The Telephone Consumer Protection Act (TCPA)

The Telephone Consumer Protection Act was enacted 20 December 1991 as Pub. L. 102-243 and codified at 47 U.S.C. § 227. Its implementing regulation is 47 CFR § 64.1200. It is the statute most of US robocall law is written under, and it is a different kind of instrument from the caller-authentication rules this library spends most of its time on. The TCPA governs whether a caller was allowed to place a call. STIR/SHAKEN governs whether the identity asserted in the signaling is real. Neither answers the other’s question.

What the statute prohibits

The prohibitions are split by line type, and the split matters.

§ 227(b)(1)(A) makes it unlawful to call using an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice, absent an emergency purpose or prior express consent, to emergency lines, hospital patient rooms, or “any telephone number assigned to a paging service, cellular telephone service, specialized mobile radio service, or other radio common carrier service, or any service for which the called party is charged for the call.” This is the wireless prong.

§ 227(b)(1)(B) makes it unlawful to call a residential line using an artificial or prerecorded voice without prior express consent, subject to FCC exemptions. Note the asymmetry: the residential prong reaches prerecorded and artificial voice only. The ATDS prohibition attaches to wireless and charged-party lines, not to residential landlines.

§ 227(b)(1)(C) covers unsolicited fax advertisements, subject to the established-business-relationship exception added by the Junk Fax Prevention Act of 2005 and the opt-out notice requirements in § 227(b)(2)(D)–(E). § 227(b)(1)(D) prohibits using an ATDS in a way that ties up two or more lines of a multi-line business simultaneously.

§ 227(c) is the do-not-call authority. It directed the FCC to protect residential subscribers’ privacy from telephone solicitations and authorized the single national DNC database. The rules built on it live at § 64.1200(c) and (d): no solicitations to residential subscribers before 8 a.m. or after 9 p.m. local time at the called party’s location, a registry scrub no more than 31 days old, and a company-specific internal DNC list with a written policy, personnel training, and honoured opt-out requests.

§ 227(d) sets technical and procedural standards — prerecorded messages must identify the calling entity at the start and give a number or address; fax headers must carry date, time, sender identity and sending number. § 64.1200(b) adds an automated interactive opt-out mechanism for prerecorded calls.

§ 227(e) is the Truth in Caller ID Act, folded into the same statutory section in 2010. It prohibits knowingly transmitting misleading or inaccurate caller ID “with the intent to defraud, cause harm, or wrongfully obtain anything of value.” It is intent-based, enforced by FCC forfeiture, and carries no private right of action — worth flagging, because readers reasonably assume everything in § 227 is privately actionable and it is not.

§ 227(f) preserves more restrictive state intrastate rules; § 227(g) gives state attorneys general enforcement authority in exclusive federal jurisdiction.

The ATDS definition

§ 227(a)(1) defines an automatic telephone dialing system as equipment with the capacity “(A) to store or produce telephone numbers to be called, using a random or sequential number generator; and (B) to dial such numbers.” The placement of that modifier is the whole fight, and the Supreme Court resolved it in 2021. See below.

Consent

Two tiers, and which one applies turns on whether the call is marketing.

Prior express consent is the statutory baseline for non-marketing autodialed or prerecorded calls.

Prior express written consent is an FCC-created heightened standard that applies when the call includes or introduces an advertisement, or constitutes telemarketing. Under § 64.1200(a)(2) it is required for ATDS or artificial/prerecorded marketing calls to wireless and other (a)(1) lines, with carve-outs for tax-exempt nonprofits and HIPAA health-care messages. Under § 64.1200(a)(3) it is required for artificial/prerecorded telemarketing calls to residential lines; non-telemarketing prerecorded residential calls are exempt within numerical caps, generally no more than three calls per consecutive 30-day period.

§ 64.1200(f)(9) defines written consent as an agreement in writing bearing the signature of the person called, clearly authorizing the specified calls to a specified number, with a clear and conspicuous disclosure that signing authorizes such calls and that signing is not a condition of purchase. Electronic and digital signatures count where valid under applicable contract law, so E-SIGN-compliant clickwrap satisfies it.

Revocation. § 64.1200(a)(10), adopted in the February 2024 TCPA Consent Order in CG Docket 02-278, lets a called party revoke consent by any reasonable method, after which consent is definitively revoked. Most of the rule took effect 11 April 2025. The “revoke-all” component — treating revocation given in response to one message type as reaching all future robocalls and robotexts from that caller, including on unrelated matters — was waived and repeatedly deferred. Order DA 26-12, released 6 January 2026, pushed it to 31 January 2027, pending the outcome of the 2025 FNPRM.

The private right of action

This is the part that makes the TCPA behave differently from every other rule in this section of the library.

§ 227(b)(3) gives a private plaintiff an injunction and/or actual monetary loss or $500 per violation, whichever is greater. If the court finds a willful or knowing violation it may increase the award to up to three times that amount — up to $1,500 per call. Trebling is discretionary, not automatic. § 227(c)(5) provides a separate private right for DNC violations, available to someone who received more than one call within a 12-month period from the same entity, with an affirmative defence for a defendant who established and implemented reasonable practices with due care. § 227(g)(1) gives state AGs the same $500-and-trebling structure.

There is no cap on aggregate statutory damages, no actual-injury requirement, and violations accrue per call or per text, provable from call logs. A campaign of 100,000 texts is a facial exposure of $50 million to $150 million. The Duguid Court noted the concern directly: a broad ATDS reading combined with § 227(b)(3) penalties “could affect ordinary cell phone owners in the course of commonplace usage.”

Filing volumes are tracked mainly by defence-side trade press rather than by any official series, so treat published counts as directional. Those trackers reported a sharp rise through 2025 and into 2026, with monthly class-action filings running roughly 20 percent above the prior year at mid-2026.

Facebook v. Duguid (2021)

Decided 1 April 2021, No. 19-511, reversing the Ninth Circuit. Unanimous in the judgment; Sotomayor wrote for eight justices and Alito concurred in the judgment only, disputing the majority’s use of the series-qualifier canon. It is 9-0 on the result and 8-1 on the opinion.

The holding: to qualify as an ATDS, a device must have the capacity either to store a telephone number using a random or sequential number generator, or to produce a telephone number using a random or sequential number generator. The modifier attaches to both verbs. The Court reasoned from the series-qualifier canon, the comma preceding the modifier, and the statutory context — Congress was targeting equipment that could randomly hit emergency lines or tie up sequentially numbered business lines. Duguid’s reading, the Court said, “would capture virtually all modern cell phones.”

The practical effect was to remove ATDS liability from calls and texts dialled off a curated customer list, which is how nearly all real-world outreach works. The Court expressly preserved the rest: “The statute separately prohibits calls using ‘an artificial or prerecorded voice’ … Our decision does not affect that prohibition.” Plaintiff practice moved accordingly — to the prerecorded-voice prong, to § 227(c) do-not-call claims, and to state mini-TCPAs in Florida, Oklahoma, Washington and Maryland, several of which define autodialers more broadly than the federal statute now does.

McLaughlin v. McKesson (2025)

Decided 20 June 2025, No. 23-1226, 6-3, Kavanaugh writing; Kagan dissenting with Sotomayor and Jackson. The Court held that the Hobbs Act does not bind district courts in enforcement proceedings to the FCC’s interpretation of the TCPA. A district court must determine the statute’s meaning independently, giving the agency’s reading appropriate respect but not deference.

The case came out of a junk-fax class action and the FCC’s 2019 Amerifactors ruling on online fax services. For anyone reading FCC declaratory rulings as settled law, this is the more consequential of the two decisions: those rulings are now persuasive authority in private TCPA litigation, not binding.

One-to-one consent, and its vacatur

In December 2023 the FCC adopted the Second Report and Order (FCC 23-107), the “lead generator loophole” item. It amended § 64.1200(f)(9) to require that prior express written consent authorize no more than one identified seller at a time, and that the consented calls be “logically and topically associated” with the interaction that produced the consent.

The Eleventh Circuit vacated it. Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277, decided 24 January 2025, held that the FCC’s additional restrictions conflicted with the ordinary meaning of “prior express consent” in the statute. Having resolved the case on statutory-authority grounds, the court did not reach the First Amendment or arbitrary-and-capricious arguments. The rule had been scheduled to take effect 27 January 2025 and never did. The mandate issued 30 April 2025, and the FCC conformed its rules by reinstating the pre-2023 text of § 64.1200(f)(9), effective 29 August 2025.

The petition backlog

CG Docket 02-278 has accumulated petitions for reconsideration and declaratory ruling for two decades, and the Commission has been clearing them out. FCC 25-76 (29 October 2025) included notice of intent to dismiss older petitions, with objections due 12 January 2026. On 12 May 2026 the Consumer and Governmental Affairs Bureau dismissed eleven petitions for reconsideration or applications for review.

On 19 August 2026 the Bureau moved to dismiss a further batch in docket 02-278 and related dockets, on stated grounds of improving efficiency and reducing backlog, describing the petitions as filed between 2003 and 2023 and having gone without advocacy for several years. Interested parties get 45 days after Federal Register publication to object. The batch reportedly includes the 2018 U.S. Chamber of Commerce petition on the ATDS definition filed after ACA International, a 2020 American Bankers Association petition on whether COVID-19 calls were made for emergency purposes, and a 2023 petition on caller-ID transmission authority.

Sourcing note: the 19 August 2026 action is reported by Communications Daily; the FCC document number has not been confirmed against a public FCC source and is deliberately not stated here.

How this sits next to the TRACED Act and STIR/SHAKEN

The TRACED Act — the Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, Pub. L. 116-105, signed 30 December 2019 — directed the FCC to mandate caller ID authentication. The Commission did so in FCC 20-136, requiring originating and terminating providers to implement STIR/SHAKEN in the IP portions of their networks by 30 June 2021.

The two regimes reach different things, and conflating them is the common error:

• The TCPA reaches the decision to place the call. Did the caller have the required consent for this call, to this number, at this hour, given the number’s DNC status? Liability attaches to the calling party or the seller, not to the network. The enforcement engine is private litigation under § 227(b)(3) and § 227(c)(5).
• The TRACED Act and STIR/SHAKEN reach the identity asserted in the signaling. Is the calling number cryptographically attested by an authorized provider, and can the origin be traced? The obligations fall on voice service providers, and enforcement is the FCC’s: forfeitures, removal from the Robocall Mitigation Database, and mandatory downstream blocking. There is no private right of action for a STIR/SHAKEN failure.

A call can be fully A-attested and still be a $1,500-per-call TCPA violation: authenticated caller, no consent. A call can be perfectly consented and still be blocked or labelled for lacking attestation. Authentication is an input to TCPA compliance evidence and to traceback. It is not a defence.