What is restricted under the TCPA?

The TCPA Minefield: What Telemarketers Can't Do Anymore

The TCPA Minefield: What Telemarketers Can't Do Anymore

Telemarketers face a minefield of restrictions under the TCPA, with core prohibitions centered on unsolicited robocalls and robotexts lacking prior express written consent, alongside strict limits on automatic telephone dialing systems (ATDS). The National Do Not Call Registry’s protections now formally extend to marketing text messages, requiring prior express invitation or permission before contacting registered numbers. Every non-compliant contact carries significant financial risk, as violations trigger statutory damages of $500 to $1,500 per incident, with a 4-year statute of limitations allowing legal action long after the call or text occurs. This creates a persistent liability where each outreach attempt could become a costly class action exposure.

• Prior express written consent must include a clear disclosure that the consumer authorizes telemarketing via ATDS or artificial voice and is not required to sign as a condition of purchase.
• Opt-out requests must be honored "as soon as practicable" and within ten business days, with only one non-marketing clarification message permitted within five minutes of revocation.
• The FCC’s definition of consent explicitly recognizes electronic or digital signatures under applicable federal or state contract law.

For businesses like GrowthPros that sell qualified, consent-recorded leads, these restrictions underscore the necessity of rigorous compliance infrastructure. Every lead must carry a verifiable consent trail documenting disclosure text, timestamp, IP address, and the named contacting party—elements that transform raw contact data into a legally defensible asset. Without this foundation, even well-intentioned outreach risks triggering the TCPA’s steep penalties, turning speed-to-lead advantages into speed-to-liability vulnerabilities. The stakes demand systems that honor consumer rights while enabling lawful, effective engagement.

The Consent Rules After the One-to-One Reversal

The regulatory ground shifted again in January 2025 when the Eleventh Circuit vacated the FCC's 2023 "one-to-one consent" rule for lead generators, ruling the agency exceeded its statutory authority. The FCC declined to appeal in April 2025, effectively removing the requirement that prior express written consent be obtained separately for each identified seller.

What remains is the codified definition of prior express written consent at 47 CFR § 64.1200(f)(9). This requires a written agreement bearing the signature of the person called that clearly authorizes the seller to deliver telemarketing messages via ATDS or artificial/prerecorded voice. The agreement must include a clear and conspicuous disclosure that the person authorizes such calls and is not required to sign as a condition of purchasing any property, goods, or services. Electronic or digital signatures recognized under applicable federal or state contract law satisfy the signature requirement.

• Written agreement with the called party's signature (electronic or digital included)
• Clear authorization for ATDS or artificial/prerecorded voice telemarketing
• Disclosure that consent is not a condition of purchase
• Conspicuous presentation separate from other terms

The opt-out landscape has also hardened. Under rules effective April 11, 2025, consumers may revoke consent in "any reasonable manner" — not just prescribed methods like "STOP" — and businesses must honor requests within ten business days. Only one clarification message is permitted within five minutes of revocation, containing no marketing content and requiring an affirmative response to continue contact. Documentation of opt-out requests should be retained for at least four years, aligning with the TCPA's four-year statute of limitations.

GrowthPros builds these requirements into every lead we deliver. Each record carries its consent trail — disclosure text, timestamp, IP address, and the named contacting party — so buyers can demonstrate compliance from day one. Our reactivation campaigns target only pre-existing, opted-in relationships, DNC-scrubbed before any outbound contact, with opt-outs honored immediately and permanently across SMS, voice, and email.

Opt-Out Obligations: The April 2025 Rules That Changed Everything

For decades, "just reply STOP" was the escape hatch companies offered consumers — and often the only one they honored. As of April 11, 2025, that loophole is closed for good.

The TCPA's new Opt-Out Rule fundamentally changes how consent revocation works. Consumers can now revoke consent in any reasonable manner — not just prescribed methods like texting "STOP" or clicking a website opt-out link, according to legal analysis from BCLP. A verbal request during a phone call, a reply to an email, even a social media message can all qualify as valid revocation.

Once a request arrives, the clock starts. Businesses must honor revocation requests "as soon as practicable" and no more than ten business days after receipt, per the FCC's effective-date guidance. The stakes are real: each unauthorized contact can trigger statutory damages of $500 to $1,500, with no requirement that the consumer prove actual injury.

The rules around post-revocation contact are equally strict:

• Only one clarification message is permitted after a revocation request.
• That message must be sent within five minutes of the opt-out request.
• It cannot contain any marketing content whatsoever.
• The consumer must affirmatively respond before any further contact is allowed.

Documentation is the other half of compliance. Because the TCPA carries a four-year statute of limitations — meaning any call or text can trigger legal proceedings up to four years after it was made, as TCPA attorney Eric Troutman's guidance notes — businesses should retain opt-out records, consent trails, and communication logs for at least four years. A single undocumented opt-out from 2023 can resurface as class action exposure in 2027.

Industry groups like the American Bankers Association have pushed back, urging the FCC to delay enforcement until April 11, 2026, citing administrative burden — though no legal challenges have succeeded so far. The rule is live, and enforcement risk is now.

This is why consent infrastructure matters as much as lead volume. At GrowthPros, every lead we deliver carries a full consent record — disclosure text, timestamp, IP address, and the named contacting party — and opt-outs are honored immediately and permanently across SMS, voice, and email. If a lead's consent trail can't survive scrutiny under the April 2025 rules, it never should have been sold in the first place.

Buying leads that arrive with their consent documentation intact isn't a luxury under this regulatory regime. It's the difference between a compliant pipeline and a four-year liability window.

State-Level Traps: Where Federal Compliance Isn't Enough

Even when a campaign follows every federal TCPA requirement, state-level laws can still render it non-compliant, creating a layered regulatory challenge for businesses that operate across state lines. These state-specific rules often impose stricter consent standards, broader technology definitions, or outright bans on certain types of outreach — meaning a federally compliant text or call could trigger liability in jurisdictions like Washington, California, or Florida. For companies like GrowthPros that deliver leads with consent records and AI-powered follow-up, understanding these state-level traps is essential to avoid costly missteps, especially when reactivating dormant lists or scaling lead delivery nationwide.

Several states have enacted laws that go beyond the TCPA’s federal framework, with some banning unsolicited text messages entirely regardless of the technology used. Washington and California both prohibit unsolicited commercial text messages sent without prior express consent, even if the message is not delivered via an autodialer or prerecorded voice — a significant expansion over federal rules that primarily target robocalls and robotexts under specific conditions. Florida’s Mini-TCPA takes a different but equally aggressive approach by defining an automatic telephone dialing system (ATDS) so broadly that it includes any equipment capable of dialing stored numbers, effectively covering most modern texting and calling platforms used in lead generation and follow-up workflows. This means that even a one-to-one SMS sent from a mobile device could potentially fall under the statute if the system used has the capacity to store and dial numbers automatically. Other states, including Oklahoma and New York, have also introduced additional restrictions such as narrower calling windows, enhanced opt-out requirements, or private rights of action that mirror or exceed TCPA penalties.

These state-level variations create real compliance risks for businesses that assume federal adherence is sufficient, particularly when using automated systems for speed-to-lead follow-up or dead list reactivation. A text message sent within five minutes of lead delivery — a best practice shown to increase contact likelihood by roughly 100x compared to 30-minute delays — could still violate state law if sent to a consumer in Washington or California without verifiable prior consent, or if the delivery platform meets Florida’s expansive ATDS definition. GrowthPros addresses this by embedding consent documentation directly into each lead record and honoring opt-outs permanently across channels, but the responsibility ultimately falls on the buyer to ensure their outreach complies with both federal and applicable state laws. Ignoring these distinctions doesn’t just risk fines of $500 to $1,500 per violation under the TCPA — it can trigger additional state penalties, private lawsuits, and reputational damage in markets where consumer protection laws are aggressively enforced.

How to Buy and Work Leads Without TCPA Exposure

Buying leads is where most TCPA exposure actually begins — because the buyer inherits the seller's compliance gaps. A lead without a verifiable consent trail isn't an asset; it's a $500–$1,500 liability per contact, per TCPA penalty rules, with a four-year statute of limitations giving plaintiffs' attorneys a long window to come knocking.

Start by demanding proof with every lead. The FCC's codified definition of prior express written consent at 47 CFR § 64.1200(f)(9) requires a written agreement, signed electronically or digitally, that clearly authorizes telemarketing via autodialer or artificial voice — and states the consumer isn't required to consent as a condition of purchase, per recent legal analysis. If your lead vendor can't produce that, walk away.

Your practical checklist:

• Demand a full consent record with every lead — disclosure text, timestamp, IP address, and the named contacting party.
• Scrub voice and SMS lists against the DNC Registry before any outreach. DNC protections now extend to marketing texts, which require prior express invitation or permission, per FCC rules.
• Honor opt-outs immediately and permanently. Since April 11, 2025, consumers may revoke consent in any reasonable manner, and you have at most ten business days to comply — with only one non-marketing clarification message allowed within five minutes, per the Opt-Out Rule.
• Keep documentation — consent records, opt-out logs, call and text histories — for at least four years, aligned with the TCPA's statute of limitations.

Reactivating dormant lists carries its own rule: only contact people with a pre-existing, opted-in relationship. Cold list revival is where class actions get built. This is exactly the line GrowthPros draws — its dead lead reactivation process only touches opted-in CRM lists clients already own, with every lead DNC-scrubbed before outbound contact and a consent trail attached at delivery.

The vendors who make this easy are the ones who build compliance into the product rather than leaving it to you. A lead that arrives time-stamped, consent-recorded, and scrubbed isn't just safer — it's workable the moment it lands in your CRM.