The Core Problem: Consent Violations Drive TCPA Penalties

Most businesses don't set out to break the law with automated calls — they get tripped up by consent. The TCPA doesn't ban robocalls outright; it makes them illegal the moment a business lacks proper consent, calls outside permitted hours, or contacts a number on the National Do Not Call Registry.

The rules are specific. Under current TCPA guidance, automated calls and texts are illegal without explicit customer consent, when placed outside the 8 AM–9 PM window in the recipient's time zone, or when directed to numbers on the National Do Not Call Registry. The FCC has also clarified — effective April 11, 2025 — that consumers may revoke consent through any reasonable method, including verbal requests, and senders must stop contacting them within ten business days.

The consent landscape itself is shifting. In February 2026, the Fifth Circuit ruled that "prior express consent" may be given orally or in writing, rejecting the FCC's longstanding written consent requirement — but as Holland & Knight attorneys note, that ruling applies only within the Fifth Circuit, and companies must still demonstrate clear, direct, and unequivocal consent. Meanwhile, the FCC extended its broader consent-revocation compliance date to January 31, 2027 — an extension that legal experts at Greenspoon Marder emphasize is not a repeal of the underlying obligations.

The financial consequences of getting this wrong are not theoretical:

• DSW faced a $4.42 million lawsuit in March 2025 over unwanted marketing SMS.
• Wells Fargo paid $17.85 million in 2019 for sending unsolicited texts and calls to non-customers.
• Uber settled for $20 million in 2017 over unwanted driver-recruitment texts.

Those headline numbers reflect the statute's structure: the TCPA's private right of action allows $500 per violation, up to $1,500 for willful or knowing violations — and violations stack call by call, text by text. A single campaign to a stale list can generate thousands of individual violations.

That stacking risk is exactly why outdated contact lists are so dangerous. The FCC estimates roughly 35 million phone numbers are disconnected and reassigned each year, and reassigned numbers invalidate prior consent entirely, because the new number holder never agreed to anything. An established business relationship — a purchase within 18 months or an inquiry within 3 months — exempts you from the Do Not Call Registry, but it does not override consent requirements for autodialed marketing outreach.

This is why permission-based reactivation matters. Services like CallMyCustomers work exclusively from lists of real customers with documented consent, honor opt-outs immediately, and route every message through owner approval before anything is sent. The lesson from DSW and Wells Fargo is simple: the businesses that stay compliant aren't the ones that skip automated outreach — they're the ones that treat consent as the foundation of every campaign.

The Solution: How CallMyCustomers Ensures Compliant Outreach

Most TCPA violations don't come from businesses trying to break the law—they come from sloppy consent practices, stale lists, and ignored opt-outs. A compliant reactivation campaign doesn't require legal gymnastics; it requires the same discipline CallMyCustomers builds into every campaign from day one.

It starts before any money changes hands. The free list review examines exactly who is on the list—real customers, old quotes, and lapsed members—before a single message goes out. That matters because the FCC estimates roughly 35 million phone numbers are disconnected and reassigned annually, and a reassigned number invalidates prior consent entirely. Working only from lists of genuine past customers dramatically reduces that risk.

Consent is collected where it's strongest: at the moment of booking. The booking flow captures explicit consent, which aligns with the standard Holland & Knight attorneys say companies must still meet even after the Fifth Circuit's ruling—clear, direct, and unequivocal consent, documented and verifiable, whether given orally or in writing.

Opt-outs are honored immediately. Under the FCC's rules effective April 11, 2025, consumers may revoke consent through any reasonable method—including a verbal request—and senders must stop upon receipt. The same discipline applies to calling hours (8 AM–9 PM in the recipient's time zone) and Do Not Call screening, since violations carry penalties of $500 to $1,500 per violation.

The compliance-by-design approach looks like this:

• Free list review before any fee, segmented by recency and relationship
• Owner-approved scripts, offers, and messages before anything is sent
• Explicit consent collected during the booking flow
• Opt-outs honored immediately, through any reasonable means
• Privacy agreements (BAA/HIPAA, TCPA, A2P 10DLC) for dental, med spa, and clinic clients

The human layer matters too. Because calls are placed by a team on the client's behalf—automation handling scale, people handling judgment—there's no risk of a prerecorded script talking over a "STOP" or a frustrated "leave me alone." That's exactly the scenario the expanded revocation rules were written to address.

For a home services business, clinic, or repair shop, this turns a legal minefield into a straightforward process: your list, your approved message, your booked appointments. Compliance isn't a feature of the campaign—it's the foundation it runs on.

Implementation: Actionable Steps to Maintain TCPA Compliance

Businesses navigating automated outreach must prioritize TCPA compliance to avoid costly violations and maintain customer trust. With penalties ranging from $500 to $1,500 per violation and recent regulatory shifts clarifying consent and opt-out requirements, proactive steps are essential. Implementing these practices not only reduces legal risk but also strengthens customer relationships by respecting communication preferences.

To maintain compliance, businesses should implement centralized consent management systems that track consent across all brands, departments, and communication platforms. This approach addresses the FCC's acknowledgment of operational challenges for organizations managing consent separately, especially ahead of the global revocation rule effective January 31, 2027. Centralized systems ensure that a consumer's opt-out request applies organization-wide, preventing accidental outreach through other channels or subsidiaries—a critical safeguard given that revocation now applies to all future communications from the same caller, regardless of topic. CallMyCustomers integrates this principle by maintaining unified consent records for every reactivation campaign, ensuring alignment with evolving TCPA standards.

Regularly scrubbing contact lists against reassigned number databases is equally vital, as approximately 35 million phone numbers are disconnected and made available for reassignment annually. Prior consent becomes invalid when a number is reassigned, since the new holder never agreed to receive messages. Businesses should limit reactivation campaigns to three messages maximum per contact followed by silence unless a reply is received, reducing exposure to reassignment risks. Additionally, restricting automated calls to 8 AM–9 PM in the recipient's time zone and honoring opt-out requests through any reasonable means—such as verbal requests like "Leave me alone"—within 10 business days remains foundational. These practices, rooted in FCC rules effective April 11, 2025, help prevent violations that carry significant financial and reputational costs. By embedding these steps into outreach workflows, service businesses can turn compliance into a competitive advantage while reactivating dormant customers responsibly.