TCPA Compliance Auto Dialer: 2026 Law Firm Checklist

TL;DR

A TCPA-compliant auto dialer is any automated calling system configured to follow the Telephone Consumer Protection Act’s rules on consent, calling hours, opt-outs, and Do Not Call lists. The 2021 Supreme Court ruling in Facebook v. Duguid narrowed the federal definition of an autodialer, but the FCC’s February 2024 ruling on AI-generated voices, plus aggressive state mini-TCPA laws, means compliance obligations are far from gone. Law firms face unique risk because they are both enforcers and targets of TCPA litigation.

Explore Lawtté’s AI lead management platform with built-in TCPA-compliant outbound dialing.

---

What Is a TCPA-Compliant Auto Dialer?

A TCPA-compliant auto dialer is automated calling equipment that operates within the rules set by the Telephone Consumer Protection Act (47 U.S.C. § 227). Under federal law, an Automatic Telephone Dialing System (ATDS) is defined as equipment with the capacity to store or produce telephone numbers using a random or sequential number generator and to dial those numbers automatically.

In plain terms: if your dialing system generates phone numbers on its own (randomly or in sequence), it’s an ATDS. If it only dials numbers you manually loaded from a contact list, it likely falls outside the federal ATDS definition, thanks to a 2021 Supreme Court decision covered below.

But “not an ATDS” does not mean “no rules apply.” TCPA compliance for auto dialers extends well beyond the autodialer definition itself. It includes consent requirements, calling hour restrictions, Do Not Call list scrubbing, abandoned call rates, opt-out mechanisms, and, as of 2024, specific rules about AI-generated voices.

The TCPA in 30 Seconds

Congress passed the TCPA in 1991 to combat intrusive telemarketing calls. The law restricts automated calls, prerecorded messages, and unsolicited texts to both cell phones and landlines.

Key facts:

• Enforcement: FCC, FTC, state attorneys general, and private lawsuits (including class actions)
• Penalties: $500 per violation, trebled to $1,500 for knowing or willful violations, with no cap on total statutory damages
• TRACED Act enhancement: Up to $10,000 per call for intentional robocall law violations
• Statute of limitations: Four years
• Class action prevalence: 78% of all TCPA filings land as class actions, compared to just 5.1% for FDCPA and 1.4% for FCRA

This is not a niche compliance risk. In 2024 alone, 2,788 TCPA cases were filed, a 67% increase from 2023. By January 2025, monthly class action filings hit 172, a 268% spike over January 2024.

What Counts as an Auto Dialer After Facebook v. Duguid?

The Supreme Court’s unanimous 2021 decision in Facebook, Inc. v. Duguid fundamentally changed what qualifies as an ATDS under federal law.

Before Duguid, federal courts disagreed about whether a system that simply dials from a stored list counted as an autodialer. Some circuits said yes, others said no. The Supreme Court settled it: an ATDS must use a random or sequential number generator to either store or produce phone numbers. Systems that merely dial from a pre-loaded contact list don’t qualify.

What this means practically: Most modern power dialers, preview dialers, and click-to-call systems, the tools law firms actually use for outbound lead follow-up, fall outside the ATDS definition under federal law. If you supply the phone numbers your system calls, it’s probably not an ATDS.

But here’s where firms get into trouble: they assume Duguid is a free pass. It isn’t. Three major compliance layers remain.

State Laws Define “Autodialer” More Broadly

Florida’s Telephone Solicitation Act defines an autodialer as “an automated system for the selection or dialing of telephone numbers or the playing of a recorded message.” That’s significantly broader than the federal post-Duguid definition and captures most modern power dialers and predictive dialers. Practitioners on Reddit frequently note that Florida’s FTSA is now the statute plaintiff attorneys cite most aggressively against firms operating in the state.

Prerecorded Voice Rules Still Apply

Even if your dialer isn’t an ATDS, using prerecorded or artificial voice messages triggers separate TCPA consent requirements. This distinction matters more than ever because of AI.

Consent and DNC Obligations Are Independent

Do Not Call rules, calling hour restrictions, and opt-out requirements apply regardless of whether your system qualifies as an ATDS.

For a deeper walkthrough of configuring your system correctly, see our guide on configuring a TCPA-compliant outbound dialer for law firms.

AI Voice Calls and the TCPA: The February 2024 FCC Ruling

This is the most important compliance development for any law firm using AI-powered outbound calling, and it’s the angle most guides miss entirely.

On February 8, 2024, the FCC issued a Declaratory Ruling confirming that AI-generated voices constitute “artificial or prerecorded voice” under the TCPA. The ruling took effect immediately. It applies regardless of whether the AI generates speech in real time or uses pre-recorded elements.

The critical implication: even if your dialer isn’t technically an ATDS (because it dials from a stored list, not a random number generator), you still need prior express written consent if the call uses an AI-generated voice for marketing purposes. The AI voice itself triggers the consent requirement.

This means law firms deploying AI voice agents for outbound lead follow-up, DEC letter chases, or medical record requests must treat every AI-initiated call as requiring TCPA consent, full stop. The technology that makes the call efficient is the same technology that creates the compliance obligation.

Additional requirements for AI voice calls include providing an opt-out mechanism within two seconds of the call beginning and clear disclosure of the call’s purpose. If your AI virtual receptionist handles both inbound and outbound calls, the compliance posture differs for each direction.

Consent Types Explained

TCPA compliance for auto dialers hinges on getting the right type of consent for the right type of call. There are two tiers.

Prior Express Consent

Required for non-marketing automated calls to cell phones. This can be as simple as a consumer voluntarily providing their phone number in a contact form. It does not need to be in writing.

Prior Express Written Consent (PEWC)

Required for telemarketing or advertising calls made using an ATDS, prerecorded voice, or AI-generated voice to cell phones, and for prerecorded marketing calls to landlines.

Valid PEWC must include:

• The consumer’s electronic or physical signature
• The specific seller or entity named
• The phone number(s) to which consent applies
• A clear statement that the consumer is not required to give consent as a condition of purchasing services
• The specific method of contact authorized (calls, texts, or both)

Firms must retain these consent records for a minimum of five years, including the timestamp, the exact disclosure language the consumer accepted, and the digital signature or IP address associated with the lead.

The One-to-One Consent Rule: Dead Federally, Alive in State Law

The FCC’s proposed one-to-one consent rule (which would have required consent to be given separately for each seller rather than shared among lead buyers) was postponed in January 2025 and formally vacated in July 2025. Your 2026 TCPA compliance program should not be built around this rule at the federal level.

However, Florida and Oklahoma continue to enforce similar one-to-one consent standards under their own state statutes. Firms buying leads in those states need seller-specific consent documentation. For more on how intake workflows connect to consent management, see legal client intake best practices.

Core TCPA Compliance Requirements: A Checklist

Every auto dialer used for outbound calling should meet these baseline requirements:

Calling hours: Marketing calls only between 8:00 AM and 9:00 PM in the recipient’s local time zone. Some states are stricter (Florida caps calls at 8:00 PM).

DNC scrubbing: Scrub contact lists against the National Do Not Call Registry and your internal DNC list. The National Registry must be refreshed at least every 31 days.

Abandoned call rate: No more than 3% of calls may be abandoned (ring with no live agent or message) over any 30-day measurement period. This applies primarily to predictive dialers.

Opt-out mechanisms: As of April 11, 2025, consumers can revoke consent by any reasonable means, not just texting “STOP.” Your system must honor opt-outs within 10 business days and remove the contact from all active queues automatically.

Caller ID: Every call must transmit a caller ID that identifies the caller’s name or the entity on whose behalf the call is made, plus a callback number.

Record retention: Consent records, revocation events, call attempt logs, and DNC scrub timestamps must be stored and exportable for at least five years.

State Mini-TCPAs: The Overlooked Risk for Law Firms

At least 12 states have passed their own TCPA-style laws, many directly in response to the Duguid narrowing. These state mini-TCPAs often have broader autodialer definitions, tighter calling restrictions, and steeper penalties than federal law.

State	Autodialer Definition	Calling Hours	Daily Call Caps	Penalties per Violation
Florida (FTSA)	Broad: any automated system for selecting/dialing numbers or playing recorded messages	8 AM to 8 PM	Not specified	$500 / $1,500 willful
Oklahoma (OTSA)	Broader than federal	8 AM to 9 PM	3 attempts per day	$500 / $1,500 willful
Texas (SB 140)	Includes texts and images; broad solicitation definition	8 AM to 9 PM	Not specified	Up to $5,000 per violation
Virginia (SB 1339)	Follows federal, with additions	8 AM to 9 PM	Not specified	Varies; 10-year DNC honor requirement (effective Jan 2026)
Maryland	Broader than federal	8 AM to 9 PM	3 attempts per day	$500 / $1,500 willful
Georgia	State-specific restrictions	8 AM to 9 PM	Not specified	State AG enforcement

For law firms operating across multiple states, the practical effect is this: you need per-contact, state-level compliance logic in your dialer. A call that’s perfectly legal under federal law and compliant in New York might violate Florida’s FTSA or Texas SB 140.

Firms with significant operations in Texas or Florida should pay special attention to these state-specific rules.

Penalties for TCPA Violations

The financial exposure is enormous and growing.

• Per-violation damages: $500 base, $1,500 for knowing or willful violations
• TRACED Act: Up to $10,000 per call for intentional violations of federal robocall laws
• No cap on total damages: A campaign touching thousands of contacts can generate seven or eight-figure liability

Notable cases illustrate the scale:

• A defendant found to have made over 1.8 million TCPA-violating calls faced a $925 million penalty
• Capital One settled a TCPA class action for $75.5 million
• Keller Williams settled for $40 million
• In 2025, TCPA class action settlements exceeded $150 million combined

The litigation surge is accelerating. Monthly class action filings increased 268% between January 2024 and January 2025. Plaintiff attorneys actively recruit TCPA plaintiffs from personal injury and mass tort markets specifically because law firms are high-value defendants. The irony is sharp: the same firms that handle TCPA plaintiff cases are being sued under the same statute for their own outbound calling practices.

What Makes a Dialer “TCPA-Compliant”?

Not all dialer software is built the same. When evaluating an auto dialer for TCPA compliance, look for these capabilities. Practitioners on forums and YouTube walkthroughs consistently highlight that the difference between compliant and non-compliant systems comes down to automation of safeguards, not just policy documents.

Consent record linking: The dialer should attach and display a verifiable consent record for each contact before the call is placed. If the system can’t show you the consent basis for a specific number, it shouldn’t dial it.

Real-time revocation processing: When a contact opts out mid-campaign (by any reasonable means), the system must remove them from all active queues automatically, not just the current campaign.

DNC scrubbing integration: The platform should scrub lists against the National DNC Registry and internal suppression lists, with configurable refresh intervals meeting the 31-day minimum.

Time-zone-aware calling windows: The dialer must calculate the recipient’s local time zone and restrict calls to permitted hours, accounting for state-level variations.

STIR/SHAKEN support: Authenticated caller ID reduces the chance carriers flag your calls as spam. This isn’t a TCPA requirement per se, but it directly affects whether your compliant calls actually connect.

Exportable audit logs: You need timestamped logs of consent records, revocation events, call attempts, and DNC scrub actions, exportable on demand for complaints or audits.

State-level rule enforcement: The system should apply different rules on a per-contact basis depending on the recipient’s state. A single federal-only compliance layer is insufficient in 2025.

Book a demo to see how Lawtté’s Scale platform handles these requirements for law firm outbound calling.

Dialer Types and Their TCPA Classification

Different dialer technologies carry different compliance obligations. Here’s how they break down after Duguid:

Dialer Type	How It Works	ATDS Under Federal Law?	Consent Required?
Predictive dialer	Dials multiple numbers simultaneously; connects answered calls to agents	Only if it uses a random/sequential number generator	PEWC for marketing; DNC/calling hours always
Power dialer	Dials numbers sequentially from a list, one at a time	Generally no (dials from stored list)	PEWC for marketing with prerecorded/AI voice
Preview dialer	Shows agent contact info before dialing; agent initiates	No	PEWC if using prerecorded/AI voice for marketing
Click-to-call	Agent manually clicks to initiate each call	No	Standard consent rules; no ATDS restrictions
AI voice dialer	Automated outbound calls using AI-generated speech	Depends on number generation method	Always PEWC for marketing (AI voice = “artificial voice” per FCC 2024)

The key takeaway: even dialer types that aren’t technically an ATDS under federal law still require prior express written consent when they use AI-generated voice for marketing. The voice is the trigger, not the dialing mechanism.

For a broader comparison of automatic dialer software options for law firms, see our full guide.

Why This Matters for Law Firms Using Outbound Dialers

Law firms use auto dialers for several high-volume outbound tasks: lead follow-up calls, DEC (Demand, Explanation, and Complaint) letter chases, medical record requests, retargeting lapsed leads, and appointment confirmations. Personal injury firms in particular run outbound campaigns at significant scale.

Three factors make TCPA compliance auto dialer configuration especially critical for legal operations:

1. AI voice adds a second compliance layer. The 2024 FCC ruling means any firm using an AI voice agent for outbound calls must secure PEWC regardless of dialer type. This is the single most important compliance point for firms adopting AI for personal injury operations or any practice area with outbound calling needs.

2. Law firms are high-value TCPA defendants. Plaintiff attorneys specifically target law firms because they have deep pockets, professional reputations to protect, and malpractice insurance. A TCPA class action against a law firm carries both financial and reputational risk that most businesses don’t face.

3. Multi-state operations multiply exposure. A PI firm buying leads in Florida, Texas, and California faces three different compliance regimes. Without state-aware dialer logic, a single campaign can violate multiple statutes simultaneously.

Lawtté’s Scale platform is built for exactly this scenario, offering a TCPA-compliant outbound dialer capable of 100+ calls per hour, with consent management, DNC scrubbing, and automated follow-up sequences designed for legal lead management.

Frequently Asked Questions

Is a power dialer considered an auto dialer under the TCPA?

Under federal law after Facebook v. Duguid, a power dialer that calls from a pre-loaded contact list (without using a random or sequential number generator) is generally not considered an ATDS. However, state laws like Florida’s FTSA define autodialers much more broadly and may classify power dialers as regulated equipment. You still need PEWC if the call uses a prerecorded or AI-generated voice for marketing.

Do I need written consent for every outbound call from my law firm?

Not necessarily. Prior express written consent (PEWC) is required for marketing or telemarketing calls made using an ATDS, prerecorded voice, or AI voice. Non-marketing calls to cell phones require only prior express consent (which can be implied by the consumer providing their number). Live calls from a human dialing manually don’t require PEWC under federal law, though state rules may differ.

How does the FCC’s 2024 AI voice ruling affect law firms?

The FCC ruled in February 2024 that AI-generated voices qualify as “artificial voice” under the TCPA. This means any outbound call using AI-generated speech requires prior express consent (for non-marketing) or PEWC (for marketing), even if the dialer system itself is not an ATDS. Law firms using AI voice agents for lead follow-up or client outreach must secure appropriate consent before placing those calls.

What is the penalty for a single TCPA violation?

The base penalty is $500 per violation. For knowing or willful violations, courts can treble damages to $1,500 per violation. Under the TRACED Act, intentional robocall violations can carry FCC-imposed penalties of up to $10,000 per call. Because 78% of TCPA cases are filed as class actions, a single campaign can generate millions in liability.

Does the one-to-one consent rule still apply?

The FCC’s one-to-one consent rule was vacated at the federal level in July 2025. However, Florida and Oklahoma enforce similar requirements under their state statutes. If you operate in those states, you should ensure consent is documented on a per-seller basis.

How often must I scrub my call lists against the Do Not Call Registry?

Federal rules require scrubbing against the National DNC Registry at least every 31 days. Your internal DNC list (contacts who have opted out directly) should be updated in real time, with opt-outs honored within 10 business days.

Can consumers revoke consent by methods other than texting “STOP”?

Yes. As of April 11, 2025, the FCC standard is that consumers can revoke consent by “any reasonable means.” This includes verbal requests during a call, email, voicemail, social media messages, or any other method a reasonable person would understand as a revocation. Your system must process these within 10 business days.

What should I look for in a TCPA-compliant auto dialer for my law firm?

Focus on consent record linking before each dial, real-time DNC scrubbing, automated revocation processing across all queues, time-zone-aware calling windows, STIR/SHAKEN caller ID authentication, state-level compliance logic, and exportable audit logs. Any platform that lacks these features creates unacceptable litigation exposure.

---

Getting TCPA compliance right is not optional for law firms running outbound campaigns. The combination of federal rules, the FCC’s AI voice ruling, and increasingly aggressive state mini-TCPAs means every call your system places carries real financial risk. The right dialer platform handles these requirements automatically so your team can focus on signing cases, not managing compliance spreadsheets.

Book a demo with Lawtté to see TCPA-compliant outbound dialing built specifically for law firms.