TCPA Compliance: What the Rules Mean for Calls, Texts and Lead Follow-Up

TCPA compliance means making marketing calls and texts only in the ways the Telephone Consumer Protection Act and the FCC's rules allow: with the right consent for the technology used, in permitted hours, honoring opt-outs and keeping proof. It matters for lead follow-up because the fastest response, an automated text or call, carries the strictest rules.

This article is general information, not legal advice. It reads the text of 47 U.S.C. § 227 and 47 CFR § 64.1200 as published by the Legal Information Institute, along with FCC and FTC guidance, in October 2026. Rules, court decisions and state laws change, and none of this replaces a lawyer looking at your real forms, scripts and vendors.

The tension is easy to see. Speed to Lead Without the Five-Minute Theater argues that responding quickly improves your odds with a lead. The TCPA does not object to speed. It objects to speed that outruns consent. A text fired at the instant a form posts is fine if the form collected the right consent and a problem if it did not. The work is in building the first touch around what the lead actually agreed to.

The FCC's delivery restrictions in 47 CFR § 64.1200 split by technology and by purpose. The table summarizes the parts most relevant to lead follow-up. It is a simplification, and exemptions exist that are not shown.

The FCC defines prior express written consent as an agreement in writing, bearing the signature of the person called, that clearly authorizes the seller to deliver advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice, and that names the telephone number to be used. The agreement must include a clear and conspicuous disclosure that signing authorizes those calls and that the person is not required to sign it, directly or indirectly, as a condition of buying anything. The definition says an electronic or digital signature counts where it is valid under applicable federal law or state contract law.

The rule text does not hand you a form. It lists elements, and the wording has to carry all of them. Have counsel approve the final language, because a vague “I agree to be contacted” may not meet the definition for automated marketing messages, and no one wants to find that out in a demand letter.

Buying or receiving leads from a partner creates the largest risk, because the consent record belongs to someone else. The FCC adopted a rule requiring consent to be given to one seller at a time. According to a law-firm client alert, the Eleventh Circuit vacated that one-to-one requirement in January 2025, days before it was due to take effect, so it is not in force. That does not make shared consent safe. The definition above still speaks of authorizing the seller, and a vendor's consent that never mentions you is only as good as the evidence behind it.

On the do-not-call side the rule is blunter. If requests are recorded by someone other than the business on whose behalf the call is made, that business is liable for failures to honor them. Outsourcing the dialing does not outsource the liability. Before using any vendor's leads for automated contact, ask for the actual consent text, the timestamp, the number and the sources, and check that your company is named. Before an AI Voice Agent Dials Anyone, Prove the Call Is Allowed applies the same test to voice agents.

The table collects the timing and opt-out rules in 47 CFR § 64.1200. One nuance first. The calling-hours limit applies to “telephone solicitations,” and the rule defines that term to exclude calls made with the person's prior express invitation or permission or within an established business relationship. A lead who asked for a callback is therefore arguably outside the federal hours limit. We would keep the window anyway, because state laws can differ and a call at 11 p.m. to someone who asked for a call tomorrow will not help the relationship.

Choose the first touch from what the lead agreed to, not from what your tools can do. The table sets out common lead situations and a conservative first move. This is our reading of the rule text and not legal advice, and the right answer for you depends on your state, your wording and your counsel.

Consent captured last year can be revoked this morning, which is why the check has to happen at the moment of sending and not when the lead was created. The workflow below turns the rule elements into steps a team can build. It is our suggested design, to be reviewed by counsel against your own facts.

The statute gives plaintiffs a reason to sue and defendants a reason to keep records. Under 47 U.S.C. § 227(b)(3), a person may recover actual monetary loss or $500 in damages for each violation, whichever is greater, and a court may increase the award up to three times if the violation was willful or knowing. The do-not-call provisions carry their own private right of action, with a similar trebling provision and an affirmative defense: that the defendant established and implemented, with due care, reasonable practices and procedures to prevent violations.

That defense is only available if the procedures exist and can be shown. The records below are the ones you will wish you had. Ask counsel how long to retain each, since the right period depends on what you rely on and on how long claims can be brought.

Federal compliance is a floor. The statute says it does not preempt state laws that impose more restrictive intrastate requirements on autodialers, artificial or prerecorded voice messages or telephone solicitations, and it allows states to bring civil actions on behalf of their residents. The practical meaning is that a lead in one state can be covered by rules about calling hours, consent or registries that differ from the federal text.

Map your exposure by where leads live, not where you operate. For each state with meaningful volume, have counsel confirm what applies to calls and texts. The FTC also enforces the Telemarketing Sales Rule, and its business guidance points companies to both the Do Not Call Registry protections and the rules against most robocalling, so a clean FCC reading is not the only test.

A workable approach is a short state register: one row per state with meaningful lead volume, recording its calling hours, consent requirements, registry rules, whether private lawsuits are allowed, the date counsel last checked it and who owns the row. The register will be partly empty at first. An empty cell is an honest answer, and a visible one beats an assumption that federal rules are enough.

For a workflow that sequences email, calls and texts, The Outbound Sequence Compliance Cookbook shows where to put the consent checks. For the voice-agent version, see Before an AI Voice Agent Dials Anyone, Prove the Call Is Allowed.

It cannot tell you whether your particular consent wording is sufficient, how courts in your circuit read it, or what your states require. It does not cover every exemption, health-care and non-profit carve-outs, debt collection, or email rules. It was written from published rule text and agency pages, and parts of the framework were in motion when it was reviewed.

Take these questions to counsel: Does our consent language meet the written-consent definition for the channels we use? Which states do our leads live in, and what do they add? How do our vendors prove consent, and what do our contracts say about liability? How fast does an opt-out reach every system? And what are our written procedures if a complaint arrives? The answers become your compliance file, and they take far less time to gather before a dispute than during one.