TCPA Compliance for Pay Per Call: What You Must Know

Let me start with the number that keeps people up at night. $1,500. That's the per-violation ceiling under the Telephone Consumer Protection Act when a court decides you did it on purpose. Multiply that across a few thousand calls in a class action and you've got a settlement that ends a company.

This is the part of [pay per call](/networks-buyers-and-compliance/what-does-a-compliance-officer-do-in-pay/) nobody puts on the sales deck. It isn't glamorous. But ignoring it is a fine way to light money on fire and the fire comes with a lawyer attached.

What the TCPA actually covers

The TCPA became law in 1991, back when a fax machine was a threat and cell phones were the size of a shoe. The Federal Communications Commission enforces it, and the rules cover calls, texts, and prerecorded or artificial-voice messages. So this isn't just an old-phone problem. It applies to your SMS follow-ups and your ringless voicemail schemes too.

The core requirement is consent. Before you make a telemarketing call or text to a cell phone using an autodialer or a prerecorded voice, you need prior express written consent. That means signed. Specific. And it can't be buried as a condition of buying something. If the only way a customer gets your product is by "agreeing" to be called, that consent isn't worth the pixels it's printed on.

Damages run $500 per violation for standard breaches and up to $1,500 for willful ones. In a class action there's no cap on total liability. Read that again. No cap.

Why pay per call has a special problem

Here's the twist that gets networks and buyers in trouble. You can be liable for a violation you didn't commit.

In pay per call, the buyer or network can be held responsible for a publisher's or affiliate's violations under vicarious liability. In practice that means the affiliate who bought a sketchy lead list and blasted texts to numbers he never got consent for can drag the whole chain into court. The advertiser at the top of the funnel, the one who never touched a phone, is now a defendant.

I learned this the slow way, watching a buyer get named in a suit over calls a third-tier affiliate generated. He'd never seen the opt-in page. Didn't matter. His name was on the campaign. That's the day I started treating vendor vetting like a real line item instead of a formality.

The takeaway is uncomfortable but simple. Good consent records and honest vetting protect everyone in the chain, not just the person who pressed dial. If you run traffic, you need to know exactly where your leads came from and what those people agreed to. Can't produce that? Assume you're exposed.

The Do Not Call Registry and calling hours

The National Do Not Call Registry launched in 2003. Telemarketers have to scrub their call lists against it. Numbers stay registered permanently unless the owner removes them, so "it was old data" is not a defense. Violations here carry their own penalties, separate from the consent stuff.

Then there's timing. Telemarketing calls are generally restricted to between 8 a.m. and 9 p.m. in the called party's local time zone. Not yours. This trips people up constantly. If you're running a campaign from Denver and dialing New York at 7:45 a.m. your time, congratulations, it's 9:45 in the recipient's world and you're fine. Reverse it and you're calling people at breakfast in violation. Route by actual number geography, not area code, because area codes lie now that everybody keeps their number forever.

The 2024 consent rule and why it got messy

The FCC tried to tighten lead generation with what became known as the "one-to-one consent" rule, part of a broader 2024 rulemaking. The idea was that a consumer's consent had to go to one specific seller, not a giant list of "marketing partners" hiding behind a checkbox. Reasonable, honestly. That checkbox thing was always a scam.

Then a federal appeals court struck down the provision in early 2025. So the rule as written isn't in force the way people expected.

Here's my advice. Don't celebrate. Courts and regulators keep circling back to the same principle: vague, list-wide consent is bad, and specific consent is good. Build your systems to the stricter standard now. You'll save the rebuild later, and juries like it when your opt-in language reads like a human wrote it for a human. I go deeper on structuring clean campaigns over on AdamYoung.com, and Perry Marshall's book The Pay Per Call Revolution is worth reading for the business-model context around all this.

States that make it harder

Federal rules are the floor. Plenty of states pile more on top.

Florida's "Mini-TCPA" took effect in 2021 and broadened the autodialer definition while adding its own damage provisions, which set off a wave of litigation aimed at the state. Oklahoma passed its own version, and others have followed or are drafting theirs. A few things are worth knowing here. Some state autodialer definitions are wider than the federal one, so a system that's legal nationally can still trip a state law, and state damage provisions can stack on top of federal claims. Consent and disclosure requirements sometimes differ by state too, which means one national opt-in form may not cover you everywhere.

Anyway, if you run high volume in Florida, treat it as its own compliance project. People got sued a lot there for a reason.

What to actually do

The boring stuff is what saves you. Keep detailed consent records: timestamps, IP addresses, the exact opt-in language the person saw, and the URL where they saw it. Store all of it for at least four to five years, which lines up with the typical statute of limitations on TCPA claims. If a plaintiff's attorney shows up in year three, you want a clean file, not a shrug.

Compliance tooling exists for this. Consent management and litigation-defense platforms typically run from a few hundred dollars a month into several thousand, scaling with your call volume and features. If you're routing serious traffic, a call platform like Ringba helps with the tracking and attribution side, so you can actually prove which publisher sent which call. Proof is the whole game here.

One more thing. Vet your publishers before the money starts, not after the lawsuit. Ask where the traffic comes from. Ask to see the opt-in flow. If someone gets cagey about their sources, that's your answer.

Quick FAQ

Does the TCPA apply to inbound calls where the consumer dials me? Mostly, no. If the consumer calls you, that's inbound and the consent rules for outbound telemarketing don't apply the same way. The risk lives in outbound dialing and texting, and in how the lead that prompted the call was generated.

Can I rely on my publisher's consent records instead of keeping my own? You can, but not alone. Under vicarious liability you may be on the hook regardless, so keep copies or contractual access to the records yourself.

How long do I need to keep consent proof? Four to five years is the widely recommended practice, matching the typical statute of limitations. Longer doesn't hurt if storage is cheap.

Is a single national opt-in form enough? Often not. States like Florida add requirements, so review your form against the states where you run the most volume.

What's the fastest way to reduce risk right now? Fix your calling hours by recipient time zone and scrub against the Do Not Call Registry. Those two are cheap, fast, and account for a big share of easy claims.