Written by: Matt Beucler, CEO, Plura AI
Last Updated: September 2026
Key Takeaways
- TCPA (Telephone Consumer Protection Act) compliance in 2026 requires prior express written consent for autodialed and artificial-voice calls and texts, immediate opt-out honoring, 8 a.m.–9 p.m. calling hours in the recipient’s local time zone, and DNC (Do Not Call) list scrubbing.2
- The FCC’s one-to-one consent rule (FCC 23-49) was vacated by the Eleventh Circuit in January 2025, but the baseline consent standard at 47 CFR § 64.1200(a)(2) still applies.2
- AI-generated voices fall under TCPA consent requirements based on the FCC’s February 2024 Declaratory Ruling.2
- State laws in Florida, California, Texas, Oklahoma, and Oregon impose stricter rules than federal TCPA, so operators often follow the strictest applicable standard.2
- Vendor liability rests with the caller, and indemnification clauses only help if the vendor can actually pay.
- Plura AI automates compliance support at the carrier level with real-time DNC scrubbing, immutable consent records, automated quiet hours, and 50+ state rule sets.
Core TCPA Rules Contact Centers Must Follow
TCPA compliance is mandatory for any operation that calls or texts consumers at scale. These six requirements form the day-to-day playbook for compliant outreach.
- Obtain prior express written consent for autodialed and artificial-voice calls and texts to wireless numbers (47 U.S.C. § 227(b)(1)(A)(iii)).
- Honor opt-outs immediately, including “STOP” keywords for SMS, do-not-call requests, and any reasonable revocation method (47 CFR § 64.1200(a)(10)).
- Respect calling hours, 8 a.m.–9 p.m. in the recipient’s local time zone (47 CFR § 64.1200(c)(1)).
- Scrub against the National Do Not Call Registry at least every 31 days and maintain an internal DNC list (47 CFR § 64.1200(d); FTC TSR 16 CFR § 310.5).
- Maintain records of consent and opt-outs that are timestamped, immutable, and audit-ready (47 CFR § 64.1200(f)(9)).
- Monitor third-party vendors and lead sources, because the FCC treats the caller as responsible for vendor actions.
| Requirement | Applicable Rule | Compliance Action |
|---|---|---|
| Prior express written consent | 47 U.S.C. § 227(b)(1)(A); 47 CFR § 64.1200(a)(2) | Capture written consent with disclosure, timestamp, and source |
| Honor opt-outs | 47 CFR § 64.1200(a)(10) | Process STOP and revocation requests within 10 business days |
| Calling hours | 47 CFR § 64.1200(c)(1) | Enforce 8 a.m.–9 p.m. recipient-local time |
| DNC scrubbing | 47 CFR § 64.1200(d); FTC TSR 16 CFR § 310.5 | Scrub federal and state DNC lists every 31 days |
| Record retention | 47 CFR § 64.1200(f)(9) | Retain consent artifacts and opt-out logs |
| Vendor oversight | FCC liability framework | Audit vendor consent records and contracts |
New TCPA Developments Affecting 2026 Operations
The regulatory landscape changed significantly between 2024 and 2026. Contact centers updating their programs now should factor in four key developments.
One-to-one consent rule (FCC 23-49): The FCC adopted this rule on December 13, 2023, with an effective date of January 27, 2025. The Eleventh Circuit vacated Part III.D of the order in Insurance Marketing Coalition Ltd. v. FCC on January 24, 2025. The court held that because the TCPA does not define “prior express consent,” ordinary common-law consent principles apply. Under that standard, a consumer can authorize communications from multiple sellers through a single, clearly given consent. The baseline consent standard at 47 CFR § 64.1200(a)(2) still requires a clear, unambiguous written agreement naming the number to be called.
AI-generated voices: The FCC ruled in February 2024 that AI-generated voices qualify as “artificial or prerecorded” voices under 47 U.S.C. § 227(b)(1)(B), which places AI-voiced calls to cell phones within the TCPA consent framework.
Revocation rules: The FCC’s 2024 Report and Order clarified that consumers can revoke consent through any reasonable method, and callers must honor revocations within 10 business days.
State law divergence: Florida, Oklahoma, and Oregon end calling at 8 p.m.; Oregon’s 8 p.m. cutoff took effect January 1, 2026, under HB 3865. Florida’s FTSA (Telephone Solicitation Act) requires written consent before any telephonic sales call and carries a private right of action at $500 per violation. Operators should consult counsel to identify the strictest applicable standard for each destination state.
How To Obtain and Document Valid Consent
Under 47 CFR § 64.1200(f)(9), prior express written consent is a clear, unambiguous written agreement that:
- Bears the consumer’s signature (electronic or physical)
- Clearly authorizes the sender to deliver advertisements or telemarketing messages
- Identifies the telephone number to which messages may be delivered
- Includes a clear and conspicuous disclosure that signing is not a condition of purchase
Example consent language:
“By providing my phone number, I agree to receive autodialed calls and text messages from [Company Name] at the number provided. I understand that consent is not a condition of purchase. Reply STOP to opt out at any time.”
Each consent event needs complete documentation so your team can defend it later.
- Capture the exact disclosure language shown to the consumer
- Record the timestamp, IP address, form URL, and source
- Store the consent artifact, such as a signed web form, recorded verbal consent, or confirmed opt-in text thread
- Retain records for at least four years, consistent with the statute of limitations under 28 U.S.C. § 1658
The FTC’s amended Telemarketing Sales Rule, effective January 27, 2025, explicitly bans “dark patterns” such as pre-checked boxes and bundling consent to multiple sellers in a single checkbox. Consent must be granular and clearly presented.
Building a Compliant Technology Stack
Compliance at scale requires technology that enforces rules automatically. When evaluating platforms, focus on five capabilities that directly affect your risk exposure, as summarized in the table below.
| Capability | What to Look For | Why It Matters |
|---|---|---|
| DNC scrubbing | Real-time checks against federal and state registries | Batch scrubbing leaves windows where opted-out numbers remain dialable |
| Consent records | Immutable, timestamped, with source capture | Courts place the burden of proving valid consent on the caller |
| Opt-out handling | Automated suppression across all channels | A consumer who opts out of one campaign is opted out of every campaign |
| State rules | 50+ state rule sets enforced automatically | State laws impose stricter rules than federal TCPA in many jurisdictions |
| Audit readiness | One-click export of compliance records | Regulatory inquiries and legal review require immediate documentation |
Plura AI builds its compliance engine into its FCC-licensed carrier platform. The platform supports real-time DNC scrubbing, TCPA-litigator screening, automated quiet hours enforced through time-zone detection, and an immutable consent ledger. These features work together to reduce compliance risk across every outbound program. Plura enforces 50+ state rule sets automatically and maintains a track record of zero violations on the platform. The AI Predictive Dialer and AI SMS channels both operate inside these compliance guardrails by default.
See detailed pricing and plan comparisons at Plura AI Pricing.
Managing Opt-Outs Effectively
Under 47 CFR § 64.1200(a)(10), a called party may revoke consent using any reasonable method, and all revocation requests must be honored within a reasonable time not to exceed 10 business days from receipt. Senders may not designate an exclusive means of revoking consent.
A compliant opt-out process covers five steps:
- Detect opt-out keywords across all channels (SMS, voice, email, web), including STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE
- Suppress the number across every campaign and channel in real time
- Log the opt-out with timestamp and source
- Send a single confirmatory message with no marketing content
- Retain opt-out records for at least five years
Suppression workflows should be event-driven, timestamped, and tied to a single company-wide internal DNC list that all calling and texting tools can read. SMS opt-outs should be processed immediately, not on the next batch scrub cycle. The FCC’s 2024 guidance clarified that “reasonable time” means quickly, not on the next batch scrub cycle.
Auditing Third-Party Vendors and Lead Sources
Vendor relationships create concentrated TCPA risk for high-volume operations. The TCPA places liability on the party that initiates the call or text, so even if a lead vendor sold invalid consent, the buyer is still the defendant. Indemnification clauses only help if the vendor can actually satisfy a judgment.
A vendor audit process should address four areas:
- Verify consent records are passed through. Request and review original consent forms, not just database flags.
- Ensure contracts include TCPA indemnification and compliance representations. Treat these clauses as a baseline protection.
- Conduct due diligence on lead sources. Verify the consent capture process, disclosure language, and documentation standards.
- Monitor vendor calling and texting practices. Review call logs, opt-out rates, and complaint patterns on an ongoing basis.
The key question for every lead vendor is simple: “Can you produce the original consent record showing the consumer saw our company name and agreed to be contacted?” Courts place the burden of proving valid consent on the caller, requiring reconstruction of a complete consent chain for every number dialed. If a vendor cannot produce that record, the leads carry unquantified liability.
State-Specific Rules and How They Interact With TCPA
State telemarketing laws layer additional requirements on top of federal TCPA rules, and businesses generally must satisfy both federal rules and any stricter state standards. As of September 2026, several states stand out for outbound operations.
- Florida’s FTSA (Fla. Stat. § 501.059): Requires written consent before any telephonic sales call, carries a private right of action at $500 per violation, and limits calls to 3 attempts per 24 hours.
- California: Uses a broader autodialer definition than post-Duguid federal law.
- Texas: Requires telemarketer registration with the Secretary of State and a bond. The calling window runs 9 a.m.–9 p.m. Monday–Saturday and noon–9 p.m. on Sunday.
- Oregon: 8 p.m. calling cutoff effective January 1, 2026, plus a 3-attempts-per-24-hours cap.
- Oklahoma: 8 p.m. cutoff and 3-attempts-per-24-hours cap.
Operators should consult qualified counsel for state-specific compliance obligations. Plura enforces 50+ state rule sets automatically, including quiet hours, frequency caps, and disclosure requirements, on every outbound contact. To see this in action, book a live demo with Plura.
Watch how Plura applies state rule sets automatically across every campaign in a live walkthrough.
Frequently Asked Questions
What Are the Penalties for Violating the TCPA?
Statutory damages under the TCPA run $500 per violation, and courts can increase that amount to $1,500 per violation for willful or knowing violations. There is no cap on total damages in a class action. A single misconfigured campaign sent to 50,000 people could produce $25 million in statutory exposure at the $500 floor before any trebling is applied. Separate from TCPA damages, the FTC’s civil penalties for Telemarketing Sales Rule violations run up to $51,744 per violation under current inflation adjustments. Both enforcement frameworks can apply to the same campaign simultaneously.
Who Is Exempt From TCPA Rules?
Exemptions under the TCPA are narrow. The do-not-call provisions exclude calls made with prior express invitation or permission, calls to persons with an established business relationship, and calls by tax-exempt nonprofit organizations. Political and survey calls generally fall outside the definition of “telephone solicitation” because they are not made to sell goods or services. The TCPA applies to calls to wireless numbers whether the recipient is a business or a consumer, so B2B calls to mobile numbers require full compliance. Operators should consult counsel to evaluate whether a specific exemption applies to their program.
What Is the Best Way To Support TCPA Compliance?
A defensible compliance program combines three components: technology that automates consent capture, DNC scrubbing, and opt-out handling in real time; documented policies and training for all personnel who touch outbound communications; and regular audits of internal practices and third-party vendors. The technology component is most effective when it enforces compliance at the carrier level, before a call or text leaves the network, because that reduces the window for human error. Plura automates this technology layer, with carrier-level controls that support real-time scrubbing and state rule enforcement on every outbound contact.
How Do I Handle TCPA Opt-Outs Correctly?
Teams should honor STOP keywords and any reasonable revocation method as quickly as possible. The FCC’s 2024 revocation rules set a maximum of 10 business days for processing written opt-outs, but SMS opt-outs should be processed immediately, not on the next batch scrub cycle. Because a consumer who opts out of one campaign is opted out of every campaign, you must suppress the number across all channels and campaigns, not just the one where the opt-out was received. Document every opt-out with a timestamp and source, and send a single confirmatory message with no marketing content. Retain opt-out records for at least five years. Consumers can revoke consent through any reasonable method, including email, web forms, or verbal requests during a call, in addition to STOP keywords.
Does the TCPA Apply to AI Voice Calls?
As noted earlier, the FCC’s February 2024 ruling treats AI-generated voices as “artificial or prerecorded” voices under 47 U.S.C. § 227(b)(1)(B). AI-voiced calls to cell phones therefore sit inside the same TCPA consent framework as traditional prerecorded calls. Operators using AI voice agents for outbound marketing should consult counsel to confirm their consent documentation addresses AI-voiced communications. Plura’s AI voice agent platform operates within this framework, with consent management and DNC scrubbing enforced at the carrier level on every outbound contact.
See Plura’s AI voice agent in a live demo and review how carrier-level controls support compliance.
Conclusion: Build Compliance Into Everyday Operations
TCPA compliance in 2026 runs through four operational layers: consent capture, DNC scrubbing, opt-out management, and vendor oversight. Each layer requires technology that enforces rules automatically, documentation that survives discovery, and ongoing audits that catch gaps before plaintiffs do. State law adds a fifth layer, with stricter calling windows, frequency caps, and consent requirements that vary by destination.
Plura AI supports this discipline at the carrier level. Its platform includes real-time DNC scrubbing, immutable consent records, automated quiet hours enforced through time-zone detection, and 50+ state rule sets. The AI Predictive Dialer and AI SMS channels both operate inside these guardrails by default, with audit-ready reporting available on demand.
Review Plura’s pricing tiers to find the right fit for your operation. Run your numbers through https://plura.ai/calculator to estimate potential cost savings in real time.
1 Plura AI maintains SOC 2, HIPAA, ISO, and GDPR posture as part of its platform infrastructure. References to compliance frameworks in this article describe Plura’s platform capabilities and do not constitute a guarantee that any customer using Plura will themselves be compliant with applicable laws or standards. Customers remain solely responsible for their own regulatory obligations, certifications, consent management, recordkeeping, and the claims they make to their own end users. Consult qualified legal counsel for guidance specific to your use case.
2 This article describes regulatory frameworks at a general level and does not constitute legal advice. Laws and regulations vary by jurisdiction, change over time, and apply differently depending on facts and circumstances. Readers should consult qualified legal counsel before making compliance decisions.
This article is provided for informational purposes only and reflects Plura AI’s understanding at the time of publication. Product capabilities, integrations, and specifications are subject to change. For the most current information, visit plura.ai.
This article was produced with the assistance of AI tools and reviewed by Plura AI prior to publication.