TCPA Compliance for Law Firm Cold Calling and Texting Leads

Key Takeaways

• Most law firm cold calls are off-limits. Bar rules (ABA Model Rule 7.3) generally ban live calls to people who haven't contacted the firm, even when the TCPA allows them.
• Automated texts, prerecorded calls, and AI voices need consent. Without it, each message can cost $500 to $1,500, with no cap.
• Follow the core sending rules on every campaign. Scrub DNC lists every 31 days, contact leads only from 8 a.m. to 9 p.m. their time, and honor opt-outs within 10 business days.
• Inbound leads are the safest growth path. When prospects contact you first, most TCPA and ethics risk disappears, so respond fast and keep proof of consent.

Speed wins cases. The firm that reaches an injured driver, a wrongly fired employee, or a family facing deportation first usually signs the client. So intake teams dial fast, text faster, and buy lead lists to keep the pipeline full. That instinct is exactly what turns a marketing budget into a class action.

The Telephone Consumer Protection Act (TCPA) lets anyone who receives an unlawful call or text sue for $500 per message, or up to $1,500 if the violation was willful. There is no cap. A 2,000-number texting campaign with three follow-ups is 6,000 potential violations before anyone at the firm notices a problem. Plaintiffs' firms know this math well, because many of them bring these suits.

Law firms carry a second layer of risk that generic TCPA checklists ignore. Bar rules on attorney solicitation can make a cold call unethical even when it is perfectly legal under the TCPA. And the federal rules changed again on September 30, 2026. This guide covers what the TCPA requires, how consent works for inbound and purchased leads, what the latest FCC order changed, and a checklist your intake team can run today.

What is TCPA compliance for law firms?

TCPA is a federal statute that restricts telemarketing calls, automated text messages, and prerecorded voice communications. Compliance means your firm only calls or texts people in ways the law allows, can prove it, and stops when asked. The TCPA (47 U.S.C. § 227) and the FCC's rules at 47 C.F.R. § 64.1200 govern three things: the technology you use, whether you had consent, and whether the number is on a Do Not Call list.

For a law firm, compliance has two layers that must both be satisfied:

The TCPA layer (federal and state telemarketing law)

Rules on autodialers, prerecorded or AI voices, texts, consent, calling hours, Do Not Call lists, and opt-outs. These apply to every business, including law firms.

The ethics layer (your state bar's rules)

ABA Model Rule 7.3 and its state versions restrict how lawyers and anyone working for them may solicit clients. Under the Model Rule, live person-to-person contact covers in-person, live phone, and real-time audio or video, but not text messages that people can easily ignore.

A call can pass one layer and fail the other. A hand-dialed live call to a number not on the DNC registry may be TCPA-compliant and still be prohibited solicitation. A text may be ethically allowed and still trigger TCPA liability if it was sent by an automated system without consent. Your intake process has to check both.

Who enforces it?

Congress wrote the TCPA in 1991, but the Federal Communications Commission (FCC) writes the detailed rules your firm actually follows. Its regulations at 47 C.F.R. § 64.1200 set the consent standards, calling hours, Do Not Call requirements, and opt-out rules covered in this guide. When those rules change, your intake scripts and texting workflows have to change with them.

The FCC shapes law firm outreach in three ways:

Rulemaking

The FCC defines terms the statute leaves open, such as what counts as written consent or a valid opt-out. Private plaintiffs then sue under those rules.

Enforcement

The FCC can impose its own fines, separate from private lawsuits. 

Declaratory rulings 

The FCC answers specific questions about how the TCPA applies to new technology, like its 2024 ruling that AI-generated voices count as artificial voices.

The FTC also regulates telemarketing through its Telemarketing Sales Rule and runs the National Do Not Call Registry. The two agencies' rules overlap, so a compliant program has to satisfy both.

What is cold calling?

Cold calling is contacting someone who has not asked to hear from you. For a law firm, it usually means calling or texting a person who has not reached out to the firm, has not given the firm consent, and has no prior relationship with it.

Common law-firm examples include:

• Calling numbers from a purchased or rented lead list.
• Texting people whose details came from accident reports, court filings, or data brokers.
• Running an outbound dialer or AI voice agent against a list of "potential claimants" for a mass tort.
• Re-contacting old leads who never signed and never agreed to marketing follow-up.

Cold outreach is where both layers of risk peak. The TCPA usually requires consent you do not have, and live calls to people known to need legal help are the core of what bar solicitation rules prohibit. Some states add blackout periods. Florida, for example, bars written solicitations about an accident until more than 30 days after it happened, and the Florida Bar has treated real-time text chat the same way. 

Cold leads vs. inbound leads: why the difference matters

The single biggest compliance lever a firm has is who starts the conversation. When a prospect contacts you first, most TCPA and ethics problems disappear for that conversation. When you contact them first, both apply in full.

Inbound does not mean anything goes. A person who asked for a callback about a car accident consented to that callback, not to a year of promotional texts. Purchased leads sit in the middle: they are only as good as the consent language the vendor captured and your ability to prove it. If the vendor's form never named your firm, treat the lead as cold.

Where consent rules apply

Consent requirements depend on two questions: what technology sends the message, and whether the message markets your services. Marketing a consultation, a case review, or "see if you qualify" is telemarketing. A reminder for an appointment the lead booked is informational.

The FCC's written-consent rule took a hit in February 2026. In Bradford v. Sovereign Pest Control, the Fifth Circuit held the TCPA requires only prior express consent, which can be oral or written, even for prerecorded telemarketing calls. That ruling binds only Texas, Louisiana, and Mississippi, and state laws can still demand written consent. Firms that operate in more than one state should keep collecting written consent, because it is the version you can prove.

The Supreme Court's 2025 decision in McLaughlin Chiropractic v. McKesson also means federal courts no longer have to defer to the FCC's reading of the statute. Expect more circuit splits like Bradford, not fewer. Build to the strictest rule that applies to your leads.

What triggers a TCPA violation?

Each call or text is its own violation, so one bad workflow multiplies fast. These are the triggers that show up most often in suits against firms and their vendors:

Automated or AI-voice marketing without consent 

Prerecorded voicemails, AI voice agents, and ringless voicemail to cell phones all need consent. The FCC confirmed in 2024 that AI-generated voices count as "artificial" voices under the TCPA.

Calling or texting numbers on the National DNC Registry

Two or more telephone solicitations to a registered number in 12 months gives the recipient a private right of action. Scrub lists at least every 31 days.

Ignoring your internal Do Not Call list

Every firm that telemarkets must keep its own list, a written DNC policy, and trained staff.

Contacting outside quiet hours

Telephone solicitations are only allowed between 8 a.m. and 9 p.m. in the recipient's local time. Several states set narrower windows.

Not honoring an opt-out

A "STOP," "don't text me," or verbal request to stop must be processed within 10 business days, and sooner is safer.

Bad purchased leads

Consent that never named your firm, was buried in fine print, or cannot be produced is no consent at all. Your firm is liable for calls made on its behalf, even by a vendor.

Reassigned numbers

If a lead's number now belongs to someone else, the new owner never consented. Checking the FCC's Reassigned Numbers Database gives a safe harbor.

Missing identification

Telemarketing calls must transmit caller ID and identify the firm; texts should name the firm in the first message.

State "mini-TCPA" laws add their own triggers. Florida and Oklahoma, for example, have their own telephone solicitation statutes with private lawsuits, consent definitions, and limits on how many times you can call in 24 hours. Check the law of the state where the lead lives, not where your office is.

Penalties: what non-compliance can cost a law firm

The TCPA's private right of action carries statutory damages of $500 per violation, trebled to $1,500 for willful or knowing violations. The plaintiff does not have to prove any actual harm, and there is no ceiling.

Statutory damages are only the start. A firm can also face:

• Class action defense costs and settlements, which often dwarf the per-message figure.
• FCC enforcement and state attorney general actions, with their own forfeitures.
• State mini-TCPA damages stacked on top of federal claims for the same message.
• Bar discipline, up to suspension, if the outreach was improper solicitation.
• Carrier filtering, where blocked or flagged numbers kill your legitimate intake texts too.
• Reputation damage in the same community you advertise to.

A willful finding does not require bad intent. Knowing you were sending marketing texts, and that the list lacked consent, can be enough.

Revoking consent: the FCC's 2026 opt-out rules

Opt-out rules changed in 2026, and several competitor guides are now out of date. The FCC's April 2025 rules let consumers revoke consent by any reasonable means and required firms to honor requests within 10 business days. A broader "revoke all" provision, where one STOP cancels every type of message, was delayed twice, most recently to January 31, 2027.

On September 30, 2026, the FCC adopted an order narrowing that rule. Under the new rules, which take effect 30 days after Federal Register publication:

Marketing opt-outs are still all-or-nothing. 

One revocation of telemarketing consent ends all future telemarketing calls and texts from your firm.

Informational opt-outs can be category-specific. 

A lead who opts out of appointment reminders has not necessarily opted out of case-status updates.

You may designate an exclusive opt-out method.

This could be a keypress or voice opt-out on calls, keyword replies to texts (STOP, QUIT, END, REVOKE, OPT-OUT, CANCEL, UNSUBSCRIBE), or a designated website or phone number. It only works if you disclose it clearly on every call or text. If you do not designate one, you must still honor any reasonable request.

More may change.

The FCC is taking comment on cutting the processing window from 10 business days to 7 and on requiring two-way texting.

For most firms, the takeaway is simple. Put "Reply STOP to opt out" in every text, train staff to log verbal opt-outs anyway, and process every request within a day.

TCPA compliance checklist for law firms

Run this checklist before launching any outbound call or text campaign, and again every quarter.

Consent capture

• Every web form, chat widget, and landing page has a separate, unchecked consent box naming your firm.
• Consent language says the lead agrees to calls and texts, including automated or AI-assisted messages, about their legal matter and your services.
• The language states consent is not a condition of hiring the firm.
• Each consent record stores the timestamp, source URL, IP address, exact disclosure text, and phone number.
• Phone intake scripts capture verbal consent and the call is recorded or logged.

Lead sources and vendors

• Every lead vendor provides a copy of the form and consent language the lead saw.
• Vendor consent names your firm specifically, not just "partners."
• Contracts require vendors to follow the TCPA and your bar's rules, and to indemnify the firm.
• You can retrieve proof of consent for any lead within 24 hours.

List hygiene

• Marketing lists are scrubbed against the National DNC Registry at least every 31 days.
• Lists are scrubbed against your internal DNC list before every campaign.
• Numbers are checked against the Reassigned Numbers Database.
• State DNC lists are checked where required.

Sending rules

• Calls and texts are blocked outside 8 a.m. to 9 p.m. in the lead's local time, or the stricter state window.
• State limits on call frequency are enforced automatically.
• The first text names your firm; every marketing text includes "Reply STOP to opt out."
• Caller ID shows a working number tied to your firm.

Opt-outs

• STOP keywords, verbal requests, and emails asking to stop are all captured.
• Opt-outs sync across every system that can call or text (CRM, dialer, texting tool, vendors).
• Requests are processed within 10 business days at the latest; aim for same day.
• Only one confirmation text is sent after an opt-out, with no marketing in it.

Ethics layer

• No live calls to people who have not contacted the firm, unless your state's Rule 7.3 allows it.
• State blackout periods after accidents or disasters are coded into campaigns.
• Written solicitations carry any "Advertisement" label and disclosures your state requires.
• Anyone who contacts leads for the firm, including vendors and AI agents, is covered by the same rules.

Records and training

• Written TCPA and DNC policy is on file and reviewed yearly.
• Intake staff are trained at hire and annually.
• Consent, scrub, and opt-out logs are kept for at least five years, a common TCPA look-back window under the four-year federal statute of limitations.

Practical rules for cold calling and texting leads in your law firm

The checklist tells you what to verify. These rules tell your intake team how to work day to day.

Make inbound your growth engine. 

Put budget into ads, SEO, and referral programs that make leads contact you. Every inbound lead removes most of the solicitation risk and comes with consent you control.

Respond to inbound leads in minutes, not hours. 

Speed is legal when the lead asked. A two-minute callback to a web form is both compliant and the best conversion tactic you have.

Never live-call a cold list. 

Under the Model Rule and most state versions, a live call to someone known to need legal help is prohibited solicitation. That includes calls by non-lawyer staff, call centers, and investigators acting for the firm.

Treat cold texts as written advertising, not a loophole. 

Texts can be ethically permitted where calls are not, but they still need TCPA consent if automated, must follow advertising rules, and must respect blackout periods.

Keep AI voice agents on inbound and consented leads only. 

AI voices are "artificial" voices under the TCPA, so outbound AI calls without consent carry the highest per-call exposure.

Separate informational and marketing messages. 

Confirmations and reminders should contain no promotional language. One line like "Ask about our other services" can turn a reminder into telemarketing.

Set a lead expiration date. 

Consent goes stale. Stop marketing to unsigned leads after a defined period, such as 90 days, unless they re-engage.

Check representation before contact. 

Do not solicit someone you know is already represented in the matter.

Log everything automatically. 

If proof of consent lives in an intake specialist's memory, you do not have proof.

Audit one campaign per month. 

Pull ten random contacts and confirm you can produce consent, scrub records, and opt-out handling for each.

Final thoughts: Make compliance part of your intake system

TCPA compliance is not a reason to slow down. It is a reason to aim your speed at the right leads. Firms that win in 2026 build their pipeline on inbound leads, respond in minutes, capture consent that names the firm, and stop the moment someone opts out. Cold lists, bundled vendor consent, and outbound AI calls without permission carry risk that no case value justifies.

The rules will keep moving. The FCC's September 2026 opt-out order takes effect soon, more changes are out for comment, and courts are splitting on what the statute requires. A process that logs consent, scrubs lists, and syncs opt-outs automatically adapts to those changes. One that depends on staff memory does not.

Integrate compliance into the tools you already use

Compliance breaks in the handoffs between systems. A web form stores consent in one place, a texting tool sends from another, and an opt-out never reaches the dialer. Legal Intaker sits at the center of intake and connects those pieces:

Your website and lead sources

Forms, chat, and vendor feeds flow into one record, with consent text, timestamp, and source attached.

Your CRM and case management system

Lead status, consent, and opt-out flags sync, so a signed client or an opted-out lead is handled correctly everywhere.

Your phones and texting

Quiet hours, DNC suppression, and frequency limits are checked before any call or text goes out.

Your compliance records

Consent, scrub, and opt-out logs export in seconds when counsel or a demand letter needs them.

Protect every lead you contact

You should not have to choose between fast intake and safe intake. Legal Intaker helps your team respond first to the leads who asked, and keeps a defensible record of every call and text.

[Book a demo] to see how Legal Intaker protects your firm's outbound communications.

Frequently Asked Questions