TCPA compliance for lead generation: a 2026 operator's guide

The Telephone Consumer Protection Act (TCPA) is the single biggest legal risk surface for lead generators, brokers, and aggregators operating in the U.S. This guide explains what TCPA compliance actually requires in 2026 — consent capture, the one-to-one rule and its 2025 vacating, the April 2025 revocation rule, damages, and the operational stack required to stay on the right side of the line.

What the TCPA actually prohibits

At a high level, the TCPA prohibits the following without prior consent from the called party:

• Calls made to cell phones using an "automatic telephone dialing system" (ATDS) or with a prerecorded/artificial voice
• Text messages sent to cell phones via automated systems
• Prerecorded calls to residential landlines
• Telemarketing calls to numbers on the National Do Not Call Registry (with limited exceptions)

For lead generators and brokers, the practical impact is enormous. The vast majority of follow-up to consumers who submitted forms involves cell phones, automated dialing, text messages, or some combination. Without proper consent, every one of those calls or texts is a TCPA violation — with statutory damages of $500 per violation (uncapped for willful violations, often trebled to $1,500).

Prior Express Written Consent (PEWC) in plain language

For telemarketing calls or texts to cell phones using automated systems, the TCPA requires Prior Express Written Consent (PEWC) from the consumer. "Written" includes electronic signatures and checkbox-style consent flows. To be valid, PEWC must:

1. Identify the seller(s). The consumer must know which company or companies will be calling.
2. Specify that the consent is for telemarketing calls/texts. Generic privacy-policy consent doesn't count.
3. Indicate that consent is not required for purchase. Bundling consent with a purchase obligation is a per-se violation.
4. Disclose that automated dialing or prerecorded voice may be used.
5. Be unambiguous and conspicuous. Buried disclosures in 8pt gray text don't survive scrutiny.

The "one-to-one consent" saga and the 11th Circuit's 2025 vacating

In December 2023, the FCC adopted what became known as the "one-to-one consent" rule. The rule would have required, in effect, that PEWC be obtained for each specific seller individually — no more bundled consent flows naming "our marketing partners" generally or listing 30+ companies in small print.

The rule was scheduled to take effect January 27, 2025. On January 24, 2025, the Eleventh Circuit decided Insurance Marketing Coalition v. FCC, vacating the rule on the grounds that the FCC had exceeded its statutory authority. The stricter one-to-one interpretation is therefore no longer in force at the federal level.

What this means in 2026: the FCC's prior, looser interpretation of PEWC applies. Consent disclosures may name multiple sellers (including via a linked "marketing partners" list), provided the consumer can clearly identify who may contact them. That said:

• The underlying TCPA still requires that consent be valid for the actual seller making the contact. Lists of "potential partners" that the consumer can't realistically navigate are still vulnerable to challenge.
• Some states have enacted their own one-to-one-style rules (or have proposed them). Compliance with federal TCPA is not the same as compliance with state law.
• Best-in-class operators have continued to use one-to-one-style consent flows voluntarily, on the view that they are more defensible in litigation and less vulnerable to future rule changes.

The April 2025 revocation rule

In a separate FCC order that took effect April 2025, the rules around how a consumer can revoke TCPA consent were significantly tightened. The key provisions:

• Consumers can revoke consent through any reasonable means — replying STOP, calling, emailing, mailing a letter, telling an agent verbally, or any other "reasonable" method. Sellers cannot restrict revocation to one specific channel.
• Revocation must be honored across all of a seller's contact channels. A STOP reply to an SMS suppresses all further telemarketing calls, texts, and prerecorded contact — not just SMS.
• The seller has 10 business days to propagate the revocation across their systems and any downstream entities to whom consent flowed.
• Confirmation messages are permitted (e.g., a one-time "You've been unsubscribed" SMS) but not required.

Damages: what TCPA violations actually cost

Statutory damages under the TCPA are $500 per violation, with willful or knowing violations subject to treble damages ($1,500 per violation). Damages are uncapped and apply per-call/per-text — meaning a single campaign to a non-consented list of 10,000 numbers can produce $5M-$15M of statutory exposure on its face.

TCPA class actions are common because:

• Plaintiff firms specialize in monitoring for TCPA violations
• Many consumers receive multiple unwanted calls/texts, producing class-action volume
• Damages math scales linearly with violation count, making class certification financially attractive
• Settlements typically range $1.5M-$50M+ for larger violators; smaller operators have been sued personally for six-figure amounts

Recent enforcement and settlement examples (publicly reported):

• $60M settlement in 2024 involving a major insurance lead-generation operation
• Multiple seven-figure settlements involving Medicare lead generators in 2024-2025
• Increasing pursuit of individual liability against operators where corporate-veil arguments fail

The compliance stack a serious operator runs

To stay TCPA-compliant at any meaningful operating volume, an operator needs:

1. A properly drafted consent disclosure on every landing page and form that captures PEWC. Reviewed by counsel. Updated whenever rules change.
2. A consent-capture service (TrustedForm by ActiveProspect or Jornaya, primarily) that records the consumer's interaction with the disclosure and produces a certificate URL.
3. DNC scrubbing against the federal DNC registry and applicable state DNC registries before every outbound call. Real-time API integration, logged scrub results.
4. A suppression list infrastructure that propagates STOP/revocation across all channels within 10 business days.
5. Recording of calls where applicable (most operations record), with proper notice in two-party-consent states.
6. Documented procedures for handling consumer complaints and revocations.
7. Retention of compliance records for 4+ years — the typical TCPA statute of limitations window plus a buffer.

The five most common TCPA mistakes by new operators

1. Skipping TrustedForm/Jornaya to save money. $0.05-$0.25 per certificate is cheap insurance against a six-figure dispute.
2. Buying "leads" that are actually contact lists. Scraped or repurposed contact data without affirmative consent records is a TCPA violation waiting to happen.
3. Treating DNC scrubbing as a one-time setup. The federal DNC registry is updated continuously. Scrubbing must happen at the moment of dial, not once a quarter.
4. Failing to propagate STOP across channels. A consumer who texts STOP to an SMS dialer must also be suppressed from voice and email outreach.
5. Selling leads downstream without consent that contemplates the resale. If your consent disclosure named you only, you can't sell that lead to a buyer who will then contact the consumer with their own brand identity.

Sources: 47 U.S.C. § 227 (TCPA statute); 47 CFR § 64.1200 (implementing rules); FCC Order CG Docket 02-278 (one-to-one rule, December 2023); Insurance Marketing Coalition v. FCC, No. 24-10277 (11th Cir. January 24, 2025); FCC Revocation Order CG Docket 02-278 (effective April 2025); LeadsCouncil compliance guidance.