Lead Gen Compliance to Avoid Huge Penalties and Lawsuits in 2026 w/ John Henson (Founder, Henson Legal)

What Is the TCPA and Who Does It Apply To?

The Telephone Consumer Protection Act, commonly called the TCPA, is a federal statute enacted in 1991 that limits how businesses can contact consumers by phone, text, and fax. The Federal Communications Commission enforces the TCPA and has updated its rules several times since the law was passed, most recently expanding its guidance on consent and automated technology. The law applies to any person or entity that initiates covered communications, which means businesses of every size, including law firms, marketing agencies, and healthcare practices, fall within its reach.

Which types of calls and messages fall under TCPA rules?

TCPA rules cover a broader range of communications than most marketers expect. The statute regulates calls made with an automatic telephone dialing system, commonly referred to as an autodialer, as well as prerecorded voice messages delivered to residential lines. Text messages sent via automated platforms are treated the same as calls under the law. Unsolicited faxes sent for advertising purposes are also regulated under a separate but related provision. Live, manually dialed calls to cell phones fall into a gray area, but any use of automated or prerecorded technology to reach a mobile number triggers full TCPA protections regardless of whether the message is commercial or informational.

Does the TCPA apply to law firm marketing?

Law firm marketing campaigns are fully subject to TCPA requirements, and this catches many firms off guard. When a firm uses a CRM with automated text follow-ups, purchases leads from a third-party aggregator, or runs a mass outreach campaign after a mass tort event, each of those touchpoints can trigger TCPA obligations. The fact that the firm is a legal professional does not create any exemption. Courts have repeatedly held law firms liable for TCPA violations when their marketing vendors sent messages without valid consent. If your firm is running paid media campaigns that feed into an automated contact sequence, TCPA compliance is not optional.

What Does TCPA Consent Actually Require?

TCPA consent requirements are more specific than a simple opt-in checkbox. The FCC’s rules at 47 C.F.R. section 64.1200 set out a prior express written consent standard for autodialed or prerecorded marketing calls and texts to cell phones. That standard requires a signed written agreement, which can be electronic, in which the consumer clearly agrees to receive such communications from a specific sender. Generic opt-in language buried in a privacy policy does not meet this standard. The consent must be unambiguous, and the consumer cannot be required to provide consent as a condition of purchasing a product or service.

What counts as prior express written consent?

Prior express written consent under the TCPA requires a clear and conspicuous disclosure that the consumer is authorizing the company to contact them using an autodialer or prerecorded message, along with the consumer’s signature, which can be an electronic signature. The disclosure must identify the specific entity that will be making the calls or sending the texts. A checkbox on a web form can satisfy this requirement if the language is specific, clearly visible, and not pre-checked by default. Firms need to retain records of when and how consent was obtained because that documentation is the primary defense in any TCPA lawsuit.

How do lead generation forms create TCPA consent risk?

Lead generation forms are one of the most significant sources of TCPA liability for law firms today. The problem typically arises when a consumer fills out a form on a third-party website and the fine print authorizes contact from a broad list of unnamed partners. The FTC and FCC have both scrutinized these shared consent arrangements, and courts have increasingly rejected them as a valid basis for TCPA compliance. When a law firm buys leads from an aggregator, the firm is relying on consent that was obtained by someone else, often using vague language that names no specific company. If that consent does not meet the written consent standard, every automated text or call the firm sends to that lead is a potential violation. Firms that purchase leads without auditing the consent language on the originating form are taking on substantial risk.

What Happens When a TCPA Violation Occurs?

TCPA violations expose businesses to private lawsuits brought by individual consumers or, more commonly, by plaintiffs’ attorneys filing class actions on behalf of large groups of people who received the same messages. The statute gives consumers a private right of action, meaning they do not need to file a complaint with a government agency first. A single campaign that reaches thousands of people without valid consent can generate thousands of individual claims simultaneously. TCPA litigation has grown into one of the most active areas of consumer class action law in the United States, and law firms that operate marketing campaigns are not insulated from it.

How much can a TCPA lawsuit cost?

TCPA lawsuit damages are set by statute at $500 per violation for standard violations and $1,500 per violation when the court finds the conduct was willful or knowing. Each individual call or text message counts as a separate violation. A campaign that sent 10,000 automated texts without proper consent could generate $5 million in statutory damages at the base rate, or $15 million if willfulness is established. Class action settlements in TCPA cases have ranged from hundreds of thousands of dollars to well over $100 million for large-scale campaigns. Class action tracking resources show that TCPA cases consistently rank among the largest consumer class action settlements filed each year. Defense costs, even for cases that settle early, add up quickly.

What does a TCPA attorney do in these cases?

A TCPA attorney handles these cases from both sides of the dispute. On the plaintiff side, a TCPA lawyer investigates whether a consumer received calls or texts without valid consent, determines whether an autodialer was used, and builds the case for statutory damages, often as part of a class action. On the defense side, a TCPA attorney audits the client’s consent records, challenges the plaintiff’s evidence that an autodialer was used, argues that consent was properly obtained, and works to limit per-violation exposure or negotiate a settlement. Attorneys who specialize in TCPA defense also advise businesses on compliance programs before litigation arises. For law firms facing a TCPA demand letter, retaining a TCPA attorney quickly is critical because the factual record around consent documentation needs to be preserved immediately.

How Can Law Firms Run Compliant Marketing Campaigns?

TCPA compliance does not mean abandoning outreach. It means building the right processes before a campaign goes live. Law firms that invest in compliant marketing infrastructure can still run aggressive, high-volume campaigns, including in the Hispanic market, without the legal exposure that comes from cutting corners on consent. The firms that get into trouble are usually the ones that delegate everything to a vendor and assume compliance is someone else’s problem. It is not. The firm that initiates the communication is the firm that gets sued.

What compliance steps should firms take before launching a campaign?

Compliance steps before launching a marketing campaign should start with a review of every consent touchpoint in the lead flow. Here is a practical checklist for law firms:

• Audit your lead forms. If you are buying leads, request a copy of the exact consent language displayed on the originating form. Confirm it names your firm specifically or uses language broad enough to include you.
• Use clear, specific opt-in language. Any form your firm controls should include a visible, unchecked checkbox with language that identifies your firm, describes the type of messages the consumer will receive, and states that consent is not required to obtain services.
• Document everything. Store timestamps, IP addresses, and the exact consent language in effect at the time each lead was captured. This is your defense record.
• Build opt-out into every message. Every automated text must include a clear opt-out instruction such as “Reply STOP to unsubscribe.” Honor opt-out requests immediately and log them.
• Scrub against the National Do Not Call Registry. For residential landline calls, cross-reference your list against the DNC Registry before dialing.
• Vet your vendors. Any marketing agency or lead generation partner you work with should be able to produce a written TCPA compliance policy. If they cannot, that is a red flag.
• Train your team. Anyone managing outreach campaigns should understand the basics of TCPA consent so they can flag problems before they become lawsuits.

For law firms targeting Spanish-speaking communities, these steps matter just as much. Hispanic consumers have the same TCPA rights as any other consumer, and campaigns reaching this audience through text or automated calls must meet the same consent standards. At Abogados NOW, every campaign we run for law firms is built with compliant lead capture and documented consent in mind, because protecting the firm is part of delivering real value.

Frequently Asked Questions About TCPA

What does TCPA stand for?

TCPA stands for the Telephone Consumer Protection Act, a federal law passed in 1991 that restricts unsolicited automated calls, text messages, and faxes to consumers.

Can a law firm be sued under the TCPA?

Yes, a law firm can be sued under the TCPA. There is no professional exemption for attorneys or legal practices. Any firm that uses automated dialing technology, sends mass texts, or purchases leads without verifying consent is exposed to the same liability as any other business. Courts have held law firms directly liable when their marketing campaigns, including those run through third-party vendors, violated the statute.

What is the statute of limitations for a TCPA lawsuit?

The statute of limitations for a TCPA lawsuit is four years from the date of the alleged violation, under 28 U.S.C. section 1658, the general federal four-year limitations period. This means a firm’s exposure does not end the day after a campaign runs. Records of consent and campaign activity should be retained for at least four years.

Is a text message treated the same as a phone call under the TCPA?

Yes, text messages are treated the same as calls under the TCPA. The FCC confirmed this interpretation, and courts have consistently applied TCPA requirements to SMS and MMS messages sent via automated platforms. Many marketers are surprised by this because texts feel less intrusive than calls, but the legal standard is identical. Prior express written consent is required before sending automated marketing texts to a cell phone.

What is the Do Not Call Registry and how does it relate to the TCPA?

The National Do Not Call Registry is a list maintained by the FTC that allows consumers to opt out of telemarketing calls to their residential phone numbers. The TCPA incorporates Do Not Call rules, making it illegal to call a registered number for telemarketing purposes. However, the Do Not Call Registry is just one part of TCPA compliance. The broader consent requirements for autodialed calls and texts to cell phones apply regardless of whether a number is on the registry. A number not on the DNC list can still generate a TCPA claim if the caller used an autodialer without written consent.

Can someone revoke TCPA consent after giving it?

Yes, consumers can revoke TCPA consent at any time and through any reasonable means. The Supreme Court addressed this in McLaughlin Chiropractic Associates v. McKesson Corporation (2024), and the FCC’s rules confirm that revocation must be honored promptly. Once a consumer opts out, any further automated messages to that number are a new violation. Firms must have systems in place to capture revocations in real time and suppress those numbers immediately from all active campaigns.

What should a firm do if it receives a TCPA demand letter?

A firm that receives a TCPA demand letter should treat it as a litigation threat and act quickly. The immediate steps are: preserve all records related to the campaign in question, including consent documentation, call logs, and vendor agreements; do not delete or alter any data; and retain a TCPA attorney before responding. Demand letters often come from plaintiffs’ attorneys who are testing whether the firm will settle quickly. A fast, uninformed response can waive defenses or signal weakness. An experienced TCPA attorney can assess the strength of the consent records, evaluate the exposure, and advise on whether to negotiate or defend.