TCPA Violations and Penalties: What Every Violation Actually Costs
You got a letter citing 47 U.S.C. § 227. That $500 number everyone quotes? It's the floor, not the ceiling - here's what TCPA violations penalties actually look like in 2026.
2,788 TCPA cases were filed in 2024, up 67% from 2023. By January 2025, monthly class action filings hit 172 - a 268% increase over January 2024. With 78% of all TCPA filings landing as class actions compared to 5.1% for FDCPA and 1.4% for FCRA, this isn't a niche compliance risk. It's a litigation industry.
Quick Penalty Reference
Every penalty applies per violation - per call, per text, per person contacted.
| Penalty Type | Per-Violation Amount |
|---|---|
| Federal statutory (standard) | $500 |
| Federal statutory (willful) | $1,500 |
| TRACED Act (civil) | Up to $10,000 |
| FCC forfeiture (e.g., Telnyx NAL) | $2,500/call |
| DNC violation (TSR/FTC civil penalty) | Up to $50,120 |
| State mini-TCPA (e.g., CT) | Up to $20,000 |
How Per-Violation Costs Scale
Here's the thing most TCPA guides skip: the math.
1,500 violations at $1,500 (willful): $2.25 million. That's a mid-size SMS campaign to a list with consent gaps - not a Fortune 500 operation, just a Series B company running aggressive outbound.
10,000 violations at $500 (standard): $5 million. At the willful treble rate, $15 million.
100,000 violations at $500: $50 million floor. At $1,500 willful, $150 million. High-volume SMS campaigns routinely touch six-figure contact lists, and every unsolicited message is a separate violation.
These aren't theoretical. Dish Network settled for $280 million. Capital One paid $75 million. Facebook settled for $90 million. Legal scholars argue statutory damages are constitutionally disproportionate. Plaintiffs' attorneys keep filing anyway.
FCC Enforcement vs. Private Lawsuits
Two separate penalty tracks, and they work differently.
FCC administrative enforcement doesn't follow the $500/$1,500 framework. The Telnyx case is the clearest example: the FCC proposed a $4.5 million forfeiture against Telnyx LLC for KYC failures - 1,797 calls at $2,500 per call over just two days.
Private right of action is where most companies actually get hit. The $500/$1,500 per-violation damages, multiplied across a class, generate eight-figure settlements. FCC enforcement is relatively rare. Class action lawsuits are not.
Every call to a reassigned number is a $500-$1,500 violation. Stale data is the #1 compliance gap plaintiffs' attorneys exploit. Prospeo refreshes all 300M+ records every 7 days - not the 6-week industry average - so your dialers reach the right person at the right number. 98% email accuracy. 125M+ verified mobiles. Zero excuses for bad data.
Stop paying TCPA fines for data your provider should have caught.
State Laws That Stack on Top
Federal exposure is just the starting point. State mini-TCPA laws pile on, and several got tougher recently.
| State | Key Provision |
|---|---|
| Connecticut | Up to $20,000/violation |
| Texas (SB 140) | DTPA treble damages |
| Virginia (SB 1339) | 10-year opt-out honor period |
| Georgia (SB 73) | Removed damage caps |
| Florida | 8 a.m.-8 p.m. + max 3 texts/24 hrs |
| Maine (LD 2234) | Mandatory reassigned-number DB check |
Texas SB 140, effective September 1, 2025, ties TCPA-style violations to the Deceptive Trade Practices Act - treble damages, mental anguish claims, and mandatory attorneys' fees. Virginia's SB 1339, effective January 1, 2026, requires businesses to honor text opt-outs for a full decade. If you're running outbound campaigns that touch multiple states, you're not just dealing with one set of rules. You're dealing with a patchwork that gets stricter every legislative session.
Who Gets Sued
Your SMS vendor won't indemnify you. Your agency won't indemnify you.
We've seen companies assume their vendor handles compliance. They don't. When the lawsuit lands, it lands on your desk. The brand, the software provider, and the marketing agency all get named as defendants. In Q1 2025 alone, 507 TCPA class actions were filed - a 112% increase over Q1 2024.
Even winning a TCPA class action costs six figures in legal fees before you reach a settlement. Plaintiffs' attorneys don't look for the worst offenders. They look for high-volume campaigns with provable consent gaps. That's the business model.
2026 Regulatory Updates
The rules changed. Here's what matters now.
January 2025: The Eleventh Circuit vacated the FCC's one-to-one consent rule, finding the FCC exceeded its statutory authority. Don't let outdated guides tell you otherwise - it's not in effect.
February 2024: The FCC classified AI-generated voices as "artificial or prerecorded" under TCPA. Every AI voice campaign now carries full exposure. (If you're using AI in outreach, see our guide to AI cold calling.)
April 2025: New consent revocation rules took effect. Cross-channel revocation requirements are delayed to April 11, 2026.
TRACED Act: Civil penalties up to $10,000 per call for certain robocall violations, separate from the private right of action.
Let's be honest: the one-to-one consent rule getting vacated doesn't actually help you much if you're running outbound at any real volume. State-level laws are filling the gap faster than the federal rules retreated. Texas and Virginia alone create more exposure than the old FCC rule would have.
Avoiding Fines in Practice
In our experience, the consent documentation gap is where most violations originate. The consequences of breaking cold calling laws go beyond statutory fines - they include class action defense costs, reputational damage, and operational disruption that can stall a sales org for months. Focus on what plaintiffs' attorneys look for and close those gaps first.
Document consent provenance. Every contact needs a timestamped, auditable trail showing when, where, and how consent was obtained. No trail, no defense.
Scrub against the DNC registry every 31 days. Missing a single cycle can expose you to civil penalties up to $50,120 per call under the TSR. You can download the registry directly from the FTC or use a third-party scrubbing service.
Verify data freshness before every campaign. Stale contact data means calls to reassigned numbers - each one a $500-$1,500 violation. Prospeo's 7-day data refresh cycle and 98% email accuracy reduce this risk at the source by ensuring you're reaching the right person at the right number. (This is the same problem as B2B contact data decay.)
Process opt-outs immediately. Delayed processing is a per-violation liability multiplier under the new revocation rules. There's no grace period that'll hold up in court.
Enforce time-zone calling hours. Florida's 8 a.m.-8 p.m. window is easy to violate if your dialer doesn't account for recipient time zones. One misconfigured campaign hitting East Coast numbers at 8:05 p.m. ET from a West Coast server is all it takes. (Use a cold call checklist so this doesn’t get missed.)
Skip the "we'll figure it out later" approach. The r/sales consensus is pretty clear: by the time you're Googling "TCPA class action defense attorney," you've already lost the cost-benefit analysis. Prevention is cheaper than any settlement.
Class actions multiply fast when your contact list has consent gaps and outdated numbers. Prospeo's 5-step verification, catch-all handling, and spam-trap removal mean you're building campaigns on data that holds up - not data that generates lawsuits. At $0.01 per email, compliance-grade data costs less than a single violation.
One verified contact costs a penny. One bad contact costs $1,500.
FAQ
What's the penalty for a single TCPA violation?
$500 per violation under federal law, or $1,500 if the court finds the violation was willful or knowing. State laws stack additional fines - Connecticut imposes up to $20,000 per violation, and Texas SB 140 enables treble damages through the DTPA.
Can you go to jail for TCPA violations?
No. TCPA violations are strictly civil, not criminal. That said, class action damages routinely reach tens of millions of dollars, and defense costs alone run six figures even if you win.
How much are cold calling fines under federal and state law?
Federal fines start at $500 per call and scale to $1,500 for willful violations. DNC violations under the TSR carry fines up to $50,120 per call. State mini-TCPA laws add further exposure - Connecticut allows up to $20,000 per violation, and Georgia recently removed its damage caps entirely.
How do you reduce TCPA risk when prospecting?
Document consent for every contact, scrub the DNC registry every 31 days, verify data freshness before campaigns, and process opt-outs immediately. Using a data provider with a weekly refresh cycle - versus the 6-week industry average - significantly reduces the chance of dialing reassigned or outdated numbers.