Lesson 11 of 25
Telemarketing & Do-Not-Call: TCPA and the Telemarketing Sales Rule
5 min read · CIPP/US
Two regimes, two agencies. Master the TCPA's consent gradations and statutory-damages exposure, the Do-Not-Call Registry and its exceptions, and why a single careless text blast becomes a class action.
Two regimes for phone marketing
- TCPA (FCC) — calls, texts, autodialers, robocalls, faxes
- Telemarketing Sales Rule (FTC) — telemarketing + Do-Not-Call
- They overlap; know which agency owns which rule
- Marketing got more emphasis in the 2025 blueprint
Phone and text marketing is policed by two overlapping regimes, and the current blueprint gives marketing more weight, so this matters. The Telephone Consumer Protection Act, the TCPA, forty-seven U.S.
C. two twenty-seven, is administered by the F-C-C and governs calls, text messages, automated dialing, prerecorded robocalls, and junk faxes. The Telemarketing Sales Rule, the T-S-R, is administered by the F-T-C and governs telemarketing practices and the National Do-Not-Call Registry.
They cover much of the same ground from different statutes. On the exam, the trick is matching the rule to its agency and remembering that the TCPA, with its private right of action, is the bigger litigation driver.
TCPA: consent is the dividing line
- Autodialed/prerecorded calls & texts need prior express consent
- Marketing calls/texts need prior express WRITTEN consent
- Manually dialed informational calls have lower requirements
- Consent must be clear and can be revoked anytime
The TCPA runs on consent, and the exam tests the gradations. Calls or texts made with an automatic telephone dialing system or with a prerecorded voice generally require the called party's prior express consent. When the message is marketing, the bar rises to prior express written consent, a clear, signed agreement that isn't a condition of buying anything.
Manually dialed, purely informational calls, like a flight-delay alert, sit at a lower tier. And consent can be revoked at any time by any reasonable means, after which you must stop. So when you read a scenario, ask three things: was it autodialed or prerecorded, was it marketing, and did the consumer consent in the required form?
The mismatch between the message type and the consent obtained is where liability lives.
Do-Not-Call and the Telemarketing Sales Rule
- National DNC Registry: don't call registered numbers
- Exceptions: established business relationship, prior consent, nonprofits
- TSR bars deceptive/abusive telemarketing, sets call-time limits
- Caller-ID transmission and prompt disclosures required
The Telemarketing Sales Rule and the National Do-Not-Call Registry add a second layer. Consumers register their numbers on the D-N-C list, and telemarketers generally may not call registered numbers. There are exceptions the exam tests: an established business relationship for a limited window, the consumer's prior express written consent, and calls from certain nonprofits and political callers.
Beyond the registry, the T-S-R bans deceptive and abusive telemarketing, limits calling hours to between eight a.m. and nine p.
m., requires telemarketers to transmit caller-ID, and requires prompt disclosure of who's calling and that it's a sales call. So Do-Not-Call is about who you may call, while the rest of the T-S-R is about how you must behave once you do.
Why the TCPA drives litigation
- Private right of action with statutory damages
- $500 per violation, up to $1,500 if willful
- Texts count as "calls" — huge class-action exposure
- Wrong-number and reassigned-number traps
Here's why the TCPA is feared in practice and tested heavily. It carries a private right of action with fixed statutory damages, five hundred dollars per violation, trebled to fifteen hundred dollars if the violation was willful or knowing. Because a single marketing campaign can reach thousands of numbers, and because text messages count as calls under the statute, one careless blast becomes a class action with enormous exposure.
Watch the classic traps: calling a number that was reassigned to a new person who never consented, or relying on stale consent. The lesson for a privacy program is rigorous consent records and scrubbing against the Do-Not-Call list and reassigned-number databases, because under the TCPA the burden of proving consent falls on the caller.
Texts, revocation, and program hygiene
- SMS marketing = a "call" under the TCPA
- Honor STOP/opt-out revocations immediately
- Keep proof of prior express written consent
- Scrub against DNC and reassigned-number databases
Because text-message marketing has exploded, the exam zeroes in on a few operational realities. First, a text counts as a call under the TCPA, so the same consent rules apply, marketing texts need prior express written consent. Second, revocation is immediate and flexible: when a consumer replies STOP or otherwise asks to opt out by any reasonable means, you must stop, and continuing to message them is a fresh violation each time.
Third, because the caller bears the burden of proving consent, you must keep clean records of exactly what each consumer agreed to and when. Fourth, scrub your lists, against the National Do-Not-Call Registry and against reassigned-number databases, because a number that once belonged to a consenting customer may now belong to a stranger who never agreed. Good program hygiene, consent records, prompt opt-out handling, and list scrubbing, is what keeps a campaign out of a class action.
Exam reasoning: match agency, message, and consent
- TCPA = FCC + consent + private suits; TSR = FTC + Do-Not-Call
- Marketing → written consent; autodialer/robocall → express consent
- Check DNC registration and exceptions
- Distractor: treating informational and marketing calls the same
Let's set the reasoning. First, identify the regime: TCPA questions sound like autodialers, robocalls, texts, and private lawsuits, and live with the F-C-C; Telemarketing-Sales-Rule questions sound like the Do-Not-Call Registry and abusive-telemarketing conduct, and live with the F-T-C. Second, classify the message: marketing demands prior express written consent, while autodialed or prerecorded calls demand at least prior express consent, and informational manual calls demand the least.
Third, check Do-Not-Call status and whether an exception, like an established business relationship, applies. The favorite distractor blurs informational and marketing calls; they carry different consent bars. Recap: two regimes, two agencies, consent as the dividing line, and the TCPA's statutory damages as the reason to get it exactly right.
Now go test yourself, then on to email and digital marketing.
Sources
- Telephone Consumer Protection Act (TCPA, 47 U.S.C. § 227)
- FCC TCPA rules (47 CFR § 64.1200)
- Telemarketing Sales Rule (TSR, 16 CFR Part 310) and National Do-Not-Call Registry
- FTC and FCC guidance
- IAPP CIPP/US Body of Knowledge, Domain II.E (Telecommunications and Marketing)
Test your knowledge
A few CIPP/US questions on this material — pick an answer to see the explanation.
Q1. The Driver's Privacy Protection Act (DPPA) restricts state motor vehicle departments from disclosing personal information from their records except:
Q2. Under CAN-SPAM, which statement correctly describes how the Act treats transactional or relationship messages?
Q3. The FTC's Telemarketing Sales Rule (TSR) and the national Do Not Call (DNC) registry primarily restrict:
Q4. Under the HIPAA Security Rule, which category of safeguards includes workforce training and access management policies?