CampaignsHow It WorksIndustriesResultsInsightsPlan My Campaign
TCPA And DNC Compliance

What are illegal text messages?

Back to InsightsWhat are illegal text messages?

What are illegal text messages?

Key Facts

  • Illegal texts cost $500 to $1,500 per message with no class-action cap, according to TCPA case research.
  • A single 10,000-recipient campaign texting outside permitted hours risks $5 million to $15 million in liability, industry analysis finds.
  • Class-action settlements for texting violations in 2025–2026 range from $4.75 million to $19 million, per telecom compliance data.
  • The National DNC Registry holds over 249 million active numbers and must be scrubbed at least every 31 days, compliance analysis shows.
  • Opt-out requests must be honored within 10 business days or violations jump to $1,500 per contact, per TCPA guidance.
  • A consent record that cannot be retrieved per number within an hour is functionally nonexistent in litigation, legal experts warn.
  • Valid consumer data does not equal valid consent, a gap that makes purchased leads the top TCPA exposure, compliance analysts explain.

The Real Cost of Illegal Text Messages: Beyond Fines to Reputational Risk

The Real Cost of Illegal Text Messages: Beyond Fines to Reputational Risk

Illegal text messages under the TCPA extend far beyond simple regulatory missteps—they trigger cascading financial and reputational damage that can cripple even established businesses. Marketing texts sent without prior express written consent, messages delivered after a consumer opts out via STOP, or outreach to numbers on the National DNC Registry each constitute violations carrying statutory damages of $500 to $1,500 per message, with no cap in class-action lawsuits. A recent study highlights that settlements in 2025–2026 routinely exceed $18 million, demonstrating how quickly exposure scales when compliance failures multiply across thousands of contacts.

The financial risk intensifies when violations are deemed willful or knowing, pushing penalties to the maximum $1,500 per text. For example, a misconfigured campaign sending 10,000 texts outside permitted 8 a.m.–9 p.m. hours creates potential liability between $5 million and $15 million, as noted in industry research. Beyond fines, reputational harm erodes trust: consumers who receive unsolicited or non-compliant messages are far more likely to associate the brand with spam, opt out permanently, and share negative experiences across social channels—amplifying long-term customer acquisition costs.

  • Marketing texts sent without prior express written consent
  • Messages delivered after consumer opt-out via STOP or similar
  • Outreach to numbers on the National DNC Registry
  • Texts sent outside permitted hours (before 8 a.m. or after 9 p.m. local time)
  • Messages lacking proper identification or opt-out mechanisms

For businesses relying on outbound engagement—such as clinics, franchises, or membership organizations—this risk is especially acute when using AI-driven tools that amplify errors at scale. My AI Call Center mitigates this by enforcing list discipline: only approved, permissioned, or reviewed lists are used, with consent records verified before any campaign launches. This approach ensures compliance is built into the process, not bolted on afterward, protecting both legal standing and customer relationships in an era where trust is the ultimate competitive advantage.

A single misconfigured campaign can turn a routine outreach into a seven-figure liability. That's why AI-powered screening has become the difference between businesses that text legally and businesses that get sued.

The stakes are real. TCPA violations carry statutory damages of $500 per message, rising to $1,500 per message when a court finds the violation was willful or knowing—and there's no cap on class-action liability. Recent settlements have ranged from $4.75 million to $19 million, with individual awards like O'Reilly Automotive's $18.8 million showing how quickly per-message penalties compound at scale.

AI screening systems attack this risk at five points, before any message is ever sent:

  • Real-time consent verification — checking timestamped consent records at the moment of outreach, since valid consumer data does not equal valid consumer consent
  • List hygiene — scrubbing against the National DNC Registry (over 249 million active numbers) and the Reassigned Number Database at least every 31 days
  • Automated opt-out enforcement — honoring STOP requests immediately and suppressing the number across all future campaigns within the required 10 business days
  • Time-zone-aware scheduling — restricting messages to 8 a.m.–9 p.m. in the recipient's local time, with stricter state limits like Texas's 9 a.m.–9 p.m. weekday window built in
  • Immutable record-keeping — preserving consent records, opt-out logs, and message content for at least 4 years, with 7 years recommended for added safety

The consent piece deserves special attention. The burden of proving TCPA consent falls on the caller, not the recipient—and according to compliance analysis, a consent record that cannot be retrieved per number within an hour is functionally nonexistent in litigation. This is why list discipline matters before launch, not after. At My AI Call Center, list source and consent records are checked before any campaign goes live, and bought lists without clear permission records are flagged and, in most cases, declined.

Opt-out failures are where mistakes become willful violations. Failing to honor a STOP request converts a $500 problem into a $1,500-per-contact one, as experts note in TCPA compliance guidance. Automated systems close this gap by carrying DNC requests across every campaign and into client DNC records, so one opt-out suppresses contact everywhere—permanently.

The math on timing failures is equally stark. A campaign texting 10,000 recipients outside permitted hours creates potential exposure between $5 million and $15 million, according to industry analysis. Time-zone-aware scheduling removes that risk by design rather than by vigilance.

The broader lesson from recent legal analysis is that even as courts split on TCPA's scope for texts, continuing to treat text messages as subject to all applicable TCPA requirements is the safest bet. Automation turns that posture from a manual burden into a built-in safeguard—one that checks itself on every message, every time.

A phone number on a spreadsheet tells you nothing about whether you're allowed to text it. That single gap between "valid data" and "valid consent" is where most TCPA violations begin—and where the most expensive lawsuits originate.

The problem is especially acute with purchased leads. As compliance analysts at ActiveProspect explain, valid consumer data does not equal valid consumer consent—consumers may have never visited a site or agreed to outreach, even if their information appears in lead forms. The most common exposure stems from lead-generation forms that fail to name the specific seller, violating the Telemarketing Sales Rule's seller-specific consent requirement, according to legal compliance analysis.

The stakes are steep. Each TCPA violation carries statutory damages of $500, rising to $1,500 if willful, with no cap on class-action liability. And the burden of proof sits entirely with the caller: a consent record that cannot be retrieved per number within an hour is, as one compliance analysis puts it, functionally nonexistent in litigation.

This is why list discipline matters more than list size. A structured pre-launch review catches problems before they scale—because AI-powered outreach amplifies flaws at speed, and one bad setting repeated across thousands of messages becomes a costly mistake fast. A misconfigured campaign texting 10,000 recipients outside permitted hours creates potential exposure between $5 million and $15 million, based on the $500–$1,500 per-violation range documented by TCPA case research.

A proper list and consent review should cover:

  • Source verification — confirming where the list came from and whether consent language names the actual seller
  • Consent record checks — timestamped, retrievable proof of prior express written consent for marketing outreach
  • DNC and reassigned-number scrubbing, refreshed at least every 31 days per FCC requirements
  • Opt-out suppression, with revocation honored within 10 business days across all channels

This is the approach My AI Call Center takes with every campaign: only approved, permissioned, or reviewed contact lists are used, and list source and consent records are checked before any campaign launches. Bought lists without clear permission records are flagged—and in most cases, declined outright. The reasoning is simple: it's better to tell you plainly that a list won't support the campaign than to let you spend money building liability.

Even with the recent Seventh Circuit ruling narrowing one litigation avenue for text opt-out violations, legal experts still advise treating all TCPA requirements as fully applicable to texting. List discipline isn't optional caution—it's the cheapest insurance available against a $500-per-message mistake.

Frequently Asked Questions

What makes a text message illegal under the TCPA?
A text message is illegal under the TCPA if it's a marketing text sent without prior express written consent, sent after a consumer opts out via STOP, sent to a number on the National DNC Registry, sent outside permitted hours (before 8 a.m. or after 9 p.m. local time), or lacks proper identification and opt-out mechanisms. Each violation carries statutory damages of $500 to $1,500 per message with no cap on class-action liability, as confirmed by FCC enforcement guidance and TCPA case research.
How much can a single illegal text message cost my business?
Each illegal text message carries statutory damages of $500, rising to $1,500 per message if the violation is found to be willful or knowing, with no cap on class-action liability. A misconfigured campaign sending 10,000 texts outside permitted hours creates potential exposure between $5 million and $15 million, according to industry analysis and settlement data.
If I buy a lead list with phone numbers, can I legally text those contacts?
No—valid consumer data does not equal valid consumer consent, and purchased leads often lack the seller-specific consent language required by the Telemarketing Sales Rule. The burden of proving consent falls on the caller, and a consent record that cannot be retrieved per number within an hour is functionally nonexistent in litigation, as explained by compliance analysts and legal analysis.
Does the Seventh Circuit ruling mean I don't have to worry about TCPA for text messages anymore?
No—while the Seventh Circuit narrowed private litigation for Do-Not-Call text violations, the First, Second, Ninth, and Eleventh Circuits still treat texts as calls under the TCPA, and compliance experts unanimously advise continuing to treat all TCPA requirements as applicable to texting until further guidance emerges. The Mondaq legal analysis states this is the safest approach given the circuit split, as noted in their coverage of the ruling.
How quickly do I need to honor a STOP request from a text recipient?
Opt-out requests must be honored within 10 business days across all channels, and failing to do so converts a $500 violation into a $1,500-per-contact willful violation. Automated systems close this gap by carrying DNC requests across every campaign and into client DNC records so one opt-out suppresses contact everywhere permanently, per TCPA compliance guidance and settlement research.
What records do I need to keep to defend against a TCPA lawsuit?
You must preserve timestamped consent records, opt-out logs, and message content for at least 4 years (7 years recommended) because the statute of limitations is four years from each violation and the burden of proof lies entirely with the caller. A consent record that cannot be retrieved per number within an hour is functionally nonexistent in litigation, according to compliance analysis and retention requirements.

Turning Compliance into Competitive Advantage

Illegal text messages aren't just a regulatory concern—they're a direct threat to your bottom line and brand reputation, with per-message penalties ranging from $500 to $1,500 and settlements regularly exceeding $18 million. As the article highlights, the real danger lies in how quickly small oversights—like missing consent records, ignoring STOP requests, or texting outside permitted hours—scale into millions in liability when amplified by AI-driven outreach. But this risk is entirely preventable. By enforcing list discipline, verifying consent in real time, scrubbing against the National DNC Registry, and maintaining immutable records, businesses can turn compliance from a burden into a safeguard that protects both legal standing and customer trust. My AI Call Center builds these protections into every campaign, ensuring only approved, permissioned lists are used and that opt-outs are honored across all channels. The result? More useful calls that confirm, qualify, and connect—without the fear of costly violations. To see how structured, compliant outbound campaigns can work for your organization, explore our campaign examples and see the difference list discipline makes.

Get campaign planning tips