Are unsolicited phone calls illegal?

The Real Answer: It Depends on Consent, Technology, and the DNC List

No — an unsolicited phone call is not automatically illegal, despite what most people assume. Under the Telephone Consumer Protection Act (TCPA), a call becomes illegal only when it's made without the level of consent the law requires for the technology used and the purpose of the contact.

Eric Troutman, a leading TCPA attorney, defines the statute as one that prevents the use of certain regulated technology to call cell phones and landlines without use-case-specific consent — and that prevents unsolicited marketing calls to residential numbers on the national Do Not Call list. In other words, three variables determine legality: the technology used, the purpose of the call, and whether the number is on the DNC Registry.

The TCPA's consent framework has three tiers:

• Prior Express Written Consent (PEWC) — required for marketing calls and texts made with an autodialer or artificial/prerecorded voice. Consent must be written, clear, and documented with proof of opt-in; verbal consent alone is insufficient.
• Prior Express Consent (PEC) — applies to informational or transactional messages, which may be obtained verbally.
• Prior Express Invitation or Permission (PEIP) — covers non-autodialed marketing or informational contact.

The stakes for getting this wrong are substantial. Statutory damages run from $500 to $1,500 per violating call or text, and the TCPA statute of limitations allows lawsuits to reach back up to four years. Because the TCPA includes a private right of action, it's already a major source of class action litigation, and Cooley LLP attorneys note that recent FCC rules "surely will provide new ammunition for an aggressive plaintiffs' bar."

The rules themselves are also a moving target. In December 2023, the FCC voted 4-1 to close the so-called lead generator loophole, requiring consent to name one seller at a time and to be "logically and topically associated" with the interaction that prompted it — so consenting to a car loan comparison site wouldn't cover robotexts about loan consolidation. Then in January 2025, the Eleventh Circuit vacated that one-seller-only rule, reinstating the prior broader standard under which consent can cover multiple sellers if disclosures are clear and compliant.

The DNC Registry adds another layer: the FCC has explicitly extended its protections to text messaging, so marketing texts cannot be sent to numbers on the registry — regardless of whether an autodialer was used. That framework is broader than TCPA robocall rules because it governs almost all commercial telephone solicitations to DNC-listed numbers.

Critically for anyone buying leads, the business making the call — not the lead seller — bears liability if consent is invalid. That's why buyers must demand traceable proof of opt-in for every lead they purchase. It's also why GrowthPros attaches a consent record to every lead it delivers, including disclosure text, timestamp, IP address, and the named contacting party, and DNC-scrubs every list before outbound contact.

The Rules Keep Moving: The Lead Generator Loophole Saga

The regulatory ground beneath lead generation shifted twice in barely a year. In December 2023, the FCC voted 4-1 to close what it called the "lead generator loophole," requiring lead generators to obtain consumer consent for robocalls and robotexts from one seller at a time rather than bundling multiple sellers under a single opt-in. The order also mandated that calls and texts be "logically and topically associated" with the interaction that prompted consent — consent on a car-loan comparison site, for example, would not cover loan-consolidation offers.

• One-to-one consent: each seller must be individually disclosed and selected
• Topical association: outreach must match the context of the original opt-in
• Non-transferable consent: the caller bears the burden of proving valid consent

Then came the reversal. In January 2025, the Eleventh Circuit vacated the FCC's one-seller-only rule, reinstating the prior broader standard where a single, clearly disclosed consent can cover multiple sellers. The practical effect: TCPA compliance remains a moving target. Meanwhile, the FCC extended DNC Registry protections to text messaging — marketing texts to registered numbers are now explicitly prohibited — and ordered terminating mobile carriers to block texts from numbers flagged by the Enforcement Bureau as suspected illegal sources.

Law firm Cooley LLP warns the TCPA is already "a major source of class action litigation" and the new rules "surely will provide new ammunition for an aggressive plaintiffs' bar." With statutory damages of $500 to $1,500 per violation and a four-year lookback window, the financial exposure compounds fast. Critically, the business making the call — not the lead seller — bears liability for invalid consent.

That liability reality is why GrowthPros builds compliance into the product from day one: every lead carries a consent record with disclosure text, timestamp, IP address, and the named contacting party; lists are DNC-scrubbed before any outbound contact; and reactivation targets only pre-existing, opted-in relationships. When the rules move, the consent trail doesn't.

Why Lead Buyers Carry the Risk (Not Lead Sellers)

Buying leads feels safe — until the phone rings and the lawsuit lands on your desk, not your vendor's. Under the TCPA, the business making the call or sending the text is the one on the hook when consent turns out to be invalid, not the company that sold the lead in the first place, as compliance analysis makes clear. That asymmetry is the single most important thing a lead buyer needs to understand.

The stakes are not trivial. Statutory damages run $500 to $1,500 per call or text, and consumers can reach back through up to four years of contact history when filing suit. The TCPA's private right of action has already made it a major source of class action litigation, and legal observers at Cooley LLP warn that evolving consent rules give plaintiffs' attorneys fresh ammunition.

The FCC has also clarified that the caller bears the burden of proving consent is valid — meaning "the vendor told me it was fine" is not a defense. If you cannot independently verify where a lead came from, what the consumer actually agreed to, and who they agreed to hear from, you are holding an unexploded liability. That is why buyers must demand a traceable consent trail on every lead and reject the ones that lack it. At minimum, that trail should include:

• The exact disclosure text the consumer saw at opt-in
• A timestamp showing when consent was given
• The IP address captured at the point of submission
• The named contacting party the consumer agreed to hear from

The FCC's 2023 order went further, requiring consent to be logically and topically associated with the interaction that prompted it — a consumer shopping for a car loan did not consent to texts about debt consolidation. And while the Eleventh Circuit's January 2025 vacatur of the one-seller-only rule reinstated a broader consent standard, the underlying documentation requirements never went away.

Consent is also revocable. Consumers can opt out at any time through reasonable methods — a STOP reply, a phone call, an email, even a verbal request — and businesses must honor those revocations promptly across every channel they use: SMS, voice, and email alike. A lead that was clean at purchase becomes a violation the moment the consumer says stop and the follow-up sequence keeps running.

This is why vendors like GrowthPros attach a consent record — disclosure text, timestamp, IP, and named party — to every lead delivered, and scrub lists against the DNC registry before any outbound contact. The lead buyer still owns the risk. The only question is whether the vendor's paperwork makes that risk manageable or invisible.

Exclusive, consent-recorded leads by niche — followed up by AI voice, SMS, and email inside five minutes, 24/7. Book your free 15-minute qualification call at growthpros.marketing.

How to Buy and Work Leads Without Stepping on a TCPA Landmine

Buying leads isn't inherently risky — buying leads without proof of consent is. Under the TCPA, the business making the call, not the lead seller, bears liability when consent turns out to be invalid, so the burden of verification sits squarely on you before you dial or text anyone.

That burden is heavier than most buyers realize. Violations carry statutory damages of $500 to $1,500 per call or text, and the TCPA's statute of limitations lets plaintiffs reach back up to four years, according to TCPA legal analysis. A single batch of bad leads can compound into a class action — a risk Cooley attorneys call a "major source of litigation" that new FCC rules only amplify.

Here is a practical playbook for staying on the right side of the line.

Scrub against the DNC Registry before any contact — including SMS. The FCC amended its DNC regulations to state explicitly that registry protections apply to text messaging, meaning marketing texts to DNC-listed numbers are prohibited even when no autodialer is involved, as regulatory reporting makes clear. Run every list — purchased or in-house — through a DNC scrub before the first outbound touch.

Verify consent records on every purchased lead. Prior express written consent must be documented with traceable proof of opt-in; verbal consent doesn't suffice. Demand the disclosure text, timestamp, and IP address behind each lead, and reject anything you can't independently verify. GrowthPros attaches this consent trail to every lead it delivers for exactly this reason.

Retain documentation for four-plus years. Because the statute of limitations runs up to four years, your consent records need to outlast the campaign itself.

Honor revocation instantly and permanently. Consumers can revoke consent through any reasonable method — STOP replies, phone calls, emails — and opt-outs must be honored promptly across every channel you use.

Build compliant speed into the process. Verification and scrubbing shouldn't slow your follow-up to a crawl. A workflow that DNC-scrubs, confirms consent, and triggers AI voice, SMS, and email follow-up inside five minutes keeps you both defensible and fast — critical when roughly 78% of buyers choose whoever responds first.

The one-to-one consent saga shows why compliance must be structural, not bolted on. The FCC's December 2023 rule limiting lead-generator consent to one seller at a time was vacated by the Eleventh Circuit in January 2025, but the underlying consent framework — and the plaintiffs' bar chasing it — remains fully intact.

If you want leads that arrive DNC-scrubbed, consent-recorded, and followed up inside five minutes, book a 15-minute qualification call. It's free, honest about fit, and commits you to nothing.