt-out from informational messages stops all future non-emergency contact, including marketing
• Revocation applies across both robocalls and robotexts regardless of the medium used

The financial stakes are immediate: statutory damages run $500–$1,500 per violation with no requirement to prove actual injury, and a four-year statute of limitations means every call or text can trigger litigation years later, as noted in the same BCLP legal insight. Meanwhile, two anticipated changes did not take effect: the 1:1 consent rule was vacated by the 11th Circuit in January 2025, and the universal opt-out provision — one revocation applying across all message types and channels — is delayed until April 11, 2026, per ActiveProspect's TCPA rules breakdown.

For teams running AI lead response and appointment-setting workflows, this shift means opt-out handling must be instant, automatic, and channel-agnostic. CallMyLeads builds immediate opt-out honoring into every text, call, and nurture sequence so a revocation via any method — voicemail, email, or a STOP reply — stops outreach across the board without manual intervention. The compliance posture isn't a separate checklist; it's baked into the response logic that qualifies, books, and nurtures leads around the clock.

What Violations Cost: Penalties, Class Actions, and State Mini-TCPAs

A single sloppy text campaign can cost more than a year's revenue. The TCPA doesn't require anyone to prove they were actually harmed — the penalties are built into the statute itself, and they stack up fast.

Under the TCPA, every illegal call or text carries statutory damages of $500 to $1,500 per violation, per class member, with no requirement to prove actual injury, according to a legal analysis by BCLP. "Per violation" means per call or per text. A 1,000-message campaign sent without proper consent can become a $1.5 million problem overnight.

That's before regulators get involved. The FCC can impose penalties of up to $16,000 per violation — and up to $26,000 for intentional ones — per a TCPA compliance FAQ from M&S Law Group. The same source notes that TCPA judgments have exceeded $925 million in recent years, and that regulators increasingly pursue owners, officers, and executives personally. Incorporating your business does not shield you.

The exposure window is long, too. The TCPA carries a four-year statute of limitations, meaning every call your business makes today can trigger litigation up to four years from now. This is why consent and opt-out records must be retained for at least four years — a point emphasized in guidance from ActiveProspect featuring telecom attorney Eric J. Troutman.

Class actions multiply everything. One plaintiff's attorney with one annoyed recipient can represent thousands of class members, each entitled to $500–$1,500 per violation. The math explains why TCPA litigation remains one of the most active areas of consumer class action law.

On top of the federal law, a growing patchwork of state "mini-TCPA" statutes adds stricter, often technology-neutral rules:

• Florida (FTSA) broadly prohibits autodialer calls to cell phones and landlines, with a wider autodialer definition than federal law — and some state laws carry criminal penalties.
• Oklahoma adopted a similar law to Florida's, with its own expansive definitions.
• New York requires telemarketers to offer an opt-out opportunity within three seconds of a call starting.
• Washington and California prohibit unsolicited texts regardless of the technology used to send them.
• Maryland, Virginia, Texas, and Michigan have proposed or enacted additional restrictions.

The practical consequence: complying with federal law alone is no longer enough. Because several states define "autodialer" more broadly than the post-Facebook v. Duguid federal standard, a dialing system that's legal federally can still violate state law. Businesses operating nationally should build their outreach to the strictest applicable standard, as industry compliance guidance recommends.

This is also where process discipline pays off. The businesses that get sued are rarely the ones that intended to break the law — they're the ones whose opt-out handling lagged, whose consent records were thin, or whose follow-up sequences kept firing after someone said stop. Since April 2025, revocations must be honored within 10 business days and accepted in any reasonable manner, which makes manual opt-out tracking a genuine liability, as BCLP's analysis of the new rules makes clear.

It's one reason CallMyLeads builds immediate, automatic opt-out honoring and explicit consent collection at booking directly into every lead-response workflow — when a lead replies STOP, the follow-up stops, the record is kept, and the risk stops compounding. Given the four-year lookback and per-message damages, automated compliance isn't a nice-to-have. It's the cheapest insurance a business can buy.

Staying Compliant While Still Responding to Leads Fast

The rules are clear, but speed doesn't have to suffer. Every lead-response workflow can stay compliant and still reply in seconds when consent, opt-outs, and list hygiene are built into the system — not bolted on afterward.

Start with prior express written consent at every touchpoint. Marketing calls and texts to cell phones require a signed agreement with clear disclosure that consent isn't a condition of purchase, and dual-purpose calls count as telemarketing even if no sale happens on that call. CallMyLeads bakes this into the booking flow so the first reply — text, email, or call — goes out with documented consent already captured.

Opt-outs must be honored in any reasonable manner within 10 business days, down from 30 days before April 2025. Consumers can revoke by texting STOP, pressing a key, leaving a voicemail, emailing, or even telling a cashier in person — and businesses may send only one non-marketing clarification text within five minutes before all messages must stop. Automated, instant opt-out handling removes the risk of the $500–$1,500 per-violation exposure that has driven TCPA judgments past $925 million in recent years.

• Scrub the National DNC Registry every 31 days and maintain an internal DNC list for at least five years — company-specific requests override even prior written consent
• Retain consent and opt-out records for at least four years to cover the statute of limitations
• Register business texting under A2P 10DLC so carrier-level filtering works with you, not against you
• Watch state mini-TCPA laws — Florida, Oklahoma, New York, Washington, and California impose stricter, technology-neutral rules, some with criminal penalties

When compliance runs on the same rails as speed, leads get answered fast and the business stays protected.