The Telephone Consumer Protection Act (TCPA) is a US federal law, passed in 1991, that restricts how businesses use phone calls, text messages and faxes to reach people. It focuses on telemarketing, automated and prerecorded calls, and unsolicited fax advertising, and it relies mainly on consent and opt-out rules. For buyers of contact center, dialer and messaging technology, it is a law that often shapes how those systems have to be configured. This entry is a general overview, not legal advice: how the TCPA applies to a particular program is fact-specific and changes as the FCC and courts revise their interpretations.
At a glance
- A US federal law; the FCC writes and updates the rules under it, and other countries have their own rules.
- Which obligations apply depends on the purpose of the call or text (marketing or informational), the technology used (autodialed, prerecorded or artificial voice, or manually dialed), the type of number called and the consent you hold.
- Common requirements include consent records, honoring opt-outs, respecting the National Do Not Call Registry and an internal do-not-call list, and calling-time limits for telemarketing.
- Individuals can sue, and class actions have made TCPA litigation common and costly.
- State laws can add stricter requirements, so check federal and state rules with counsel.
What problem it solves
The TCPA was written to protect people from intrusive calls and faxes: unwanted sales calls at dinner time, recorded messages dialed to thousands of numbers, and junk faxes that used up the recipient’s paper and toner. It gives consumers control by requiring businesses to get permission for certain contacts and to stop when asked.
For a business, the problem is the other side of that: outbound calling and texting are useful, but a campaign set up without the right consent, opt-out handling or calling windows can produce lawsuits where damages are counted per call or per text. A program that reaches tens of thousands of people creates exposure on the same scale.
How it works
Consent tiers. The rules distinguish between kinds of consent. Telemarketing calls or texts that use an autodialer or a prerecorded or artificial voice generally need prior express written consent, a signed (including electronically signed) agreement that meets specific disclosure requirements. Many informational automated calls and texts to mobile numbers need prior express consent, which can be less formal. Manually dialed telemarketing calls are mainly governed by do-not-call rules. Exactly which tier applies to a message is fact-specific.
Do-not-call rules. Telemarketers must generally respect the National Do Not Call Registry and keep their own internal do-not-call list of people who have asked not to be called, subject to exemptions such as some established business relationships.
Opt-outs and identification. Recipients can revoke consent, and FCC rules address how revocation can be made and how quickly it must be honored. Under FCC rules, prerecorded messages and telemarketing calls generally must identify the caller, and automated telemarketing messages generally must include a way to opt out.
Calling times. Telemarketing calls are restricted to set hours in the called party’s local time, and some states impose narrower windows.
Faxes. Unsolicited fax advertisements are generally prohibited. A limited exception for established business relationships applies only when several conditions are all met: there is an established business relationship with the recipient; the fax number was obtained through a permitted route, generally given voluntarily by the recipient within that relationship or taken from a qualifying public source, subject to any notation by the recipient that it does not accept unsolicited ads; and the fax carries an opt-out notice that meets the rules’ requirements. Have counsel review any fax advertising program before relying on the exception.
Enforcement. The FCC enforces the rules and can impose forfeiture penalties, state attorneys general can bring actions, and individuals can sue for their actual loss or statutory damages, whichever is greater. Key definitions, such as what counts as an autodialer, have been reshaped by court decisions, including the Supreme Court’s 2021 Facebook v. Duguid ruling. The FCC has also said that AI-generated voices count as artificial voices under the rules.
When it matters for buyers
- When you buy or reconfigure a dialer or contact center platform. Dialing modes, prerecorded messages and AI voice agents all affect which rules apply. See our contact center as a service overview for how platforms handle compliance controls.
- When you launch an SMS program. Marketing texts, appointment reminders and alerts may each need different consent, and carrier programs such as 10DLC and short codes add their own registration and opt-out requirements.
- When consent lives in different systems. If web forms, the CRM and the dialer each hold part of the consent record, proving consent later can be hard.
- When you use a third party to call or text for you. Liability can extend to the business on whose behalf messages are sent, depending on the facts.
- When you operate in states with their own telemarketing laws. Federal compliance alone may not be enough.
Questions to ask vendors
These are questions for dialer, CCaaS, CPaaS and CRM vendors; legal conclusions should come from your counsel.
- How does the platform capture, store and timestamp consent, and can we export proof of consent for a specific number?
- How are opt-outs (spoken requests, STOP replies, web requests) captured and applied across every channel and campaign, and how fast?
- Does the platform scrub against the National Do Not Call Registry, our internal list and reassigned-number data, and how often?
- Can we enforce calling windows by the recipient’s time zone and by state rules?
- Which dialing modes does the platform offer (manual, preview, progressive, predictive), and can we restrict campaigns to specific modes?
- How are AI or prerecorded voice features configured, and what disclosures do they play?
- How long are call, text and consent records retained, and can we set retention to match our counsel’s guidance?
How it differs from 10DLC and STIR/SHAKEN
The TCPA is a law with legal penalties. 10DLC is a carrier framework for registering business texting on standard 10-digit numbers; carriers can block or filter unregistered traffic, but 10DLC registration does not make a campaign TCPA-compliant. STIR/SHAKEN is a caller ID authentication framework that helps carriers verify that a call really comes from the number shown; it fights spoofing and affects spam call labeling, but it says nothing about whether you had consent to place the call. A compliant outbound program usually has to satisfy all three: the law, the carrier messaging rules and the caller ID requirements.
Problems this helps with
- Worried our outbound calling or texting could get us sued
- Not sure whether our dialer or texting platform creates legal risk
- No reliable record of who consented to be contacted, or who opted out
- Launching an SMS or appointment-reminder program and need to get consent right
