TCPA Regulatory Framework
Understanding federal restrictions on automated telephone and text message communications
The Telephone Consumer Protection Act (TCPA), codified at 47 U.S.C. § 227, governs automated telephone and text message communications to wireless devices. Enacted in 1991 and amended in 2013, the statute establishes strict consent requirements for commercial messaging and enables consumer class-action litigation with statutory damages ranging from $500 to $1,500 per unauthorized message.
Statutory Requirements
- Express written consent for marketing messages
- Clear disclosure of message frequency and opt-out methods
- Affirmative consent action (no pre-checked boxes)
- Purpose-specific consent (separate for marketing vs transactional)
- Consent cannot be conditioned on purchase
Enforcement Mechanisms
- FCC regulatory enforcement and fines
- Private right of action (consumer lawsuits)
- Class-action certification for aggregate claims
- State attorney general enforcement authority
- 4-year statute of limitations from violation date
Consent Documentation Requirements
Organizations must maintain comprehensive consent records to defend against TCPA litigation. Required elements include:
Date, time, and timezone of consent capture with millisecond precision where available
IP address, user agent string, device fingerprint, or session identifier
Exact copy of disclosure text presented to recipient at consent moment
Checkbox state, button click event, reply keyword, or signature capture
Minimum 4 years to cover statute of limitations (6 years recommended)
Revocation timestamp and method (STOP keyword, unsubscribe link, phone request)
Common TCPA Violations
- Inadequate Consent Language: Failing to disclose message frequency, data rates, or opt-out instructions
- Pre-Checked Boxes: Using opt-in checkboxes that default to selected state
- Purchase-Conditioned Consent: Requiring SMS opt-in as condition of completing transaction
- Lack of Documentation: Unable to produce timestamped consent records during litigation discovery
- Cross-Purpose Consent: Using marketing consent for transactional messages or vice versa
- Post-Revocation Messaging: Continuing to send messages after recipient opts out
- Affiliate Sharing: Sharing consent across unrelated business entities without separate authorization
TCPA Penalty Exposure Calculator
Estimate potential statutory damages and litigation costs based on violation scope
Total messages sent without proper TCPA consent
Willful violations involve intentional disregard for TCPA requirements
Number of unique individuals who received unauthorized messages
Class actions aggregate claims for all affected recipients
Penalty Exposure Analysis
Litigation Risk Assessment Framework
Systematic evaluation of TCPA exposure across messaging program components
| Risk Factor | Low Risk | Medium Risk | High Risk |
|---|---|---|---|
| Consent Documentation | Timestamped written consent with full disclosure, 6+ year retention, linked to CRM | Written consent present but incomplete disclosure or inconsistent retention | Verbal-only consent, no documentation, or missing consent records |
| Opt-Out Compliance | Automated STOP processing <5 seconds, confirmation sent, database suppression immediate | Manual opt-out processing 1-24 hours, occasional failures | Opt-out requires phone call or email, >24 hour processing, continued messaging after opt-out |
| Message Volume | <5,000 messages/month, transactional focus, low frequency | 5,000-50,000 messages/month, mixed transactional/marketing | >50,000 messages/month, high-frequency marketing blasts, multi-brand campaigns |
| Consent Freshness | Consent captured <6 months, active engagement, confirmed opt-in | Consent 6-18 months old, declining engagement | Consent >18 months old, purchased lists, no engagement confirmation |
| Industry Vertical | Healthcare, education, utilities (low TCPA litigation history) | Retail, ecommerce, technology (moderate litigation) | Financial services, auto sales, insurance, debt collection (high litigation) |
| Affiliate Practices | No affiliate sharing, direct brand-to-consumer only | Controlled affiliate sharing with documented consent transfer | Broad affiliate networks, consent shared without disclosure, lead aggregators |
| Previous Violations | No prior TCPA litigation or FCC enforcement actions | Prior complaints settled without admission, corrective action implemented | Multiple TCPA lawsuits, consent decrees, FCC enforcement actions, repeat violations |
High-Risk Remediation Priorities
Audit Consent Records
Review 100% of active subscriber consent documentation for completeness and retention compliance
Implement Automated Opt-Out
Deploy real-time STOP keyword processing with <5 second suppression and confirmation message
Refresh Stale Consent
Re-permission subscribers with consent >12 months old using double opt-in confirmation
Terminate High-Risk Affiliates
Cease messaging to lists from lead aggregators, purchased data, or unverified consent sources
Need TCPA Compliance Support?
Schedule a consultation to review your messaging program, consent documentation, and litigation risk exposure with MyTCRPlus compliance specialists