TCPA Compliance for Outbound Dialing: What businesses must know
TCPA compliance is a legal requirement for any business making autodialed or prerecorded calls to US consumers. The Telephone Consumer Protection Act requires prior express written consent before contacting mobile numbers with an autodialer or prerecorded message, restricts calling hours to 8am–9pm in the recipient's local time zone, and establishes the National Do Not Call Registry. Violations carry statutory damages of $500–$1,500 per call, and class actions are common. This guide covers the core rules every outbound calling programme must follow.
By My Call Connect
Disclaimer: This guide is informational only and does not constitute legal advice. Consult a qualified attorney for guidance on your specific compliance obligations.
What is the TCPA?
The Telephone Consumer Protection Act (TCPA) is a United States federal law enacted in 1991 and enforced by the Federal Communications Commission (FCC). It restricts how businesses may contact consumers by phone and text message. The TCPA requires prior express consent before making autodialed or prerecorded calls to mobile numbers, sets permitted calling hours, and establishes the National Do Not Call Registry.
The law was passed in response to consumer complaints about unwanted telemarketing calls. Over the following decades, courts and the FCC have expanded its reach to cover SMS messages, and interpretations of what constitutes an "autodialer" (Automatic Telephone Dialling System, or ATDS) have been contested in litigation. The result is a legal landscape that continues to evolve, making it important to stay current and to work with qualified legal counsel.
Enforcement comes from two directions: the FCC can take regulatory action, and — critically — the TCPA creates a private right of action, meaning individual consumers and plaintiff classes can sue for statutory damages without needing to prove actual harm.
Who the TCPA applies to
Any business making outbound calls or sending texts to US consumers is potentially subject to TCPA. This includes contact centres, sales dialers, marketing campaigns, appointment reminder services, and debt collection operations. The law applies to calls and texts to US mobile numbers regardless of where the calling business is located — international businesses calling US numbers are subject to TCPA.
Business-to-business calls face fewer TCPA restrictions, but are not entirely exempt. The National Do Not Call Registry primarily protects residential subscribers, and the prior express written consent requirement is focused on consumer mobile numbers. However, mobile numbers used for business purposes can still fall under TCPA protections if registered to an individual, and courts have applied the statute broadly in some circuits. B2B callers should maintain internal DNC lists and honour opt-outs regardless.
The TCPA also covers text messages (SMS) sent using an ATDS, making it relevant for businesses running SMS marketing campaigns, appointment reminders, or any outbound text programme targeting US mobile numbers. For campaigns using 10DLC registration, TCPA consent requirements apply alongside carrier registration requirements.
Prior express written consent
For autodialed or prerecorded calls and texts to mobile numbers, TCPA requires prior express written consent. This is the most demanding consent standard under the law, and it applies to the majority of modern outbound dialling operations that use a predictive dialler or any system that stores and dials numbers automatically.
What counts as valid consent
- → A signed written agreement — physical or digital — clearly authorising the specific company to contact the consumer using an autodialer or prerecorded message.
- → A checkbox on a web form, provided it is unchecked by default and the consumer actively checks it. Pre-ticked boxes do not constitute valid consent.
- → A recorded verbal agreement that meets the written consent standard under applicable e-signature law.
What does not count
- → An existing business relationship alone. The fact that a consumer previously purchased from you or enquired about your services does not constitute prior express written consent for autodialed or prerecorded calls.
- → Consent given to a third party. Consent must be specific to the calling entity — it cannot be transferred or assumed from consent given to a different business.
- → Buried consent language in unrelated terms and conditions, where the consumer could not reasonably have known they were agreeing to receive autodialed calls.
Consent records must be retained with timestamps and evidence of the mechanism through which consent was obtained. If your consent is challenged in litigation, you will need to produce records showing who consented, when, to what, and through which channel.
Calling hours and Do Not Call rules
TCPA and FCC rules restrict outbound calling to between 8am and 9pm in the called party's local time zone. Calls outside these hours are a violation regardless of consent status. For operations calling across multiple US time zones, dialler software must enforce time-zone restrictions per number, not per campaign start time.
National Do Not Call Registry
The National DNC Registry, maintained by the FTC, lists consumers who have opted out of telemarketing calls. Businesses engaged in telemarketing must scrub their calling lists against the National DNC Registry before each campaign. Calling a number on the registry is a separate TCPA and TSR violation, subject to its own statutory damages.
Company-specific DNC lists
Independent of the National Registry, every business must maintain an internal company-specific DNC list. Any consumer who requests not to be called must be added to this list immediately and that request must be honoured for a minimum of five years. The internal DNC must be suppressed against every future outbound campaign to that consumer, not just the campaign in progress when the opt-out was received.
State DNC lists
Several US states maintain their own Do Not Call registries in addition to the National Registry. Businesses calling consumers in those states must check state lists as well as the federal registry. State rules can be stricter than federal TCPA in other ways too — some states have their own telemarketing statutes with additional requirements. This is one area where state-specific legal review is particularly important.
Abandoned call rate for predictive dialers
The FTC's Telemarketing Sales Rule (TSR), which works alongside TCPA for outbound telemarketing calls, sets a strict limit on abandoned calls. An abandoned call occurs when a consumer answers but no agent is available to take the call. The TSR requires that abandoned calls do not exceed 3% of all answered calls per campaign per 30-day period for operations using a predictive dialler.
When a call is abandoned, the TSR requires that an automated message play within two seconds of the consumer's greeting. That message must include the company's name, the phone number from which the call was placed, and an interactive opt-out mechanism that allows the consumer to request not to be called again.
The 3% cap is calculated per campaign, not per platform or per company, so a business running multiple simultaneous campaigns must track the abandon rate for each one separately. Modern contact centre platforms and sales dialers can enforce this limit automatically, but the compliance obligation rests with the business, not the software provider.
Exceeding the 3% abandon rate while running a telemarketing campaign is a TSR violation subject to civil penalties from the FTC, in addition to any TCPA exposure from other aspects of the same campaign.
TCPA penalties
The TCPA provides for statutory damages of $500 per violation for unintentional violations, and up to $1,500 per willful or knowing violation. These are per-call or per-text figures — a campaign that sends 10,000 non-compliant text messages faces exposure of up to $5 million for unintentional violations, or up to $15 million for willful ones.
TCPA is treated as a strict liability statute in many federal circuits. This means a violation can be established by showing that the prohibited call or text was made — intent is not required to establish liability. Whether a violation was willful affects the damages multiplier, but not the threshold question of whether a violation occurred.
Class action lawsuits are common under TCPA. The private right of action, combined with the strict liability standard and per-call damages, makes TCPA an attractive vehicle for class plaintiffs. Settlements in nine-figure ranges have occurred for large-scale calling campaigns that failed to obtain proper consent.
FCC enforcement can run separately from private litigation — a business may face both a regulatory investigation and a class action arising from the same calling programme.
Practical compliance checklist
The following steps represent the operational baseline for a TCPA-compliant outbound dialling programme. This is not an exhaustive legal checklist — work with a qualified attorney to assess your specific programme.
- → Obtain and document consent. Collect prior express written consent before autodialing or prerecording to mobile numbers. Record the timestamp, channel (web form, paper, verbal), and the specific consent language shown or read to the consumer. Store records so they can be retrieved per phone number on demand.
- → Scrub lists before every campaign. Run calling lists against the National DNC Registry, applicable state DNC registries, and your internal DNC list before each campaign starts — not once at list acquisition. Numbers can be added to registries between campaigns.
- → Enforce calling hours in dialler software. Configure your predictive dialler to block calls outside 8am–9pm in the called party's local time zone. Use per-number time-zone enforcement, not campaign-level scheduling based on a single reference time zone.
- → Monitor and cap the abandon rate. Track abandoned calls per campaign per 30-day rolling period. Keep the rate below 3% of answered calls. Ensure abandoned calls trigger the required automated message with company name, number, and opt-out mechanism.
- → Honour opt-outs in real time. Any opt-out request — verbal, text, or digital — must be processed immediately and the number added to your internal DNC list. Do not wait for a batch update cycle. Train agents to recognise and log opt-out requests accurately.
- → Train agents and audit regularly. TCPA compliance is an operational discipline, not a one-time setup task. Regular agent training, periodic audits of consent records, and documented compliance reviews reduce both the risk of violations and the evidence of willfulness if a violation does occur.
A contact centre platform designed with compliance controls — built-in DNC scrubbing, time-zone enforcement, and abandon-rate monitoring — reduces the operational burden of TCPA compliance and creates an audit trail. Talk to the MCC team about how the platform supports compliant outbound dialling.
Frequently asked questions — TCPA compliance
Related reading: Sales Dialer, AI Contact Center, What Is 10DLC?, All Guides.
Need a compliant outbound dialling platform?
MCC's cloud communications platform includes built-in DNC scrubbing, time-zone enforcement, and abandon-rate controls to support TCPA-compliant outbound programmes. Talk to the team about your contact centre or sales dialler requirements.