Yes, You Can Get Sued — Here's What Cold Calling Can Cost You

Yes, you can get sued — and the costs can escalate quickly under the TCPA. Statutory damages range from $500 to $1,500 per individual call, with no aggregate cap, meaning a single campaign dialing thousands of numbers can trigger six- or seven-figure liability. Class-action settlements have reached $5M–$20M in recent years, including Gen Digital’s $9.95M agreement and QuoteWizard’s $19M payout. These risks are amplified by a 95% year-over-year increase in TCPA filings and a four-year statute of limitations, giving plaintiffs ample time to pursue claims.

The law applies strict liability: good intent or lack of profit is not a defense. Even if your team believes a call is helpful or informational, if it meets the TCPA’s definition of a telemarketing call — or uses an AI-generated voice without prior express consent — the violation is complete. The February 2024 FCC Declaratory Ruling confirmed that AI-generated voices are treated as "artificial or prerecorded voice" under the TCPA, eliminating any technological loophole. This means your AI calling campaign requires the same consent as a robocall, regardless of how natural the voice sounds.

Vendor chain liability further increases exposure. Courts now hold companies responsible for calls made by their third-party providers, lead generators, or agents, as seen in cases like Lamb v. Mortgage One Funding. If your vendor dials a number without proper consent, your business can still be liable. This risk is especially relevant for companies using purchased lists or outsourced calling services that lack verified consent records.

For My AI Call Center, these risks are mitigated by design. The service operates exclusively on approved, permissioned, or reviewed lists, with consent verified before any campaign launches. List sources are scrubbed, opt-outs are honored immediately, and AI disclosures are included on every call — aligning with TCPA requirements for prior express consent and real-time revocation handling. By building compliance into the campaign workflow — from list review to outcome routing — the service helps clients avoid the costly pitfalls of cold calling while still achieving outreach goals like appointment reminders, lead qualification, and retention check-ins.

• TCPA statutory damages: $500–$1,500 per call, no cap
• Recent settlements: Gen Digital $9.95M, QuoteWizard $19M
• TCPA filings up 95% year-over-year
• Statute of limitations: 4 years
• AI-generated voices require prior express consent per FCC ruling

Why AI Calling Doesn't Dodge the Rules — and Where Businesses Get Caught

Some businesses assume that switching from human dialers to AI agents creates a compliance loophole. The opposite is true — the rules got tighter, and the trapdoors got harder to see.

The FCC's February 8, 2024 Declaratory Ruling confirmed that AI-generated voices count as an "artificial or prerecorded voice" under the TCPA. No matter how human the voice sounds, it requires the same prior express consent as a traditional robocall. The FCC was blunt: the statute does not allow any carve-out for technologies that imitate a live agent.

The Established Business Relationship exemption is where even careful teams get burned. As compliance experts put it plainly: "Your live SDR can dial a 16-month-old customer on the DNC list under EBR. Your AI agent cannot dial the same person without separate consent. The voice is what the law cares about."

That means the same contact list carries different legal weight depending on who — or what — places the call. A relationship that fully protects a human caller offers zero protection the moment an AI voice picks up the line. This is why list review has to account for both the relationship and the consent tier, not just one or the other.

Outsourcing the dialer does not outsource the liability. In Lamb v. Mortgage One Funding, the proposed class action covers every consumer called by the company "or from any of the company's vendors, lead generators, or agents." The entity on whose behalf a call is made bears the liability, regardless of which vendor actually dialed.

One expert's warning is worth pinning to the wall: "If you are buying AI calling from a third party and assuming the third party owns the compliance risk, Lamb is the case that proves you wrong." This is why My AI Call Center reviews list source and consent records before any campaign launches, and declines bought lists without clear permission trails.

A 2025 telemarketing rule update cut the required opt-out processing window from 30 days to 10. Consumers can now revoke consent "in any reasonable manner" — including verbal cues like "stop" or "take me off your list" — and callers must honor it within 10 business days. With TCPA filings up 95% year-over-year, slow opt-out handling is no longer a rounding error.

Where businesses actually get caught:

• Assuming AI voices fall outside the TCPA's artificial voice rules
• Dialing EBR-protected contacts with an AI agent that lacks separate consent
• Trusting a vendor's compliance claims without documented consent records
• Processing opt-outs on a 30-day timeline instead of the current 10-day requirement

Every one of these is preventable before the first call goes out — not after a demand letter arrives.

The Compliance Practices That Actually Prevent TCPA Lawsuits

The real threat of TCPA lawsuits isn't just theoretical—it's a financial liability that can escalate rapidly. Statutory damages range from $500 to $1,500 per violation, with no aggregate cap, and recent settlements have reached as high as $19 million for untraceable vendor consent issues. For businesses relying on outbound calling, compliance isn't optional; it's the only practical defense against exposure that can reach into the millions.

Effective prevention starts with understanding consent tiers. Prior express consent (PEC)—which can be oral—is sufficient for informational or transactional calls, such as appointment reminders or service updates. However, marketing calls require prior express written consent (PEWC) in 47 states, a distinction that trips up many organizations. My AI Call Center builds this tiered consent verification into its list review process, ensuring campaigns only proceed when the correct consent level matches the call purpose, reducing the risk of misclassification that often triggers litigation.

Honoring opt-outs in real time is equally critical. The 2025 telemarketing rule update reduced the required processing window from 30 to 10 business days, and consumers may revoke consent using any reasonable verbal phrase—including "stop," "quit," or "take me off your list"—during a call. Systems must detect and act on these requests immediately, logging them across all campaigns and syncing with client DNC records to prevent repeat calls. This responsiveness directly addresses the expanded definition of valid revocation under current regulations.

Additional safeguards include scrubbing DNC lists at least every 31 days—a hard regulatory requirement—and adhering to state-specific quiet hours, which can be stricter than the federal 8 a.m.–9 p.m. window. In the 11 states plus D.C. requiring all-party consent for recording, disclosure and explicit permission are mandatory before any call is captured. AI disclosure must be delivered on every outbound call, clarifying the use of artificial voice and offering recipients the option to speak with a human or opt out. Finally, retaining detailed records—including consent proof, opt-out logs, and call dispositions—for seven years aligns with the TCPA’s four-year statute of limitations and defense counsel’s recommendation, providing a defensible audit trail if challenged.

How a Managed, List-Disciplined Calling Partner Reduces Your Exposure

The fastest way to lose a TCPA lawsuit is to assume someone else handled the compliance. Courts now hold the company on whose behalf calls are made liable for vendor and lead-generator dialing — a proposed class action in Lamb v. Mortgage One Funding covers every consumer called by the company "or from any of the company's vendors, lead generators, or agents." With TCPA statutory damages running $500 to $1,500 per call and no aggregate cap, the list you dial matters as much as what you say on it.

That is why list discipline sits at the front of how My AI Call Center runs a campaign, not at the end. Before anything launches, the list source and consent records get reviewed — where the numbers came from, what permission exists, and whether the calling windows are lawful. Bought lists without clear permission records are flagged, and in most cases declined. If the list will not support the campaign, you hear that plainly before you spend anything.

This matters because consent requirements for AI voices are strict. The FCC's February 2024 Declaratory Ruling confirmed that AI-generated voices count as "artificial or prerecorded voice" under the TCPA, requiring prior express consent regardless of how human the voice sounds. And the Established Business Relationship exemption does not rescue you: a live rep can call a past customer on the DNC list under EBR, but an AI agent cannot call the same person without separate consent.

A managed, structured process also handles the parts of compliance that trip up in-house teams:

• AI disclosure on every call — recipients can ask if the call is AI-assisted, request a human, or opt out at any point.
• Immediate opt-out honoring — keyword revocations like STOP and REVOKE are honored on the spot, not within weeks. That matters since the 2025 rule update cut the required opt-out processing window from 30 days to 10.
• DNC requests carried forward — opt-outs are logged and respected across all campaigns, and carried into your client DNC records so one campaign's "no" protects every future one.
• Pre-launch campaign review — the goal, script, disclosure, and escalation path are approved before launch, so risky lists and risky language get caught while changes are still free.

The economics of getting this wrong are severe. Recent TCPA settlements have ranged from $5M to $20M, and one industry tracker puts aggregate TCPA verdicts above $925M. TCPA is strict liability — good intent is not a defense, and the violation is complete whether or not the call made you money.

A managed partner does not eliminate your legal responsibility — campaign requirements vary by location, industry, and consent status, and you should get appropriate legal guidance before launch. But it does remove the most common failure points: unvetted lists, missing consent records, slow opt-out handling, and undisclosed AI voices. The first campaign review is free, and the full cost is known before you approve anything — so you can find out whether your list will hold up before a plaintiff's attorney tells you it won't.