TCPA Compliance in 2026: A National Guide to Calling and Texting Rules

Introduction: TCPA compliance is everyone’s problem

If you’ve ever felt like TCPA lawsuits only target the little guys, you’re not alone. Smaller brands often can’t afford a law firm on a big monthly retainer, let alone a six- or seven-figure settlement. But the biggest names in banking, retail and telecom are getting hit too.

Whether you call prospects in one state or all fifty, TCPA compliance in 2026 is a moving target. Class actions keep coming. The FCC is reshaping how caller ID, robocall and opt-out rules work. And a growing number of states are layering their own “mini-TCPA” laws on top of federal rules.

In this guide, we’ll give you a national overview of what matters most right now:

1. The federal rules every business that calls or texts needs to know
2. Why nationwide TCPA class actions keep hitting household-name brands
3. The FCC’s expanding STIR/SHAKEN, KYC and robocall mitigation rules
4. The FCC’s new opt-out rule that lets businesses designate how consumers say “stop”
5. How state telemarketing laws add another layer, with a few examples

Then we’ll share a practical checklist, explain how Superhuman Prospecting keeps client campaigns compliant across the country, and answer the questions we hear most often.

A tip of the hat to Allen, Mitchell & Allen PLLC, a TCPA defense and compliance law firm whose recent newsletter inspired this roundup.

The federal TCPA rules every business needs to know

The Telephone Consumer Protection Act (TCPA) has been the backbone of U.S. telemarketing law since 1991. The FCC writes the rules, and the FTC enforces a companion regulation, the Telemarketing Sales Rule (TSR). Together they apply to calls and texts in all 50 states.

Here are the core requirements in plain English:

Penalties: consumers can sue for $500 per violating call or text, rising to $1,500 if the violation was willful. Because there’s no cap and class actions are allowed, a single campaign can turn into a multimillion-dollar case. The FTC can also seek civil penalties of more than $50,000 per TSR violation.

The legal ground is shifting, too. In 2025, the U.S. Supreme Court ruled in McLaughlin Chiropractic v. McKesson that federal courts don’t have to follow the FCC’s interpretations of the TCPA. That means courts in different parts of the country may read the same rule differently, which makes a conservative, documented process even more valuable.

Even the biggest brands are facing TCPA class action lawsuits

In just the last few months, Eric Allen of Allen, Mitchell & Allen PLLC tracked new nationwide TCPA class actions against dozens of major companies. The list reads like a mall directory and a Fortune 500 roster combined: Wells Fargo (again), American Express (three times in one month), T-Mobile, AT&T, Comcast, JPMorgan Chase, CVS Pharmacy, United Airlines, H&M, Zara, Tiffany & Co., Birkenstock USA, Groupon, Shutterfly, Omaha Steaks and Norwegian Cruise Line, among others.

Many of these suits seek damages going back four years, the TCPA’s statute of limitations. At $500 to $1,500 per call or text, the math gets scary fast.

Why big companies keep getting sued

• Scale multiplies mistakes. One bad consent flow or one broken opt-out process can touch millions of messages.
• Vendors create blind spots. Lead sellers, texting platforms and outsourced call teams all touch consent and opt-outs.
• Plaintiffs’ firms are organized. A small group of repeat plaintiffs files a large share of TCPA cases, and they know exactly what to look for.

The takeaway for growing businesses

Deep pockets don’t buy immunity, and a small budget doesn’t make you invisible. The brands that stay out of court treat compliance as a process: documented consent, clean lists, fast opt-outs and partners who take it as seriously as they do.

The FCC keeps expanding STIR/SHAKEN, KYC and robocall mitigation rules

STIR/SHAKEN is the caller ID authentication framework that helps carriers confirm a call really comes from the number shown. The FCC pairs it with “Know Your Customer” (KYC) rules and the Robocall Mitigation Database (RMD), where voice service providers file plans describing how they stop illegal robocalls.

That used to be a carrier problem. Not anymore. Regulators and big carriers increasingly treat dialing and texting platforms as voice service providers, which means smaller brands running their own calling infrastructure may now be expected to file robocall mitigation plans.

The pressure is still rising in 2026:

• In April, the FCC proposed tougher KYC and “Know Your Upstream Provider” rules for originating providers (Mintz).
• In September, it proposed a major expansion of the RMD, with more detailed mitigation plans and a framework for removing providers that fall short (Mintz).
• Providers removed from the RMD effectively lose the ability to send traffic, because carriers can only accept calls from listed providers.

Why it matters to you: if your dialer or texting vendor gets removed or flagged, your campaigns stop and your numbers get labeled “spam likely.” Ask your vendors how they handle STIR/SHAKEN attestation and RMD filings, and find out whether your own setup puts you in the provider category.

The FCC’s new opt-out rule: businesses can now define how people say “stop”

Under the FCC’s 2024 rules, consumers could revoke consent “by any reasonable means.” That opened the door to lawsuits built on odd opt-outs like “leave me alone,” “no more please,” or a muttered “not interested” before hanging up. Some plaintiffs reply to “Text STOP to opt out” with deliberately nonstandard wording, then sue when it isn’t caught.

On September 30, 2026, the FCC adopted an order changing that (Day Pitney). A business can now designate one exclusive opt-out method:

• An automated, interactive voice or key-press opt-out on the call
• A reply text using one of seven standard words: STOP, QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE
• A phone number or website set up to process opt-outs

The catch: you must clearly disclose the designated method in every call or text. Texters can disclose a single keyword like “Reply STOP,” but must still honor all seven standard words (Latham & Watkins). If you don’t designate a method, the old “any reasonable means” rule still applies. The order also lets businesses read revocations more narrowly by message category, though opting out of one marketing message still stops all marketing.

The new rules take effect 30 days after publication in the Federal Register, so confirm the effective date before you rely on them. The FCC is also taking comments on shortening the 10-business-day window to honor opt-outs.

Our take: this is a real win for businesses, but only if you set it up properly. Write the opt-out language into every script and text template, and keep records proving you disclosed it.

State telemarketing laws add another layer

Federal law sets the floor, not the ceiling. A growing list of states have passed their own “mini-TCPA” laws, and many give consumers a separate right to sue. If your reps call or text across state lines, the strictest state you reach effectively sets your rules.

State laws tend to tighten the same few levers:

• Shorter calling windows. Several states end calling at 8 p.m. instead of 9 p.m., and some ban Sunday or holiday calls.
• Call frequency caps. Some limit how many times you can call the same person about the same thing in 24 hours.
• Broader consent requirements. Some require written consent for automated calls or texts beyond what federal rules demand.
• Registration or licensing. Many states require telemarketers to register and sometimes post a bond.
• Their own penalties. State damages often stack on top of federal TCPA exposure.

A few examples of strict state laws

Pennsylvania’s update is a good sign of where states are heading. It also extends liability to the company that hired the telemarketer, not just the one dialing (TCPAWorld). In other words, outsourcing your calls doesn’t outsource your risk.

Our take: you don’t need to memorize 50 statutes. You do need a process that checks each number’s state, applies the strictest rules that fit, and documents what you did.

Your 2026 TCPA compliance checklist

You don’t need a giant legal budget to lower your risk. You need a repeatable process that works no matter where your prospects live. Here’s where we’d start:

• Audit your consent records. Can you prove who consented, to what, for which number, and when?
• Scrub every list before you dial. Check the National DNC Registry at least every 31 days, plus state DNC lists, your internal do-not-call list and a known-litigator list.
• Know where each number lives. Map area codes to states and time zones, and apply the strictest calling window that fits.
• Check state registration requirements. Many states require telemarketers to register before calling or texting their residents.
• Pick and disclose a designated opt-out method. Put “Reply STOP to opt out” or a key-press opt-out in every message and script.
• Honor opt-outs fast and everywhere. Sync suppression lists across your dialer, CRM, texting tool and vendors, within 10 business days at most.
• Vet your vendors. Ask about STIR/SHAKEN attestation, Robocall Mitigation Database status, dialer type and how they handle DNC and litigator scrubs.
• Avoid risky dialing tech. Predictive and parallel dialers and prerecorded messages carry more legal and “spam likely” risk.
• Put it in writing. Your vendor contracts should spell out who handles consent, scrubbing and opt-outs.
• Talk to a TCPA attorney. Many offer affordable flat-fee reviews, and an hour of advice is cheaper than a class action.

How Superhuman Prospecting handles cold calling compliance for clients

At Superhuman Prospecting, compliance isn’t a checkbox. It’s built into every one of our cold calling campaigns before a single dial. Our clients sell to businesses all over the United States, so our process starts with federal rules and then layers on the strictest state requirements.

Here’s what happens to your list before our SDRs pick up the phone:

1. Federal DNC scrub. Every list is checked against the National Do Not Call Registry.
2. Strict-state scrub. We scrub against the rules of 13 states with the toughest telemarketing laws, including Pennsylvania, Florida, Texas, California, New Jersey, Maryland and Washington.
3. Litigator scrub. About a third of TCPA lawsuits come from a small group of repeat plaintiffs. We remove numbers flagged as known litigators before any campaign.
4. Internal Do Not Call list. Anyone who asks not to be called, or is marked Not Interested, Unreachable or already converted, goes on our internal DNC list. That protects them, and you, across every future campaign.
5. Your suppression list. We scrub against any client-provided suppression list, so your current customers and opt-outs stay off the call sheet.
6. Smart number handling. Wireless numbers in states with wireless restrictions are excluded. Toll-free and unknown-location numbers are held for conservative calling windows. Numbers restricted under state auto-dial laws are flagged for manual dialing only.

You get a clear status for every contact (Approved, Denied, Pending or Used for Campaign), so you always know what was called and why.

A few more things that set us apart:

• No predictive, parallel or robo-dialing. Our USA-based SDRs use manual or auto dialing only. That’s safer under state laws and means fewer “spam likely” flags.
• Real humans, real conversations. Every SDR is trained in the H2H Method, which is built on honest, non-deceptive conversations. That’s good for compliance and better for your brand.
• Legal backing. We work with a law firm that specializes in telemarketing compliance.
• TCPA compliance in every package. It’s included in all calling plans, not sold as an add-on, and our list building service includes DNC, litigator and suppression-list scrubs.

The result: you get the pipeline benefits of outbound calling in every market you sell to, without carrying the compliance burden alone.

Conclusion: stay nimble, stay compliant

TCPA compliance in 2026 comes down to a simple truth: the rules keep changing, and the lawsuits keep coming. Big brands are getting sued nationwide. The FCC is tightening caller ID and robocall rules while giving businesses new tools to manage opt-outs. And states keep adding their own penalties on top of federal law.

None of that means you should stop calling. Outbound is still one of the fastest ways to start real conversations with real buyers and book qualified sales appointments. It just means you need clean lists, documented consent, clear opt-outs and partners who sweat the details.

Want outbound results without the compliance headaches? Talk to Superhuman Prospecting about a campaign built compliant from day one.

This article is for general information and isn’t legal advice. Talk to a qualified TCPA attorney about your specific situation.

Frequently asked questions about TCPA compliance

What is TCPA compliance?

TCPA compliance means following the Telephone Consumer Protection Act and the FCC’s rules for telemarketing calls, texts, autodialers and prerecorded messages. That includes getting proper consent, respecting Do Not Call lists, calling within allowed hours and honoring opt-outs.

What are the penalties for violating the TCPA?

The TCPA allows $500 per violating call or text, rising to $1,500 if the violation was willful, with no cap on total damages. The FTC can also seek civil penalties under the Telemarketing Sales Rule, and many states add their own damages on top.

What are the federal calling hours for telemarketing?

Federal rules allow telemarketing calls between 8 a.m. and 9 p.m. in the recipient’s local time. Some states are stricter, ending calls at 8 p.m. or banning Sunday calls, so check the rules for each state you call into.

Do state telemarketing laws apply if my business is in another state?

Usually, yes. State telemarketing laws generally protect the state’s residents, so they can apply based on where the person you’re calling or texting lives, not where your business is located.

Is B2B cold calling exempt from the TCPA?

Partly. Calls to business landlines generally aren’t covered by the National DNC Registry. But calls to cell phones, autodialed or prerecorded calls, and state laws like Pennsylvania’s can still apply, even in B2B outreach.

What does the FCC’s new opt-out rule change?

Businesses can designate one exclusive way for consumers to opt out, such as replying with a standard keyword like STOP, pressing a key, or using a set phone number or website. If the method is clearly disclosed, the business generally doesn’t have to honor opt-outs made other ways.

Does outsourcing cold calling protect my company from TCPA liability?

No. Under TCPA case law, and some newer state laws, the company that hires a caller can be held liable for that caller’s violations. That’s why it matters to choose a partner with a documented compliance process.

How does Superhuman Prospecting keep campaigns compliant?

We scrub every list against the National DNC Registry, the rules of 13 states with the strictest telemarketing laws, a known-litigator list, our internal DNC list and your suppression list. We use USA-based SDRs with manual or auto dialing only, and we work with a telemarketing compliance law firm.