Core TCPA Violations: Consent, Opt-Outs, and Autodialed Calls

Most business owners assume TCPA liability only applies to willful spammers — but the law doesn't care about intent. Under its strict liability standard, a misdialed call made in good faith carries the same penalty as one made recklessly, which means even a single compliance slip can become expensive fast, according to TCPA compliance research.

The most common violations fall into three core categories, and each one is easier to trigger than most businesses realize.

Calling without prior express written consent. Using an autodialer or prerecorded voice — including AI-generated voices, which the FCC confirmed in February 2024 trigger the same consent obligations as traditional robocalls — without documented written consent is a violation. The absence of documented consent remains the single leading cause of TCPA lawsuits, which makes capturing proof at the point of contact just as important as the consent itself. And the exposure multiplies quickly: a campaign sent to 50,000 numbers without proper consent could result in up to 50,000 separate violations, not one.

Failing to honor opt-outs. As of 2025, businesses must process revocation requests within 10 days, down from the previous 30-day window, per updated telemarketing rules. Regulators have also expanded what counts as a valid revocation — and as a default posture, an opt-out of a telemarketing text should be treated as a request to be placed on a company's internal do-not-call list, according to Kelley Drye & Warren LLP. The smarter operating posture, as compliance analysts put it, is to honor revocations broadly and quickly regardless of the deadline, because that conduct is exactly what a plaintiff's attorney will hold up in court.

Calling numbers on the National Do-Not-Call Registry. Dialing registered numbers without an applicable exemption is a straightforward violation, and state-level rules often tighten the screws further — Florida, Oklahoma, and Washington enforce stricter consent rules and shorter calling windows than federal TCPA.

The financial stakes are substantial. Statutory damages run $500 to $1,500 per call or text with no aggregate cap, and state-level analysis notes that average TCPA settlements now exceed $6.6 million. Texas SB 140, effective September 2025, allows damages up to $5,000 per violation plus treble damages and attorney's fees.

For service businesses running reactivation campaigns on past customers, the practical takeaway is that compliance has to be built into the process — documented consent, immediate opt-out handling, and list scrubbing — rather than left to agent judgment. That's the approach CallMyCustomers takes: working only from lists of real customers, honoring opt-outs immediately, and collecting explicit consent during the booking flow, with every message approved by the business owner before anything goes out. Where the line is unclear, treating the call as covered is the cheaper mistake.

Emerging and State-Specific Risks: AI Voices, Reassigned Numbers, and Mini-TCPA Laws

The compliance landscape shifts faster than most calling operations can track. New rulings on AI voices, number recycling, and state-level "mini-TCPA" statutes create fresh exposure for any business reaching out to past customers.

In February 2024, the FCC declared that AI-generated voices qualify as "artificial voices" under the TCPA, triggering the same prior express written consent obligations as traditional robocalls. This means an AI-driven outreach campaign carries identical liability to a prerecorded blast if consent documentation is missing. Industry analysis confirms the ruling closes the door on treating synthetic speech as a compliance loophole.

Phone number reassignment compounds the risk. Tens of millions of U.S. numbers change hands each year, and contact lists six months old may contain 3–5% reassigned numbers. Because consent follows the person, not the number, dialing a recycled line without fresh permission is a violation. A safe harbor exists only if you can prove prior express consent and that reassignment occurred after consent was obtained — documentation that must be captured at the point of contact, not reconstructed later. FDIC guidance outlines this safe harbor framework.

State-level mini-TCPA laws add another layer of complexity. Florida, Oklahoma, Maryland, and Oregon cap calls at three per 24-hour period. Florida and Oregon cut the calling window off at 8 p.m. instead of the federal 9 p.m. Virginia requires honoring opt-outs for ten years versus the federal five. Texas SB 140, effective September 2025, allows up to $5,000 per violation plus treble damages and attorney's fees. Legal analysis shows at least a dozen states have enacted stricter telemarketing statutes since 2021.

• AI voices now require the same written consent as robocalls
• 3–5% of six-month-old lists are reassigned numbers
• State laws impose tighter caps, earlier cutoffs, and longer opt-out periods
• Texas exposes violators to $5,000 per call plus treble damages
• Area code is no longer a reliable proxy for recipient location

CallMyCustomers builds compliance into every reactivation campaign — scrubbing lists against reassignment databases, honoring opt-outs within the 10-day federal window, and calibrating outreach to the strictest applicable state rules so your customer conversations stay productive and protected.

Building a Compliance System: Documentation, List Hygiene, and Vendor Oversight

Building a compliance system requires more than good intentions—it demands concrete processes that protect both the business and the consumer. For service businesses relying on customer reactivation, the foundation starts with capturing and storing prior express written consent at the point of contact, as the absence of documented consent remains the single leading cause of TCPA lawsuits. Under the amended Telemarketing Sales Rule, detailed call records—including the script used and call disposition—must be retained for five years, up from the previous two-year requirement. This extended recordkeeping window means businesses need reliable systems to preserve consent evidence long after the initial interaction.

List hygiene is equally critical, especially given how frequently phone numbers are reassigned. Contact lists six months old may contain 3–5% reassigned numbers, and calling these numbers without fresh consent constitutes a violation because consent follows the person, not the number. To mitigate this risk, businesses should scrub their calling lists against the Reassigned Numbers Database before dialing. Maintaining documentation that proves prior express consent was obtained and that the number was reassigned after consent was given can qualify callers for a safe harbor provision, shielding them from liability even if a number has been recycled.

Honoring opt-out requests promptly and broadly is another non-negotiable component of compliance. The opt-out processing time has been reduced from 30 days to 10 days, meaning businesses must act quickly when a consumer revokes consent. Furthermore, a single opt-out should be treated as a request to be placed on the company’s internal do-not-call list for all marketing messages, not just the specific channel used. In states like Virginia, where opt-out honor periods extend to ten years versus the federal five-year standard, businesses must adhere to the most restrictive applicable rule based on the recipient’s actual location. For companies using services like CallMyCustomers to manage reactivation campaigns, it’s essential to understand that liability for outsourced calling typically falls on the business, not the vendor—making proactive oversight and clear communication with partners a vital part of risk management.