Why TCPA Enforcement Is Not a Single-Agency Question

Most businesses assume the FCC is the only enforcer they need to worry about. That assumption leaves them exposed on three other fronts simultaneously.

The TCPA operates on a hybrid enforcement model — the FCC leads federal enforcement through its Enforcement Bureau, which conducts nonpublic investigations into robocalls, robotexts, and caller ID spoofing. Unwanted calls remain the FCC's #1 consumer complaint, keeping TCPA enforcement a stated bureau priority. But the FTC steps in when conduct overlaps with unfair or deceptive trade practices under the FTC Act, and it separately enforces the Telemarketing Sales Rule with updated recordkeeping and B2B coverage. Meanwhile, the TCPA's private right of action turns every recipient into a potential plaintiff — statutory damages of $500 to $1,500 per call or message can compound into class actions numbering in the thousands.

• FCC Enforcement Bureau — direct federal enforcement, investigations, fines, and declaratory rulings
• FTC — indirect TCPA involvement via unfair/deceptive practices; direct TSR enforcement
• Private litigants — "additional enforcers" because FCC resources are limited
• State attorneys general — expanding "mini-TCPA" laws in Maryland, Maine, Georgia, Mississippi, and more

State-level enforcement is accelerating. Maryland's Stop the Spam Calls Act took effect January 1, 2024 with its own private right of action. Maine now requires scrubbing against the FCC reassigned number database. Georgia eliminated the "knowing" violation standard and removed damage caps on class actions. Mississippi restricted Medicare plan telemarketing. All took effect July 1, 2024. The 2024 mid-year review from Kelley Drye documents this wave of stricter state statutes, each adding independent liability on top of federal exposure.

The legal ground is shifting beneath the FCC's own interpretations. The Fifth Circuit's February 2026 ruling in Bradford v. Sovereign Pest Control rejected the FCC's long-standing prior express written consent framework for automated calls to cellphones, holding that express consent may be oral or written. The court's willingness to disregard FCC guidance post-Loper Bright means enforcement standards now vary by circuit. For businesses running AI-powered outbound campaigns, the FCC's February 2024 Declaratory Ruling is unambiguous: AI-generated voices are "artificial or prerecorded voices" under the TCPA and require prior express consent.

My AI Call Center treats every AI voice as an artificial voice requiring prior express consent — not because it's a best practice, but because the FCC said so. We only run campaigns against approved, permissioned, or reviewed lists with consent records checked before launch. Opt-outs are logged and honored immediately across all campaigns, with STOP and REVOKE keywords handled per FCC requirements. One clear goal per campaign, quoted before launch. Plan your campaign at myaicallcenter.app/campaigns.

The Four Layers of TCPA Enforcement, Explained

Most people assume one agency polices robocalls. In reality, the TCPA is enforced by four overlapping layers — and the one most likely to hit your business isn't a regulator at all.

Layer 1: The FCC Enforcement Bureau. The Federal Communications Commission interprets and enforces the TCPA, which Congress passed in 1991 and codified in Section 227 of the Communications Act. Within the FCC, the Enforcement Bureau describes itself as "the primary FCC unit responsible for enforcing the Communications Act," conducting nonpublic investigations into robocalls, robotexts, and caller ID spoofing, according to the FCC's own enforcement priorities. Unwanted calls are the FCC's #1 consumer complaint, which keeps TCPA enforcement at the top of the bureau's agenda. The FCC also coordinates with state, federal, and global partners through its C-CIST designation.

Layer 2: The FTC's indirect role. The FTC does not directly enforce the TCPA. It steps in when telemarketing conduct crosses into unfair or deceptive trade practices — say, misleading consumers into giving consent. Separately, the FTC enforces the Telemarketing Sales Rule, whose March 2024 updates expanded coverage to B2B calls and added recordkeeping obligations, per a Kelley Drye mid-year review. If your calling practices are deceptive, you can face both agencies at once.

Layer 3: Private lawsuits — the biggest practical risk. Because the FCC has limited enforcement resources, Congress built a private right of action into the TCPA, making every consumer (and their attorney) an additional enforcer. Damages run $500 to $1,500 per call or message, and they compound in class actions — one compliance misstep can trigger dozens or thousands of claims, as ActiveProspect's analysis notes. This is why list discipline matters more than any other single control. My AI Call Center checks list source and consent records before any campaign launches, precisely because a bought list without permission records is where these lawsuits start.

Layer 4: State "mini-TCPA" laws. States are writing their own rules, many with private rights of action:

• Maryland's Stop the Spam Calls Act (effective January 1, 2024), with a private right of action
• Maine's requirement to scrub against the FCC reassigned number database (July 16, 2024)
• Georgia's elimination of the "knowing" violation requirement and uncapped class actions (July 1, 2024)
• Mississippi's restrictions on Medicare plan telemarketing (July 1, 2024)

These state statutes stack on top of federal exposure, multiplying the financial risk of a single bad campaign. And with courts increasingly willing to interpret the TCPA independently of the FCC after the Loper Bright decision, the rules can differ by circuit — a reason to get current legal guidance before launching any outbound calling program.

What the FCC's AI-Voice Ruling Means for Outbound Calling

The FCC's unanimous February 2024 Declaratory Ruling (FCC-24-17) settled a critical question: AI-generated voices fall squarely under the TCPA's "artificial or prerecorded voice" restrictions, requiring prior express consent before any outbound call is placed. The Commission's announcement was direct — "FCC Makes AI-Generated Voices in Robocalls Illegal" — and the ruling applies to every campaign that uses synthetic speech, regardless of how human the voice sounds.

That consent requirement now sits inside a shifting legal landscape. The FCC's 1:1 consent rule took effect January 27, 2025, meaning a single opt-in no longer covers multiple sellers or brands. At the same time, the FCC's expanded revocation rules require businesses to honor reasonable opt-out requests — including keywords like STOP, REVOKE, and CANCEL — within 10 business days. The "global revocation" rule, which would extend a single opt-out across all related campaigns, has been pushed to January 31, 2027, but the direction is clear: consent is narrower, revocation is easier, and enforcement is faster.

• AI voices = artificial voices under the TCPA — prior express consent required
• 1:1 consent: one brand, one opt-in, no shared or bundled permissions
• Opt-out keywords (STOP, REVOKE, QUIT, END, CANCEL, UNSUBSCRIBE, OPT OUT) honored within 10 business days
• Post-Loper Bright, the Fifth Circuit has rejected the FCC's written-consent framework — consent rules now vary by circuit

The Fifth Circuit's February 2026 decision in Bradford v. Sovereign Pest Control rejected the FCC's long-standing prior-express-written-consent framework, holding that the TCPA does not categorically require written consent for automated calls to cellphones. That ruling applies only within the Fifth Circuit; other circuits may still follow the FCC's written-consent standard, and state telemarketing statutes can impose their own requirements. For any organization running outbound campaigns across state lines, the consent floor is no longer uniform — it is fragmented by jurisdiction and circuit precedent.

My AI Call Center builds every campaign around this reality: AI disclosure on every call, immediate keyword opt-out handling, DNC records carried across all campaigns, and list discipline that starts with a consent review before a single dial is placed. Campaign requirements vary by location, industry, contact type, consent status, and technology — clients are responsible for obtaining appropriate legal guidance before launch.

Plan a campaign that starts with consent discipline: Plan My Campaign — we review your list, consent records, and regulated-area flags before quoting anything.

How to Run Compliant Campaigns Under Multiple Enforcers

The enforcement landscape isn't theoretical — it shows up in every call you place. With the FCC Enforcement Bureau as the primary federal enforcer, the FTC active on overlapping unfair-practice claims, private litigants pursuing $500 to $1,500 per call, and states like Maryland, Georgia, and Maine layering on their own "mini-TCPA" statutes, a single list error can trigger action from multiple directions at once. The Fifth Circuit's 2026 Bradford v. Sovereign Pest Control decision rejecting the FCC's written-consent framework means consent rules now vary by circuit, and the FCC's unanimous ruling confirming AI-generated voices fall under "artificial or prerecorded voice" restrictions makes consent non-negotiable for AI-powered outreach.

• Verify list source and consent records before any campaign launches — decline lists without clear permission documentation
• Treat AI voices as artificial voices requiring prior express consent, with AI disclosure on every call
• Log and honor opt-outs immediately; keywords like STOP and REVOKE must be processed within 10 business days per FCC rule
• Carry DNC requests across all campaigns and into client DNC records so a single opt-out protects every future touchpoint

List discipline is the primary defense against every enforcement layer. My AI Call Center runs structured campaigns only against approved, permissioned, or reviewed lists — checking consent records and calling windows before launch, flagging bought lists without clear permission, and telling you plainly if a list won't support the campaign before you spend anything. Opt-outs are logged and honored in real time, and DNC requests carry across every campaign we run. Consent requirements vary by jurisdiction, industry, and circuit; clients are responsible for obtaining appropriate legal guidance before launch.