The Real Cost of One DNC Call: Fines, Lawsuits, and Stacked Penalties

One phone call to the wrong number can cost more than most marketing budgets. Under the TCPA, a single call to a DNC-listed number carries statutory damages of $500 per violation — and if the call is willful or knowing, courts can treble that to $1,500.

Now do the exposure math. Run one unscrubbed 5,000-call campaign into DNC-registered numbers, and you're looking at $2.5 million in baseline statutory exposure — $7.5 million if deemed willful. That's before regulators get involved.

The regulatory layer stacks on top. DNC Registry violations carry fines of $43,792 per violation, while FTC civil penalties under the Telemarketing Sales Rule can reach $53,088 per violation. One industry analysis calculates that calling just 500 DNC-listed numbers creates over $25 million in potential FTC exposure.

These penalties don't just hit boiler rooms. The biggest verdicts belong to household names and ordinary businesses:

• A $925 million verdict against a multi-level marketing company for more than 1.8 million illegal calls
• Dish Network's $280 million penalty, resolved at $210 million paid
• The Krakauer v. Dish Network jury verdict, trebled to $61 million for over 51,000 calls to DNC-registered numbers
• Capital One's $75.5 million class settlement
• Realogy Brokerage Group's $20 million settlement covering nearly 300,000 class members

Notice the pattern: satellite TV, banking, real estate, insurance. As one compliance analysis puts it, these were "ordinary companies" undone by a per-call statute multiplying one process failure across an entire call log.

The risk also compounds with time. The TCPA carries a four-year statute of limitations, meaning a plaintiff filing today can reach back to calls placed in mid-2022. Every unscrubbed campaign from the last four years is still on the books.

And private lawsuits — not regulators — are the most likely threat. As one analysis notes, "regulators pick targets, private plaintiffs pick whoever called them." Serial TCPA litigators make a business of this, and many aren't even on the registry.

The compliance obligation always stays with you — the caller — never the vendor. Scrubbing providers explicitly disclaim compliance guarantees, so outsourcing list hygiene doesn't outsource liability. This is why, when you're evaluating any growth partner or outreach provider, their compliance practices matter as much as their conversion rates. At Worqd, outreach is built to be permission-aware from the start — because a lead generation program that creates seven-figure legal exposure isn't a growth engine. It's a liability with a dialer.

Why Private Lawsuits Are the Biggest Risk — Not Regulators

Regulators pick targets; private plaintiffs pick whoever called them. That distinction makes the Telephone Consumer Protection Act the enforcement track most likely to find ordinary businesses. Serial TCPA litigators have turned compliance failures into a business model, and many of the most active filers aren't even on the National Do Not Call Registry — so a list that passes a standard scrub can still contain the numbers most likely to sue. The four-year statute of limitations means a plaintiff filing today can reach calls placed back to mid-2022, letting violations compound across campaigns.

• Private TCPA suits carry $500–$1,500 per call with no damages cap, and class actions routinely reach seven- and eight-figure settlements
• A 5,000-call campaign into DNC-registered numbers creates $2.5 million baseline exposure, or $7.5 million if willful
• The FTC also pursues "assisting and facilitating" parties — VoIP carriers, lead generators, and payment processors — not just the caller

Recent FTC actions against VoIP providers like XCast Labs and lead generators like Response Tree show the agency treats the entire call chain as liable. For teams running AI voice outreach, the FCC now classifies AI-generated voices as "artificial voices" under the same consent rules and per-call damages. The compliance obligation always stays with the seller, even when a vendor runs the scrub — DataZapp explicitly disclaims compliance guarantees, and the 31-day obligation remains yours. Worqd builds consent capture and suppression logic into every AI SDR workflow so follow-up stays inside the boundaries that matter.

What Compliant Calling Actually Looks Like

The businesses that never face DNC penalties aren't lucky — they're boring. Their defense is a paper trail of fresh scrubs, signed consent, and fast opt-outs. Here's what that discipline actually looks like in practice.

Scrub every list, on a schedule. Federal rules require checking outbound lists against the National DNC Registry at least every 31 days — but that's the floor, not the target. Best practice is scrubbing every 7 to 14 days, because new numbers land on the registry daily and old numbers get reassigned or ported. A list that was clean last month is not clean today.

Screen beyond the registry. Serial TCPA litigators often aren't on the DNC list at all, which means a list that passes a standard scrub can still hold the numbers most likely to sue. That's why many teams now run lists through known-litigator databases alongside the registry check — litigation, not regulatory fines, is the track most likely to find an ordinary business.

A compliant calling operation rests on a handful of habits:

• A written DNC policy that every caller and vendor actually follows, with internal opt-out records kept for five years
• Documented consent records and scrub logs retained at least four years — the full statute of limitations — because "we scrubbed the list" is worthless without proof of when and how
• Opt-outs honored within 10 business days by law, with 24 hours as the best-practice standard, and no exemption ever overriding a direct "stop calling me"
• Calls placed only between 8 a.m. and 9 p.m. in the called party's local time zone

• 18 months for calls based on a completed transaction with your business
• 3 months for calls based on an inquiry
• The exemption never overrides a direct request to stop calling — per compliance guidance, that request wins every time

• Permission-aware, personalized outreach — not a template blast
• AI SDR follow-up with consent records and fast opt-out handling
• Pipeline recovery that re-scrubs aged leads before reactivation
• One partner, one report — no compliance gaps between vendors