TCPA Risk Framework: Assess Any Sales Technology

TCPA litigation surged 95% in 2025, with 507 class action lawsuits filed in Q1 alone. Yet most sales leaders have no structured way to evaluate whether their technology puts them at risk. They rely on vendor claims, hope their legal team catches problems and cross their fingers when launching campaigns.

This approach worked when penalties were rare. It doesn't work anymore. Experts predict another 50% increase in lawsuits in 2026. Before you purchase, renew or deploy any sales technology, you need a framework for assessing its TCPA risk. This article provides one.

Key Takeaways

• TCPA litigation up 95%: 507 class action lawsuits in Q1 2025 alone make vendor evaluation critical before any purchase
• B2B is NOT exempt: The FCC applies the same TCPA rules to B2B as B2C, exposing businesses that assume otherwise to significant risk
• Platform providers are liable too: Courts hold vendors directly accountable for violations, not just the companies using their software
• Three-tier assessment: Evaluate any sales tool using dialing method, consent management and list hygiene capabilities

Why TCPA Risk Assessment Matters Now

The Litigation Explosion

The numbers tell a stark story. According to industry analysis, TCPA litigation has nearly doubled compared to last year. Q1 2025 saw more than double the class action volume of Q1 2024. And this is just the beginning. Legal experts expect 50% more lawsuits in 2026 as plaintiffs' attorneys capitalize on new regulations.

New rules effective April 2025 require processing opt-out requests within 10 business days, reduced from the previous 30-day standard. April 2026 brings even stricter requirements: individual consent per seller, meaning separate authorization for each entity within corporate structures.

The Stakes for Your Sales Team

The penalties for TCPA violations are severe. Standard penalties range from $500 to $1,500 per violation, per call. Some violations carry fines up to $16,000 per call. Major settlements demonstrate that legitimate businesses with legal teams still face substantial liability: Dish Network paid $341 million across two separate court actions. Caribbean Cruise Line settled for $76 million.

Beyond fines, platform providers themselves can be held liable. The FCC and FTC have found dialing platform vendors directly responsible for TCPA and TSR violations. Courts have emphasized that providers cannot simply blame their customers for violations. If your vendor doesn't have robust compliance features, both of you could face legal action.

The Three-Tier TCPA Risk Assessment Framework

When evaluating any sales technology for TCPA compliance, assess three critical areas: dialing technology, consent management and list hygiene. Each tier has specific risk factors and questions to ask vendors.

Tier 1: Dialing Technology Risk

The type of dialing technology determines your baseline TCPA risk. Understanding the distinctions is essential.

Automatic Telephone Dialing Systems (ATDS): Systems that can store or produce telephone numbers using random or sequential generators, then dial those numbers automatically. Using an ATDS to call or text wireless numbers without prior express written consent is illegal under TCPA, regardless of whether the contact is B2B or B2C.

Auto-Dialers (Sales Context): Software that automatically dials down a list of numbers but requires a human to initiate the call. These are different from ATDS but still require careful compliance management.

AI Calling Systems: The FCC's February 2024 ruling determined that AI-generated voices constitute "artificial voices" under federal law. This means AI cold calling requires the same prior express consent, identification disclosure and opt-out mechanisms as traditional robocalls.

Risk Assessment Questions:

• Does the system qualify as an ATDS under current FCC definitions?
• If using AI voices, does the platform include required disclosures?
• Does the system require human initiation for each call?
• What calling time restrictions are enforced (8 AM to 9 PM local time)?

Tier 2: Consent Management Risk

How your technology handles consent determines whether you can prove compliance if challenged.

Prior Express Written Consent (PEWC): The highest standard required by TCPA. Must be obtained in writing and is required for most marketing texts, prerecorded messages and auto-dialed sales calls to mobile phones.

Consent Documentation: Each number you dial must have explicit written consent on record. Consent requests must include the business name, contact purpose, frequency and any charges.

Opt-Out Processing: New April 2025 rules require 10-day processing (down from 30 days). The April 2026 scope expansion will treat all future communications from the same sender as revoked upon any opt-out.

Risk Assessment Questions:

• How does the platform document and store consent records?
• Can you prove consent for each number if challenged in court?
• How quickly does the system process opt-out requests?
• Does the platform track consent at the individual contact level?

Tier 3: List Hygiene Risk

Bad data creates compliance exposure even with proper consent and compliant dialing technology.

DNC Registry Scrubbing: Approximately 250 million of 450 million U. S. phone numbers are on the Do Not Call Registry. Calling a registered number can cost up to $43,792 per infraction. Your platform must scrub against the national registry before any outreach.

Reassigned Number Detection: Phone numbers get reassigned to new users. The person who gave consent may no longer have that number. Calling the new owner without their consent creates liability.

Internal DNC Management: The FCC requires businesses to maintain their own do-not-call list and have a written policy for maintaining it. Your technology must support this requirement.

Risk Assessment Questions:

• What DNC registry sources does the platform scrub against?
• How frequently does scrubbing occur (real-time vs. batch)?
• Does the platform detect reassigned numbers?
• Can you maintain and enforce an internal DNC list?

Risk Factors Unique to AI Calling Technology

AI calling presents specific compliance challenges that require additional scrutiny.

The FCC Ruling on AI Voices

In February 2024, the FCC issued a declaratory ruling that AI-generated voices constitute "artificial voices" under federal law. This has immediate implications:

• Prior express consent is required for all AI voice calls
• AI must identify itself as artificial during the call
• Opt-out mechanisms must be provided
• All TCPA restrictions apply without AI-specific exemptions

Questions to Ask AI Calling Vendors

Before purchasing any AI calling solution, ask these specific questions:

1. How does the system verify consent before each AI call?

2. What disclosure language is included in AI scripts?

3. How are opt-outs captured and processed during AI calls?

4. Does the AI identify itself as artificial at the start of each call?

5. What happens when a contact is not safe for AI calling?

If a vendor cannot answer these questions clearly, their platform likely has compliance gaps that put you at risk.

The Vendor Evaluation Checklist

Use this checklist when evaluating any sales technology with calling capabilities.

Essential Questions Before Purchasing

Liability and Responsibility:

• Does the platform accept any liability for compliance, or is it entirely shifted to you?
• What compliance documentation does the vendor provide?
• Has the vendor faced TCPA litigation, and what was the outcome?

DNC and Scrubbing:

• What DNC databases does the platform scrub against?
• How frequently is scrubbing performed?
• Is scrubbing automatic before campaign launch?

Consent Management:

• How is consent documented and stored?
• Can you mark contacts as having PEWC?
• How quickly are opt-outs processed?

Calling Controls:

• What timezone-based calling restrictions exist?
• Are calling hours enforced automatically (8 AM to 9 PM local time)?
• Can you restrict calling by day of week or holiday?

AI-Specific (If Applicable):

• Does the AI identify itself as artificial?
• What disclosure scripts are included?
• How are AI-unsafe contacts handled?

Red Flags to Watch For

Be cautious of vendors who:

• Claim "B2B calls are exempt" without qualification
• Offer no consent documentation capabilities
• Have no DNC scrubbing integration
• Don't enforce calling time restrictions
• Cannot explain their AI disclosure compliance
• Shift all liability to customers without providing compliance tools

How AvairAI Addresses Each Risk Factor

AvairAI's TCPA compliance system was built specifically to address every tier of this framework.

One-Click Phone Classification

Before any calling begins, AvairAI classifies every contact:

• CAN_CALL_AI (Green): Safe for AI calling
• CAN_CALL_MANUAL (Yellow): Requires human judgment
• CANNOT_CALL (Red): Legally prohibited

This classification checks the national DNC registry, screens for known TCPA litigators, verifies line types and detects reassigned numbers. For a deeper understanding of TCPA requirements, see our complete TCPA compliance guide for sales leaders.

Compliance by Design

AvairAI integrates compliance into the campaign workflow:

• Automatic scrubbing before any campaign launches
• Weekly re-screening of active campaigns
• Timezone enforcement restricting calls to 10 AM to 4 PM recipient's local time
• AI disclosure automatically included in call scripts
• Manual task queue for contacts that require human calling

The Pair Selling Advantage

This is where the Pair Selling philosophy applies to compliance. AI handles the compliance checking, the DNC scrubbing, the phone classification, the timezone enforcement. Salespeople focus on what requires human judgment: evaluating edge cases, building relationships with qualified prospects and closing deals. Together, they achieve compliant calling at scale without making compliance a burden on the sales team.

Taking Action

The 95% surge in TCPA litigation isn't slowing down. Your vendor choice is your first and biggest compliance decision. The right technology makes compliance automatic. The wrong technology makes every call a potential lawsuit.

Use this framework to evaluate your current sales technology stack. Ask the questions. Watch for the red flags. If your vendors can't demonstrate how they address each tier of risk, it's time to find vendors who can.

Start with the three-tier assessment. Evaluate your dialing technology risk, consent management capabilities and list hygiene processes. The organizations that build compliance into their sales technology now will avoid the lawsuits and settlements that will define 2026 and beyond.