TCPA violations: what counts, statutory damages and fines

A TCPA violation is a call, text or fax that breaks the Telephone Consumer Protection Act or the FCC rules under it, such as an autodialed marketing text sent without prior express written consent. The statute lets a person recover actual loss or a fixed statutory amount per violation, which a court may triple for willful or knowing violations.

This page reflects 47 U.S.C. 227 and the FCC rule text in the Electronic Code of Federal Regulations as amended through March 25, 2026, checked on October 6, 2026. It is general information, not legal advice. If you have received a claim or a demand letter, talk to a lawyer.

What counts as a TCPA violation?

A TCPA violation is a call, text message or fax that does not meet a requirement of 47 U.S.C. 227 or of the FCC rules that carry it out at 47 CFR 64.1200. Each call or message is assessed on its own, so one campaign can produce many separate violations.

The violations that come up most in lead generation fall into five groups:

Calling hours are also a rule: 64.1200(c)(1) bars telephone solicitations to residential subscribers before 8 a.m. or after 9 p.m. local time at the called party’s location. What consent each type of call needs is covered in TCPA consent.

TCPA fines and statutory damages in 47 U.S.C. 227

The statute sets out who may sue and what they may recover. The amounts below are quoted from 47 U.S.C. 227. They are per violation, which in practice usually means per call or per text.

What "per violation" means for lead buyers

Because damages attach to each call or text, the total grows with the number of contacts. A buyer that sends an automated sequence of several texts to one lead, without valid consent, may face a separate claim for each text. That is why consent has to be checked before the first automated contact, not after a complaint.

What is the TCPA statute of limitations?

The TCPA does not state a time limit for private lawsuits. A general federal rule fills that gap: 28 U.S.C. 1658(a) says that, except as otherwise provided by law, a civil action arising under an Act of Congress enacted after December 1, 1990 may not be commenced later than 4 years after the cause of action accrues.

Courts have applied that period to TCPA claims. In Sawyer v. Atlas Heating & Sheet Metal Works, Inc. (7th Cir. 2011), a TCPA case about unsolicited faxes, the U.S. Court of Appeals for the Seventh Circuit stated that the statute of limitations is four years under 28 U.S.C. 1658. Questions such as when a claim accrues, and whether a pending class action pauses the clock, are decided case by case.

The statute does state a limit for FCC forfeitures. Under 227(b)(4)(E), the FCC may not impose a forfeiture under 227(b)(4)(A) for a violation that occurred more than 1 year before its notice, or under 227(b)(4)(B) (violations with intent) for one that occurred more than 4 years before its notice. State telemarketing laws have their own deadlines.

For record-keeping, the point is simple: a claim can arrive years after the call. Consent records that are deleted early cannot be produced later. Retention periods are covered in TCPA consent record-keeping.

How lead generation consent records relate to TCPA violations

In a TCPA dispute about a lead, the main question is usually whether the person agreed to be contacted, by whom, and how. The answer comes from records. In lead generation, those records sit with different parties: the publisher or seller who ran the form, the broker or network, and the buyer who made the call.

Summit Leads captures TCPA consent on every lead and delivers leads with consent certificates, so a buyer can match each lead to the form and consent text behind it (how buying works). The wider lead lifecycle, from form to sale, is explained in the lead generation industry guide.

Steps to reduce the risk of a TCPA violation

1. 1

   Map every automated contact

   List each call and text your campaign sends after a lead arrives, and note whether it uses an autodialer, a prerecorded or artificial voice, or a person dialing by hand.

2. 2

   Match each contact to its consent

   Confirm the form’s consent language covers the seller making the contact and the type of contact (calls, texts, prerecorded messages).

3. 3

   Check Do Not Call status

   Scrub numbers against the National Do Not Call Registry, state lists that apply and your internal list before telemarketing calls. See Do Not Call list for businesses.

4. 4

   Honor opt-outs fast

   Process revocations from any reasonable method within ten business days, as 47 CFR 64.1200(a)(10) requires, and stop sending the lead to other buyers.

5. 5

   Keep the records

   Store consent certificates, scrub records and opt-out logs for at least as long as a claim could be brought.

6. 6

   Review with counsel

   Have a lawyer review your forms, scripts and call flows before launch and after any rule change.

Common mistakes

• Assuming a manual dialer removes all risk. Do Not Call rules, calling hours and opt-out rules apply to telephone solicitations regardless of the dialing technology.
• Counting a campaign as one violation. Damages in 227(b)(3) and 227(c)(5) are stated per violation, and each call or text can count.
• Deleting consent records too soon. A claim can be filed years after the call.
• Re-sending a lead after an opt-out. Once a person revokes consent, sellers and publishers should not send that number to another buyer.
• Relying on rules that changed. The FCC one-to-one consent rule never took effect. Check the current rule text, not older summaries. See the one-to-one consent rule page.

Frequently asked questions

Related guides

• TCPA compliance hub: Every TCPA guide on the site.
• TCPA consent: Which consent each type of call needs.
• DNC list violations: Penalties for Do Not Call violations under the TSR and the TCPA.
• Express written consent: What the written agreement must contain.
• TCPA compliance checklist: A working checklist for lead generators.

Generating leads on your own forms? Sell your leads.