For years, the TCPA was the primary statute governing telemarketing compliance in the United States. There were a handful of state-level equivalents — Florida’s Telephone Solicitation Act, Oklahoma’s Telephone Solicitation Act, Washington’s automatic dialing laws — but the federal TCPA set the floor and, for most companies, the ceiling.
That era is over.
In the past 12 months, Texas, Virginia, and Oregon have each enacted or expanded state-level telemarketing laws that impose requirements the federal TCPA does not. North Carolina and South Carolina have pending bills that would add to the list. For national lead generation companies that sell leads or contact consumers across state lines, the compliance calculus has fundamentally changed.
You are no longer managing one set of rules. You are managing a patchwork. And that patchwork is getting denser by the quarter.
Texas: Expanded Scope, Private Right of Action
Effective: September 1, 2025
Texas amended its Deceptive Trade Practices Act (DTPA) to expand the state’s telemarketing protections in two significant ways.
Texts and images are now covered. The prior Texas law focused primarily on voice calls. The amendment explicitly extends coverage to text messages, multimedia messages, and image-based marketing communications. If you are running SMS campaigns or sending MMS with product images to Texas consumers, you are now subject to state-level restrictions that carry their own penalty structure.
Direct consumer lawsuits under the DTPA. This is the provision that should concern lead generators most. Texas consumers can now bring direct lawsuits under the DTPA for violations of the state’s telemarketing rules. The DTPA allows for actual damages, plus up to three times actual damages for knowing violations, plus attorney’s fees.
Unlike the federal TCPA, where statutory damages are capped at $500 per violation ($1,500 for willful violations), the Texas DTPA framework ties damages to actual harm with a treble damage multiplier. For a defendant facing a class of Texas consumers, the exposure calculation changes significantly.
What this means in practice: A lead buyer who purchases leads and sends marketing texts to Texas consumers without proper consent is now exposed to both federal TCPA liability and a separate Texas DTPA claim. The Texas claim carries its own standards, its own damages calculation, and its own attorney’s fee provision that incentivizes plaintiff’s attorneys to bring cases.
The dual-track exposure means that settling the federal claim does not necessarily resolve the state claim. Defense costs multiply.
Virginia: The 10-Year STOP Rule
Effective: January 1, 2026
Virginia Senate Bill 1339 introduces what may be the most aggressive opt-out requirement in the country.
STOP means stop for 10 years. When a Virginia consumer replies “STOP” or otherwise revokes consent to receive text messages, the sender must honor that revocation for a minimum of 10 years. Not 30 days. Not 12 months. Ten years.
Under the federal TCPA, the duration of a consent revocation is not explicitly defined. The FCC’s pending revoke-all rule (now delayed to January 2027) will address revocation procedures but does not specify a mandatory duration. Virginia has filled that gap with a number that will force lead generators to rethink their entire suppression and data retention strategy.
The operational implications are significant. Consider what a 10-year STOP window means for a lead generation company:
- You must maintain suppression lists for a minimum of 10 years for any Virginia consumer who opts out
- You must check those suppression lists before every outbound text to a Virginia number
- You must be able to prove, in litigation, that your suppression system correctly identified and honored a 10-year-old opt-out
- If a lead is sold and the buyer contacts a Virginia consumer who opted out seven years ago with the original seller, the entire chain has a problem
Re-consent does not automatically reset the clock. The statute does not include a clear mechanism for a consumer to re-consent during the 10-year window and restart the period. That ambiguity will generate litigation. Until Virginia courts or the legislature clarify the re-consent question, the safest position is to treat a Virginia STOP as permanent for a decade, regardless of subsequent consumer actions.
What this means in practice: Every lead generation company that contacts Virginia consumers via text must build 10-year suppression capability into its operations. That is not a feature you bolt onto an existing suppression list. It requires durable data storage, reliable matching across phone number changes and reassignments, and audit trails that will hold up in court a decade after the opt-out event.
Oregon: Call Limits and Hour Restrictions
Effective: January 1, 2026
Oregon House Bill 3865 takes a different approach. Instead of focusing on consent mechanics, Oregon restricts the volume and timing of telemarketing calls.
Three calls per day, per consumer. No telemarketer may place more than three calls to the same Oregon consumer in a single calendar day, regardless of whether those calls are answered. This count applies across all phone numbers associated with the consumer, not per phone number.
For lead generation, this creates a practical problem. If a lead is sold to multiple buyers and each buyer calls the consumer, the aggregate call volume may exceed Oregon’s three-call limit even if each individual buyer only called once. The statute does not clearly allocate responsibility between lead sellers and lead buyers for managing the aggregate count.
Restricted calling hours. Oregon limits telemarketing calls to the hours of 8:00 AM to 8:00 PM in the consumer’s local time zone. While this is similar to the federal TCPA’s time-of-day restriction, Oregon’s enforcement mechanism is state-level, with its own penalty structure and attorney general enforcement authority.
Daily call logs required. Telemarketers must maintain daily logs of all calls placed to Oregon consumers, including the number called, the time of the call, and the duration. These logs must be retained and made available for inspection. This is a documentation requirement that goes beyond what the federal TCPA mandates.
What this means in practice: Lead buyers who purchase leads for Oregon consumers need real-time visibility into how many times a consumer has been called that day — across all buyers in the chain. Without a coordinated suppression or call-tracking system, individual buyers have no way to know whether their call will be the fourth of the day and therefore a violation.
This is the kind of requirement that makes exclusive lead distribution more attractive and shared-lead models more legally dangerous.
The Pending Bills: North Carolina and South Carolina
North Carolina and South Carolina both have pending telemarketing bills that would add to the state-level patchwork.
North Carolina’s bill would create a state-level private right of action for unwanted telemarketing calls and texts, with statutory damages and attorney’s fee recovery. The bill has passed committee and is expected to reach a floor vote in the current legislative session.
South Carolina’s bill would establish a state-level Do Not Call list with enhanced penalties for violations and mandatory registration for companies conducting telemarketing to South Carolina consumers.
Neither bill has been signed into law as of this writing, but both have bipartisan support. Telemarketing reform is not a partisan issue at the state level. Consumer protection bills targeting unwanted calls consistently poll well across demographics, and state legislators know it.
If both bills pass, the Southeast alone would have four states (Florida, Texas, North Carolina, South Carolina) with state-level telemarketing laws that impose requirements beyond the federal TCPA.
The Patchwork Problem
Here is the strategic reality for any lead generation company operating nationally.
You cannot comply with a single standard anymore. The federal TCPA sets a baseline, but that baseline is no longer sufficient in a growing number of states. Each state law has its own:
- Scope (what communications are covered)
- Consent requirements (how consent must be obtained and for how long it must be honored)
- Operational restrictions (call limits, time-of-day rules, logging requirements)
- Enforcement mechanisms (private right of action, attorney general enforcement, or both)
- Damages calculations (statutory per-violation, actual damages with multipliers, or hybrid)
For a company that sells leads nationally, or that buys leads and contacts consumers in multiple states, the cost of managing state-by-state compliance manually is unsustainable. You either need technology that handles per-state rules automatically, or you need to default to the most restrictive standard across all states.
The Most-Restrictive-Standard Approach
Many compliance officers are landing on this strategy: identify the most restrictive requirement across all applicable jurisdictions and apply it universally. Under the current patchwork, that would mean:
- Suppression duration: 10 years (Virginia)
- Daily call limit: 3 per consumer (Oregon)
- Calling hours: 8:00 AM to 8:00 PM local time (Oregon/federal TCPA)
- Channel coverage: voice, text, and image (Texas)
- Consent evidence: sufficient to defend in both federal and state courts, with per-state documentation requirements
This approach simplifies operations but increases cost. Maintaining 10-year suppression lists for every consumer, not just Virginia residents, is expensive. Capping calls at three per day nationally reduces contact rates. But the alternative — building per-state logic into your dialer, your suppression system, and your consent flows — is more expensive and more error-prone.
How Consent Evidence Fits In
State mini-TCPA laws are making consent evidence more important, not less. Here is why.
When you face a TCPA claim in federal court, you produce your consent evidence and argue federal standards. When you face a Texas DTPA claim in state court, you produce the same consent evidence but argue Texas standards. When a Virginia consumer claims you violated the 10-year STOP rule, you need to produce suppression records going back a decade.
The common thread is evidence. Every state-level claim, like every federal TCPA claim, ultimately comes down to whether you can prove that your contact was authorized and that you followed the rules.
Consent verification platforms like eConsent become more valuable in a multi-state patchwork because they provide a single, auditable evidence chain that supports defense across jurisdictions. A session-level consent certificate that captures the disclosure language, the consumer’s action, and the technical metadata does not change based on which state’s law applies. The evidence is the evidence. What changes is the legal standard it is measured against.
The stronger your evidence, the more confidently you can defend across all 50 states — regardless of how many of them have their own telemarketing statutes.
What You Should Do Now
1. Map your state exposure. Identify every state where you generate leads, sell leads, or contact consumers. Cross-reference that list against current state telemarketing laws. If you are contacting consumers in Texas, Virginia, Oregon, Florida, Oklahoma, or Washington, you have state-level obligations beyond the federal TCPA today.
2. Decide on a compliance strategy. Either build per-state compliance logic into your systems or adopt the most-restrictive-standard approach nationally. The second option costs more upfront but eliminates the risk of per-state errors and simplifies training.
3. Upgrade your suppression infrastructure. If you are not already retaining suppression records for 10 years, start now. Virginia’s law is effective and enforceable today. A consumer who texts STOP today has rights that extend to 2036. Your systems need to handle that.
4. Audit your lead distribution model. Oregon’s three-call-per-day limit makes shared leads riskier. If you sell the same lead to five buyers and all five call the consumer on the same day, you have a problem. Consider whether exclusive or semi-exclusive distribution models reduce your state-level exposure.
5. Strengthen your consent evidence. State mini-TCPA laws are creating new litigation venues with new judges, new juries, and new standards. The consent evidence that was “good enough” for federal TCPA defense may not be sufficient in a Texas DTPA case or a Virginia opt-out dispute. Invest in consent capture that produces the most complete evidence package possible, because you do not know in advance which state’s court you will be defending in.
6. Watch the legislative calendar. North Carolina and South Carolina are not the only states considering telemarketing reform. Track pending bills in your key markets. The cost of compliance drops significantly when you know what is coming and plan for it before it takes effect.
The federal TCPA is still the most important telemarketing statute in the country. But it is no longer the only one that matters. State legislatures have decided that the federal baseline is not enough, and they are writing their own rules. Lead generation companies that ignore this trend will learn about it the expensive way — in a courtroom they did not expect, under a statute they did not know applied to them.