The TCPA: The Law Behind Every A2P Rule
The Telephone Consumer Protection Act is the federal law that decides whether a call or text is legal to send. Private right of action, $500–$1,500 per message, no cap. This is the deep dive: scope, PEWC, the 2025 consent-revocation rules, quiet hours, and the dead one-to-one rule.
The TCPA (Telephone Consumer Protection Act, 1991, 47 U.S.C. 227, implemented at 47 CFR 64.1200) is the federal law that governs whether an automated call or text is legal to send. It is FCC-enforced, but its defining feature is the private right of action: any recipient can sue — individually or as a class — without a regulator’s involvement. Combined with statutory per-message damages and no aggregate cap, that is the single economic force behind US messaging compliance and the ongoing class-action wave.
This page is the regulatory deep dive. For the texting-operator’s working summary, see TCPA basics for texting.
Scope: calls and texts
Under the TCPA, a text message is treated as a “call.” The statute reaches autodialed, prerecorded, and artificial-voice calls and texts to mobile numbers. Two practical bands:
- Marketing / promotional messages require the highest consent tier — Prior Express Written Consent (PEWC) .
- Informational / transactional messages the recipient asked for (order updates, OTPs, appointment reminders) are held to a lower bar but still require some form of prior express consent.
The FCC’s February 2024 ruling that AI-generated voices are “artificial” brought voice-cloning and synthetic-voice campaigns squarely inside this scope — see /regulations/fcc/.
PEWC — the marketing consent standard
For marketing, PEWC is the highest tier. It requires a signed written agreement — electronic signatures and form check-the-box opt-ins count — that:
- clearly authorizes the specific sender to send marketing calls/texts, and
- states that consent is not a condition of purchasing any goods or services.
In practice PEWC is captured through a compliant Call-to-Action carrying all the required disclosures (brand, message type, frequency, “msg & data rates may apply”, STOP/HELP, and links to Terms and Privacy). The mechanics live on consent & opt-in.
Statutory damages — why this is expensive
Because the right of action is private, you don’t have to attract the FCC’s attention to be sued — a single recipient and a plaintiff’s firm are enough.
Consent revocation — the April 11, 2025 rules
The FCC’s consent-revocation rules took effect April 11, 2025 and substantially raised the bar on honoring opt-outs:
- Any reasonable means. Consumers may revoke consent by any reasonable means — you cannot require an exact keyword or a specific channel. Per-se reasonable words include STOP, QUIT, END, REVOKE, OPT-OUT, CANCEL, and UNSUBSCRIBE, but any clearly intended request counts.
- Prescribed vs non-prescribed methods. A method you prescribe is conclusively reasonable; a non-prescribed method carries a rebuttable presumption of reasonableness, with the burden on the business to disprove it.
- Honor within 10 business days. Revocation must be processed within 10 business days (as soon as practicable).
- One confirmation message allowed. After revocation you may send one message within 5 minutes, only to confirm or clarify scope, with no marketing content. Anything beyond that requires an affirmative consumer response.
The operator-facing version, including the mandatory STOP/HELP keyword behavior, is on opt-out & STOP/HELP.
The “revoke-all” provision — delayed to Jan 31, 2027
One piece of the revocation framework — the cross-channel “revoke-all” provision, under which revoking consent on one message type applies to all unrelated types — was not included in the April 2025 effective date. The FCC delayed it, and then extended that delay again:
Quiet hours — a live litigation front
TCPA telemarketing rules prohibit solicitation calls and texts before 8:00am or after 9:00pm in the recipient’s local time (47 CFR 64.1200(c)(1)). Since November 2024, 100+ cookie-cutter class actions have alleged that marketing texts sent outside that window violate the TCPA even where the recipient consented. The Ecommerce Innovation Alliance petitioned the FCC (March 3, 2025) arguing PEWC forecloses quiet-hours liability; comments closed April 10, 2025 and the petition remains unresolved as of mid-2026.
Practical guidance: send marketing texts only 8am–9pm based on the recipient’s location (area code or known address as a proxy). The full litigation status and timing logic is on quiet hours.
The one-to-one consent rule is dead
The FCC’s 2024 one-to-one consent rule — aimed at lead-generation, requiring per-seller, topically-related consent — never took effect:
| Event | Date | Status |
|---|---|---|
| Rule vacated by the 11th Circuit (Insurance Marketing Coalition v. FCC) | Jan 24, 2025 | One business day before its Jan 27, 2025 effective date |
| Rule formally repealed by FCC final rule | Sept 2025 | Dead |
There is no federal one-to-one consent mandate today.
How the TCPA relates to everything else
- TCPA = the binding law (legality, consent, damages). FCC-enforced; privately litigated.
- CTIA best practices = carrier-enforced delivery rules layered on top — see /regulations/ctia/.
- TCR + carriers = registration and filtering that gate whether traffic flows at all.
You can be fully registered with TCR and still face a TCPA suit; registration controls delivery, the TCPA controls legality.
Next
- TCPA basics for texting — the operator’s working summary.
- Quiet hours — the live litigation risk even where consent exists.
- Opt-out & STOP/HELP — the 2025 “any reasonable means” rule in practice.
- FCC — the agency that writes and enforces these rules.
- Change tracker — every dated TCPA change since 2024.