Compliance
TCPA (Telephone Consumer Protection Act)
The Telephone Consumer Protection Act (TCPA) is a US federal law that restricts how businesses can call, text, or auto-dial consumers — requiring prior express consent for most outbound contact.
The Telephone Consumer Protection Act (TCPA) is a US federal law that restricts how businesses can call, text, or auto-dial consumers — requiring prior express consent for most outbound contact.
The Telephone Consumer Protection Act (TCPA) is a US federal law passed in 1991 that regulates telemarketing calls, autodialed calls, prerecorded messages, and unsolicited text messages to consumers. It is enforced by the Federal Communications Commission (FCC) and gives consumers a private right of action — meaning they can sue businesses directly for violations.
For contact centers and BPOs serving US customers, TCPA is the single most expensive compliance regime to violate. Statutory damages range from $500 per violation to $1,500 per willful violation, and class-action lawsuits regularly result in settlements in the tens or hundreds of millions of dollars.
The TCPA imposes strict requirements on outbound communications:
The most common ways contact centers run afoul of TCPA:
Each of these is a violation per call, per consumer. A single non-compliant campaign that contacts 10,000 numbers can generate $5M-$15M in statutory exposure.
| Violation Type | Penalty per call | |---|---| | Negligent violation | $500 | | Willful or knowing violation | Up to $1,500 | | FCC enforcement action | Up to $50,752 per violation (as of 2024) | | Class-action settlements | Often $5M-$100M+ |
Notable settlements: Capital One paid $75.5M in 2014, Bank of America paid $32M in 2013, Caribbean Cruise Line paid $76M in 2020.
Manual QA samples 2-5% of calls — meaning 95% of TCPA violations go undetected until a consumer complains or sues. AI-powered QA scores 100% of calls automatically and can flag every TCPA risk in real time:
Gistly automatically flags every call where a TCPA-relevant pattern occurs, with timestamped audio segments for compliance review. BPOs that move from sampling to 100% AI auditing typically reduce TCPA exposure by 90%+ within 60 days.
| Dimension | TCPA (US) | DPDP (India) | GDPR (EU) | |---|---|---|---| | Year enacted | 1991 | 2023 | 2018 | | Scope | Calls, texts, autodialers | All personal data | All personal data | | Consent requirement | Prior express written | Free, specific, informed | Freely given, specific | | Penalty per violation | $500 - $1,500 | Up to ₹250 crore | Up to 4% of global revenue | | Private right of action | Yes | Yes | Yes |
A US contact center serving Indian customers is subject to both TCPA and DPDP simultaneously. Multinational BPOs often build their compliance program around the strictest regime they touch.
Manually dialed calls without prerecorded messages have less restrictive rules — but they still must comply with DNC registry, calling hours, identification, and opt-out requirements. The autodialer + prerecorded message restrictions are the most stringent.
A consumer's signature (electronic or physical) on a written agreement that clearly authorizes the caller to deliver advertisements or telemarketing using an autodialer or prerecorded voice to the specific phone number provided. Unclear or pre-checked consent boxes do NOT meet the standard.
Yes. Courts have ruled that consumers can revoke consent through any reasonable means, including verbally during a call. Contact centers must capture and honor these revocations immediately.
TCPA's autodialer + prerecorded message rules apply to all calls to mobile phones, including business numbers if the business is a person (e.g., a sole proprietor's cell phone). Pure office landlines have weaker restrictions but still must comply with DNC for telemarketing.
Last updated: May 2026
Every term we use across QA, compliance, and contact center operations — defined in one place.
View all glossary terms →