TCPA Compliance Checklist for Business Calls & Texts

Regulatory compliance is more than a legal requirement—it shapes how businesses treat customers and handle data with care.

The Telephone Consumer Protection Act (TCPA) sets strict rules around calls, texts, and automated outreach. Failing to follow those rules can lead to serious fines, legal disputes, and damage to customer trust, especially for teams that rely on phone and SMS communication.

This guide breaks down a practical TCPA compliance checklist for voice, text, and outreach tools. It also explains common violations, potential penalties, and how to build a compliance process that fits into daily operations.

What Is the TCPA & Who Must Comply?

The Telephone Consumer Protection Act is a U.S. federal law that limits how businesses may contact people by phone, text message, and automated dialing systems. 

It sets rules for when companies may place marketing calls, send a promotional text, use a prerecorded message, or rely on auto-dialers. The law exists to reduce unwanted communications and protect personal information and privacy.

Violations can result in private lawsuits, class actions, and government fines, and each unlawful call or text may trigger a separate penalty.

Who the TCPA applies to

The TCPA applies to any organization that contacts United States phone numbers for business purposes, no matter the company size, industry, or location, including:

• Small businesses: Local shops, service providers, online stores, and solo operators fall under the same TCPA rules as larger companies. Business size does not reduce legal exposure.
• B2B outreach: Business-to-business calling and texting is not exempt. Marketing messages to work phones, mobile phones, and text numbers still requires proper consent and opt-out handling.
• Call centers and outsourced teams: Inbound and outbound call centers carry direct TCPA risk. This includes appointment setting, lead follow-up, support callbacks, debt collection, and survey outreach.
• Political vs marketing calls: Political calls face fewer limits than commercial sales calls, though some TCPA consent and time-of-day rules still apply. Sales, lead generation, fundraising for businesses, and product promotions follow the strictest TCPA standards.
• SMS and text message marketing: Text messages count as phone calls under the TCPA. Consent rules apply to promotion, appointment alerts, payment reminders, and two-step verification texts.

What counts as a TCPA violation?

A TCPA violation may occur when a business:

• Calls or texts a mobile phone using automated systems without prior written consent
• Sends marketing texts without a clear opt-in
• Ignores “STOP” or verbal opt-out requests
• Calls numbers listed on the National Do Not Call (DNC) Registry without proper authorization
• Uses misleading or blocked caller ID information
• Delivers prerecorded marketing messages without permission
• Contacts people outside legal calling hours
• Fails to keep records of consent and opt-outs

Each improper message can create legal exposure on its own, which makes repeat outreach especially high risk.

Your TCPA Checklist for Compliance

This checklist covers the main TCPA rules that affect calls, texts, and automated outreach. It is designed to help businesses confirm that consent, timing, opt-outs, and records meet legal standards.

1. Obtain and Document Consent

The heart of the TCPA is respecting consumer privacy and autonomy by obtaining their consent to send marketing communications. Before placing marketing calls or sending promotional texts, a business must have clear permission from the recipient. Without valid consent in place, each call or message may carry legal risk.

TCPA mandates that businesses obtain prior express consent from consumers for many types of outreach and prior express written consent for most automated marketing calls and texts. Failing to meet the correct consent standard can lead to lawsuits and regulatory penalties.

There are three main types of consent for TCPA compliance:

• Express written consent: This is the highest standard of consent required by TCPA, must be obtained in physical (paper) or digital writing, and clearly authorize contact. It is required for most marketing texts, prerecorded messages, and auto-dialed sales calls to mobile phones. 
• Express verbal consent: Verbal permission may apply in limited situations, such as certain non-marketing calls. You must maintain accurate records, including the date, time, and nature of the consent given.
• Implied consent: Businesses may contact consumers via telemarketing messages if there’s an established business relationship, like a recent purchase. Implied consent has limits and does not cover most automated marketing outreach. Recipients must always have a clear way to opt out.

Record-keeping and documentation best practices

Proper records protect your business if a complaint or lawsuit arises. At a minimum, businesses should document:

• How and when consent was obtained
• The exact language shown or read at the time of opt-in
• The phone number tied to the consent
• Any opt-out requests and when they were received
• Proof that opt-outs were honored

Consent records should be stored in a system that allows fast retrieval. If consent cannot be verified, outreach should not take place.

2. Honor the National Do Not Call (DNC) Registry

Together, the Federal Communications Commission (FCC) and Federal Trade Commission (FTC) maintain the National Do Not Call (DNC) Registry, which is a database of consumers who opted out of telephone solicitation with a do-not-call request. Individuals can register their numbers for free and once a number is listed, most sales calls to that number are prohibited. 

All organizations that place outbound marketing calls must check their calling lists against the National DNC Registry. Any number on the registry must be removed unless a lawful exemption applies, such as prior express consent or a limited business relationship that meets legal rules.

Failure to screen against the registry can lead to fines for each unlawful call.

Key DNC compliance requirements:

• Register with the FTC to gain legal access to the DNC database
• Scrub outbound call lists against the registry on a regular schedule
• Maintain an internal do-not-call list for direct opt-out requests
• Honor opt-out requests even if a number is not on the national registry
• Avoid transferring calling responsibility to vendors without written DNC controls

Call centers and third-party sales teams carry the same responsibility as in-house staff. A business may still be held liable for violations made on its behalf.

3. Adhere to legal call time restrictions

TCPA guidelines restrict when telemarketing calls can be placed. Businesses may not make sales or marketing calls to residential or mobile numbers before 8:00 a.m. or after 9:00 p.m. in the recipient’s local time zone.

These restrictions govern the specific days and hours businesses can make calls. While the TCPA doesn’t explicitly prohibit telemarketing on weekends or holidays, it does require businesses to use discretion to avoid calls when consumers aren’t likely to be home or might not be open to marketing calls.

Since VoIP phones can make voice calls from anywhere with an internet connection, contact centers often call consumers in distant time zones. It’s always the responsibility of the business to know the time zone of whoever they’re calling. To avoid a potential violation, make sure your agents know the time wherever they’re calling.

Key time-related compliance rules:

• Follow the 8:00 a.m. to 9:00 p.m. local-time window for all marketing calls
• Use verified time zone data for every outbound call
• Apply time controls to dialers and calling software
• Hold vendors and third-party call centers to the same limits
• Do not rely on agent judgment alone for time compliance

4. Comply with the Telemarketing Sales Rule (TSR)

The TSR is a set of regulations enforced by the Federal Trade Commission (FTC) that protect consumers from deceptive and abusive telemarketing practices. While the TCPA primarily regulates phone communication for marketing purposes, the TSR provides additional guidelines specific to telemarketing sales calls.

The Telemarketing Sales Rule mandates compliance with the National DNC Registry and requires telemarketers to provide accurate caller ID. It also imposes record-keeping requirements on telemarketers, including maintenance of calling lists, consent records, and records of sales transactions — a call center best practice.

Remember, businesses that place outbound sales calls must follow both the TCPA and the TSR. Compliance with one does not replace the other.

Core TSR requirements for businesses:

• Follow National Do Not Call (DNC) Registry rules
• Identify the seller and the purpose of the call at the start of each call
• Provide truthful information about products, services, pricing, and terms
• Avoid misleading statements or pressure tactics
• Disclose refund, cancellation, and billing terms clearly
• Keep records of calling activity, consent, and completed transactions

5. Respect opt-out requests immediately

Any business that sends marketing calls, texts, application-to-person (A2P) messages, or emails needs to give consumers a clear way to opt out of receiving them.

When someone opts out, you must promptly honor that request. Avoid communicating with that consumer unless they explicitly opt back in to remain compliant. Ignoring or delaying opt-out requests is a common source of TCPA complaints and lawsuits.

Key opt-out rules:

• Accept opt-outs by text reply, voice request, or written notice
• Process opt-outs right away
• Apply the opt-out across all calling and messaging systems
• Do not resume outreach without a new opt-in

6. Meet caller ID transparency requirements

Transparency is a key TCPA regulation goal, so businesses that place outbound calls must transmit accurate caller ID information. This includes a valid phone number and, when available, the company name tied to that number. The STIR/SHAKEN protocol helps businesses obtain a digital certificate that authenticates their business and identifies themselves to consumers.

Regulation enforced by the Federal Communications Commission, like the Truth in Caller ID Act of 2009, prohibit the use of false or misleading caller ID information when the intent is to mislead, defraud, or cause harm.

Key caller ID rules:

• Transmit a real, reachable phone number on every outbound call
• Do not hide or alter caller ID for marketing outreach
• Register business numbers with carriers where required
• Apply the same standards to third-party call centers

Falsifying contact information, often called spoofing, is a frequent trigger for consumer complaints and can lead to costly violations.

7. Prioritize SMS & text message compliance

Text messages are treated the same as phone calls under the TCPA. Businesses must have explicit consent before sending any marketing or promotional texts to a mobile number.

Consent is required even when a text conversation begins with a customer inquiry. A business may respond to a one-time request, but ongoing messaging, promotions, or alerts require a clear opt-in.

The same time limits that apply to calls also apply to texts. Messages sent outside the legal calling window may count as violations. Because text messaging generates high complaint volume, SMS compliance is a frequent source of TCPA claims.

Key SMS compliance rules:

• Obtain consent before sending marketing texts
• Use clear opt-in language at the time of sign-up
• Honor STOP and other opt-out keywords right away
• Apply call-time restrictions to text messaging
• Keep records of opt-ins and opt-outs

8. Understand robocall & auto-dialer regulations

A robocall uses a pre-recorded or artificial voice. An auto-dialer places calls or sends messages without manual dialing. This includes tools such as predictive dialers, power dialers, AI dialers or voice systems, and ringless voicemail. All of these fall under strict TCPA limits.

For most marketing outreach to mobile phones, prior express written consent is required before sending a prerecorded message or using automated dialing. Each call or text sent without proper consent may count as a separate violation.

These rules apply whether outreach is sent through in-house systems, VoIP platforms, or third-party dialing tools.

Key robocall and auto-dialer rules:

• Do not use prerecorded or AI-generated voices for marketing without written consent
• Do not use predictive or power dialers for marketing calls or texts to mobile phones without written consent
• Do not deploy ringless voicemail for marketing without written consent
• Honor opt-out requests without delay
• Follow call-time limits for all automated outreach
• Keep proof of consent for every number

TCPA Violations and Penalties: What Businesses Need to Know

Failure to comply with the TCPA can result in substantial financial penalties. Fines are assessed per violation, and the amount often depends on whether the conduct is considered negligent or willful.

Courts may assess:

• $500 per violation for standard violations
• Up to $1,500 per violation for willful or knowing violations

Because penalties apply per call or text, even small campaigns can create large legal exposure.

Here is a look at common TCPA violations and their consequences:

Handling complaints and legal risk

The best way to mitigate risk regarding TCPA compliance is to obtain consent, document it thoroughly, and stay up to date on regulatory changes related to TCPA and TSR.

Dealing with complaints and lawsuits requires a proactive approach to reputation management and risk mitigation, which can include:

• Response: Acknowledge the complaint promptly and offer clear and concise explanations. Confirm opt-out status and stop all further outreach to that number.
• Investigation: Log the complaint, review consent records, call history, and opt-out handling. Identify the exact failure that led to the issue and note areas of improvement for compliance practices.
• Legal guidance: Consult legal counsel with TCPA experience to assess exposure and determine the appropriate response. Early legal review is often less costly than defending litigation later.

Weak consent controls and delayed opt-out handling remain the most common triggers for TCPA claims.

How to Implement TCPA Compliance in Your Business

The most reliable way to avoid TCPA violations is to build compliance into daily operations and review it regularly. Clear rules, training, and documentation help prevent unwanted and unlawful communications.

Develop a TCPA compliance guide

Start by writing a policy that explains:

• What types of calls, texts, and automated tools your business uses
• Which consent standard applies to each type of outreach
• How you handle Do Not Call and opt-out requests
• How you collect, store, and access consent records

Assign a compliance officer or small team to oversee every TCPA rule. Their role should include updating the policy, monitoring changes in the law, and coordinating with vendors.

Train and educate your team

Everyone who places calls or sends texts on behalf of your business should receive regular training on general call center best practices as well as:

• TCPA and TSR rules that apply to your programs
• Consent requirements for calls, texts, and auto-dialers
• How to recognize and honor opt-out requests
• Caller ID rules
• Record-keeping expectations

Training should be part of onboarding and refreshed on a set schedule, especially for contact center agents and marketing teams.

Perform regular compliance audits

Periodic audits help find and fix gaps in your compliance plan and record-keeping practices before they turn into complaints.

Review:

• Samples of call and text campaigns
• Consent records and opt-out logs
• DNC scrubbing processes
• Caller ID practices
• How vendors and outsourced teams follow your rules

Use audit findings to correct issues quickly and adjust scripts, workflows, or tools as needed.

Use technology that supports compliance

Customer experience technology facilitates TCPA compliance by making it easier than ever to track your efforts to obtain consent. The tools and tech you use for calling and texting should help you:

• Capture and store consent tied to each phone number
• Log opt-outs and apply them across all systems
• Enforce time-of-day limits automatically
• Display valid caller ID information
• Pull records quickly if a complaint arises

Data and contact management systems should keep records current and easy to search, especially for high-volume programs.

Work with legal counsel for compliance assurance

TCPA and TSR rules change over time, and new guidance can affect how you run campaigns. A lawyer who’s an expert in this area can:

• Review your policy, scripts, and consent flows
• Advise on higher-risk outreach (for example, new auto-dialer tools or text campaigns)
• Help you respond when a complaint or demand letter arrives

Note: While we referenced some of the laws pertaining to telemarketing, this guide is for general information only and does not replace legal advice. For specific questions about your situation, speak with a licensed attorney in your state.

Put Your TCPA Compliance Checklist to Work with Nextiva

A clear TCPA compliance checklist helps you stay consistent on the basics: making sure you obtain express written consent, honoring the Do Not Call Registry, following call-time limits, meeting TSR and caller ID rules, managing SMS programs carefully, and controlling robocalls and auto-dialers. 

When you pair that checklist with training, audits, and good record-keeping, you reduce legal risk and show customers that you respect their time and privacy.

Today’s modern contact center software, like Nextiva, has compliance and reporting functionality built in, so you can focus on serving customers while keeping TCPA obligations in view.