Operations
If somebody calls on your behalf and gets it wrong, the exposure is usually yours as well as theirs. What the rules actually say, and what changed in 2025.
7 min read
Most owners meet the Telephone Consumer Protection Act the same way. A letter arrives, and it turns out a vendor they hired has been calling people it should not have been calling. The vendor gets sued. So, quite often, do they.
That is the part worth understanding before anything else, so we will start there rather than end there.
The TCPA is enforced largely through private lawsuits. Statutory damages are $500 per call, trebled to $1,500 where the violation is wilful or knowing. There is no cap, and the person suing does not have to show they were harmed. A modest campaign that goes wrong for a fortnight can produce a number that looks like a misprint.
Under ordinary agency principles, the company whose goods or services are being sold can be held responsible for calls a contractor makes on its behalf. Hiring somebody to make the calls does not move the risk off your books. It gives you a second party who may be liable alongside you.
So the useful way to read the rest of this is not what must my vendor do. It is what am I on the hook for if they do not.
Three things, broadly. Calls and texts to mobile numbers made with an autodialer or an artificial or prerecorded voice. Prerecorded voice calls to residential lines. And calls to numbers on the Do Not Call registry, which has its own set of rules and its own article.
Ordinary manual dialling to a customer who asked you to ring them is not what this statute is aimed at. Most of the trouble sits in marketing to people who did not ask.
For marketing calls and texts to a mobile using an autodialer or a prerecorded voice, you need prior express written consent. Written has a specific meaning: a signed agreement that names the seller, states clearly that the person agrees to receive these calls, includes the number, and makes clear that agreeing is not a condition of buying anything. An electronic signature counts.
For non-marketing calls, the bar is lower. But the line between a service call and a marketing call is not where most people assume, and a reminder with an offer attached to the end of it is a marketing call.
The practical failure is almost never a company deciding to ignore consent. It is a company that cannot produce it two years later when somebody asks. Consent you cannot evidence is, for litigation purposes, consent you do not have.
In Facebook v. Duguid (2021) the Supreme Court narrowed what counts as an autodialer: the system has to use a random or sequential number generator. Dialling from a stored list of customer numbers, on its own, does not meet that definition.
That took a lot of air out of a lot of claims, and it is frequently over-read. It says nothing about prerecorded or artificial voice calls, which are restricted regardless of how the number was dialled. It says nothing about the Do Not Call rules. And it does not stop a plaintiff arguing about what your particular platform can do.
Federally, telemarketing calls to residential subscribers are prohibited before 8 a.m. or after 9 p.m. — local time at the called party’s location. Not your time zone. Not the time zone the area code implies, which is a genuinely dangerous assumption now that numbers move with people.
This has become one of the most active areas of TCPA litigation, particularly for text messages, where a scheduled send can trip the rule across three time zones at once without anybody noticing. Several states are stricter than the federal window, and a few also cap how many times you may call in a day.
The FCC’s revocation rules took effect on 11 April 2025 and they are strict in a way worth reading carefully.
A consumer may revoke consent by any reasonable means. In a text reply, the words stop, quit, end, revoke, opt out, cancel and unsubscribe are automatically reasonable — you cannot require a particular keyword or a particular channel. Anything else gets judged on the totality of the circumstances, which in practice means a jury.
Once revoked, you have a reasonable time and no more than ten business days to honour it. One confirmation message is allowed, provided it only confirms the opt-out and carries no marketing.
One provision was delayed. The requirement that a revocation on one type of message must be treated as applying to unrelated robocalls and texts as well is under a limited FCC waiver until 31 January 2027. The rest of the rule is live now.
In January 2025 the Eleventh Circuit vacated the FCC’s one-to-one consent rule in Insurance Marketing Coalition v. FCC, holding that the agency had gone beyond the statute. Companies that had rebuilt their lead forms for it got a reprieve. Companies that use shared or sold leads should not read that as an all-clear, because the underlying consent still has to be real and traceable.
In June 2025 the Supreme Court decided McLaughlin Chiropractic v. McKesson, which ended the practice of district courts automatically deferring to FCC interpretations of the TCPA. Courts now reach their own reading of the statute. The practical effect is less predictability, not more freedom: an FCC position you have been relying on is no longer the last word in a courtroom.
More than a dozen states now have their own telemarketing statutes, and several are stricter than the federal law. Oklahoma requires prior express written consent for a much broader definition of automated system and caps calls at three per day. Washington requires you to identify yourself within thirty seconds and to stop within ten seconds of being asked, then leave the number alone for a year. Florida and Maryland run narrower calling windows and their own frequency caps. Texas made timing violations a deceptive trade practice, which brings treble damages and legal fees.
Federal compliance is the floor. If you sell across state lines, it is not the ceiling.
Ask where consent is stored, in what form, and how long they keep it — the answer should be years, not months. Ask how they determine the called party’s local time, and whether it is based on area code or on address. Ask what happens in their system the moment somebody says stop, and how quickly it takes effect. Ask whether the platform they dial with uses a random or sequential number generator, and get the answer in writing. Ask who is named in the indemnity clause when a claim arrives, and read it rather than assuming.
If a vendor cannot answer those without going away to check, that is your answer.
Most of what we do is inbound: somebody rings you and we pick up. Consent is not really in question when the customer is the one dialling. Where we make outbound calls, we call people who have asked to be called, we work to the called party’s local hours, and a request to stop is recorded on the call it happens on, not at the end of the week.
We are not a compliance vendor and we would not want to be sold as one. But we would rather you asked us these questions than found out the answers later.
This is general information about how these rules work, not legal advice, and it is not a substitute for a lawyer who knows your business. The rules change often — the two most significant changes described here happened within the last eighteen months.
Bring your call volume and your average customer value. Fifteen minutes, and if it does not add up we will say so.
Summit Call Solutions