The Hidden Liability in Your Customer Outreach

Every past customer on your list represents revenue — and, if you're not careful, a potential lawsuit. The same customer database that could power your next wave of repeat business can also become a legal liability the moment outreach touches a phone number without the right consent.

The numbers are sobering. Under the Telephone Consumer Protection Act, each violating call or text can cost $500 to $1,500 — and those penalties multiply fast. A single campaign contacting 10,000 people without proper consent could theoretically expose a business to $5–15 million in damages. And the window for liability stays open far longer than most owners expect: depending on the jurisdiction and claim, the statute of limitations runs from four to six years from the date of the violating call.

Class actions make this a boardroom-level risk, not a nuisance. In April 2023, a Florida court preliminarily approved a $40 million class-action settlement by Keller Williams over unauthorized auto-dialing claims — a real estate giant, not a fly-by-night operation. And in a 2018 New York decision, a court even required an insurer to cover a $50 million TCPA settlement because of ambiguous policy language, showing how the financial fallout can ripple into unexpected corners of a business.

Here's where it gets tricky for service businesses. Many owners assume that because someone was a customer once, they're fair game for any future outreach. That's not how the law works. The TCPA draws hard lines around:

• Autodialed or pre-recorded calls and texts to cell phones without prior express written consent for marketing purposes
• Calls to numbers on the National Do-Not-Call Registry absent an established business relationship or written consent
• Contacting reassigned phone numbers when the new owner never consented — a common trap with aging customer lists

A past HVAC customer, a former dental patient, an old quote that never converted — none of these relationships automatically grant permission to use autodialers, prerecorded messages, or AI-generated voices. As of January 2024, AI-generated content is explicitly classified as an "artificial voice" under TCPA, pulling new technologies squarely into scope.

This is exactly why permission-based reactivation matters. At CallMyCustomers, every campaign runs from a list of real customers, with the owner approving each script and opt-outs honored immediately — the practical discipline the TCPA rewards. Reactivation is still outreach, and outreach still follows the rules, no matter how warm the relationship once was. The businesses that win repeat revenue are the ones that treat consent as an asset, not an afterthought — because a compliant list is the only list worth calling.

The Seven Things TCPA Explicitly Prohibits

Every call, text, and voicemail your business sends carries legal weight — and the TCPA draws hard lines around what you can and cannot do. Violations run $500 to $1,500 each, and a campaign contacting 10,000 people without consent could trigger $5 to $15 million in fines. Here are the seven things the law explicitly prohibits.

1. Autodialed, prerecorded, or AI-voice calls and texts to cell phones without prior express written consent. The TCPA bars businesses from using autodialers or prerecorded voices — which, as of January 2024, explicitly includes AI-generated content — to contact consumers without their prior express written consent for marketing purposes.

2. Contacting numbers on the National Do-Not-Call Registry. You cannot call DNC-listed residential numbers unless you have a pre-existing business relationship or documented written consent. A past customer may qualify as an established relationship, but the burden of proving it falls on you.

3. Ignoring consent revocation. As of April 11, 2025, consumers can revoke consent through any reasonable means — text, email, voicemail, verbal statements, even social media messages. The old 30-day window is gone; you now have just 10 business days to remove them from your lists.

4. Calling outside the 8 a.m. to 9 p.m. local time window. Contact outside those hours is prohibited, measured by the recipient's local time zone — not yours.

5. Sending unsolicited fax advertisements. The TCPA bans faxed ads sent without the recipient's prior express invitation or permission.

6. Contacting reassigned phone numbers. Dialing a number whose original owner consented but whose new owner never did remains a significant source of TCPA violations, making regular screening against reassigned numbers essential for aging customer lists.

7. Using ringless voicemail without consent. Some businesses try to sidestep the rules by delivering messages straight to voicemail, but regulators still treat this as a violation when consent is missing.

For service businesses that live on repeat work, these prohibitions shape how reactivation must be done. CallMyCustomers works only from lists of real customers, honors opt-outs immediately, and routes every message through owner approval before anything goes out. The practical safeguards look like this:

• Segment your list by relationship recency so outreach targets genuine, documented customers
• Monitor every channel — text, email, phone, even social media — for opt-out requests
• Screen customer lists regularly against reassigned numbers before each campaign
• Keep written records of consent for every contact you reach

Consent is the cornerstone of every compliant campaign. As the American Bankers Association notes, the TCPA prohibits calls and texts to mobile phones using an autodialer unless the caller has the called party's prior express consent. Build your outreach around that principle, and the seven prohibitions above take care of themselves.

The 2025 Rule Changes That Catch Businesses Off Guard

The Telephone Consumer Protection Act continues to evolve, and recent changes are creating unexpected compliance challenges for businesses engaged in customer outreach. As of April 11, 2025, consumers can now revoke consent through any reasonable means—not just replying "STOP"—including text, email, phone calls, voicemails, verbal statements, and even informal social media messages. This expansion means businesses must monitor multiple channels for opt-out requests, a shift that catches many off guard who previously relied solely on keyword-based text responses. According to industry research, this change significantly broadens the scope of what constitutes a valid revocation of consent.

Compounding this complexity is the shortened compliance window: businesses now have only 10 business days to remove a consumer from contact lists after consent is revoked, down from the previous 30-day buffer. This tighter timeline leaves little room for error, especially for companies managing large-scale reactivation campaigns across multiple platforms. Furthermore, if a customer opts out via text, any confirmation message must be sent within five minutes, contain no marketing content, and be purely informational—violating this rule can still trigger TCPA liability even after an opt-out is received. As noted by regulatory experts, these timing requirements demand real-time processing capabilities that many legacy systems lack.

Since January 2024, AI-generated voices have been explicitly classified as "artificial voices" under TCPA, meaning they fall under the same restrictions as pre-recorded messages and require prior express consent for marketing calls to cell phones. This classification affects businesses using voice AI for appointment reminders, follow-ups, or reactivation efforts, even if the content is informational. Additionally, a growing patchwork of state-level "mini-TCPA" laws—enacted in Florida, New York, Texas, Washington, and others—imposes stricter rules than federal TCPA, such as Florida’s broad autodialer definition and New York’s near-instant opt-out expectations. For businesses like CallMyCustomers, which manages done-for-you reactivation campaigns across US service industries, navigating this layered regulatory environment requires constant vigilance and adaptive compliance strategies. Failure to align with these evolving standards risks costly violations, with penalties ranging from $500 to $1,500 per incident and potential class action exposure.

How to Run Compliant Reactivation Outreach (Without a Legal Team)

Reading a list of TCPA prohibitions can make reactivation outreach feel radioactive — but the businesses that win repeat customers aren't avoiding outreach, they're structuring it so compliance is built in from the first list review.

The foundation is simple: work only from lists of real customers with documented consent. When a consumer voluntarily provides their phone number, they generally consent to normal business communications related to that relationship, as legal analysis from Mac Murray & Shuster explains. That's why reactivating known customers — people who booked, quoted, or visited before — sits on far safer ground than cold acquisition.

Next, screen your list against the Reassigned Numbers Database before dialing. Contacting a reassigned number whose new owner never consented remains a significant source of TCPA violations, according to compliance research — and customer lists older than a year are exactly where stale numbers accumulate.

Opt-out handling is where most campaigns break the rules. As of April 11, 2025, consumers can revoke consent through any reasonable means — text, email, voicemail, verbal statements, even social media — and you have just 10 business days to remove them, down from 30. A single confirmation text is permitted, but it must go out within five minutes and contain no marketing content.

A compliant reactivation workflow looks like this:

• Segment real customers only — recency tiers, old quotes, expiring memberships, past bookings — never purchased or scraped lists.
• Screen numbers against the Reassigned Numbers Database during list review, before any outreach begins.
• Monitor every channel — phone, text, email — for opt-outs and honor them immediately.
• Have the business owner approve every script and offer before anything is sent.
• Route calls through real humans, not autodialers or prerecorded or AI-generated voices, which the TCPA treats as regulated technology.

That last point matters more than ever. AI-generated content is now explicitly classified as an "artificial voice" under TCPA rules, as compliance guidance notes, meaning automated outreach carries the same consent requirements as robocalls. With penalties running $500 to $1,500 per violation and exposure lasting years, compliance experts consistently recommend human-placed calls as the lower-risk path.

This is the model CallMyCustomers is built on: the owner signs off on every message, outreach runs from the client's actual customer list, and real people make the calls while automation only handles scale. Turning past customers into booked work — approved by you, run by us — starts with a free list review that shows exactly what your list can produce before you spend a dollar.