TCPA Compliance for Automated Calling: What You Need to Know

The Telephone Consumer Protection Act (TCPA) is the most important federal law governing automated calling in the United States. Enacted in 1991 and amended multiple times since, it sets strict rules about who you can call, when you can call them, and what technology you can use. Violations carry penalties of $500 to $1,500 per call — and with class action lawsuits regularly reaching seven or eight figures, TCPA compliance is not optional.

This guide covers the core requirements every business needs to understand before deploying automated calling systems, and how CallTone's built-in compliance tools help you stay protected.

Prior Express Consent

The foundation of TCPA compliance is consent. Before making an automated call or sending a prerecorded message to a cell phone, you need prior express consent from the recipient. For marketing calls, the bar is even higher: you need prior express written consent.

What counts as written consent? A signed form (physical or digital), a web form submission with clear disclosure language, an email opt-in, or a text message opt-in. The key requirements are:

• The consent must be clearly and conspicuously disclosed
• The recipient must agree knowingly and voluntarily
• The consent must specify the phone number being authorized for calls
• Consent cannot be required as a condition of purchase

CallTone's consent tracking system records the type of consent (verbal, written, web form), the timestamp, the IP address (for web forms), and any associated documentation. Every contact in your system shows their consent status at a glance.

Do Not Call (DNC) Requirements

The TCPA requires compliance with both the National Do Not Call Registry and your own internal DNC list.

National DNC Registry: Maintained by the FTC, this registry contains over 240 million phone numbers. You must scrub your calling lists against it before every campaign. Numbers must be checked at least every 31 days.

Internal DNC list: When any person asks to be placed on your do-not-call list, you must honor that request within a reasonable time (typically 30 days) and maintain the request indefinitely. This applies to verbal requests during calls, written requests, and opt-out keywords via SMS.

CallTone maintains your internal DNC list automatically. When a contact says "take me off your list" during a call or texts STOP, they are added to your DNC list and excluded from all future campaigns. You can also import DNC lists in bulk and manually add numbers.

Calling Hour Restrictions

Under the TCPA, automated calls to residential numbers are prohibited before 8:00 AM and after 9:00 PM in the recipient's local time zone. This means you need to know the time zone of each number you are calling.

CallTone handles this automatically. When you set up a campaign, you define your calling hours, and the system uses area code-based time zone detection to ensure every call falls within the legal window. Numbers with ambiguous time zones are treated conservatively.

Call Recording Disclosure

While the TCPA itself does not specifically require call recording disclosure, most states have their own wiretapping laws. Twelve states require two-party consent — meaning both parties must agree to be recorded:

• California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington

The safest approach is to always disclose that calls may be recorded. CallTone's agents include an automatic disclosure at the beginning of each call, and the system detects two-party consent states based on the called number's area code.

STIR/SHAKEN and Caller ID

STIR/SHAKEN is the industry framework for authenticating caller ID information to combat robocall spoofing. Since 2021, voice service providers are required to implement STIR/SHAKEN, and calls without proper attestation are increasingly blocked by carriers.

All phone numbers provisioned through CallTone include full STIR/SHAKEN verification. This means your outbound calls carry an "A" attestation level — the highest trust rating — reducing the likelihood of being flagged as spam.

Penalties and Enforcement

TCPA violations are enforced through both FCC actions and private lawsuits. The statutory damages are:

• $500 per violation (per call)
• $1,500 per willful or knowing violation

With no cap on total damages, a campaign of 10,000 calls to numbers without proper consent could result in $5 million to $15 million in liability. Class action TCPA lawsuits are among the most common types of consumer litigation in the U.S., with over 4,000 filed annually.

Best Practices Checklist

1. Obtain and document consent before adding contacts to campaigns
2. Scrub calling lists against the National DNC Registry monthly
3. Honor opt-out requests immediately and maintain your internal DNC list
4. Restrict calling hours to 8 AM - 9 PM in the recipient's time zone
5. Include a recording disclosure at the start of every call
6. Use STIR/SHAKEN-verified phone numbers for outbound calls
7. Keep records of all consent, opt-outs, and campaign details for at least 5 years
8. Train your team on TCPA requirements and audit your processes quarterly

TCPA compliance is not just about avoiding lawsuits — it is about building trust with the people you call. Businesses that respect consent and calling preferences see higher answer rates, better sentiment, and stronger customer relationships.