TCPA Violations: What Actually Gets Cold Callers Sued

TCPA violations cost $500 per call — up to $1,500 per call if a court finds the conduct willful or knowing — and consumers can sue you directly: no regulator, no proof of monetary loss required. Most TCPA violations by legitimate teams are process failures, not robocall schemes: a lapsed Do-Not-Call scrub, a dial at the wrong hour, an opt-out that never made it into the system. Below: the federal rules that actually generate lawsuits, what changed in 2025 and 2026, and the five places dialer users typically trip — as of July 2026.

This page is education, not legal advice. A dialer is a tool — compliance depends on how you use it. Enzo does not scrub against national or state DNC registries — use a third-party service (e.g., Blacklist Alliance) before uploading lists. Enzo provides campaign-level internal DNC (per-campaign only). Consult a TCPA attorney for your specific situation.

What a Violation Costs

The TCPA lets individuals sue directly under 47 U.S.C. § 227(b)(3) (autodialer and prerecorded voice) and § 227(c)(5) (do-not-call): actual loss or $500 per violation, whichever is greater, trebled to up to $1,500 for willful or knowing violations — with one wrinkle: a do-not-call claim under § 227(c)(5) requires more than one violating call by or for the same company within a 12-month period. Damages attach per call or text, not per person or campaign, with no proof of injury required.

Class actions turn those per-call figures into headlines:

• Capital One — $75.5 million class settlement (2014) over autodialed debt-collection calls to cell phones.
• Krakauer v. Dish Network — jury verdict trebled to $61 million for 51,000+ calls to DNC-registered numbers — roughly $1,200 per call.
• United States v. Dish Network — $280 million penalty ordered in 2017, resolved in 2020 with Dish agreeing to pay $210 million.

None of these were boiler rooms. These rules bite ordinary sales teams.

Calling Hours: 8 a.m. to 9 p.m., the Called Party’s Local Time

Federal rules prohibit telephone solicitations to residential subscribers before 8 a.m. or after 9 p.m., local time at the called party’s location — the caller bears the burden of determining that local time, and there is no weekend or holiday exception. Area code is not location: a 212 number can live in California, and a wave of “quiet hours” lawsuits built on that gap hit federal dockets in 2025.

The National DNC Registry and the 31-Day Scrub

Sales calls to numbers on the National Do-Not-Call Registry are prohibited unless an exemption applies, and the FCC’s safe harbor requires using a registry version obtained no more than 31 days before any call.

The main exemption is the established business relationship (EBR): a purchase or transaction within the prior 18 months, or an inquiry or application within the prior 3 months. An EBR dies the moment the consumer makes a company-specific do-not-call request. Enzo does not check lists against any registry — scrub through a third-party service before a list touches your dialer.

Autodialers After Facebook v. Duguid — the Contested Part

In Facebook v. Duguid (2021), a unanimous Supreme Court held that equipment is an automatic telephone dialing system (ATDS) only if it can store or produce numbers using a random or sequential number generator — dialing automatically from a lead list, by itself, does not qualify.

Since then, most federal courts have held that predictive dialers calling stored lead lists fall outside the definition, and human-launched click-to-dial systems have repeatedly been found non-ATDS. But the area remains unsettled: the Supreme Court declined to adopt a “human intervention” test, and the Second Circuit has read the definition more broadly for stored numbers. Where your prospects live can change your exposure — get counsel. One constant: artificial or prerecorded-voice calls are restricted separately, whatever dialer places them.

Consent in 2026: One-to-One Is Dead, PEWC Is the Standard

The FCC’s December 2023 “one-to-one consent” rule — seller-by-seller consent on lead-gen forms — never took effect: the Eleventh Circuit vacated it on January 24, 2025 in Insurance Marketing Coalition v. FCC, and the language was formally deleted effective August 29, 2025.

That restored the prior standard: prior express written consent (PEWC) — a written agreement, bearing the signature of the person called, clearly authorizing the seller to deliver telemarketing using an ATDS or artificial/prerecorded voice to a specified number. Bundled multi-seller consent via lead-gen forms is again permissible under federal law (state laws may differ). Whatever consent you rely on, keep the signed records.

Revocation, Your Internal DNC List, and Identifying Yourself

Three operational rules round out the federal picture:

• Revocation (effective April 11, 2025). Consumers may revoke consent in any reasonable manner — including replying “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” or “unsubscribe” to a text — and callers must honor it within a reasonable time not to exceed ten business days. The related “revoke-all” provision has been delayed to January 31, 2027 and is under FCC reconsideration.
• Internal do-not-call list. Separate from the national registry: keep a written DNC policy, train personnel, and record and honor a company-specific request within ten business days, then honor it for five years.
• Caller identification. On a telemarketing call, provide the individual caller’s name, the company on whose behalf the call is made, and a telephone number or address for that company. Build it into your opener.

What the TCPA Does Not Ban

The TCPA does not ban cold calling. A live, manually dialed, non-prerecorded sales call to a number not on the DNC registry, placed within legal hours, requires no prior consent under federal law. Direct-dial business lines and switchboards sit outside the residential DNC rules. Two cautions: there is no blanket B2B exemption for cell phones — a decision-maker’s personal cell is treated as a wireless number regardless of business use — and prerecorded or AI-voice content triggers consent rules no matter who you call.

Where Most TCPA Violations Actually Happen

For legitimate dialer users, TCPA violations cluster in five preventable places:

1. List hygiene — letting the national DNC scrub lapse past 31 days, or skipping state DNC lists entirely.
2. Consent records — no signed PEWC documentation for autodialed or prerecorded marketing, or leaning on pre-2025 multi-seller lead forms without records.
3. Time zones — dialing outside 8 a.m.–9 p.m. at the called party’s location, usually because scheduling ran off area codes.
4. Revocation handling — opt-outs not honored within ten business days, or internal-DNC additions that never happen.
5. Identification — agents who skip stating their name, the company, and a callback number or address.

Every one of these is a workflow fix, not a legal mystery.

State Mini-TCPAs: Federal Law Is the Floor

More than 15 states have their own telemarketing statutes that often go beyond federal law — among them Florida’s Telephone Solicitation Act, Oklahoma’s Telephone Solicitation Act, Texas SB 140, Washington’s Robocall Scam Protection Act, and Maryland’s Stop the Spam Calls Act — each with its own consent, hours, frequency, and penalty rules. Have counsel verify current requirements for every state you call into.

Where Enzo Fits — and Where It Doesn’t

Enzo’s role here is deliberately narrow. It provides campaign-level internal DNC: mark a contact DNC and they stay excluded from that campaign, even if they appear in another list you upload to it. It is per-campaign only — marks do not carry across campaigns — so keep your master suppression list outside the dialer and re-apply it to every new campaign. Enzo does not scrub against national or state DNC registries: run every list through a third-party service such as Blacklist Alliance first. No dialer makes your calling lawful — your lists, records, and habits do.

TCPA violations are rarely exotic, and TCPA compliance is mostly a checklist — scrub inside 31 days, document consent, schedule by the prospect’s actual location, honor opt-outs within ten business days, identify yourself on every call. Run that checklist, have a TCPA attorney sanity-check it against the states you call into, and cold calling remains what it has always been under federal law: legal, regulated, and workable. For scripts, caller ID health, and process, start with the Cold Calling Guide.

See how Enzo handles campaign-level DNC inside a real calling workflow — book a free discovery call.

Company names are trademarks of their owners. Figures from public records, FCC orders, and the CFR as of July 2026 — educational only, not legal advice.