TCPA Compliance in 2026: What the Law Requires, and What Is Only Proposed

The Telephone Consumer Protection Act is the most expensive statute in lead generation. Not because the government fines are the largest — they usually aren't — but because the law hands private plaintiffs a per-call meter and a four-year window in which to run it.

2026 is a bad year to work from memory. A requirement that most compliance decks still describe as current has been pushed to 2027. The FCC has formally proposed deleting several rules that vendors are still selling you tools to satisfy. And a petition that would let consent buy you the right to call at 10pm is sitting unresolved, which means the answer is still no.

This page separates the three categories that actually matter to an operator: what binds you today, what has been delayed, and what is only a proposal.

What is the TCPA?

The Telephone Consumer Protection Act is a 1991 federal statute, codified at 47 U.S.C. § 227. Congress passed it in response to a specific complaint that will sound familiar: automated dialing equipment had made it trivially cheap to call enormous numbers of people who had not asked to be called, and the cost of that behavior landed on the recipient rather than the sender.

The FCC writes the implementing rules, and those live at 47 CFR § 64.1200. When practitioners argue about "the TCPA," they are almost always arguing about the FCC's regulations rather than the statute itself, because the statute is short and the regulations are where the operational detail sits.

One framing is worth getting right early, because it prevents a whole category of confusion. The TCPA is not a general marketing-permission law. It regulates a channel: calls and texts placed to telephone numbers. What you say matters mostly because it determines which tier of consent you need. How you reached the handset is what puts you inside the statute in the first place.

What does the TCPA actually prohibit?

Stripped to its operating parts, the law and its rules restrict:

• Autodialed or prerecorded calls and texts to mobile numbers without the applicable level of consent.
• Artificial or prerecorded voice calls to residential lines without consent or an applicable exemption.
• Telemarketing to numbers on the National Do Not Call Registry, absent consent or an established business relationship.
• Telemarketing to anyone who has asked you specifically to stop — the internal do-not-call obligation, which is separate from the national registry and is the one operators most often under-build.
• Calls outside permitted hours, covered below.
• Failing to identify yourself in a prerecorded message, and failing to offer an automated opt-out mechanism.

The consent that sits underneath most of this is a document, not a feeling. What it must contain, and the four elements that make it hold up, are covered in prior express written consent, explained.

Does the TCPA apply to text messages?

Yes. This has been settled for a long time and is not a live controversy: a text message sent to a wireless number is treated as a "call" under the statute, and the same consent tiers apply.

The practical consequence is the part people miss. A texting program is not a lighter-weight version of a calling program from a compliance standpoint. If anything it is heavier, because texts are cheap enough to send at volumes that produce class-action-sized numbers quickly, and because every message is self-documenting evidence with a timestamp attached.

Does the TCPA apply to email?

No. The TCPA governs calls and text messages placed to telephone numbers. Commercial email is governed by a different statute, the CAN-SPAM Act, which has its own and considerably lighter requirements — notably no private right of action for ordinary recipients.

This is worth stating plainly because the asymmetry drives real strategy. When a channel decision is close, email carries materially less litigation exposure than SMS. That is not a reason to email people who do not want to hear from you, but it is a reason to be honest that the two channels do not sit at the same risk level.

What are the legal calling hours?

Telephone solicitations may not be made before 8:00 a.m. or after 9:00 p.m. in the local time of the person being called. The FCC's version is at 47 CFR § 64.1200(c)(1); the FTC's parallel rule, which reaches most telemarketers through the Telemarketing Sales Rule, is at 16 CFR § 310.4(c) and sets the same window.

The trap is the phrase local time at the called party's location. It is their clock, not yours. A dialer running a nationwide list out of an Eastern-time office is calling Pacific-time consumers at 5:00 a.m. when it opens at 8:00 a.m., and that is a violation on every one of those records. Time-zone logic keyed to area code is imperfect — numbers travel with people — but dialing off your own wall clock is not defensible at all.

Two refinements matter:

Mobile numbers. The rule text speaks of residential subscribers, and § 64.1200(e) extends the subsection (c) protections to wireless numbers in the manner described in the Commission's orders, under which a cell phone listed on the Do Not Call Registry is treated as presumptively residential. That presumption is currently being tested in litigation. The operationally sound response is not to follow the case law hoping for a favorable answer — it is to apply the calling window to every number you dial, which costs you almost nothing and removes the question entirely.

States are stricter. Several state mini-TCPAs impose narrower windows than the federal 8-to-9, and some carry their own private rights of action. The federal window is a floor, not a safe harbor. See state mini-TCPAs, explained.

If you run a dialer, what is the abandoned-call limit?

Three percent — but the details are where compliance programs fail an audit.

Under the FTC's safe harbor at 16 CFR § 310.4(b)(4), a telemarketer must abandon no more than three percent of all calls answered by a person, measured over the duration of a single calling campaign if that campaign runs less than 30 days, or separately over each successive 30-day period. It is not a daily figure, and it is not measured against calls placed — the denominator is calls a human actually answered.

A call counts as abandoned when a person picks up and no live representative is connected within two seconds of that person's greeting. Separately, an unanswered call may not be disconnected before at least 15 seconds or four rings have elapsed. When no representative is available, a prerecorded identification message must play, and it must carry an automated opt-out mechanism.

Now the part almost nobody states correctly. In FCC 25-76, released October 29, 2025, the Commission sought comment on eliminating its own versions of both rules — the 3% cap and the 15-second/four-ring requirement at 47 CFR §§ 64.1200(a)(6) and (a)(7). The reasoning is that predictive dialers have changed since 2003 and that marketers now have their own incentives to avoid dead air.

That is not permission to stop measuring, for a reason the FCC itself points out in the same document: the FTC's Telemarketing Sales Rule contains comparable provisions, and the FTC's rule is independent. If the FCC deletes its abandonment rules and the FTC does not, a telemarketer within FTC jurisdiction is in exactly the same position as before.

Who enforces the TCPA, and what does a violation cost?

Four enforcers, and they are not equally dangerous to you:

• The FCC issues forfeitures and citations, primarily against egregious and high-volume actors.
• The FTC enforces the Telemarketing Sales Rule, which overlaps heavily but reaches through a different jurisdictional door.
• State attorneys general bring actions under both federal and state authority.
• Private plaintiffs — and this is the one that determines your actual exposure.

The TCPA's private right of action provides statutory damages of $500 per violation, which a court may treble to $1,500 for willful or knowing violations. No proof of actual harm is required, which is precisely what makes the statute class-action fuel: damages are arithmetic, and the arithmetic is done on your own call records.

The full math, including how "per violation" compounds and how the four-year clock works, is in TCPA statutory damages, explained. How a case is actually assembled against an operator is in how TCPA lawsuits get built.

What is changing in 2026, and what is only proposed?

This is the section to read twice, because the gap between these categories is where operators make expensive planning errors in both directions.

In force today:

• The consent-revocation framework has been effective since April 11, 2025: revocation by any reasonable means, certain per-se methods, no exclusive-channel requirement, and a deadline of a reasonable time not to exceed 10 business days. See how to revoke TCPA consent.
• An AI-generated voice is an artificial voice under the TCPA. The FCC said so in a declaratory ruling adopted February 8, 2024 (FCC 24-17). Voice cloning in an outbound program does not sit in a regulatory gap.

Delayed:

• The cross-topic piece of § 64.1200(a)(10) — the "revoke-all" requirement, under which a revocation sent in response to one type of message applies to all future robocalls and robotexts from that caller on unrelated matters — has been pushed to January 31, 2027 by Order DA 26-12, adopted January 6, 2026. The waiver is narrow. It suspends only the cross-topic application; the rest of the revocation framework above is live and enforceable right now.

Proposed only, and therefore not law:

FCC 25-76 was adopted October 28, 2025 and released October 29, 2025, and includes a Further Notice of Proposed Rulemaking in CG Docket No. 02-278. In it the Commission seeks comment on:

• Eliminating the call-abandonment and ring-duration rules discussed above.
• Amending § 64.1200(a)(10), including a proposal to permit callers to designate the exclusive means by which consumers may revoke consent, replacing the current reasonable-means standard.
• Streamlining the identification requirements for artificial and prerecorded voice calls.
• Eliminating the rule limiting fraud-alert calls by financial institutions to the number the consumer provided.

Where operators actually get caught

Across the enforcement and litigation patterns, the failures cluster in a small number of places, and almost none of them are exotic:

• Assuming consent transferred with the lead. It generally does not. This is the single most common structural failure in a buying operation — see the buying-leads compliance checklist and how to vet a lead vendor.
• Holding consent you cannot reproduce. You carry the burden of proof, which makes an unretrievable record functionally equivalent to no consent. See proof of consent and how long to keep consent records.
• Honoring revocation in one channel only. A reply of STOP to a text that does not stop the calls is a live claim.
• Running a suppression list with no policy behind it. The internal do-not-call rules require a written policy, training, and retention — not just a list. See internal DNC policy requirements.
• Treating the federal rules as the ceiling. The state layer is stricter and increasingly where the filings originate.

If you want to know which of these you are currently exposed to, the self-audit scorecard walks the same ground in about five minutes and returns a scored list of what to fix first.