The Real Cost of a TCPA Violation: $500 to $1,500 Per Call, With No Cap

The most dangerous number in telemarketing compliance is $500 — because it's never just $500. Under the TCPA, every unlawful call or text carries statutory damages of $500 to $1,500, and plaintiffs don't need to prove a single dollar of actual harm to collect, according to legal analysis from BCLP.

What makes this structure so punishing is that penalties are assessed per violation, per call, per person — with no cap on total liability, as compliance guidance on the FCC's consent rules confirms. One violation is a rounding error. Ten thousand violations are a company-ending event.

Here is how quickly the math compounds at campaign scale, based on penalty modeling from Prospeo:

• 1,500 willful violations = $2.25 million in statutory damages
• 10,000 violations = $5 million to $15 million
• 100,000 violations = $50 million to $150 million

And those are the conservative scenarios. Attorney Michele Shuster of Mac Murray & Shuster notes that a company making 5,000 calls per day while violating both the TCPA and Florida law could face up to $15 million in private litigant damages from a single day of calling — before any regulatory penalties are added.

The largest TCPA damages ever awarded reached $925 million, and the settlement record includes names most businesses recognize: Dish Network at $280 million, Facebook at $90 million, and Capital One at $75 million, according to the same compliance research.

This is precisely why high-volume outreach is where exposure explodes. A business making a handful of calls has a handful of chances to be wrong. A business running thousands of calls per day against a list with weak consent records has thousands of chances — and plaintiffs' attorneys specifically target high-volume campaigns with provable consent gaps, not the worst offenders.

The lesson for any organization that runs outbound calling: volume without list discipline isn't scale — it's accumulated liability. That's why structured campaign providers like My AI Call Center review list source and consent records before any campaign launches, and decline bought lists that lack clear permission trails. Every call you make should be defensible before it's dialed — because after the campaign runs, the per-call meter is already running.

Class Actions, Not the FCC, Are What Actually Hit Businesses

If you're picturing an FCC agent showing up at your door after a bad calling campaign, picture something else: a plaintiffs' attorney with your call logs. According to litigation trend data, FCC enforcement is rare — class actions are not.

The numbers tell the story. Businesses faced 2,788 TCPA cases filed in 2024, up 67% from 2023, and 78% of those filings were class actions, per the same litigation analysis. The momentum hasn't slowed: January 2025 alone saw 172 class action filings, a 268% jump over the prior January.

Here's the part that surprises most business owners. Plaintiffs' attorneys don't hunt the worst offenders — they hunt high-volume campaigns with provable consent gaps. A sloppy list with missing permission records is a more attractive target than a deliberate scammer, because the business has assets, insurance, and documentation failures that are easy to prove.

The settlements reflect that math:

• Dish Network — $280 million
• Facebook — $90 million
• Capital One — $75 million
• The largest TCPA damages award on record: $925 million, according to compliance industry reporting

These aren't outliers reserved for household names. TCPA class actions "have led to some of the largest settlements in U.S. history," notes compliance firm Gryphon.ai, and statutory damages of $500–$1,500 per violation — with no requirement to prove actual injury — make even mid-sized campaigns worth suing over, as law firm BCLP explains.

Even the winners lose. Defeating a TCPA class action on the merits still costs six figures in legal fees before any settlement discussion begins, per the litigation data. And don't count on your vendors absorbing the blow — brands, software providers, and marketing agencies routinely get named as co-defendants, and your SMS vendor won't indemnify you.

There's also no quick expiration date on the risk. The TCPA's statute of limitations means liability can surface months or even years after the calls themselves, as Gryphon.ai notes — which is why opt-out records should be retained for at least four years, BCLP advises.

This is exactly why consent provenance matters more than intent. At My AI Call Center, every campaign starts with a list and consent review — source checked, permission records verified, bought lists without clear consent flagged or declined — because the difference between a defensible campaign and a class action target usually comes down to what you can prove, not what you believed.

State Mini-TCPAs, New 2025 Revocation Rules, and AI Voice Exposure Stack the Risk Higher

The federal TCPA is only half the story. A business that clears federal rules can still get crushed by state laws, new revocation rules, and the FCC's stance on AI voices — three layers of risk that stack on top of each other.

State mini-TCPAs multiply your exposure. The federal TCPA does not preempt state law, so businesses can face penalties under both frameworks at the same time, according to state-level TCPA analysis. Twelve states have their own TCPA laws, and 11 states maintain their own DNC lists, with five states introducing new legislation in 2024 alone, per regulatory tracking.

The dollar figures are startling. New York and Connecticut impose penalties of up to $20,000 per violation — compared to $500–$1,500 under the federal statute. Arizona reaches $1,000 per violation, and Oklahoma applies $500–$1,500 per call or text. Attorney Michele Shuster notes penalties are enforced on a per-call basis, so "penalties and private litigant damages can snowball quickly." A company making 5,000 calls a day while violating both federal and Florida law could face up to $15 million in private litigant damages from a single day of calling.

There is another wrinkle many businesses miss. Federal TCPA violations are strictly civil, but some state laws impose criminal penalties for certain calling violations. That means the same campaign can carry civil damages in federal court and criminal exposure at the state level.

The April 11, 2025 revocation rules shift the burden onto you. Under new FCC rules, consumers can revoke consent "in any reasonable manner" — not just approved keywords. Businesses must honor revocations within 10 business days across all systems. If a consumer opts out in a non-standard way, the law presumes the method was reasonable, and the business bears the burden of proving otherwise. Recognized opt-out keywords include Stop, Quit, End, Revoke, Opt out, Cancel, and Unsubscribe, per FCC guidance summaries.

AI voices carry their own consent requirement. In February 2024, the FCC classified AI-generated voices as "artificial or prerecorded" under the TCPA, per regulatory analysis. That means AI voice calls require prior express consent — before the first dial. This is why My AI Call Center reviews list source and consent records before any campaign launches, treats AI voices as artificial voices requiring consent, and logs opt-outs immediately.

The practical takeaway for any outbound calling program:

• Check state penalties before launching — some reach $20,000 per violation.
• Honor every revocation, however phrased, within 10 business days.
• Document consent provenance for AI voice calls from day one.
• Monitor state legislation — laws can change with fewer than 30 days to implement.

Layered compliance is no longer optional. It is the difference between a manageable campaign and uncapped, multi-jurisdiction liability.

Beyond Fines: Reputation Damage, Stale Data Traps, and Why Liability Stays With Your Brand

The dollar figure on a TCPA settlement is rarely the last cost a business pays. The real damage often shows up in ways that are harder to quantify — and significantly harder to reverse once consumer perception shifts.

According to compliance research, TCPA violations can trigger loss of consumer trust, damaged brand reputation, reduced shareholder value, and a decreased ability to raise capital. A breach of consumer trust from non-compliance can cost more in long-term brand erosion than the legal damages themselves.

This isn't theoretical. In 2024, 2,788 TCPA cases were filed, a 67% increase over the prior year. With 78% of those filings structured as class actions, a single consent gap can expose an entire customer base to claims. The litigation environment is accelerating, not slowing down.

Stale data is the #1 compliance gap plaintiffs' attorneys exploit. Every call to a reassigned number is a separate violation — the consent belonged to a different person. If your list hasn't been verified recently, you're handing a plaintiff's attorney a ready-made class of claimants.

Here's what makes the stale data trap so dangerous:

• Phone numbers get reassigned routinely — carriers recycle them, and the new owner never consented to your calls.
• A single outdated number in a 50,000-contact list can seed a class action covering every person who received an unwanted call.
• The four-year statute of limitations means a violation from a campaign you ran last year can still surface as a lawsuit today.
• Plaintiffs' attorneys specifically target provable consent gaps, not the worst offenders — they look for lists with weak documentation.

When a case does land, liability falls on the brand — not the vendor, not the agency. The brand, software provider, and marketing agency all get named as defendants. Your SMS vendor won't indemnify you. Your agency won't indemnify you. The brand on the dialer is the one that ultimately pays.

This is why consent provenance documentation matters more than any post-incident legal strategy. If you can't prove who consented, when, and through what channel, you lose. A documentation gap from a campaign you ran in 2021 can still be litigated today.

At My AI Call Center, list source and consent records are reviewed before any campaign launches. Bought lists without clear permission records get flagged — and in most cases, declined. That's not a sales tactic; it's the same discipline that keeps a brand out of a class action filing.

The statute of limitations works both ways. It gives plaintiffs time to build a case, and it means your compliance posture today determines your exposure years from now. Protecting your brand starts with the list, not the lawsuit.

How to Protect Your Campaigns: Consent Records, Instant Opt-Outs, and Reviewed Lists

Knowing the penalties is only half the equation — the other half is building a calling operation that never triggers them. The good news: most TCPA exposure traces back to a handful of preventable gaps, and every one of them has a practical fix.

Document consent provenance before any campaign launches. Plaintiffs' attorneys target high-volume campaigns with provable consent gaps rather than the worst offenders, according to litigation trend analysis. That means your defense starts before the first dial: every contact record should show where the lead came from, when they gave permission, and what they agreed to. Stale data compounds the risk — every call to a reassigned number is a fresh $500–$1,500 violation, which is why bought lists without clear permission records deserve a hard no.

Honor opt-outs immediately, across every system. Under FCC rules effective April 11, 2025, consumers can revoke consent "in any reasonable manner," and businesses must honor revocations within 10 business days, as detailed in a BCLP client alert. If someone opts out through a non-standard channel, the burden falls on you to prove the method was unreasonable.

• Process required keywords — Stop, Quit, End, Revoke, Opt out, Cancel, Unsubscribe — in real time, per FCC rule summaries.
• Sync opt-outs across all campaigns and systems, not just the one where the request arrived.
• Retain opt-out records for at least four years, matching the TCPA's statute of limitations.
• Send at most one clarification text within five minutes, with no marketing content.

Respect state-specific calling windows. Twelve states run their own TCPA-style laws and eleven maintain separate DNC lists, according to state compliance research. Florida, for example, limits calls to 8 a.m.–8 p.m. and caps contact at three calls per number per 24 hours, per state-level TCPA analysis. Segment campaigns by state or default to the strictest rule set.

Disclose AI involvement on every call. The FCC classified AI-generated voices as "artificial or prerecorded" under the TCPA in February 2024, per regulatory coverage — so AI calling requires prior express consent, and recipients should be able to ask whether a call is AI-assisted, request a human, or opt out at any point.

This is exactly the discipline My AI Call Center builds into every engagement. Before anything dials, we run a list and consent review — checking list source, permission records, and calling windows — and we flag, and in most cases decline, bought lists without clear consent documentation. Opt-outs are logged and honored immediately, DNC requests carry across all campaigns, and AI disclosure runs on every call. We tell you plainly if a list will not support the campaign, before you spend anything.

Campaign requirements vary by location, industry, contact type, consent status, and technology, so always obtain appropriate legal guidance before launch. When you are ready to run structured outbound calls against an approved, permissioned list, plan your campaign with our team — the first campaign review is free, and calling starts at 9¢ per connected minute with the full quote locked before launch.