TL;DR

  • The Telephone Consumer Protection Act creates a private right of action with statutory damages of $500 per violation, rising to up to $1,500 per violation where the violation is willful or knowing, under 47 U.S.C. § 227(b)(3) and § 227(c)(5). A plaintiff does not have to prove any actual harm.
  • Each individual call or text is a separate violation. In a campaign, damages multiply by message, not by consumer — a single wrong number contacted forty times is forty violations.
  • Class actions are where the numbers become existential. Because damages are statutory and per-message, a class covering hundreds of thousands of calls can produce nine- and ten-figure exposure with no proof of injury required from any class member.
  • Willfulness does not require intent to break the law. Courts have repeatedly held that “willful or knowing” refers to the volitional act of placing the call, not knowledge that it was unlawful — which is why treble damages are on the table far more often than callers expect.
  • The caller bears the burden of proving consent. Consent is an affirmative defense, so the defendant must produce the record — and the entity that benefits from the call, typically the advertiser or lead buyer, can be held vicariously liable for a vendor’s violations.

Overview: Why the Numbers Are the Point

Most compliance statutes deter through the threat of an enforcement action — a regulator investigates, finds a violation, and imposes a fine. The TCPA works differently, and understanding why is the first step in understanding the exposure.

Congress built the TCPA around a private right of action with fixed statutory damages. That single design choice is responsible for nearly everything that makes the statute dangerous. There is no need for a regulator to act. There is no need to prove that anyone was actually harmed. Any recipient of a non-compliant call or text can sue, and the damages are set by statute at a level high enough to make individual claims worth bringing and class claims worth financing.

The result is a private enforcement engine. A plaintiffs’ bar has grown up around the statute precisely because the math is predictable: the damages are fixed, the violations are countable, and the defense — consent — must be proven by the defendant with a record it usually does not control. For a lead buyer or publisher, the penalties are not an abstract regulatory risk. They are a calculable liability that scales directly with call volume and inversely with the quality of the consent record behind each contact.

This guide walks through how those damages are actually computed, where the multipliers come from, and why the proof burden — not the per-message figure — is what determines whether a defendant pays.

The Statutory Damages Framework

The TCPA’s damages provisions sit in two parallel places in the statute, and it matters which one a claim is brought under.

Section 227(b): Robocalls, Autodialers, and Prerecorded Messages

The core prohibition most lead-gen litigation turns on is 47 U.S.C. § 227(b), which restricts autodialed or prerecorded telemarketing calls and texts to wireless numbers without prior express written consent. Its damages provision, § 227(b)(3), gives a successful plaintiff the greater of actual monetary loss or $500 in damages for each violation. If the court finds the defendant “willfully or knowingly” violated the subsection, it “may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times” that figure — i.e., up to $1,500 per violation.

Section 227(c): Do-Not-Call Violations

A separate track, 47 U.S.C. § 227(c)(5), governs violations of the do-not-call regulations — calls to numbers on the National Do Not Call Registry, or to consumers who have made a company-specific opt-out request. It carries the same structure: $500 per violation, trebled to up to $1,500 for willful or knowing conduct, and it likewise requires no proof of actual damages.

The two tracks are not mutually exclusive. A single call can violate both § 227(b) (autodialed call without consent) and § 227(c) (call to a registered number), and courts have allowed recovery under both, compounding the per-call exposure.

No Injury Requirement

The feature that separates the TCPA from most consumer statutes is that a plaintiff need not prove any actual harm. The statutory figure is the floor and, in practice, the measure. The Supreme Court’s standing decision in Spokeo, Inc. v. Robins (2016) required a “concrete” injury for Article III standing, and the TransUnion LLC v. Ramirez (2021) decision tightened that further — but the federal courts of appeals have consistently held that the receipt of an unwanted call or text is itself a concrete injury sufficient to sue. The nuisance is the harm. That means the statutory damages are not a proxy for loss; they are the recovery.

How Violations Multiply

The per-violation figure is deceptively small. The exposure comes from how violations accumulate.

Every Message Is a Violation

Each individual call and each individual text message is a separate violation carrying its own statutory award. A campaign that sends one text to one wrong number is a $500–$1,500 claim. A campaign that sends the same consumer a five-message drip sequence is five violations. A dialer that retries an unanswered number a dozen times over a week has produced a dozen violations against a single consumer.

This is why call-frequency and retry logic are compliance-relevant in their own right: the same non-compliant consent record does more damage the more often it is acted upon.

The Class-Action Multiplier

The statutory-damages structure is what makes the TCPA one of the most-litigated consumer statutes in the country. Because damages are fixed and per-message, and because no individual injury needs to be proven, a class can be certified around a single campaign and a single defective consent practice.

The arithmetic is unforgiving. A campaign that placed 200,000 non-compliant calls faces a baseline exposure of $100 million at $500 per call, and $300 million if the conduct is found willful. These are not hypothetical ceilings; they are the numbers that drive the large TCPA settlements that recur every year. The point of leverage for plaintiffs is not any single call — it is the multiplication of a per-message figure across an entire class list.

For a lead buyer, the exposure is a direct function of volume and deficiency rate. A buyer contacting 10,000 leads a month with even a 1% consent-deficiency rate is generating roughly 1,200 defective contacts a year — between $600,000 and $1.8 million in annual statutory exposure from that single failure mode, before class dynamics or the DNC track are layered on.

The Willfulness Multiplier — Lower Than You Think

The jump from $500 to $1,500 is a tripling of exposure, and the standard for reaching it is far easier to meet than the word “willful” suggests.

Courts interpreting § 227(b)(3) and § 227(c)(5) have overwhelmingly held that “willful or knowing” refers to the volitional act of making the call, not to knowledge that the call was illegal. Under this reading — drawn from the definition of “willful” in § 312(f)(1) of the Communications Act and applied by numerous district courts — a defendant acts willfully when it intends to place the call, regardless of whether it believed it had valid consent. A caller who genuinely but wrongly thought a lead was consented can still be found to have acted willfully because it meant to dial the number.

The practical consequence is that treble damages are a live risk in most contested cases, not an exceptional one reserved for bad actors. It also means the quality of the consent record does double duty: it is both the affirmative defense to liability and the best evidence against a willfulness enhancement, because a caller that can show it reasonably relied on a specific, documented consent record is in a materially stronger position on the treble question than one relying on a generic assurance.

Who Actually Pays: The Proof Burden and Vicarious Liability

The per-violation figures determine the size of the exposure. Two doctrines determine who bears it.

In TCPA litigation, the caller bears the burden of proving consent. Consent is an affirmative defense, which means the plaintiff proves the call was made and the defendant must come forward with the record establishing that the recipient agreed to receive it. A missing, incomplete, or unverifiable consent record is not a neutral gap — it is a failed defense.

This allocation is why documentation is the whole game. The 2023 FCC Lead Generators Order sharpened the requirement by making prior express written consent seller-specific: consent must name the particular seller and cannot be spread across a list of “marketing partners.” A consent record that cannot show the named seller, the disclosure the consumer actually saw, an affirmative action, an immutable timestamp, and an unbroken chain of custody to the number dialed will not carry the defendant’s burden — no matter what a lead purchase agreement warranted.

Vicarious Liability Flows to the Beneficiary

The second doctrine determines that the party with the deepest pocket usually pays. Under vicarious-liability principles the FCC affirmed in its 2013 DISH Network declaratory ruling, the entity that benefits from a call — the advertiser, the brand, the lead buyer — can be held liable for violations committed by its vendors, agents, or contractors under common-law agency theories including actual authority, apparent authority, and ratification.

Because that theory rests on common-law agency rather than agency interpretation of the statute, it was unaffected by the Supreme Court’s decision in Loper Bright Enterprises v. Raimondo (2024), which dismantled Chevron deference. The vicarious-liability exposure of a lead buyer does not depend on deference to an FCC reading; it is grounded in agency law that predates the statute.

The recurring litigation pattern follows directly. When a class action names every party in the chain — the publisher, the lead generator, the dialer, and the buyer — the smaller upstream players frequently settle early and cheaply, leaving the buyer as the last, best-funded defendant standing. Contractual indemnity offers thin protection: an indemnity clause is only as good as the indemnitor’s ability to pay, and an undercapitalized lead vendor that has already settled its own exposure leaves the buyer with a worthless claim and the full class in front of it.

The Statute of Limitations and How Long Exposure Persists

TCPA claims are generally subject to a four-year federal statute of limitations under 28 U.S.C. § 1658. That window matters for two reasons.

First, it defines how large a class can grow: a campaign’s exposure is not limited to recent calls but reaches back across four years of contacts, which is how class lists reach hundreds of thousands of members.

Second, it defines how long a consent record must remain retrievable and intact. A defense that depends on reconstructing what a consumer saw and agreed to at a lead event three years earlier is only as strong as the record preserved from that moment. Consent records that are mutable, siloed with a vendor that may no longer exist, or reconstructable only from a summary rather than the rendered event are the records that fail when the claim finally lands — years after the call.

Practical Checklist: Sizing and Reducing TCPA Exposure

  • Calculate exposure by message, not by consumer. Multiply your monthly non-compliant contact volume — deficiency rate times total contacts — by $500, then by 12 for an annual figure, then by 3 to see the willful ceiling. That is your live statutory exposure before class dynamics.
  • Treat the DNC track as additive. Scrub against the National Do Not Call Registry and maintain a company-specific internal DNC list; a single call can violate both § 227(b) and § 227(c) and be counted twice.
  • Assume willfulness is on the table. Because “willful” means intending the call, not intending to break the law, plan around the $1,500 figure, not the $500 one.
  • Own the consent record, don’t rely on a warranty. Contractual indemnity does not shift the proof burden and is worthless against an insolvent vendor. Hold a record you can produce yourself.
  • Verify the record satisfies the seller-specific rule. The consent must name your entity as the seller, show the disclosure the consumer saw, capture the affirmative action, bear an immutable timestamp, and trace to the number dialed.
  • Preserve records for at least four years. The limitations period defines your retention floor; a record you cannot retrieve is a defense you cannot raise.
  • Distinguish independent records from self-attested ones. A record you can prove was captured independently of the party being paid to deliver the lead is materially harder for a plaintiff to impeach than a summary the vendor generated about itself.

Key Takeaways

  • TCPA damages are statutory and per-message: $500 per violation, up to $1,500 for willful or knowing conduct, with no requirement to prove any actual harm.
  • The danger is not the per-call figure but the multiplication — across every message, across a four-year class, with no injury element to narrow the class.
  • Willfulness is easy to reach, because courts read it as intending the call rather than intending to break the law, putting treble damages in play in most contested matters.
  • The caller carries the burden of proving consent, and vicarious liability routes that burden to the beneficiary of the call — usually the lead buyer, whose indemnity clause is only as good as the vendor’s solvency.
  • The strongest defense is an independent, seller-specific, immutable consent record preserved across the full four-year limitations window — the kind of record that documents what the consumer actually saw and did, not merely that a form was filled out.

Understanding where TCPA exposure comes from is the first step; documenting consent in a way that actually carries the caller’s burden is the second. See how independent consent records hold up in court, or read more on who pays when TCPA consent breaks down and what proof of consent the TCPA actually requires.