The Escalating TCPA Threat Landscape

The numbers tell a story that should keep every business owner awake at night. TCPA class action filings surged 112% year-over-year in Q1 2025, jumping from 239 to 507 cases, and the pace has only accelerated with more than 2,128 lawsuits filed through September 2025 — a 50% increase over the prior year.

Nearly 80% of all TCPA suits now proceed as class actions, a rate that dwarfs the 5.1% for FDCPA cases and 1.4% for FCRA matters. Leading defense attorney Eric J. Troutman calls the statute the "single most significant legal threat to American businesses" and the "biggest cash cow in history" for the plaintiff's bar.

Plaintiffs have adapted their playbook. After the Supreme Court narrowed the autodialer definition in Facebook v. Duguid, they pivoted to unsolicited advertisement and telephone solicitation theories that don't require ATDS proof. Courts are embracing expansive readings of what counts as an "advertisement" — including free webinars with commercial nexus and contingency-fee legal service calls — creating new exposure for businesses that never touch an autodialer.

• The Fifth Circuit ruled that "prior express consent" doesn't explicitly require writing, but this applies only in Texas, Louisiana, and Mississippi
• The Seventh Circuit held that marketing texts aren't "telephone calls" under Section 227(c)(5), eliminating a key do-not-call claim for texts in Illinois, Indiana, and Wisconsin
• Section 227(b) liability for autodialed calls and texts remains fully intact nationwide
• State mini-TCPA laws and FCC enforcement authority are unaffected by either ruling

The pending Supreme Court decision in McLaughlin Chiropractic Associates, Inc. v. McKesson Corp. could multiply jurisdictional inconsistency. If the Court decides district courts aren't bound by FCC interpretations, businesses face a patchwork of conflicting standards across federal districts — making documented consent for every lead the only reliable shield.

At CallMyCustomers, we've built our entire reactivation model around this reality: every campaign runs on verified customer lists, every message is approved before it sends, and every opt-out is honored instantly. Compliance isn't a checkbox — it's the foundation that makes repeat revenue sustainable.

Who Faces Liability: Entities in the Crosshairs

It's not just the company making the call that ends up in court. TCPA plaintiffs cast a wide net, and recent litigation shows the net widening: class action filings surged 112% year-over-year in Q1 2025, and nearly 80% of all TCPA lawsuits are now class actions — a dynamic that turns even a single calling mistake into a six-figure exposure.

So who actually faces liability? Courts have held several categories of entities accountable:

• Companies using autodialers or prerecorded voice — the core Section 227(b) claim, which remains fully in force even after recent favorable rulings for text senders.
• Senders of unsolicited fax advertisements — a claim that requires no proof of autodialer use and has become a plaintiff favorite.
• Telemarketers making telephone solicitations, including law firms making contingency-fee solicitation calls.
• Any entity that fails to honor opt-outs or maintain proper consent records for the numbers it contacts.

The definition of "telephone solicitation" has also expanded in ways that surprise many businesses. Courts increasingly accepted expansive interpretations in 2024, covering communications that only indirectly lead to profit — free webinars with a commercial nexus, for example, or contingency-fee legal services calls. If a communication ultimately benefits your business commercially, it can qualify, even when no product is being sold on the call itself.

Vendor and third-party marketer gaps create another layer of exposure. Lack of vendor oversight is cited as a key risk factor in TCPA litigation, and because plaintiffs can pursue telephone solicitation claims based on indirect commercial benefit, the business that hires a third party can be sued directly for that party's conduct. Handing your list to an outside marketer doesn't hand off the liability.

This is why consent discipline matters more than the tool you use. With statutory damages of $500 to $1,500 per call or text, legal experts advise maintaining robust compliance practices, including honoring opt-outs and Do-Not-Call requests, since exposure survives under multiple legal theories regardless of jurisdiction. Written consent remains the safest and most defensible practice nationwide, even though the Fifth Circuit has questioned whether the TCPA explicitly requires it in its ruling on written consent.

The practical takeaway for a home services shop, clinic, or salon running reactivation campaigns: work only from lists of real customers, collect explicit consent at the point of booking, honor opt-outs immediately, and insist on approval rights over every script and message before anything goes out. That's the model we follow at CallMyCustomers — the client signs off on every campaign, and compliance is built into the workflow rather than treated as an afterthought.

Circuit Splits That Change Your Exposure Map

For businesses running nationwide outreach campaigns, jurisdictional rulings create a patchwork of exposure that demands a unified compliance strategy. The Fifth Circuit’s decision in Bradford v. Sovereign Pest Control clarified that while the TCPA requires prior express consent, it does not explicitly mandate written consent—though this interpretation applies only to Texas, Louisiana, and Mississippi. Meanwhile, the Seventh Circuit ruled in Steidinger v. Blackstone Medical Services that unwanted marketing text messages are not "telephone calls" under Section 227(c)(5) of the TCPA, eliminating a key private do-not-call claim for texts in Illinois, Indiana, and Wisconsin. However, this ruling does not affect liability under Section 227(b) for autodialed calls and texts, nor does it impact state mini-TCPA laws or FCC enforcement authority.

These circuit splits mean that a single text message campaign could trigger liability in one state while avoiding it in another, depending on the claim type and jurisdiction. For example, a business might avoid a Section 227(c)(5) do-not-call claim in Wisconsin due to the Seventh Circuit’s ruling but still face Section 227(b) autodialer liability or a claim under Wisconsin’s state mini-TCPA. With nearly 80% of TCPA lawsuits filed as class actions and statutory damages reaching up to $1,500 per violation, the financial exposure remains severe even in jurisdictions with favorable rulings.

• Document consent for every lead using verifiable records, as written consent remains the safest nationwide practice despite circuit-specific interpretations.
• Scrub all calling and texting lists against the National Do Not Call Registry and reassigned number databases to mitigate Section 227(b) and state law risks.
• Monitor third-party vendors and marketers closely, as plaintiffs increasingly pursue claims based on telephone solicitations that indirectly lead to profit.

The pending Supreme Court decision in McLaughlin Chiropractic Associates, Inc. v. McKesson Corp. could further complicate the landscape by determining whether federal district courts are bound by the FCC’s interpretations of the TCPA under the Hobbs Act. If the Court limits judicial deference to the FCC, businesses may face a multiplicity of TCPA interpretations at the district court level, increasing litigation risk and compliance complexity. For nationwide operators like CallMyCustomers, which manages consent-based reactivation campaigns for U.S. service businesses, this underscores the necessity of adhering to the strictest applicable standard across all jurisdictions—ensuring that every message, whether call or text, is backed by documented consent and executed with rigorous data hygiene. This approach not only reduces legal exposure but also aligns with the permission-based, relationship-first outreach that drives sustainable repeat revenue.

Five-Point Protection Framework for Service Businesses

A compliance system only works if it's built before the first call goes out — not after a lawsuit lands. For service businesses running reactivation campaigns on lists of past customers, the stakes are real: violations carry $500–$1,500 per call or text, and with nearly 80% of TCPA lawsuits filed as class actions, a single campaign mistake can multiply into thousands of claims. The businesses that win, as industry compliance research puts it, are the ones that "verify consent, control their data, and audit everything before hitting 'call' or 'send.'"

Here's a five-point protection framework tailored to reactivation outreach:

• Document verifiable consent for every customer record before any outreach begins. Missing or invalid consent is cited as a top risk factor in TCPA litigation, and reactivation campaigns — by definition — reach customers whose last interaction may be months or years old. Capture explicit consent at the point of booking and keep records tied to each number on the list.
• Scrub lists before every campaign wave against the National Do Not Call Registry and reassigned-number databases. Poor lead data quality and failure to honor opt-outs are major litigation risk factors, and numbers change hands constantly. Scrubbing once isn't enough — each wave needs a fresh pass.
• Build vendor oversight into contracts with audit rights and compliance warranties. Lack of vendor oversight is a key risk factor in TCPA cases, and plaintiffs have successfully pursued claims based on telephone solicitations that only indirectly lead to profit. If a third party runs your outreach, their compliance failures become yours.
• Honor opt-outs instantly across all channels — voice, text, and email. A "stop" reply or do-not-call request must suppress that customer everywhere, not just on the channel where they opted out. Nixon Peabody attorneys advise maintaining robust opt-out practices regardless of any favorable court rulings, because exposure under other legal theories survives.
• Treat written consent as the universal standard — even though the Fifth Circuit ruled in Bradford v. Sovereign Pest Control that the TCPA doesn't explicitly require it. That ruling binds only Texas, Louisiana, and Mississippi, and class actions don't respect circuit boundaries. As compliance analysts note, written consent remains the safest and most defensible practice nationwide.

The jurisdictional picture is genuinely unsettled. The Supreme Court's pending decision in McLaughlin Chiropractic Associates v. McKesson could multiply TCPA interpretations at the district court level, and the Seventh Circuit's recent ruling that texts aren't "telephone calls" under one provision leaves Section 227(b) liability fully intact — meaning autodialed and prerecorded outreach still carries primary risk.

This is why CallMyCustomers builds compliance into reactivation campaigns from the start: working only from lists of real customers, honoring opt-outs immediately, and securing client sign-off on every script and message before anything is sent. Permission-based outreach to customers who already know your business is both the growth strategy and the safest legal footing — provided the five points above are non-negotiable.

How CallMyCustomers Builds Compliance Into Every Campaign

Knowing who can be sued under the TCPA is one thing; building a process that keeps you off the defendant list is another. With nearly 80% of TCPA lawsuits now filed as class actions and Q1 2025 filings up 112% year-over-year, compliance has to be designed into outreach from the first step — not bolted on after the dialing starts.

That is exactly how CallMyCustomers approaches reactivation. Before a client spends a dollar, the free list review segments every contact by recency and consent status — 30 days, 6 months, 12+ months — so outreach only goes to real customers with a defensible relationship to the business. This mirrors what compliance analysts recommend: verify consent, control your data, and audit everything before hitting "call" or "send."

Owner approval is the second safeguard. Every script, offer, and message is signed off before anything goes out, which eliminates the unauthorized solicitations that drive so much litigation. Courts have increasingly accepted expansive interpretations of what counts as a "telephone solicitation," including communications that indirectly lead to profit — so nothing goes out that the business owner hasn't explicitly approved.

The operational layer looks like this:

• Human judgment at the edges, automation for scale — real people handle judgment calls, so edge cases get handled rather than blasted through.
• Instant opt-out routing — opt-outs flow straight into the client's CRM and are honored immediately, addressing the failure-to-honor-opt-outs risk cited as a major litigation driver.
• Clinical-vertical safeguards — dental, med spa, and clinic outreach runs under BAA/HIPAA agreements and A2P 10DLC registration, with patient outreach held to clinical standards.
• Fresh consent at booking — the booking flow captures explicit consent from the customer at the moment of re-engagement, creating a new documented record.

This matters because the legal ground keeps shifting. Even after the Seventh Circuit held that marketing texts are not "telephone calls" under one TCPA provision, consent rules for autodialed calls and texts remain fully in force and still drive most text-message litigation. And with statutory damages of $500 to $1,500 per violation, a single sloppy campaign can compound fast.

The point is not that compliance is a checkbox to clear. It is the foundation that makes reactivation revenue sustainable — the difference between a second revenue engine and a class action waiting to happen. Permission-based outreach to people who already know your business is not just the safer legal posture; it is the one that actually converts.