What is prohibited by TCPA?

Core TCPA Prohibitions: Autodialers, Time, and DNC Rules

The Telephone Consumer Protection Act (TCPA) establishes clear boundaries for telemarketing practices that businesses must respect to avoid significant legal exposure. At its core, the TCPA prohibits three fundamental activities: using autodialers or prerecorded voices without prior express written consent, calling outside the 8 a.m. to 9 p.m. window in the recipient’s local time zone, and contacting numbers listed on the National Do Not Call Registry. These prohibitions remain firmly in place despite recent legal shifts, forming the non-negotiable foundation of TCPA compliance for any organization engaging in outbound communications.

Violating these core rules carries substantial financial risk, with statutory damages ranging from $500 to $1,500 per violation, per class member. For willful or knowing violations, courts can award treble damages of up to $1,500 per call or text, with no cap on total liability. A single non-compliant campaign targeting 10,000 consumers could therefore result in $5 million to $15 million in statutory damages alone, underscoring why adherence to these basic prohibitions is critical for businesses like GrowthPros that specialize in lead generation and follow-up services. Industry analysis confirms that these penalties drive much of the surge in TCPA litigation, which saw 1,807 putative class actions filed between January and September 2025.

To operationalize compliance, businesses must implement specific safeguards around each prohibition. First, any use of an autodialer or prerecorded voice message for marketing purposes requires prior express written consent that includes clear disclosure, a timestamp, the consumer’s IP address, and identification of the contacting party. Second, all outbound calls must be time-restricted to 8:00 AM through 9:00 PM in the recipient’s local time zone, a rule that directly impacts services promising rapid lead response. Third, organizations must scrub every contact list against the National Do Not Call Registry before initiating any telemarketing outreach and immediately honor opt-out requests through any reasonable means. Recent regulatory updates have shortened the opt-out honor period to ten business days and expanded acceptable revocation methods beyond traditional keywords like "STOP."

• Prior express written consent is mandatory for autodialer or prerecorded voice marketing communications
• Telemarketing calls are restricted to 8:00 AM–9:00 PM in the consumer’s local time zone
• Calling numbers on the National Do Not Call Registry is strictly prohibited
• Opt-out requests must be honored within ten business days through any reasonable means
• Violations incur $500–$1,500 per violation in statutory damages, with treble damages for willful conduct

For GrowthPros, these rules shape how leads are sourced, qualified, and delivered. Every lead sold includes a comprehensive consent record capturing disclosure text, timestamp, IP address, and the named contacting party—ensuring that when clients use the AI Follow-Up service to initiate contact within five minutes, they do so only with properly documented prior express written consent. Lists are rigorously DNC-scrubbed before any outbound attempt, and the platform’s architecture supports immediate, permanent honoring of opt-out requests across voice, SMS, and email channels. By embedding these TCPA requirements into its lead delivery process, GrowthPros helps clients navigate the complexities of telemarketing compliance while maintaining the speed-to-lead advantage that drives conversion. Legal precedent confirms that consent need not be limited to a single seller, allowing compliant capped-shared lead models (maximum two buyers) to thrive under current TCPA interpretation.

Opt-Out and Revocation Rules: What Changed in April 2025

For years, "just text STOP" was the industry's answer to opt-outs. That safe assumption collapsed on April 11, 2025, when the FCC's revised revocation rules took effect — and businesses that haven't updated their follow-up systems are now exposed.

The most significant change is speed. Businesses must now honor opt-out requests within ten business days, down from the previous 30-day window, according to legal analysis from BCLP. In practice, most compliance teams treat this as a floor, not a target — the safer operational standard is honoring revocations immediately and permanently.

The second change is broader and harder to engineer: consumers may now revoke consent through any reasonable means. A reply of "STOP" still works, but so do keywords like "QUIT" or "END," and non-traditional methods carry a rebuttable presumption of reasonableness. As BCLP's breakdown explains, a consumer can revoke via voicemail, email, or even by telling a cashier — and the burden falls on the business to prove the request was unreasonable.

The third change is the narrowest but most operationally tricky. After a revocation request, a business may send exactly one clarification message, and it must arrive within five minutes and contain zero marketing content. The rules in brief:

• Honor all opt-outs within ten business days (effective April 11, 2025)
• Accept revocation through any reasonable means — no exclusive opt-out method permitted
• Send at most one non-marketing clarification message within five minutes of revocation
• Retain opt-out documentation for at least four years, matching the TCPA statute of limitations

These rules hit automated lead follow-up systems especially hard. A five-minute speed-to-lead sequence — voice, SMS, and email firing in rapid succession — can easily trip the clarification-message limit if a revocation lands mid-sequence. Every channel in the sequence must recognize an opt-out instantly and suppress all remaining touches, not just the SMS thread where the keyword appeared.

The stakes are not theoretical. Industry compliance data shows TCPA class actions surging, with 1,807 putative class actions filed between January and September 2025 — a 283% year-over-year spike in September alone. At $500 to $1,500 per violation with no cap on total damages, a single non-compliant campaign can quickly become an extinction-level event for a lead generation business.

This is why GrowthPros treats opt-out handling as a system-level requirement, not a keyword filter: revocations are honored immediately and permanently across SMS, voice, and email, with the consent trail attached to every lead record. In the current litigation environment, the opt-out process is as much a compliance asset as the consent captured at the top of the funnel.

Consent Clarifications: What the Vacated One-to-One Rule Means for Lead Sellers

For lead sellers, January 2025 delivered one of the most consequential TCPA rulings in years — and it changed far less than many buyers feared.

On January 24, 2025, the Eleventh Circuit Court of Appeals vacated the FCC's one-to-one consent rule just days before its January 27 implementation deadline, finding that the FCC had exceeded its statutory authority. According to the court's analysis, the restriction "falls outside the scope of the FCC's statutory authority to 'implement' the TCPA" because it attempted to alter the ordinary common law meaning of "prior express consent."

The practical result: prior express written consent does not need to be limited to a single seller, nor does it need to be logically or topically related to the consumer's original interaction. As legal analysis of the ruling confirms, a consumer need only "clearly and unmistakably" state willingness to receive the communication — even when consenting to multiple vendors at once. A later FCC final rule on consent reinforced this position, formally killing the one-to-one requirement.

This is why lead generators like GrowthPros can legally offer capped-shared leads — where a single consented lead goes to a hard maximum of two buyers rather than being dumped into a broad marketplace pool. Shared distribution, in itself, does not violate the TCPA.

What the vacatur does not do is eliminate liability at the point of capture. Lead sellers remain jointly liable if consent at capture is insufficient — a consumer who never clearly agreed to receive calls can still bring a claim against everyone in the chain, per industry compliance analysis. The stakes are severe: statutory damages run $500 to $1,500 per violation with no cap on total liability, and 1,807 putative class actions were filed between January and September 2025 alone.

For lead buyers evaluating sellers, the vacatur clarifies what to verify:

• Consent language at capture clearly discloses that contact may come from a buyer (or multiple named buyers)
• Every lead carries a documented consent trail — disclosure text, timestamp, IP address, and the named contacting party
• Opt-out requests are honored within ten business days through any reasonable means, per the rules effective April 11, 2025
• Consent records are retained for at least four years, matching the TCPA statute of limitations

The one-to-one rule is gone, but the underlying prohibition stands: marketing calls and texts using an autodialer or prerecorded voice still require prior express written consent. Sellers who treat the vacatur as a compliance holiday rather than a clarification are the ones funding the class action bar.