How TCPA Lawsuits Get Built (and Where the Risk Really Lives)

Why TCPA Cases Are a Cottage Industry

If you generate, buy, or sell leads that end up in a phone call or a text message, the Telephone Consumer Protection Act (TCPA) is the law most likely to turn a routine marketing slip-up into a lawsuit. I'm an operator, not a lawyer, and what follows is how these cases tend to get built from the outside looking in — so you can spot the exposure before a demand letter shows you the hard way.

The engine that makes TCPA litigation attractive is written right into the statute: a private right of action. A consumer doesn't need a regulator to act. They can sue on their own under 47 U.S.C. § 227(b)(3), and the damages are fixed by statute rather than tied to any actual harm.

Think about what that means at volume. A consumer doesn't have to prove they lost a dime. Each individual call or text carries its own price tag. A campaign that dials or texts the same person a dozen times has stacked a dozen violations before anyone argues about consent.

How a Case Comes Together

Most TCPA suits I've seen follow a recognizable arc. A plaintiff (sometimes a serial one, sometimes a genuinely annoyed consumer) documents the calls or texts — screenshots, call logs, carrier records. Their counsel then works backward through the chain: who placed the call, what platform sent it, who supplied the number, and whether there's any record of consent.

That backward trace is exactly why lead-gen sits in the blast radius. The brand that made the call will point to the lead seller. The lead seller points to the publisher. Everyone in the chain becomes a potential defendant, and the party with the weakest paperwork tends to absorb the most risk.

The Three Theories You'll See Most

TCPA complaints in the lead-gen world usually rest on one of three theories:

• No consent. The plaintiff says they never agreed to be contacted at all. If you can't produce a record showing they did, you're defending a negative.
• Revoked consent. They consented once, then asked you to stop — by reply, by phone, by any reasonable means — and contact continued anyway. Honoring opt-outs promptly and across every system matters here.
• Do-not-call (DNC) violations. Separate from the autodialer rules, the statute provides its own private right of action under 47 U.S.C. § 227(c)(5) for people on the National Do-Not-Call Registry, with a parallel $500 / up to $1,500 damages structure and an affirmative defense for companies that maintain reasonable do-not-call practices and procedures.

Notice that two of the three theories are won or lost on documentation, not intent. Good faith doesn't help much if you can't show the paper.

The One-to-One Consent Rule: What Actually Happened

This is the current-events piece every operator should get right, because there's a lot of confusion about it.

In December 2023, the FCC issued an order interpreting "prior express consent" to require one-to-one consent — consent given to a single identified seller at a time, for calls logically and topically related to the interaction that prompted it. The aim was to close the so-called "lead generator loophole," where one checkbox could authorize contact from dozens or hundreds of partners. The rule was scheduled to take effect January 27, 2025.

It never took effect. In Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277, the U.S. Court of Appeals for the Eleventh Circuit issued its decision on January 24, 2025 — days before the effective date — and vacated the one-to-one consent restriction. The court held that the FCC had exceeded its authority: "prior express consent" carries its ordinary common-law meaning, and the agency couldn't bolt on the one-to-one and "logically and topically related" requirements.

Where the Risk Concentrates for Operators

So if the strictest rule is off the table, why stay disciplined? Because the lawsuit machinery I described above runs on the rules that are still standing — and on your records.

• Documentation is the whole game. When a plaintiff says "I never consented," your defense is the consent record: the form, the timestamp, the IP, the exact language shown, the page URL. If you can't reproduce it, you can't rebut it.
• State law didn't get vacated. A number of states run their own "mini-TCPA" statutes, some with their own consent and one-to-one-style requirements. A federal vacatur says nothing about Florida, Oklahoma, or any other state regime.
• The chain is only as strong as its weakest record. Buyers should demand and retain proof of consent from sellers; sellers should generate consent records they'd be comfortable handing to a court.