TCPA violations: the most common ones and how to avoid them

Most TCPA violations come from five mistakes: texting people who never gave consent, ignoring opt-outs, contacting Do Not Call numbers, sending outside permitted hours, and placing autodialed or prerecorded calls without consent. Each one can cost $500 per message, and up to $1,500 if a court finds it willful, so prevention consists of consent records, opt-out handling and scrubbing, applied to every send.

This post lists the violations businesses actually get sued for, what each one costs, and a checklist that pairs each risk with a fix. We make Ready, so where our product handles part of the job we say which part, and where it doesn't we say that too. This is not legal advice. If you're building a texting program at any real volume, have a TCPA attorney review your consent language and process.

What a TCPA violation costs

The Telephone Consumer Protection Act lets the person who received the message sue directly. That's the main reason these cases are so common. The statutory damages are:

• $500 per violation (per text or per call), with no need to prove actual harm
• Up to $1,500 per violation if the court finds the violation willful or knowing
• Class actions multiply those figures across every recipient

Here's an illustrative example of how quickly the numbers grow. Assume a business texts 2,000 people who never opted in, and each person gets 3 promotional texts over a month:

• 2,000 recipients × 3 texts = 6,000 texts
• 6,000 × $500 = $3,000,000 at the statutory minimum
• 6,000 × $1,500 = $9,000,000 if the court finds it willful

Real cases usually settle for less than the statutory maximum. Defense costs alone run high, though, and settling is not cheap. Many state laws also have their own private right of action. Florida's and Oklahoma's are the well-known ones, and some reach further than the federal law.

The five most common TCPA violations

1. Texting without consent

This is the most common violation by a wide margin. The FCC treats texts as "calls" under the TCPA. Marketing texts generally require prior express written consent: a clear agreement, signed or electronically agreed to, saying the person wants marketing texts from you at that number. Informational texts, such as appointment reminders and order updates, carry a lower bar, but they still need consent.

The usual ways businesses get this wrong:

• A purchased or scraped list gets imported into a texting tool
• A phone number collected for one purpose (shipping) gets used for another (promotions)
• A checkbox is pre-checked, or consent is buried in terms of service
• Consent existed once, but nobody can produce proof of it when a demand letter arrives

Our stance is simple: cold contact happens by phone and mail, and SMS goes to people who consented or replied.

2. Ignoring STOP and other opt-outs

Someone texts STOP and gets another promo the next day. That's a violation, and plaintiffs' attorneys look for it specifically. Under FCC rules, consent can be revoked by any reasonable means, which includes "please stop texting me" and "take me off your list," not only the word STOP. Revocations must be honored within 10 business days.

A second trap: the opt-out lands in one tool or campaign, and a different tool keeps texting the same person.

3. Contacting Do Not Call numbers

Sending telephone solicitations to numbers on the National Do Not Call Registry exposes you to suit. The private right of action applies once a person gets more than one solicitation within 12 months. The exceptions are prior express consent and, within limits, an established business relationship. You're also required to keep an internal do-not-call list of people who told you directly not to contact them. Failing to keep and honor that list is a violation of its own.

There's also a group of professional plaintiffs who file TCPA suits repeatedly. Their numbers show up on known-litigator lists, and screening them out is cheap.

4. Sending during quiet hours

The federal rules bar telephone solicitations before 8 AM or after 9 PM in the recipient's local time. Your local time doesn't count. A campaign scheduled for 8 AM Eastern lands at 5 AM in California. Some state laws set narrower windows than the federal one, so the safe practice is to schedule well inside them.

5. Autodialed or prerecorded calls without consent

Prerecorded or artificial-voice calls to cell phones need prior express consent, and marketing calls of this kind need written consent. The FCC has confirmed that AI-generated voices count as "artificial" voices. After the Supreme Court's 2021 Facebook v. Duguid decision, the federal definition of an autodialer is narrower. Several state laws still define it more broadly, so "it isn't technically an autodialer" is a thin defense to rely on.

The prevention checklist: each risk mapped to a fix

A few notes on the table.

Consent proof is your job. Ready logs that you attested to consent on each send. If you're on the API, that's the consent_attested: true field on POST /v1/messages, documented at docs.tryready.com/api/messages. It does not store when each recipient opted in, what wording they agreed to, or which page they were on, unless the contact signed up on a Ready-hosted opt-in page (stored with time, IP address and exact wording). A keyword reply creates no consent record either. Your signup form, store or CRM has to keep that per-contact record. If you're an agency texting for customers, also read who gets sued when a client's bad list gets texted.

Plain-language opt-outs count too. Ready opts a contact out on STOP and UNSUBSCRIBE and on clear phrases like "quit messaging me," "take me off your list" or "do not text me." Someone should still read replies for the odd wording no list catches. Under the "any reasonable means" rule, those messages count as revocations.

You can check before you send. Platforms on the API can look up a number's opt-out status with GET /v1/opt-outs/:phone and screen it with GET /v1/scrub/:phone before queuing a text.

Timing is also a deliverability question. Quiet hours are the legal floor. For the windows that actually get replies, see the best time to send SMS marketing texts.

What scrubbing actually costs

Scrubbing is the cheapest item on this list, so it's worth showing the numbers.

There are two ways to buy it in Ready:

• Standalone TCPA & DNC Litigator Scrub: $0.005 per contact. One check runs each number against known TCPA-litigator lists and DNC-complainer lists, and matches are suppressed automatically. You pay only for what you scrub.
• Scrubbing switched on for an account: a $0.003 surcharge per segment on sends. It's off by default. Landline validation is a separate $0.003-per-segment surcharge, also off by default. With it switched on, texts to known landlines are refused up front and not charged (the number check itself can still be billed). Our post on whether you can text a landline explains why this matters.

Worked example (assumptions stated): a consented list of 5,000 contacts gets one 1-segment campaign with account scrubbing on, on the Standard rate of $0.0075/segment plus a $0.0045 carrier fee:

• Message rate: 5,000 × $0.0075 = $38
• Carrier fee: 5,000 × $0.0045
• Scrubbing surcharge: 5,000 × $0.003 = $15

Alternatively, running the same 5,000 contacts once through the standalone scrub costs 5,000 × $0.005 = $25.

Compare that $25 to a single litigator receiving 3 texts: $1,500 at the $500 minimum, or $4,500 if the court finds the violations willful, before any legal fees. Scrubbing reduces risk cheaply. It won't make you lawsuit-proof, because it only catches numbers that appear on the lists.

What registration does and doesn't cover

People often confuse A2P 10DLC registration with TCPA compliance. They are separate systems:

• 10DLC registration is a carrier requirement. Unregistered traffic gets filtered. In Ready, registration has no setup fee. You pay $25 at submit, which covers the first month, and after that the monthly cost is $25/mo for registration and $2 per number. Most approvals take 2 to 7 days.
• TCPA compliance is a legal requirement covering consent, opt-outs, DNC and timing. Carriers can approve your campaign while you still violate the TCPA on every send.

For a fuller picture of what a compliance platform should handle, see 10DLC compliance platform: what one should do for you.

What Ready doesn't do for you

To be clear about the limits:

• We don't verify that your list was collected with consent. Your attestation is your promise, and compliance is ultimately the sender's responsibility.
• We don't store a per-contact opt-in record for a number you text from your own list; only a sign-up on a Ready-hosted opt-in page is stored (time, IP and exact wording).
• We don't give legal advice or review your consent language.

Teams that already have tight consent capture, a working suppression list and scheduled sends can run a compliant program on a raw carrier API with their own tooling. What Ready offers is having opt-out propagation, quiet-hours holds, scrubbing and send attestation already built in, so there's nothing for you to build. You can check the per-segment card at tryready.com/pricing.

The practical takeaway

Nearly every TCPA suit traces back to one of five gaps. Work through them in this order:

1. Collect real opt-in and store per-contact proof yourself.
2. Honor every opt-out, including ones written in plain language.
3. Scrub against DNC and litigator lists before sending.
4. Send only inside the recipient's permitted local hours.
5. Get consent before any prerecorded or AI-voice call.

If you want to see how Ready handles opt-outs, quiet hours and scrubbing on your own account, you can sign up. The first 20 texts are free one-to-one sends, and to send any text you need a card and a number ($2 a month, the first month charged when you get it).

FAQ

How much is a TCPA violation per text? $500 per text in statutory damages, and up to $1,500 per text if the court finds the violation willful or knowing. In class actions, those amounts are multiplied across every recipient and every message.

Does an opt-out have to be the word STOP? No. FCC rules allow consent to be revoked by any reasonable means, and revocations must be honored within 10 business days. Ready catches STOP, UNSUBSCRIBE and clear phrases like "stop texting me" automatically. Someone should still read replies for unusual wording.

Does the TCPA apply to texts or only phone calls? It applies to both. The FCC treats text messages as calls under the TCPA, so the consent, DNC and timing rules all apply to SMS.

Does 10DLC registration make my texting TCPA compliant? No. Registration satisfies carriers and keeps your traffic from being filtered. TCPA compliance depends on consent, opt-out handling, DNC scrubbing and send timing, and those are separate obligations.

Will scrubbing protect me from TCPA lawsuits? It lowers your risk, but it doesn't eliminate it. A scrub at $0.005 per contact removes known litigators and DNC complainers. It does nothing for a contact who never consented in the first place, so consent records still matter most.