Prospecting penalties: TCPA, DNC, CAN-SPAM and state fines

Penalty by law, per violation

The largest exposure is usually a private suit, not a regulator. The TCPA lets the person called sue for $500 per violation. The FTC's cap is higher per violation, but the FTC brings far fewer cases. The table lists the statutory figure, who enforces it and the source. The state rules that sit on top of these are in cold calling laws by state.

Law	Amount	Who enforces	Source
TCPA, prerecorded and autodialed calls, 227(b)(3)	$500 per violation or actual loss, whichever is greater; up to 3 times if willful or knowing	The person called, in court	47 U.S.C. 227
TCPA, Do Not Call rules, 227(c)(5)	Up to $500 per violation; up to 3 times if willful or knowing. Requires more than one call in 12 months. Reasonable practices with due care is a defense	The person called, in court	47 U.S.C. 227
TCPA, state attorney general, 227(g)	$500 per violation, up to 3 times if willful or knowing	State attorneys general	47 U.S.C. 227
TCPA, FCC forfeiture, 227(b)(4)	Set under the Communications Act; for intentional violations, an added penalty not to exceed $10,000	FCC	47 U.S.C. 227
Telemarketing Sales Rule and Do Not Call	Up to $53,088 per violation	FTC and DOJ	FTC Q&A, 16 CFR 1.98
CAN-SPAM	Up to $53,088 per separate email	FTC	FTC guide
Florida FTSA	$500 or actual damages, up to 3 times if willful or knowing; attorney fees to the prevailing side	The person called; state agencies for civil penalties	Fla. Stat. 501.059
Texas	$500 per violation or actual damages; up to $1,500 or 3 times actual damages if knowing or intentional	The person called	Bus. and Com. Code 305.053

The federal civil penalty figures are inflation adjusted. The $53,088 amount applies to penalties assessed after 01/17/2025. In a notice scheduled for the 09/15/2026 Federal Register, the FTC said its civil penalty amounts remain unchanged during 2026, so the 2025 levels still apply (FTC notice).

How violations are counted

Each call that breaks the rule is a separate violation, and each email is a separate violation under CAN-SPAM. The statutes say "each such violation," and the FTC guide says "each separate email." The count is what turns a small number into a large one.

Worked example, using the statutory figures above. A team places 2,000 prerecorded calls to cell phones without written consent.

• At $500 per call: 2,000 x $500 = $1,000,000.
• If a court finds the violations willful and trebles them: 2,000 x $1,500 = $3,000,000.
• Add the FTC route on the same conduct, at the maximum of $53,088 per violation: 2,000 x $53,088 = $106,176,000. This is a ceiling, not a prediction. Courts set the actual penalty case by case.

Under the Do Not Call private claim, the called person needs more than one violating call in any 12-month period (47 U.S.C. 227(c)(5)). In Florida, a person who gets a violating text must first reply STOP, and the sender then has 15 days to stop before a suit can be filed (Fla. Stat. 501.059(10)(c)).

How class actions multiply it

A class action lets one person sue for everyone who received the same call or text. The damages formula then runs across the whole class. This is why a dialing campaign, not a single call, is the unit of risk.

Two court and agency records show the scale.

• Krakauer v. Dish Network. A jury found a vendor made calls as Dish's agent and awarded $400 per call. The district court found the violations willful and knowing and trebled the award. The Fourth Circuit affirmed on 05/30/2019 in No. 18-1518 (opinion).
• United States v. Dish Network. On 06/06/2017 the FTC announced a ruling in a case brought with DOJ and four states. The Central District of Illinois ordered $280 million in civil penalties, $168 million of it to the federal government, and found more than 66 million Telemarketing Sales Rule violations (FTC).

Both cases involved a seller whose outside call centers made the calls. The next section covers why that matters.

Seller liability for a vendor's calls

A seller can be liable for calls it did not place. In a 2013 declaratory ruling (FCC 13-54, adopted 04/17/2013, released 05/09/2013), the FCC held that a seller may be held vicariously liable under federal common law agency principles for violations of either section 227(b) or 227(c) by a third-party telemarketer (FCC 13-54). The Fourth Circuit applied agency law in Krakauer and held Dish liable for the willful conduct of its agent. The FTC takes the same view for email: the company whose product is promoted and the company that sent the message can both be liable.

Practical steps:

• Put TCPA, Do Not Call and CAN-SPAM duties in the vendor contract.
• Require the vendor to scrub against the National Do Not Call Registry and your internal list.
• Keep consent records yourself. A vendor's record is not enough if the vendor disappears.
• Audit a sample of the vendor's calls every month.

Personal liability of officers, and insurance

An owner or officer can be sued personally when he took part in the violation. The leading test comes from Texas v. American Blastfax, 164 F. Supp. 2d 892 (W.D. Tex. 2001): officers are not personally liable solely because of their status as officers, but an officer who directly participated in or authorized the statutory violations can be, even while acting for the corporation. The Missouri Court of Appeals applied that rule to a company president on 02/05/2013 (Hoops and Associates v. Financial Solutions, 395 S.W.3d 594). Courts apply "direct participation" differently, so the result depends on the circuit and the facts. Treat any owner who approves a call script, a dialer setup or a list purchase as exposed.

Insurance is a separate gap. Some liability policies exclude claims built on statutory damages for calls, texts or email. Ask your broker in writing whether your policy covers TCPA and CAN-SPAM claims, and do not assume it does.

What changed in the last 24 months

• 01/17/2025: The FTC's adjusted civil penalty maximum of $53,088 took effect for penalties assessed after that date (16 CFR 1.98).
• 01/24/2025: The Eleventh Circuit vacated the FCC's one-to-one consent requirement before it took effect (Insurance Marketing Coalition v. FCC). Prior express written consent remains the standard.
• 06/20/2025: In McLaughlin Chiropractic v. McKesson, the Supreme Court held that a district court is not bound by the FCC's interpretation of the TCPA (opinion). FCC guidance still carries weight, but defendants and plaintiffs can both argue the statute afresh.
• 01/06/2026: The FCC extended the waiver of its "revoke all" consent rule to 01/31/2027 (DA 26-12).
• 09/15/2026: The FTC said 2026 civil penalty amounts are unchanged and the 2025 levels still apply (notice).
• 09/30/2026: The FCC adopted an order letting callers read a revocation as covering only the category of informational calls it addressed, and opened further comment on revocation timing and texting (FCC 26-67). See consent revocation rules.

The single policy that clears all of it

Most of the exposure above comes from the same few mistakes. One policy removes them.

• Scrub every list against the national registry, state registries and your own internal list at least every 31 days.
• Dial by hand or with a human-initiated dialer. No prerecorded or artificial voice without prior express written consent.
• Send no marketing text without written consent that names your company. See SMS marketing rules and 10DLC and what the TCPA covers.
• Honor any stop request at once and log it. Keep an internal do-not-call list permanently.
• Keep the consent record for each number: date, source and wording.
• Put an unsubscribe link and a postal address in every commercial email. See CAN-SPAM cold email rules.
• Bind every vendor to this policy in writing and audit them.

The operating side is in the cold calling how-to. The full list of compliance guides is in the compliance hub.

Next step

To size a calling or mailing campaign before you scrub it, see the homeowner counts and request a count at /get-counts/.

This page is a plain-English summary with sources, not legal advice. Last reviewed 10/10/2026.

Questions people ask

Q01How much is a TCPA fine per call?

A person who received an illegal call can recover $500 per violation, or actual loss if greater. A court may raise that to as much as three times, so $1,500, if the violation was willful or knowing. Statute: 47 U.S.C. 227(b)(3).

Q02Does the FTC fine per call or per campaign?

The FTC seeks civil penalties per violation, and each call can count. The current statutory maximum is $53,088 per violation. In the Dish Network case, the court counted more than 66 million Telemarketing Sales Rule violations.

Q03Is a seller liable for TCPA violations by its outside call center?

It can be. The FCC ruled in 2013 (FCC 13-54) that a seller can be vicariously liable under federal agency law for a third-party telemarketer's calls. In Krakauer v. Dish Network, the Fourth Circuit upheld a trebled class verdict against Dish for calls its vendor placed.

Q04Can an owner or officer be sued personally?

Yes, in some cases. Courts applying the rule from Texas v. American Blastfax hold an officer liable if he directly participated in or authorized the violation. Holding the title alone is not enough.

Q05What does one illegal email cost under CAN-SPAM?

The FTC says each separate email in violation is subject to penalties of up to $53,088. Both the company whose product is promoted and the company that sent the message can be held responsible.

Sources

1. 47 U.S.C. 227 (TCPA), Cornell LIIlaw.cornell.edu
2. 16 CFR 1.98, FTC adjusted civil penalty amountslaw.cornell.edu
3. FTC civil penalty inflation notice, 2026 (amounts unchanged)public-inspection.federalregister.gov
4. FTC Q&A for telemarketers and sellers about DNC provisions of the TSRftc.gov
5. FTC CAN-SPAM Act compliance guide for businessftc.gov
6. Fla. Stat. 501.059 (Florida Telephone Solicitation Act)leg.state.fl.us
7. Tex. Bus. and Com. Code 305.053, Texas Legislature statute texttcss.legis.texas.gov
8. FCC 13-54, Declaratory Ruling (DISH Network), released 05/09/2013docs.fcc.gov
9. Krakauer v. Dish Network, No. 18-1518 (4th Cir. 05/30/2019)ca4.uscourts.gov
10. FTC and DOJ: $280 million civil penalties against Dish Network (06/06/2017)ftc.gov
11. Texas v. American Blastfax, Inc., 164 F. Supp. 2d 892 (W.D. Tex. 08/17/2001)courtlistener.com
12. Hoops and Associates v. Financial Solutions, 395 S.W.3d 594 (Mo. Ct. App. 02/05/2013), applying American Blastfax (third-party host of the opinion)ott.law
13. McLaughlin Chiropractic v. McKesson, U.S. Supreme Court (06/20/2025)law.cornell.edu
14. Insurance Marketing Coalition v. FCC, 11th Cir. (01/24/2025)media.ca11.uscourts.gov
15. FCC DA 26-12, consent revocation waiver extended (01/06/2026)docs.fcc.gov
16. FCC 26-67, TCPA Report and Order and Further Notice of Proposed Rulemaking (adopted 09/30/2026, released 10/01/2026)docs.fcc.gov