What makes a robocall illegal?

The Consent Foundation: Why Permission Is Non-Negotiable

Every illegal robocall case the FCC pursues tends to trace back to the same root cause: nobody actually agreed to receive the call. Under the Telephone Consumer Protection Act, consent isn't a formality — it's the legal foundation that determines whether an automated call is a legitimate business touchpoint or a violation carrying serious financial consequences.

The TCPA sets different consent standards depending on the line being called. For telemarketing calls to landlines, callers need prior express written consent. For calls and texts to wireless numbers, oral or written consent is required before any artificial or pre-recorded message goes out. Without that permission in place first, the call is illegal from the moment it's placed — regardless of the offer, the script, or the intent behind it.

The stakes are substantial. The TCPA's private right of action lets individuals recover the greater of actual monetary loss or $500 per violation, with treble damages up to $1,500 for knowing or willful violations. With roughly 4.5 billion robocalls hitting U.S. phones every month — about a third of them telemarketing — the exposure for sloppy consent practices compounds fast.

AI-generated voices don't create a loophole. The FCC's February 2024 Declaratory Ruling made this explicit: an AI-generated voice on a robocall is "an artificial or pre-recorded voice" under the TCPA, meaning these calls cannot evade the statute and require the same prior express consent as any traditional robocall. The FCC is also proposing enhanced protections, including specific consent for AI-generated calls and in-call disclosure that AI is being used.

What about the one-to-one consent rule? A federal court vacated it in January 2025, holding that the FCC exceeded its statutory authority by attempting to redefine "prior express consent." But that ruling narrowed one interpretation — it didn't touch the core framework. The baseline consent requirements remain fully intact and enforceable.

For businesses that buy leads, the practical takeaway is simple:

• Consent must exist before the call, not be reconstructed after a complaint.
• Consent records — disclosure text, timestamp, IP address — are the evidence that protects you.
• Revocation must be honored within 10 business days, through any reasonable means.

That's why every lead GrowthPros delivers carries a full consent record attached, and why reactivation campaigns target only pre-existing, opted-in relationships. In this regulatory environment, permission isn't a nice-to-have — it's the entire legal basis for picking up the phone.

Honoring Opt-Outs and Caller ID: Avoiding Costly Compliance Gaps

A broken opt-out link or a spoofed caller ID can turn a compliant campaign into a TCPA violation faster than most businesses realize. The FCC treats both as bright-line failures, and the enforcement data backs that up.

Consumers can revoke consent through any reasonable means — saying "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe" all count — and callers have a strict 10-day window to honor that revocation. The FCC's February 2024 Final Rule creates a rebuttable presumption that consent is revoked if a consumer uses an unlisted but reasonable method, shifting the burden to the company to prove otherwise. Only one confirmation message is allowed after revocation, and it cannot contain marketing content. Legal analysis confirms this framework is now fully effective.

• Provide a functional opt-out mechanism on every call and text — automated, not manual
• Honor revocation requests within 10 business days across all channels (voice, SMS, email)
• Display accurate caller ID: name, number, and business identity at the start of every prerecorded message
• Implement STIR/SHAKEN authentication with your provider's own digital certificate tied to its SPC token

Caller ID failures carry their own penalties. The FCC identifies spoofing as a central tool for illegal robocallers, and STIR/SHAKEN directly addresses it by "erod[ing] the ability of callers to illegally spoof a caller ID." FCC guidance requires most voice providers to implement this authentication, and new rules effective September 2025 mandate that providers sign calls with their own certificates. In August 2025 alone, the FCC removed 1,200+ voice service providers from the Robocall Mitigation Database for deficient filings — effectively disconnecting them from the U.S. telephone network. A $1 million civil penalty against Lingo Telecom for spoofed caller IDs shows the financial exposure.

GrowthPros builds consent records into every lead — disclosure text, timestamp, IP address, and the named contacting party — so revocation tracking starts at the source. Lists are DNC-scrubbed before any outbound contact, and opt-outs are honored immediately and permanently across SMS, voice, and email. Reactivation campaigns target only pre-existing, opted-in relationships, never cold lists.

The compliance infrastructure matters as much as the consent itself. When your follow-up runs on AI voice, SMS, and email within minutes, every channel needs its own opt-out logic and its own revocation trail. One missed "stop" text on a reactivated lead can trigger the same liability as a cold call with no consent at all.

Calling Practices That Cross the Line: Time, Tech, and Enforcement Risks

Even a robocall with valid consent behind it can become illegal the moment it violates the rules governing when you call, how the voice on the line is generated, and whether your traffic can be authenticated on the network. These operational details trip up otherwise compliant businesses more often than consent failures do.

Time-of-day restrictions are straightforward but frequently ignored. The FCC prohibits telemarketing calls to home phones before 8 a.m. and after 9 p.m. local time, and callers must immediately honor any do-not-call request made during a call, according to the agency's consumer guidance on unwanted robocalls. A call placed at 9:15 p.m. is illegal even if the consumer consented weeks earlier.

AI-generated voices now fall squarely under the TCPA. The FCC's February 2024 Declaratory Ruling affirmed that an AI-generated voice is "an artificial or pre-recorded voice" under the TCPA, meaning AI calls cannot evade TCPA coverage and require prior express consent. The FCC is also proposing enhanced protections, including specific consent for AI-generated calls and in-call disclosure that AI will be used. For companies using AI voice follow-up — as GrowthPros does to contact every lead within minutes — disclosure and consent documentation aren't optional extras; they're the legal foundation.

Caller ID authentication and database certification failures carry the heaviest enforcement consequences. The stakes are concrete:

• The FCC removed more than 1,200 voice service providers from the Robocall Mitigation Database in August 2025 for deficient filings, effectively disconnecting them from the U.S. telephone network.
• Over 2,000 providers were notified in December 2024 to correct deficiencies or face removal, per regulatory analysis from Mintz.
• New third-party caller ID authentication rules effective September 18, 2025 require providers to sign calls with digital certificates tied to their own Service Provider Code token.

The financial penalties are equally severe. The FCC has issued hundreds of millions of dollars in enforcement actions against illegal robocallers, and the TCPA's private right of action lets individuals recover the greater of actual monetary loss or $500 per violation — up to $1,500 for knowing or willful violations. Lingo Telecom paid a $1,000,000 civil penalty in a consent decree over spoofed caller IDs.

FCC Chairman Brendan Carr put it bluntly: "Providers that fail to do their duty when it comes to stopping these calls have no place in our networks." The message to any business running outbound calling is clear — build compliance into the pipeline from day one, or risk losing network access entirely.