Who enforces the TCPA?

The FCC Is the Primary Enforcer of the TCPA — And It’s Tightening the Screws

The FCC is the primary federal agency responsible for enforcing the TCPA, using rulemaking and enforcement actions to shape how businesses communicate with consumers. The agency has been actively tightening requirements, particularly for lead generators, through recent orders targeting consent practices and revocation procedures. These changes reflect a broader trend of increased regulatory scrutiny on telemarketing and lead generation activities.

In December 2023, the FCC adopted new rules requiring one-to-one consent for lead-generated communications, effectively closing what it described as the "lead generator loophole." Under this rule, businesses must obtain prior express written consent separately for each identified seller, eliminating the practice of using a single consent to contact multiple vendors. The FCC emphasized that there are no exceptions to this requirement for affiliated companies under common corporate ownership, meaning even businesses within the same corporate family must secure individual consent for each entity. This rule became effective after a 12-month transition period, with enforcement ramping up as the deadline passed.

The FCC is also revising consent revocation rules, with changes set to take effect in January 2027 after multiple delays. Originally scheduled for earlier implementation, the "revoke-all" provision was postponed to address concerns from financial institutions about potentially silencing fraud alerts. Under the revised framework, businesses will be limited to sending no more than three messages per event over three days per affected account for fraud-alert exemptions. Additionally, the FCC already requires businesses to honor opt-out requests within 10 business days and accept revocation in "any reasonable manner," including non-standard language, with a one-time confirmation message allowed within five minutes if it contains no marketing content.

These regulatory shifts have real financial consequences for non-compliance. TCPA violations carry penalties of $500 to $1,500 per violation, with no statutory cap on total damages — a factor that has driven some of the largest class action awards in history, including a $925 million verdict. Companies like Keller Williams have faced fines as high as $40 million for TCPA violations, demonstrating the material risk of inadequate consent management. For lead generators and buyers alike, the FCC’s focus on consent documentation and vendor accountability means that maintaining detailed records — including disclosure text, timestamp, IP address, and the named contacting party — is no longer optional but a core compliance requirement.

GrowthPros builds these requirements into its lead delivery process, ensuring every lead includes a verifiable consent trail and is sourced only from DNC-scrubbed, opted-in lists. As enforcement intensifies, businesses purchasing leads must prioritize vendors who can prove compliance at the point of origin, not just at the point of delivery.

Exclusive leads by niche, followed up in minutes — including the leads you already paid for. Book your 15-minute qualification call at growthpros.marketing.

The FTC Enforces Parallel Rules That Can Trigger Liability for Lead Generation Practices

If you think the FCC is the only cop on the telemarketing beat, the FTC's $45 million MediaAlpha settlement should reset that assumption fast. The Federal Trade Commission doesn't enforce the TCPA itself — it doesn't need to. It pursues lead generators under a parallel set of laws that reach the exact same conduct.

The FTC enforces the FTC Act, the Telemarketing Sales Rule, and the Rule on Impersonation of Government and Businesses against lead generation practices, as the agency explained in its own analysis of the MediaAlpha settlement. In August 2025, MediaAlpha agreed to pay $45 million over allegations it sold consumer data to telemarketers who went on to make millions of illegal robocalls.

The mechanism that should worry every lead buyer and seller is facilitation liability. The FTC's position is blunt: a company can't avoid responsibility for deception it facilitates by intentionally burying its head in the sand. If you knowingly — or consciously avoid knowing — provide substantial assistance to a partner's violations, you can be liable even if you never dialed a single number yourself.

That principle aligns with how TCPA litigation already treats the lead market. Courts have held lead buyers and sellers vicariously liable for each other's actions, which is why legal commentators like Michele Shuster, former Chief of the Ohio AG's Consumer Protection Section, call the "TCPA-compliant lead" a myth — consent is simply too hard to verify when it changes hands between vendors.

The practical exposure is real and well-documented:

• Final Expense Direct paid hundreds of thousands in penalties and faced a $100,000 lawsuit because its lead agency ignored TCPA rules, per Phonexa's compliance analysis.
• Keller Williams faced fines as high as $40 million for TCPA violations.
• The largest TCPA damages award on record stands at $925 million, with statutory damages of $500–$1,500 per violation and no cap on totals, according to Drips' rule-change overview.

The FTC has made its posture explicit: addressing unlawful lead generation is a priority, and the agency will act when lead generators break the law. For businesses that buy leads, that means the question isn't just "did we make the call?" — it's "can we prove where the consent came from?" Vendors like GrowthPros respond to that question by attaching a consent record — disclosure text, timestamp, IP address, and the named contacting party — to every lead delivered, so the paper trail exists before a regulator ever asks for it.

Exclusive leads by niche, followed up in minutes — including the leads you already paid for. Book your 15-minute qualification call at growthpros.marketing.

Private Lawsuits, State Laws, and Court Limits Create a Multi-Layered Enforcement Landscape

Consumers aren’t just protected by federal agencies — they can also take legal action themselves. The TCPA creates a private right of action allowing individuals to sue for $500 to $1,500 per violation, with no statutory cap on total damages, making it a major source of class action litigation. This means a single illegal text or call could trigger significant liability, especially when multiplied across thousands of contacts. For lead buyers and sellers, this risk is amplified because courts have held both parties vicariously liable for each other’s actions under the TCPA, meaning a seller’s compliance failure can expose the buyer to damages — and vice versa.

State attorneys general are adding another layer of enforcement by imposing rules that go beyond the TCPA. Many states have enacted their own telemarketing statutes with stricter consent requirements, broader definitions of prohibited calls, and enhanced penalties. These state-level rules often mirror federal requirements but can include additional obligations, such as stricter opt-out handling or expanded DNC list protections. As a result, businesses operating nationally must navigate a patchwork of regulations where compliance in one state doesn’t guarantee compliance in another.

Judicial oversight is also checking federal overreach. In January 2025, the Eleventh Circuit Court of Appeals vacated a key portion of the FCC’s 2023 order on robocall regulations, finding the agency exceeded its statutory authority under the TCPA. This decision underscores that while the FCC drives rulemaking, courts serve as a critical check on its power — creating uncertainty for businesses trying to stay ahead of evolving standards. For companies like GrowthPros, which delivers consent-recorded, DNC-scrubbed leads with AI-powered follow-up within five minutes, this multi-layered enforcement landscape makes rigorous consent documentation and vendor vetting not just advisable, but essential. MS Law Group emphasizes that the idea of a "TCPA-compliant lead" is often a myth due to the difficulty of verifying consent — reinforcing why every lead must carry a clear, auditable trail. Exclusive leads by niche, followed up in minutes — including the leads you already paid for. Book your 15-minute qualification call at growthpros.marketing.

How GrowthPros Reduces TCPA Risk Through Consent Documentation and Immediate Opt-Out Honoring

Enforcement of the TCPA doesn't just punish the company that dialed the phone — courts have held lead buyers and lead sellers vicariously liable for each other's conduct, which means the vendor you buy leads from can become your legal problem overnight. Final Expense Direct learned this the hard way, paying hundreds of thousands in penalties after its lead agency failed to follow TCPA rules (Phonexa).

This is why consent documentation has become the single most important thing a lead buyer can demand from a vendor. When the FCC adopted its December 2023 one-to-one consent rules targeting lead generators, it effectively made the consent trail the centerpiece of TCPA compliance for anyone buying or selling leads (Cooley LLP). A lead without a documented trail of who consented, when, and to whom is a liability waiting for a plaintiff's attorney.

GrowthPros builds its compliance model around exactly these enforcement realities. Every lead delivered carries a consent record containing:

• The disclosure text the consumer actually saw
• A timestamp showing exactly when consent was given
• The consumer's IP address
• The named contacting party — the specific seller the consumer agreed to hear from

That last item matters more than it might seem. The FCC's one-to-one consent framework requires prior express written consent obtained separately for each identified seller, and the agency declined to create exceptions even for companies under common corporate ownership. Named-party consent records align directly with what regulators expect.

DNC scrubbing closes another gap. Since March 2024, the FCC has extended National Do Not Call Registry protections to marketing text messages, meaning an unsold, unscrubbed list now carries regulatory risk on two fronts (Phonexa). GrowthPros scrubs every list against the DNC registry before any outbound contact, and reactivation campaigns target only pre-existing, opted-in relationships — never cold lists.

Opt-out handling is where many vendors fall short. FCC rules effective April 2025 require businesses to honor revocation requests within 10 business days and accept them in "any reasonable manner" (Drips). GrowthPros treats that 10-day window as a ceiling, not a target: opt-outs are honored immediately and permanently across SMS, voice, and email. With penalties running $500 to $1,500 per violation and no statutory cap on damages, the difference between "within 10 business days" and "immediately" can be the difference between a clean record and a class action (Drips).

The FTC's "facilitation liability" standard raises the stakes further — companies that knowingly or consciously avoid knowing about partners' violations can be liable themselves (FTC). As the agency put it, a company can't bury its head in the sand and escape responsibility. Documented consent is how lead buyers keep their heads out of the sand — and it's the standard every vendor should be held to.

Exclusive leads by niche, followed up in minutes — including the leads you already paid for. Book your 15-minute qualification call at growthpros.marketing.