By Mike Reeves | ComplianceJournal.news | Updated April 2026

TCPA class action filings reached 1,052 cases through mid-2025 — a 95.2 percent increase over the same period in 2024. At $500 to $1,500 per violation, a single campaign contacting 200 reassigned phone numbers generates $100,000 to $300,000 in potential exposure before a compliance team finishes its morning coffee. The rules have changed significantly in the past 18 months. Most compliance guides have not caught up. This one has.

What Is the TCPA?

The Telephone Consumer Protection Act, codified at 47 U.S.C. § 227, was enacted in 1991 to regulate telemarketing calls, text messages, faxes, and prerecorded voice messages. The FCC administers the TCPA and issues implementing regulations. The statute creates a private right of action with statutory damages of $500 per negligent violation and $1,500 per willful violation — making it one of the most litigated consumer protection statutes in the country.

What the TCPA Covers in 2026

The TCPA restricts calls and texts made using an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice, as well as all calls and texts to numbers on the National Do Not Call Registry for telemarketing purposes.

The Supreme Court's 2021 Facebook v. Duguid decision narrowed the definition of an ATDS — a system must have the capacity to use a random or sequential number generator to store or produce numbers to be called. Standard dialers calling from pre-loaded lists were effectively cleared from ATDS classification. But Duguid did not make the TCPA toothless. It shifted plaintiff strategies toward DNC violations, consent documentation failures, and state-law theories — which is why state mini-TCPA laws have become the real compliance frontier in 2026.

TCPA consent requirements vary depending on the type of call or text and whether the contact is for marketing or informational purposes.

For autodialed marketing calls and texts to cell phones, prior express written consent is required. The consent must be a clear and conspicuous written disclosure that the consumer authorizes the company to contact them using automated dialing systems or prerecorded messages. The disclosure must include the telephone number to which the consent applies. The consent cannot be required as a condition of purchasing goods or services.

A general terms-of-service checkbox that includes language about automated communications is almost certainly insufficient. Courts and the FCC have found that consent buried in terms of service or combined with other authorizations does not satisfy the TCPA's written consent standard.

For autodialed non-marketing calls and texts to cell phones — account notifications, appointment reminders, fraud alerts — prior express consent (without the "written" requirement) is sufficient. However, once a consumer revokes consent, informational calls and texts must stop as well as marketing contacts.

Consent documentation is the battleground in TCPA litigation. A business that cannot produce contemporaneous, specific consent documentation for a given phone number at the time a call or text was placed has no defense. Adequate consent documentation captures the specific disclosure language the consumer saw at the time of consent, the channel through which consent was given, the specific phone number for which consent was obtained, the date and time of consent with time zone, and the technical mechanism by which consent was recorded.

The FCC's April 2025 consent revocation rules significantly changed opt-out handling. These rules are active and enforceable now:

Any reasonable method. Consumers may revoke consent using any reasonable method that clearly expresses a desire not to receive further communications. Businesses cannot designate an exclusive revocation method. A consumer who replies STOP to a text, says "stop calling me" during a live call, or submits an opt-out through a web form has revoked consent regardless of the company's preferred revocation channel.

10 business days to honor revocation. Businesses must honor revocation requests within 10 business days. Processing revocations through a weekly batch file that takes two weeks to propagate to sending systems does not comply with this requirement.

One confirmation text permitted. After a consumer opts out via text, the business may send one confirmation text within 5 minutes. No additional marketing or informational texts may be sent after that.

One element of the revocation rules was delayed: the requirement that revocation of one type of message applies to all other types of future calls and texts from the same sender on unrelated matters. The FCC delayed this "revoke all" provision to January 31, 2027. Everything else is live now.

The National Do Not Call Registry

Telemarketers must scrub calling lists against the National Do Not Call Registry at least every 31 days. The 31-day window is a safe harbor — businesses that scrub more frequently have stronger documentation of compliance. Maintain timestamped records of each scrub for at least 24 months.

A number on the DNC Registry cannot be contacted for telemarketing purposes regardless of what consent the business believes it has. DNC compliance is a separate obligation from ATDS consent compliance.

The Reassigned Number Problem

Phone number reassignment is one of the highest-risk TCPA exposure sources in 2026. The United States processes tens of millions of phone number reassignments annually. A consumer who gave valid consent two years ago may have a different person with the same number today. Consent follows the person, not the number. Contacting a reassigned number generates TCPA liability even if consent was validly obtained from the prior holder.

A database of 100,000 contacts with a 25 percent annual decay rate means roughly 25,000 records are unreliable within a year. A business running a single campaign to that database without a reassigned number check has up to $37.5 million in potential exposure at $1,500 per willful violation — before the first defendant's attorney files a motion.

The FCC's Reassigned Numbers Database is available for scrubbing. Regular database hygiene — identity verification, phone number validation, and reassigned number checks before each campaign — is the minimum reasonable practice in the current environment.

State Mini-TCPA Laws — The Real Compliance Frontier

If you are only tracking federal TCPA rules in 2026, you are exposed. State mini-TCPA laws are now stricter than federal regulation for many businesses and many call types.

Florida. Florida's mini-TCPA applies to calls made using automated systems to Florida area codes, regardless of where the caller is located. It limits businesses to three attempts per day per number and requires calls only between 8 a.m. and 8 p.m. local time.

Texas. Texas SB 140, effective September 1, 2025, expanded "telephone solicitation" to include text messages, image messages, and other transmissions designed to induce a purchase. It created a new private right of action through the Texas Deceptive Trade Practices Act for violations. If you are texting prospects in Texas, this law applies to you.

Virginia. Virginia SB 1339, effective January 1, 2026, requires businesses to honor a consumer's STOP or Unsubscribe request for 10 years. That is not a typo. A decade-long suppression obligation that most CRMs are not built to manage.

Maryland, Oklahoma, and several other states have enacted or are considering their own mini-TCPA laws. Compliance programs that apply the same standards to every state are increasingly insufficient.

TCPA and AI-Generated Calls

The FCC opened a Notice of Proposed Rulemaking in early 2026 specifically addressing AI-generated voice calls and texts. The proposed rules would require disclosure that communications are AI-generated, require consent that specifically references AI generation, and extend revocation rules to AI-generated content. Final rules are expected in late 2026 or early 2027. Businesses using AI voice synthesis or AI text generation in customer communications should begin compliance planning now.

Quiet Hours — A Frequently Missed TCPA Provision

The TCPA prohibits telemarketing calls and texts before 8 a.m. or after 9 p.m. in the recipient's local time. A campaign scheduled for 6 a.m. Eastern time reaches Mountain and Pacific time zone recipients at 5 a.m. and 3 a.m. respectively. AI-powered send-time optimization tools — designed to maximize engagement — frequently generate TCPA quiet hours violations when they are not configured with time zone compliance logic. This is a class action risk that is entirely avoidable with proper system configuration.

This guide is for informational purposes only and does not constitute legal advice. For legal advice specific to your situation, consult a licensed attorney. ComplianceJournal.news is an independent publication. Content current as of April 2026.