
What makes a robocall illegal?
Key Facts
- Marketing robocalls require prior express written consent, and calling after any reasonable opt-out makes them illegal, per BCLP's compliance analysis.
- TCPA violations cost $500 to $1,500 per call with no proof of injury required, and treble damages for willful violations, per WilmerHale's analysis.
- Consumers can revoke consent 'in any reasonable manner' — voicemail, email, or even telling a cashier — under FCC rules effective April 11, 2025, per BCLP.
- The FCC recognizes seven opt-out keywords — stop, quit, end, revoke, opt out, cancel, unsubscribe — triggering immediate compliance, per Kelley Drye.
- Businesses must process opt-outs within 10 business days and may send only one confirmation message, within 5 minutes, with no marketing, per WilmerHale.
- The FCC removed over 1,200 non-compliant voice providers from the Robocall Mitigation Database in August 2025 alone, per a Mintz regulatory update.
- Non-standard opt-outs carry a rebuttable presumption of validity — the burden falls on the business to prove otherwise, per BCLP's legal analysis.
The Two Pillars of Illegal Robocalls: No Consent or Ignored Revocation
Robocalls cross the line from legitimate outreach to illegal robocalls in two clear scenarios: when they are made without prior express written consent for marketing purposes, or when a business continues to call after a consumer has revoked consent. Under the TCPA and FCC rules effective April 11, 2025, both conditions trigger liability regardless of intent. Marketing robocalls and texts require prior express written consent, and calling after a reasonable revocation—communicated in any manner that clearly expresses a desire to stop contact—makes an otherwise permissible call illegal. The stakes are high: violations carry statutory damages of $500 to $1,500 per call, with no need to prove actual injury, and courts allow treble damages for knowing or willful violations.
Consent revocation is now governed by an "any reasonable manner" standard, meaning opt-out requests can come through voicemail, email, in-person conversation, or even telling a cashier—and they apply across both calls and texts. Businesses must honor these requests within ten business days and are limited to sending only one confirmation message, within five minutes, containing no marketing content. The FCC has also established seven recognized opt-out keywords—stop, quit, end, revoke, opt out, cancel, unsubscribe—that trigger immediate compliance obligations. For companies like CallMyCustomers, which manages outreach for U.S. service businesses, this means building systems that detect non-standard opt-outs and halt all non-emergency communication immediately upon receipt, regardless of channel.
- The FCC removed over 1,200 non-compliant voice providers from the Robocall Mitigation Database in August 2025 alone, signaling aggressive network-level enforcement.
- Statutory damages under the TCPA range from $500 to $1,500 per violation, with no requirement to show actual harm.
- Businesses must process opt-out requests within ten business days and may send only one confirmation message, within five minutes, containing no marketing content.
CallMyCustomers aligns with these requirements by working exclusively from verified customer lists, honoring opt-outs immediately, and routing all communications through a human-in-the-loop model where trained staff can identify nuanced revocation requests that automated filters might miss. This approach transforms compliance from a checkbox into a core part of delivering permission-based, relationship-first reactivation campaigns.
How 'Any Reasonable Manner' Revocation Raises Compliance Stakes
The FCC's February 2024 Order fundamentally changed how consent revocation works: consumers can now opt out "in any reasonable manner that clearly expresses a desire not to receive further calls or text messages," and businesses can no longer mandate a single exclusive channel. This medium-agnostic standard means a verbal request on a call, an email to support, or even telling a technician in person triggers the same legal obligation as texting "STOP" — and it applies across both robocalls and robotexts.
Rigid, keyword-only opt-out systems now carry significant liability. The FCC recognizes seven keywords — stop, quit, end, revoke, opt out, cancel, unsubscribe — but the "any reasonable manner" rule creates a rebuttable presumption that non-standard methods like voicemails, emails, or in-person requests are valid, placing the burden on the business to prove otherwise. With statutory damages of $500–$1,500 per violation and no requirement to prove actual injury, a single missed opt-out can scale quickly into class-action exposure.
The compliance window is tight: businesses have 10 business days to process any revocation, and only one confirmation message (sent within five minutes, no marketing content) is permitted afterward. This demands more than automated filters — it requires human judgment to catch the opt-outs that don't fit a script.
- Train every customer-facing employee to recognize and document opt-out requests in any form
- Centralize opt-out records so a revocation in one channel immediately suppresses outreach in all channels
- Retain opt-out documentation for at least four years — the TCPA statute of limitations
- Audit your systems quarterly against the seven recognized keywords plus non-standard methods
CallMyCustomers builds this into every campaign: real humans review every reply, opt-outs are honored immediately across calls, texts, and emails, and the business owner approves every script before it sends — so consent revocation is never missed, and compliance isn't left to a keyword filter.
Why Human-in-the-Loop Outreach Reduces Robocall Risk
Most robocall violations don't happen because a business set out to break the law — they happen when an automated system misses a signal a human would have caught. The FCC's 2024 rules, effective April 11, 2025, now let consumers revoke consent "in any reasonable manner" — and that word "reasonable" is exactly where pure automation breaks down.
The rules recognize seven opt-out keywords: stop, quit, end, revoke, opt out, cancel, and unsubscribe. But they also protect opt-outs that arrive by voicemail, email, in person, or in a sentence like "please don't call me about this anymore." As BCLP's compliance analysis notes, non-traditional opt-out requests carry a rebuttable presumption of reasonableness — the burden falls on the business to prove otherwise. A keyword filter can't hear frustration in a voice reply or read intent in a rambling text. A trained person can.
That's why judgment-based outreach is a compliance control, not just a service philosophy. When real humans place calls and read responses, non-standard opt-outs get recognized and honored the moment they surface — not ten business days later, which is the FCC's maximum processing deadline. And since revocation is medium-agnostic, an opt-out expressed on a call stops the texts too, and vice versa.
The stakes make this worth getting right. TCPA violations carry statutory damages of $500 to $1,500 per violation with a private right of action and no requirement to prove actual injury, per WilmerHale's analysis. A single ignored opt-out across a reactivation list can multiply into hundreds of claims fast.
This is the logic behind CallMyCustomers' human-in-the-loop model — real people run the outreach, the owner approves every script and message before it goes out, and opt-outs are honored immediately, not queued for batch processing. Automation handles the scale; people handle the judgment.
The compliance posture rests on three practices:
- Working only from verified customer lists, so every contact has an existing relationship rather than a scraped number.
- Human review of every reply, catching opt-outs that keyword filters would miss.
- Owner sign-off on every message before sending, so nothing goes out that hasn't been vetted.
The enforcement backdrop reinforces why this matters: the FCC removed over 1,200 voice providers from the Robocall Mitigation Database in August 2025 alone. Regulators are watching the entire call chain — and businesses that put humans between their campaigns and their customers are simply harder to catch on the wrong side of it.
The Cost of Non-Compliance and Why Regulators Are Escalating Enforcement
Getting robocall rules wrong is not a slap on the wrist — it is a per-call financial exposure that can turn a well-intentioned marketing campaign into a six-figure liability. And regulators are making it clear they have no patience for businesses that treat compliance as optional.
The TCPA allows consumers to recover $500 to $1,500 per violation, with no requirement to prove actual injury, according to legal analyses of the FCC's 2024 Opt-Out Rule. The statute permits the greater of actual monetary loss or $500 per violation, and courts can award treble damages for knowing or willful violations, as WilmerHale's privacy attorneys note. Multiply that across a 5,000-contact list and the math becomes existential for a small business.
What makes this exposure especially dangerous is the private right of action. Consumers do not need to wait for a regulator — they can sue directly, and TCPA-related litigation has been rising, with one analysis describing the statute as "fertile ground for potential legal claims." Class actions amplify the risk because damages are assessed per violation, per class member.
Regulators, meanwhile, are escalating at the network level. In August 2025 alone, the FCC removed more than 1,200 voice service providers from the Robocall Mitigation Database — 185 on August 6 and roughly 1,000 more on August 25 — after warning over 2,000 providers about deficient filings in December 2024, as reported in a Mintz regulatory update. Removed providers are effectively disconnected from the U.S. phone network. FCC Chairman Brendan Carr was blunt: "Providers that fail to do their duty when it comes to stopping these calls have no place in our networks."
For a business running customer outreach, the practical takeaways are straightforward:
- Work only from lists of real customers with an existing relationship — never scraped or purchased data.
- Honor opt-outs immediately, well within the ten-business-day processing deadline, and recognize non-standard revocations like replies to an email or a verbal "stop."
- Retain consent and opt-out documentation for at least four years, the TCPA statute of limitations.
- Approve every script and message before it goes out, so nothing reaches a customer that has not been reviewed.
This is why who runs your outreach matters as much as what you say. A vendor that builds compliance into the workflow — like CallMyCustomers, where the owner signs off on every script, offer, and message before anything is sent, and opt-outs are honored immediately — shifts a meaningful part of that exposure off your plate. The rules are also still moving: the FCC extended its "revoke all" waiver to January 31, 2027, and is reconsidering parts of the revocation rule itself, even as keyword opt-outs and processing deadlines remain fully in force. Compliance is not a one-time checkbox — it is an ongoing discipline, and partnering with someone who treats it that way is one of the cheapest forms of insurance available.
Turn your past customers, old quotes, and inactive members into booked work — approved by you, run by us. Get a free list review and see exactly what your list can produce before you spend a dollar.
Frequently Asked Questions
What actually makes a robocall illegal under the TCPA?
Can a customer really opt out by just telling my receptionist or leaving a voicemail?
What are the seven opt-out keywords the FCC recognizes, and do I have to honor others?
How fast do I need to process an opt-out request, and what can I send after?
What's the real financial risk if my business gets this wrong?
Is the FCC actually enforcing these rules, or is it just talk?
Legal Outreach Is a Discipline, Not a Dice Roll
A robocall becomes illegal in two ways: it was sent without prior express written consent, or consent was revoked and the outreach kept coming. Since April 11, 2025, revocation can happen "in any reasonable manner" — a voicemail, an email, a sentence on a live call — and businesses have ten business days to honor it, with only one non-marketing confirmation allowed afterward. The stakes are $500 to $1,500 per violation with no injury requirement, and regulators removed over 1,200 voice providers from the Robocall Mitigation Database in August 2025 alone. Your next steps: audit your lists so every contact is a real customer, train your team to catch non-standard opt-outs, centralize revocation records across channels, and keep documentation for four years. Or hand the judgment calls to someone who does this daily. CallMyCustomers runs owner-approved, human-reviewed reactivation campaigns from verified customer lists, with opt-outs honored immediately. Get a free list review and see what your list can produce — before you spend a dollar.