The High Cost of Not Knowing What the TCPA Prohibits

Most businesses don't get in trouble for deliberately breaking the rules — they get in trouble for assuming someone else handled consent. The TCPA is a strict liability statute, which means companies are legally responsible for violations regardless of fault or intent, according to compliance analysis.

"I didn't know" is not a defense. The burden of proving valid consent falls on the caller, and a good-faith but mistaken belief that consent existed does not protect you. If you dialed a list you bought from a vendor and can't produce permission records, the law treats that as your failure, not the vendor's.

The math is what makes TCPA risk genuinely dangerous for any organization running outbound campaigns. Private plaintiffs can seek $500 per violation, rising to $1,500 for willful or knowing violations, with no cap on statutory damages. The FCC can seek up to $16,000 per violation — $26,000 for intentional ones — per TCPA legal guidance.

Scale those numbers against a real campaign and the exposure becomes concrete:

• A campaign contacting 10,000 people in violation of the TCPA could result in fines of $5 million to $15 million.
• TCPA class-action judgments have exceeded $925 million in recent years.
• A Florida court preliminarily approved a $40 million class-action settlement against a real estate company in April 2023.
• The FTC has brought 151 enforcement actions under Do Not Call rules, recovering over $178 million in civil penalties.

Here's the detail that catches finance teams off guard: many commercial liability policies explicitly exclude TCPA claims, classifying settlements as regulatory penalties. That $5–15 million exposure sits on your balance sheet, uncovered.

Every dollar of that risk traces back to one question: can you prove where your list came from and that the people on it agreed to be called? Bot-generated leads and reassigned numbers are documented risk multipliers that create liability even when the original contact seemed legitimate.

This is why My AI Call Center reviews list source and consent records before any campaign launches — and plainly tells clients when a list won't support the campaign. Declining a bad list before dialing is the least expensive TCPA decision you will ever make. Enforcement increasingly targets owners, officers, and executives personally, so the cost of a sloppy list doesn't stay at the corporate level.

If you're planning structured calling against approved, permissioned, or reviewed lists, plan your campaign with consent verified up front — from 9¢ per connected minute.

The Five Things the TCPA Prohibits

The Telephone Consumer Protection Act draws clear boundaries around how businesses can reach consumers by phone or text. Violating these rules carries significant financial risk, with private plaintiffs able to seek $500 per violation—rising to $1,500 for willful acts—and no cap on statutory damages. The FCC can pursue penalties up to $16,000 per violation, or $26,000 for intentional breaches, making compliance a critical operational priority.

The TCPA’s core prohibitions center on five specific violation types that every outbound calling program must avoid. First, using an automatic telephone dialing system (ATDS) to place calls or send texts to cell phones without prior express written consent is strictly forbidden. Second, delivering prerecorded or artificial voice messages—including those generated by AI—requires the same level of consent before contact. Third, telemarketing to numbers listed on the National Do Not Call Registry is prohibited unless the caller has obtained written consent or shares an established business relationship with the recipient.

Fourth, businesses must honor any consumer request to revoke consent within 10 business days, recognizing that revocation can be communicated in any reasonable manner—such as texting "STOP," saying "I do not want to hear from you," or using other clear opt-out language. Finally, as confirmed by the FCC’s February 2024 Declaratory Ruling, AI-generated voice calls are explicitly treated as artificial voice calls under the TCPA and therefore require prior express consent before being placed. Notably, ringless voicemail also counts as a call under the TCPA and triggers the same consent requirements as live or prerecorded calls.

• Autodialed calls/texts to cell phones without prior express written consent
• Prerecorded or artificial voice calls without consent
• Telemarketing to National DNC Registry numbers absent consent or EBR
• Failure to honor consent revocation within 10 business days
• AI-generated voice calls without prior express consent (per FCC 2024 ruling)

For services like My AI Call Center, which manages outbound campaigns exclusively on approved, permissioned, or reviewed lists, these prohibitions shape every operational step—from list vetting and consent verification to real-time opt-out processing and DNC scrubbing. The emphasis on list discipline isn’t just a best practice; it’s a direct response to the TCPA’s burden-of-proof rule, which places full responsibility on the caller to demonstrate valid consent. Ignoring these boundaries doesn’t just risk regulatory action—it invites costly class litigation where damages can quickly escalate into millions, as seen in recent settlements exceeding $40 million for single campaigns. Staying compliant means building calling programs around permission, not volume.

What the AI Voice Ruling Means for Your Outbound Calls

If your outbound calls use an AI-generated voice, the FCC considers them robocalls — and robocalls without consent are illegal. That is the practical effect of the FCC's February 2024 Declaratory Ruling (FCC-24-17), and it changes how every AI calling campaign must be run.

The ruling confirms that TCPA restrictions on "artificial or prerecorded voice" cover current AI technologies that generate human voices, meaning AI-generated voice calls require prior express consent from the called party. There is no gray area for voices that sound convincingly human. If a machine is speaking, the consent rules apply in full.

The stakes are high. Private plaintiffs can seek $500 per violation, rising to $1,500 for willful or knowing violations, with no cap on statutory damages. TCPA class-action judgments have exceeded $925 million in recent years, and a single campaign contacting 10,000 people without proper consent could mean fines of $5 million to $15 million.

Revocation rules also got stricter in 2025. Amendments effective April 11, 2025 require callers to honor revocation requests within 10 business days and to accept consent revocation in any reasonable manner. That includes informal phrasing — a recipient texting "I do not want to hear from you" counts as a valid opt-out, according to TCPA legal guidance. Your scripts and escalation paths must recognize those moments, not just the word "STOP."

Two hidden risk multipliers deserve attention:

• Reassigned numbers — liability can attach even when the original consumer consented, which is why the FCC's Reassigned Numbers Database exists.
• Bot-generated leads, which can create fraudulent consent events and multiply TCPA exposure across an entire list.
• Bought lists with no documented permission trail — a list you cannot verify is a list you cannot defend.

Here is the part that surprises many operators: good faith is not a defense. The TCPA is a strict liability statute, and companies are legally responsible regardless of fault or intent. Callers bear the burden of proving valid consent, so a mistaken but honest belief that consent existed changes nothing in court.

This is why list discipline matters more than dialing volume. My AI Call Center checks list source and consent records before any campaign launches, and declines bought lists that lack clear permission records — because under this framework, an unverifiable list is not an asset. It is a liability with a phone number attached.

Plan a consent-verified campaign with structured AI calling from 9¢ per connected minute.

How to Run Compliant Campaigns: A Pre-Launch Checklist

Knowing what the TCPA prohibits is one thing. Running a campaign that survives contact with those rules — at $500 to $1,500 per violation with no cap on statutory damages — is another entirely.

The good news: compliance is a checklist, not a mystery. Here is the pre-launch sequence My AI Call Center applies to every campaign before a single call goes out, and the one you should demand from any calling partner.

Start with list provenance and consent records. The burden of proving valid consent falls entirely on the caller — a good-faith mistaken belief is not a defense. That means every list gets reviewed for source and permission history before dialing begins. Bought lists without clear permission records are flagged and, in most cases, declined outright. Bot-generated leads and reassigned numbers are documented risk multipliers, so provenance checks are not optional hygiene — they are the foundation of the whole campaign.

Scrub, then scrub again. Telemarketing to numbers on the National DNC Registry is prohibited unless you hold written consent or a qualifying Established Business Relationship — a transaction within the prior 18 months or an inquiry within the prior 3 months. Beyond the national registry, company-specific DNC requests must be honored for at least five years, even where consent or an EBR exists. Internal DNC lists get carried across every campaign a client runs.

Honor opt-outs immediately. The 2025 rule update cut required processing time from 30 days to 10 business days, and callers must recognize any reasonable revocation — even informal phrasing like "I do not want to hear from you." Keyword recognition for STOP and REVOKE, plus immediate logging, keeps every campaign inside that window with room to spare.

Disclose AI on every call. Since the FCC's February 2024 ruling, AI-generated voices are explicitly artificial voices requiring prior express consent. Recipients should be able to ask whether the call is AI-assisted, request a human, or opt out on the spot.

Two final checks close the loop:

• Respect state quiet hours — roughly half of states run their own mini-TCPA laws with distinct calling-time and holiday rules.
• For clinic campaigns, structure calls to fit the FCC healthcare exemption: no promotional or financial solicitation, patient-provided numbers only, entity identification, and immediate opt-out honoring.
• Approve the script, disclosure, opt-out handling, and escalation path before launch — nothing dials until sign-off.

A single campaign contacting 10,000 people improperly could trigger $5 million to $15 million in fines. The checklist is cheaper than the violation — every time.

Ready to run calls that confirm, qualify, and retain — against lists that can actually support the campaign? Plan your campaign and get a full quote before anything launches. Managed outbound calling from 9¢ per connected minute, with list and consent review included.