TCPA Compliance Checklist for 2026: A Practical Guide for Outbound Teams

TL;DR: TCPA compliance comes down to three things: prove consent before you contact someone, stop fast when they ask, and only reach people you're allowed to, when you're allowed to. The 2026 checklist for any team that calls or texts US consumers:

• Get and document prior express written consent before autodialed or pre-recorded marketing calls and texts.
• Honor every opt-out within 10 business days, however the consumer asks.
• Scrub three lists before you dial: the National Do-Not-Call registry, your own internal suppression list, and the FCC Reassigned Numbers Database.
• Call only 8 a.m. to 9 p.m. in the recipient's local time zone, and tighter where a state requires it.
• Identify yourself on every contact with your business name and a callback number.
• Follow state "mini-TCPA" laws (Texas, Virginia, Oregon, and a growing list) for every state you contact.
• Vet the consent behind any purchased leads. A vendor's bad consent becomes your liability.
• Keep proof of consent and contact history you can produce on demand.

This article is general education, not legal advice. Your TCPA exposure depends on your specific practices and the states you contact. Work with qualified counsel to build your program.

What is TCPA compliance?

The Telephone Consumer Protection Act is the 1991 federal law that governs how businesses can call and text consumers, with the FCC writing and updating the rules beneath it. At its core, the TCPA requires consent before you send autodialed or pre-recorded marketing calls and texts, gives consumers the right to opt out, and limits when and how you can contact them.

The stakes are high. Under the TCPA's private right of action, statutory damages run $500 per violation and up to $1,500 for willful or knowing violations, and every individual call or text can count as a separate violation. There is no cap on total exposure, so a single non-compliant campaign can become a class action. TCPA filings have climbed sharply over the past two years.

Key takeaway: The TCPA controls consent, opt-outs, and timing for calls and texts. Damages of $500 to $1,500 per message, with no cap, are what make it a board-level risk.

What changed in 2025 and 2026

Three developments reshaped TCPA compliance.

The consent-revocation rule (effective April 11, 2025)

The FCC's revocation-of-consent rule lets consumers revoke consent in any reasonable manner. They do not have to use a specific keyword or form. A reply of "stop texting me," a verbal request to an agent, or an email all qualify. Once a consumer revokes, you must stop the relevant calls and texts within 10 business days. One narrow provision, whether a single opt-out automatically applies across every unrelated message type, was delayed past its original date and is still being resolved. The core 10-business-day rule is in force.

The one-to-one consent rule was struck down

The FCC's one-to-one consent rule would have banned "bundled" lead-generation consent. It never took effect. The Eleventh Circuit vacated it on January 24, 2025 in Insurance Marketing Coalition v. FCC, days before its scheduled start. Bundled consent remains permissible under the existing "prior express consent" standard. Document how clearly you obtained consent, because that question is still litigated constantly.

State "mini-TCPA" laws now cover texts

The federal TCPA is no longer the whole story. Several states now have their own statutes that explicitly cover marketing texts. Texas extended its telephone-solicitation law to text and image messages effective September 1, 2025, with damages of $500 to $5,000 per violation. Virginia began requiring businesses to honor STOP requests for years, effective January 1, 2026. Oregon added text coverage with tighter 8 a.m. to 8 p.m. hours and daily call caps, also effective January 1, 2026. If you contact consumers nationwide, your checklist has to be multi-state.

Key takeaway: Honor opt-outs in any form within 10 business days, treat bundled consent as legal but well-documented, and track the state texting laws that apply where you contact.

The 2026 TCPA compliance checklist

Ten steps that map to how the rules work today.

1. Get and document prior express written consent for autodialed or pre-recorded marketing calls and texts. Keep the timestamp, the source, and the exact language the consumer agreed to.
2. Honor opt-outs in any reasonable manner within 10 business days. A STOP reply, "remove me," or a verbal request to a rep all count. Suppress across the channels the consumer named.
3. Scrub against the National and state Do-Not-Call registries before you dial. Our DNC compliance guide covers the full process.
4. Respect calling hours. The federal window is 8 a.m. to 9 p.m. in the recipient's time zone, and some states are tighter. Calling across regions requires time-zone-aware dialing, not a single office clock.
5. Identify yourself on every contact with your business name and a callback number, and pair that with a clean caller reputation so you are identified rather than flagged.
6. Maintain an internal Do-Not-Call and suppression list, and check it on every campaign separately from the federal registry.
7. Track state mini-TCPAs for every state you contact, especially for texting programs.
8. Confirm consent before autodialing. If your platform cannot verify that a number is consented and not on a suppression list, that number should not be in the dialer.
9. Keep proof of consent and contact history. In a dispute, the question is almost always whether you can show consent, so make that a one-click answer.
10. Train your team and monitor rule changes. The rules moved three times in 18 months, and they will keep moving.

2026 TCPA quick reference

Key takeaway: Consent, 10-business-day revocation, calling hours, DNC scrubbing, identification, and state rules are the spine of a defensible 2026 program.

TCPA exceptions

Some calls fall outside the marketing rules, but the exceptions are narrower than people assume, so confirm before relying on one. Common ones include genuine emergency calls, certain non-commercial and tax-exempt nonprofit calls, and specific informational messages such as some healthcare or package-delivery notices that meet strict conditions. "We thought it was exempt" is not a defense. If you are unsure, treat the contact as covered and get consent.

How Aloware operationalizes the checklist

A checklist on paper only protects you if your tooling enforces it on every call and text. Aloware gives outbound teams the controls to turn this checklist into defaults:

• Opt-out handling. When a contact replies STOP, Aloware automatically suppresses further texts to them. To stop calls as well, add the contact to your do-not-call / suppression list, which is what blocks calling them.
• An internal do-not-call and suppression list your whole team works from, so a number you have marked stays off your campaigns.
• Full call and message logging, with calls and texts recorded against the CRM contact, so your contact history and opt-out records are an audit trail you can pull on demand.
• Time-zone-aware dialing that respects 8 a.m. to 9 p.m. local windows across regions.
• Trusted, identified calling through STIR/SHAKEN attestation and A2P 10DLC registration, so your calls and texts go out properly identified and deliverable.
• A power dialer that works from your lists and honors your suppression list.

One honest caveat: software supports compliance, it does not replace it. Your consent practices, your policies, and your legal counsel own the program. Aloware gives you the controls to run it consistently at volume.

Key takeaway: The checklist becomes real when your tooling enforces it. Opt-out and suppression handling, contact logging, time-zone guardrails, and identified calling are where Aloware does the operational work.

The bottom line

TCPA compliance in 2026 rests on a few disciplines. Honor opt-outs in any form within 10 business days, document consent cleanly, respect calling hours by the consumer's clock, and track the states you text into. Then make your tooling enforce all of it, so a fast outbound team stays well inside the rules.

See compliant outbound in action

Book a 20-minute demo and we'll show how Aloware handles opt-out and suppression, contact logging, time-zone dialing, and identified calling, so your team can dial at volume and stay compliant.

Reviewed and edited by Ruby Kootval. This article is for general information only and is not legal advice; consult qualified counsel for your specific situation. Sources below.

Sources

• FCC, "TCPA Rules: Revoking Consent for Unwanted Robocalls/Robotexts": https://www.fcc.gov/document/tcpa-rules-revoking-consent-unwanted-robocallsrobotexts
• Consumer Financial Services Law Monitor, "Eleventh Circuit Vacates FCC's One-to-One Consent Rule" (Jan 2025): https://www.consumerfinancialserviceslawmonitor.com/2025/01/eleventh-circuit-vacates-fccs-one-to-one-consent-rule-fcc-issues-stay/
• ActiveProspect, "TCPA Text Messages: Rules and Regulations" (penalties, calling hours): https://activeprospect.com/blog/tcpa-text-messages/
• Kelley Drye, "Texas Mini-TCPA Law: FAQs for Marketing Texts": https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/texas-mini-tcpa-law-faqs-for-marketing-texts
• National Do Not Call Registry: https://www.donotcall.gov/