🇺🇸Telephone Consumer Protection Act

Skin

← Back to laws in United States

Telephone Consumer Protection Act

TCPA regulates certain calls, texts, prerecorded messages and fax advertising

The Telephone Consumer Protection Act is a United States communications law that restricts certain uses of telephone equipment and marketing communications. It is particularly important for businesses that use autodialed calls, prerecorded or artificial voice messages, SMS campaigns, lead generation, call centres, customer reminders, debt collection calls, appointment reminders or fax advertising.

For privacy teams, TCPA compliance is about consent, contact-channel governance and suppression. It is not enough to have a customer’s phone number. The organisation must know how the number was collected, what consent was obtained, what technology will be used, what type of message will be sent and whether the recipient has revoked consent or is on a do-not-call list.

Core restrictions

The TCPA restricts certain calls made using an automatic telephone dialing system or an artificial or prerecorded voice, including calls to emergency lines, hospital patient rooms and certain mobile or charged services without required consent. It also regulates prerecorded voice calls to residential lines and unsolicited fax advertisements, subject to statutory exceptions and implementing rules.

Text messages can also create TCPA risk where they are treated as calls for relevant purposes. Businesses using SMS marketing should therefore maintain consent records and opt-out handling with the same seriousness as call compliance.

Key Provisions

Autodialed and prerecorded calls: certain calls using regulated technology require prior consent unless an exception applies.

Mobile numbers: calls or texts to mobile or other charged services can carry heightened risk.

Residential calls: artificial or prerecorded voice calls to residential lines are restricted subject to exceptions.

Telephone solicitation: telemarketing calls are subject to consent, relationship and do-not-call requirements.

Fax advertising: unsolicited fax advertisements are specifically regulated.

Consent records are the backbone of TCPA compliance

TCPA compliance depends heavily on being able to prove consent. The business should maintain records showing the phone number, consent language, date, time, source, IP address or form record where applicable, purpose of consent and any later withdrawal.

Lead-generation arrangements need special care. A purchased lead or affiliate-generated contact may not provide valid consent for the buyer’s specific campaign. Consent should be traceable to the actual seller, caller, campaign type and communication channel.

Revocation and suppression

Consumers must be able to stop unwanted communications. A business should maintain suppression lists for calls and texts and ensure that opt-outs are honoured across sales, marketing, support, collections and vendor campaigns. Where a consumer revokes consent, the revocation should be recorded and pushed into the systems that trigger communications.

Internal teams should also distinguish between transactional, informational and marketing messages. A reminder, security alert, delivery update or account notice may be treated differently from a promotional message, but the technology used and the recipient’s number type still matter.

Practical risk area

The highest risk often sits with outsourced call centres, lead sellers and marketing automation tools. If vendors call or text on your behalf, your contract and audit process should cover consent evidence, scripts, calling technology, opt-outs and complaint handling.

Operational controls for call and SMS programmes

A TCPA-ready programme should include consent capture, consent language review, number-type screening where appropriate, do-not-call checks, campaign classification, script approval, opt-out processing, vendor controls, complaint review and record retention. The compliance system should be connected to CRM and dialler tools, not maintained only in policy documents.

Businesses should also monitor changes in calling technology and regulatory interpretation. The legal assessment may change depending on how numbers are stored, generated, selected and dialled.

What this means for you

If you call or text US consumers, treat phone numbers as regulated communication permissions. Build consent evidence, suppress opt-outs quickly, govern vendors, review dialling technology and separate marketing from transactional communications before campaigns go live.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis