Compliance & Legal

The Telephone Consumer Protection Act of 1991 has become what leading TCPA defense attorney Eric Troutman calls "the biggest cash cow in history" for the plaintiff's bar. The numbers are staggering: In Q1 2025 alone, 507 class action lawsuits were filed-a 112% increase over Q1 2024. By September 2025, class actions were up 97% year-over-year. Nearly 80% of all TCPA lawsuits are filed as class actions, compared to just 2-5% under other consumer protection statutes.

The statute carries statutory damages of $500-$1,500 per violation with no cap on aggregate damages. A company making 10,000 non-compliant calls faces potential exposure of $5 million to $15 million-before attorney's fees. The four-year statute of limitations means violations from years ago can still generate liability today.

Average TCPA class action settlements exceed $6.6 million. Recent major settlements include National Grid at $38.5 million, Citibank at $29.5 million, and Realogy at $20 million. Defense costs typically run $40,000-$50,000 for cases that proceed through discovery.

Analysis of 2024 filings found that 31-41% of cases were filed by serial litigators-individuals who have turned TCPA claims into a business model. Florida (330 cases), California (274 cases), and Texas (170 cases) accounted for 58% of all TCPA filings despite representing only 27.6% of the U.S. population.

The operators who survive in this environment treat TCPA compliance not as a legal checkbox but as core business infrastructure.

Prior Express Written Consent is the gold standard for TCPA compliance in telemarketing. The FCC defines PEWC with six specific elements that must all be present:

1. An Agreement in Writing. Electronic signatures satisfying the E-SIGN Act qualify, but the intersection of TCPA and E-SIGN creates compliance complexity. Courts have increasingly held that obtaining electronic TCPA consent triggers E-SIGN's consumer disclosure requirements.

2. Consumer Signature. The agreement must bear the signature of the individual to whom calls will be placed. Checkbox clicks, typed names, and digital signatures are accepted if they satisfy E-SIGN requirements.

3. Clear Authorization. The agreement must clearly authorize the seller to deliver marketing messages using automatic telephone dialing systems or artificial/prerecorded voice.

4. Identified Telephone Number. The agreement must identify the specific phone number for which consent is granted.

5. Not a Condition of Purchase. Critically, consent cannot be required as a condition of purchasing goods or services.

6. Clear and Conspicuous Disclosure. The consent language must be "apparent to a reasonable consumer"-not buried in fine print or accessible only through hyperlinks.

Essential Documentation for Each Lead: Consent timestamp in tamper-proof format, IP address from which consent was submitted, exact disclosure language displayed to the consumer, evidence of the consumer's affirmative action (checkbox, signature), phone number for which consent was granted, form URL and configuration, and TrustedForm certificate or Jornaya LeadiD (industry best practice).

Retain documentation for at least five years-the Telemarketing Sales Rule extended the retention period from two years in March 2024.

The one-to-one consent rule represents one of the most significant regulatory developments in lead generation history-even though it never actually took effect.

The Timeline: In December 2023, the FCC adopted rules requiring that consent be obtained "one seller at a time." The rule would have required consumers to provide separate consent to each seller rather than blanket consent covering multiple parties. Multi-seller consent lists-common on comparison shopping sites-would have become invalid.

On January 24, 2025, two things happened within hours: First, the FCC postponed the effective date by one year. Then, the Eleventh Circuit vacated the rule entirely in Insurance Marketing Coalition v. FCC, holding that the FCC exceeded its statutory authority. The rule has been formally deleted from the Code of Federal Regulations.

The Current Reality: Despite the vacatur, many industry participants continue one-to-one consent practices. Here's why:

Litigation risk management. One-to-one consent provides stronger litigation defense. When you can demonstrate that the consumer specifically identified your company and consented to receive your calls-documented through a certificate showing your name in the disclosure-consent is harder to challenge.

Buyer preference. Sophisticated lead buyers increasingly demand one-to-one consent as a purchase condition. They recognize that litigation risk transfers with the lead.

CMS Medicare requirements. For Medicare leads, CMS implemented one-to-one consent requirements for Contract Year 2025-creating a parallel regulatory framework regardless of the FCC rule's vacatur.

State-level activity. Florida, Oklahoma, and other states have effectively required similar specificity through their interpretation of "prior express written consent."

Building one-to-one infrastructure now positions you for where the industry is heading.

Federal TCPA compliance is necessary but no longer sufficient. As of late 2025, at least fifteen states have enacted their own "mini-TCPA" telemarketing laws, often with broader definitions, stricter time restrictions, and enhanced private rights of action.

Calling Hours: Federal TCPA permits 8 AM-9 PM local time. Florida and Oklahoma restrict to 8 AM-8 PM local time. Connecticut requires 9 AM-8 PM local time (most restrictive). Texas allows 9 AM-9 PM Mon-Sat; 12 PM-9 PM Sunday.

Call Frequency Limits: Florida and Oklahoma limit maximum 3 calls per 24 hours on the same subject matter.

Autodialer Definitions: Many states retain broader definitions than the post-Facebook v. Duguid federal standard. Maryland and Georgia use "selection or dialing" language that captures more equipment.

Private Rights of Action: Florida, Oklahoma, Texas (via DTPA), Georgia, and Washington all allow private lawsuits-not just regulatory enforcement.

Texas SB 140 (September 2025): Expanded scope to include text messages, requires $10,000 security bond and state registration, integrates with Texas Deceptive Trade Practices Act for treble damages, and eliminates pre-filing requirements for private suits.

Eleven states maintain separate DNC lists beyond the National Registry: Colorado, Connecticut, Indiana, Louisiana, Massachusetts, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas, and Wyoming.

The "apply strictest standard" approach simplifies compliance: calling window becomes 9 AM to 8 PM everywhere, call frequency caps at 3 per 24 hours. The compliance overhead of tracking state-by-state variations often exceeds the revenue impact of conservative calling windows.

General compliance frameworks apply across the industry, but verticals carry additional regulatory burdens that can make or break your operation.

Insurance: State licensing requirements determine whether your activity constitutes "solicitation" requiring a producer license. California requires anyone who "aids" in solicitation to hold a license. Verify producer licenses for all buyers in every state where leads originate using NIPR or state-specific systems.

Medicare: CMS Medicare marketing rules are the most restrictive in insurance. Contract Year 2025 requires one-to-one consent naming specific entities, mandatory call recording of all beneficiary calls, CMS approval of marketing materials, and TPMO (Third-Party Marketing Organization) agreements throughout the distribution chain. Violations trigger civil monetary penalties up to $100,000 per violation plus potential marketing suspension.

Mortgage: RESPA prohibits kickbacks and unearned fees-structure pricing as flat per-lead fees for marketing services, not performance bonuses tied to loan closings. TILA advertising regulations require specific disclosures when mentioning interest rates, loan amounts, or payment terms. NMLS licensing verification is required for all buyers.

Healthcare: HIPAA applies when Protected Health Information is involved. If you're a business associate, you need Business Associate Agreements with covered entities, and your entire technology stack must be HIPAA-compliant. Penalties range from $141 per violation (unknowing) to $2.1 million per year for willful neglect.

Legal: State bar ethics rules vary dramatically. California is relatively permissive but disclosure-heavy. Texas requires pre-approval and strict testimonial standards. Florida aggressively enforces the 30-day rule prohibiting solicitation to accident victims.

Regulatory complexity creates genuine barriers to entry that protect established operators who invest in compliance expertise.

Medicare lead generation operates under the most restrictive federal marketing rules in the insurance industry. The Centers for Medicare & Medicaid Services has progressively tightened controls driven by documented patterns of misleading tactics directed at elderly beneficiaries.

Third-Party Marketing Organizations (TPMOs): If you're generating Medicare leads, you're likely a TPMO with specific compliance obligations.

Contract Year 2025 Requirements:

One-to-One Consent: Before sharing beneficiary information with another TPMO, you must obtain prior express written consent that specifically names each entity receiving the data. This isn't general consent-the beneficiary must consent to each specific TPMO in the chain.

All Calls Must Be Recorded: All sales, marketing, and enrollment calls with beneficiaries must be recorded in their entirety, including both inbound and outbound calls. This requirement applies to manual dialing-previously exempt from many consent requirements.

CMS Marketing Material Approval: Consumer-facing websites promoting specific carriers' Medicare products must be submitted for CMS review. Social media content, event materials, and any communication influencing enrollment decisions all require approval.

Prohibited Practices: Cannot use words like "free," "limited time," or phrases creating false urgency. Cannot imply CMS approval or government endorsement. Cannot hold marketing events within 12 hours of educational events at the same location. Cannot make unsolicited calls about Medicare plans. Cannot use calls about other products to generate Medicare leads.

Penalties: CMS can impose civil monetary penalties reaching $100,000 or more per violation. Intermediate sanctions include suspension of marketing activities, enrollment processing, or payments. Contract termination ends a plan sponsor's ability to offer Medicare plans entirely.

The regulatory trend points toward increased scrutiny. Operators who build compliance into their business models gain competitive advantage as marginal players exit under regulatory pressure.

The Real Estate Settlement Procedures Act prohibits kickbacks and unearned fees in connection with real estate settlement services. This prohibition has direct implications for how mortgage lead generators structure their pricing.

Section 8 of RESPA prohibits giving or receiving anything of value for the referral of settlement service business. A straightforward reading suggests paying for mortgage leads might violate RESPA. However, regulatory guidance distinguishes between prohibited referral fees and permissible payments for actual services rendered.

Compliant Pricing Structures:

Flat-Fee Marketing Services: You charge lenders $35 per lead regardless of whether leads convert to closed loans. Payment is for marketing services actually rendered-traffic generation, form capture, data delivery. The fee is reasonably related to your actual cost of generating the lead. This is generally RESPA-compliant.

Subscription Pricing: $5,000/month for access to approximately 150 leads. Fixed pricing for access to lead flow, not tied to loan outcomes.

Non-Compliant Red Flags:

Performance-Based Bonuses: $35 per lead plus $200 bonus for each lead that closes. The $200 payment is tied to successful referral outcomes, not services you performed. The CFPB has explicitly targeted "pay-for-performance" arrangements.

Exclusive Lead Agreements: A lender pays premium pricing for exclusive access to all leads meeting certain criteria. The economic substance-lender paying for exclusive access to borrowers-may constitute a prohibited kickback despite the contractual form.

CFPB Enforcement Patterns: Marketing services companies receiving per-lead fees of $500+ when actual generation cost was under $100 faced RESPA enforcement. Operators receiving both upfront per-lead fees and backend success bonuses were deemed to be receiving prohibited compensation. Exclusive referral relationships in exchange for premium pricing triggered scrutiny.

Best Practice: Document the reasonable market value of your marketing services through cost accounting. Treat all buyers equally in pricing-avoid special arrangements that could be characterized as kickbacks.

When the call comes, you need to already know what to do. Your response in the first three days sets the trajectory for everything that follows.

Hours 0-4: Immediate Actions

Stop the bleeding: Pause all calling and texting campaigns related to the alleged violation. Do not delete anything: This is critical-spoliation of evidence can result in adverse jury instructions. Contact specialized counsel: Not your general business attorney-TCPA defense counsel specifically. Notify your insurance carrier: Many policies have notification requirements measured in days. Begin documentation: Record everything you learn about the issue.

Hours 4-24: Assessment and Containment

Issue a written litigation hold to all relevant personnel and third-party vendors-this is legally mandatory once you have reasonable anticipation of litigation. Identify exposure scope: How many consumers may have been affected? Over what time period? Pull consent records for the named plaintiff: TrustedForm certificates, call logs, lead source documentation. Check litigator databases: Is the plaintiff a known serial litigator? 31-41% of TCPA cases are filed by repeat plaintiffs.

Hours 24-72: Strategic Planning

Work with counsel to assess the strength of your consent documentation. Evaluate indemnification rights against lead vendors who may have contributed. Determine whether early individual settlement makes sense or vigorous defense is warranted. If a class action, begin preparing opposition to class certification.

For Demand Letters Specifically:

If you have strong consent documentation (TrustedForm certificate showing clear consent language with timestamp): Respond professionally but firmly. Share evidence with plaintiff's counsel-many will withdraw rather than pursue a case they'll lose.

If consent documentation is weak or incomplete: Early settlement often makes economic sense. Individual settlements typically range from $2,500 to $15,000-dramatically cheaper than defense costs of $40,000-$50,000 or class exposure averaging $6.6 million.

Never ignore a demand letter. Failing to respond typically leads to an actual lawsuit filing, which escalates costs dramatically even if you ultimately prevail.

Here's the uncomfortable truth: standard business insurance policies often don't cover TCPA violations.

Coverage Gaps in Standard Policies:

General Commercial Liability: Typically excludes coverage because TCPA violations are regulatory penalties, not traditional tort damages.

Errors and Omissions: May or may not cover TCPA claims depending on specific policy language. Review your policy carefully-don't assume coverage exists.

Directors and Officers: Often contain "invasion of privacy" exclusions that courts have applied to deny TCPA coverage.

Specialized TCPA Insurance:

Specialized TCPA insurance has become more available and affordable in recent years. If your business engages in any outbound calling or texting, work with a broker who understands telemarketing compliance to secure coverage that explicitly includes TCPA defense costs and statutory damages.

Critical Policy Elements to Verify: Does the policy cover defense costs? (Many do). Does the policy cover statutory damages? (Some exclude these). Are there sublimits that may prove inadequate for class action exposure? Does the policy cover settlement payments? What are the notice requirements for claims?

Vendor Indemnification:

Your contracts with lead vendors should include robust indemnification provisions covering TCPA compliance. In Moore v. Torchlight Technology Group, an Illinois federal court granted summary judgment requiring a lead generator to indemnify its client after the lead generator failed to obtain proper consent.

However, indemnification clauses are only as valuable as the company providing them. If your lead vendor disappears or lacks assets, that indemnification right becomes worthless.

Best Practices: Require vendors to carry TCPA-specific insurance and provide certificates of coverage. Include provisions requiring vendors to maintain consent records and produce them upon request. When a claim arises, immediately notify vendors in writing of your intent to seek indemnification. Don't assume you're covered-request a coverage opinion from your broker specifically addressing TCPA scenarios before you need it.