Why TCPA Violations Are a Growing Threat to Customer Outreach

The math punishes scale. TCPA class-action filings have surged 95% year over year, with aggregate verdicts exceeding $925 million, turning every outreach call into a potential four-year liability. For US service businesses running reactivation, reminder, and win-back campaigns, statutory damages of $500–$1,500 per violation, per class member, mean that even a modest list can generate exposure far beyond the campaign’s cost — especially when consent documentation must be retained for the full four-year statute of limitations.

This risk is amplified by recent regulatory shifts that expand consumer rights while tightening compliance windows. Effective April 11, 2025, the FCC’s Opt-Out Rule requires businesses to honor consumer revocation requests through any reasonable method — text, email, voicemail, or social media — within ten business days, down from the previous 30-day window. Clarification messages must now be sent within five minutes of revocation and contain no marketing content. These changes eliminate the ability to prescribe exclusive opt-out procedures, placing the burden on businesses to prove a request was unclear if challenged.

For service businesses relying on repeat customers, the prohibited acts under TCPA directly impact common outreach tactics. Using autodialers or prerecorded/artificial voice technology without prior express written consent for marketing calls or texts to wireless numbers remains a core violation. Calling numbers on the National Do Not Call Registry for telemarketing purposes is prohibited, as is making calls outside permitted hours (before 8 a.m. or after 9 p.m.). Prerecorded messages must begin with clear identification — caller name, phone number, and organization — and include an opt-out mechanism at the start. Crucially, the entity on whose behalf calls are made bears liability, regardless of which vendor pressed dial, meaning CallMyCustomers clients retain responsibility for compliance even when outsourcing outreach.

• Using autodialed or prerecorded/artificial voice calls/texts to wireless numbers without prior express consent
• Making marketing calls to numbers on the National Do Not Call Registry
• Failing to honor opt-out requests within ten business days via any reasonable method
• Calling residences before 8 a.m. or after 9 p.m.
• Omitting required identification in prerecorded telemarketing messages

With one call often all it takes to win back a customer — and reactivation costing roughly one-fifth of acquisition — the stakes are clear. Permission-based outreach isn’t just compliant; it’s the foundation of sustainable repeat revenue. For businesses ready to reconnect with past customers the right way, CallMyCustomers offers a done-for-you reactivation service where every script, offer, and message is approved by you before execution — turning compliance into a competitive advantage.

The Five Prohibited Acts Under the TCPA

The Telephone Consumer Protection Act (TCPA) establishes clear boundaries for businesses conducting outreach, with violations carrying significant financial risk. Understanding these prohibitions is essential for any company engaging customers via phone or text, as statutory damages range from $500 to $1,500 per violation per class member, and the four-year statute of limitations enables substantial class-action exposure. Industry research confirms that TCPA class-action filings have increased 95% year over year, with aggregate verdicts exceeding $925 million, underscoring the importance of compliance.

The five core prohibited acts under the TCPA are: using an autodialer or prerecorded/AI-voice technology to call or text a cell phone without proper consent; making unsolicited marketing calls to residential numbers listed on the National Do Not Call Registry; failing to honor consumer opt-out requests within the required timeframe; calling before 8 a.m. or after 9 p.m.; and omitting required identification information in prerecorded messages. Notably, the TCPA treats text messages as calls under its provisions, meaning the same consent requirements apply to SMS outreach as to voice calls. Regulatory guidance confirms that texts are legally considered calls and subject to identical restrictions, a point reinforced by FCC consumer resources explaining how unwanted robocalls and texts fall under the same regulatory framework.

Effective April 11, 2025, the FCC's Opt-Out Rule significantly strengthened consumer rights by allowing revocation of consent through any reasonable method—including text, email, phone call, voicemail, in-person request, or social media message—and requiring businesses to honor such requests within ten business days. This represents a major shift from prior rules that permitted companies to dictate specific opt-out procedures. Additionally, opt-out confirmation messages must now be sent within five minutes of revocation and contain no marketing content. Compliance experts emphasize that the burden now lies with businesses to prove a revocation request was unclear, reversing previous assumptions about consumer responsibility.

Artificial intelligence-generated voices are explicitly covered under the TCPA’s prohibition on prerecorded or artificial voice calls. The FCC’s February 8, 2024 Declaratory Ruling confirmed that AI voices are considered "artificial or prerecorded voice" under the statute, requiring prior express consent before dialing any U.S. cell phone. Industry analysis notes that Established Business Relationships (EBR) do not exempt AI or artificial-voice calls from consent requirements—a critical distinction for businesses relying on past interactions to justify new outreach. Furthermore, the entity on whose behalf calls are made bears liability regardless of which vendor initiated the contact, making vendor chain accountability essential for compliance. Legal precedent consistently holds businesses responsible for TCPA violations even when downstream vendors place the calls.

For service businesses using platforms like CallMyCustomers to reactivate past customers, these rules directly impact campaign design. Outreach must be built on verified consent levels, with scripts and timing strictly adhering to TCPA limits—such as avoiding calls outside 8 a.m. to 9 p.m. and ensuring prerecorded messages include clear identification and opt-out mechanisms. Honoring opt-out requests promptly and documenting them for at least four years aligns with both TCPA requirements and the permission-based approach central to customer reactivation. While the Seventh Circuit has ruled that text messages are not "calls" under the TCPA’s Do-Not-Call private right of action in certain jurisdictions, this does not affect TCPA § 227(b) claims covering texts sent via autodialer or prerecorded/artificial voice technology, FCC regulatory authority, or state mini-TCPA laws, creating a complex but navigable compliance landscape. Businesses must remain vigilant, as the financial penalties for noncompliance scale rapidly with volume, making proactive adherence not just a legal necessity but a strategic imperative for sustainable outreach.

Consent Rules That Trip Up Even Careful Businesses

Even careful businesses stumble on consent nuances that seem minor but carry major TCPA risk. The difference between prior express consent and prior express written consent isn’t just semantic—it determines whether you can legally use autodialers or prerecorded voices for marketing outreach. Prior express consent (which can be oral) suffices for informational messages like appointment reminders, but prior express written consent is required for any marketing or telemarketing call/text using an autodialer or artificial voice—a distinction that trips up businesses trying to repurpose consent from service reminders for promotional campaigns.

This misstep is especially costly because consent for one purpose doesn’t transfer to another. Using appointment-reminder consent to send unrelated marketing offers violates TCPA’s purpose limitation, as confirmed in multiple enforcement actions. Similarly, the new any-reasonable-method revocation rule effective April 11, 2025, means consumers can withdraw consent via text, email, voicemail, or even social media—and businesses must honor these requests within ten business days. Crucially, a confirmation message with no marketing content must be sent within five minutes of revocation, or the opt-out isn’t considered valid under FCC rules.

Documentation gaps compound these risks. Businesses must retain proof of consent and opt-out requests for at least four years—the TCPA’s statute of limitations—to defend against class actions. Recent settlements highlight how vendor-chain liability amplifies exposure: Gen Digital paid $9.95 million for prerecorded calls to non-customers, while QuoteWizard’s $19 million settlement stemmed from failure to trace consent through its vendor network. For service businesses using done-for-you outreach like CallMyCustomers, this means liability remains with the client business regardless of which vendor initiated the call, making end-to-end consent tracking essential.

• Prior express written consent is required for marketing calls/texts using autodialers or artificial voices
• Consent for appointment reminders cannot be reused for unrelated marketing offers
• Opt-out requests must be honored within ten business days via any reasonable method
• Confirmation messages must be sent within five minutes and contain no marketing content
• Consent and opt-out documentation must be retained for at least four years

How to Run Compliant Reactivation Campaigns Without the Legal Overhead

Running a reactivation campaign shouldn't mean gambling with compliance. The TCPA prohibits using autodialers or prerecorded voices without proper consent, calling numbers on the National Do Not Call Registry, and failing to honor opt-outs within ten business days — a window that narrowed from 30 days under rules effective April 11, 2025. Violations carry statutory damages of $500–$1,500 per call, with a four-year statute of limitations that lets class actions reach back years. Recent FCC guidance also requires confirmation messages within five minutes of any revocation request, and consumers can now opt out through any reasonable method — text, email, voicemail, even social media.

• Work only from real customer lists where explicit consent was collected at booking
• Honor every opt-out immediately, across every channel
• Get owner approval on every script and offer before a single message goes out
• Route replies through a real team with human judgment, not a bot

That's the difference between a compliant reactivation engine and a risky DIY robocall setup. CallMyCustomers handles the compliance layer — TCPA, A2P 10DLC, and HIPAA/BAA for clinics — so your team doesn't have to become regulatory experts. We plan the campaign together, you sign off, and we run it from your existing CRM or spreadsheet. No software to buy, no per-seat fees, and no surprise line items. Your next booked customer already knows your business. Let's reactivate them the right way.