November 2, 2026. The Telephone Consumer Protection Act does not say how long a person has to sue over an unlawful call, and the Second Circuit held in 2013 that federal law supplies the period: the general four-year limit in 28 U.S.C. 1658(a), which covers any civil action "arising under an Act of Congress enacted after" that section's own enactment in 1990. The Second Circuit put it plainly in Giovanniello v. ALM Media in 2013: "federal law supplies the appropriate statute of limitations", and the period it named was four years. The only limitation periods written into the Act itself apply to the FCC's own forfeiture penalties: one year for an ordinary forfeiture under section 227(b)(4)(A), four years where the FCC charges a violation "with the intent to cause such violation," and four years for caller ID violations under section 227(e). For an outbound team the consequence is a records rule: every consent record, do-not-call request and call log needs to outlive the call by at least four years, because that is how long a $500-per-call claim can wait. This is what the texts say on 2 November 2026.
Key numbers
| Item | Number |
|---|---|
| Limitation period for a private TCPA suit (28 U.S.C. 1658(a), per Giovanniello, 2d Cir. 2013) | 4 years |
| FCC forfeiture clock, general provision (47 U.S.C. 227(b)(4)(E)(i)) | 1 year |
| FCC forfeiture clock, violation with intent (47 U.S.C. 227(b)(4)(E)(ii)) | 4 years |
| Statutory damages per violation, section 227(b)(3) (up to 3 times if willful or knowing) | $500 |
| Calls needed for a section 227(c)(5) claim (by or on behalf of the same entity) | more than one in 12 months |
| Caller ID forfeiture cap per violation (up to $1,000,000 for a continuing act) | $10,000 |
| Year the four-year default rule was enacted (Public Law 101-650) | 1990 |
| Year Giovanniello v. ALM Media was decided (Second Circuit, 8 August) | 2013 |
47 U.S.C. 227 and 28 U.S.C. 1658 as published by Cornell's Legal Information Institute, and the Second Circuit's opinion in Giovanniello v. ALM Media, LLC (decided 8 August 2013) as published by FindLaw, all read on 2 November 2026.
The Act has no limitations period for private suits
The private rights of action live in two places in 47 U.S.C. 227. Section 227(b)(3) lets a person sue over calls that violate section 227(b), such as prerecorded calls made without consent, for "actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater," with a court able to increase that to "not more than 3 times" for a willful or knowing violation. Section 227(c)(5) covers do-not-call violations: a person "who has received more than one telephone call within any 12-month period by or on behalf of the same entity" may recover "up to $500 in damages for each such violation," again with a treble option. Neither paragraph says when the suit must be filed.
The word "limitation" appears six times in the section we read, and every occurrence is about something else: the established business relationship, and the clocks on FCC forfeitures described below. Congress wrote limitation periods for the government's penalties and none for the private claim.
Why the answer is four years
Congress filled that kind of gap in 1990. 28 U.S.C. 1658(a) reads: "Except as otherwise provided by law, a civil action arising under an Act of Congress enacted after the date of the enactment of this section may not be commenced later than 4 years after the cause of action accrues." The section was added by Public Law 101-650 in 1990. The TCPA was enacted in 1991, after that date, and provides no period of its own, so the four-year default applies.
Before Mims v. Arrow Financial Services the open question was whether a state period, such as Connecticut's, applied to a TCPA suit in federal court. In Giovanniello v. ALM Media, LLC, decided 8 August 2013 after the Supreme Court vacated an earlier judgment and sent the case back for reconsideration in light of Mims, the Second Circuit wrote that it concluded, "in light of Mims, that federal law supplies the appropriate statute of limitations", naming "four years, see 28 U.S.C. § 1658(a)", "rather than Connecticut state law." The plaintiff still lost, because his fourth class action over one unsolicited fax came too late once the court held that class-action tolling under American Pipe runs only until a district court first denies class status. The case is a reminder that the four years can be paused by an earlier class action, but not forever.
The clocks that are in the Act apply to the FCC
Three limitation periods do appear in section 227, and all of them govern penalties the Commission imposes rather than lawsuits by the people who were called.
| Who is suing or penalizing | Period | Where it is written |
|---|---|---|
| Person who received the call, section 227(b) or (c) claim | 4 years from accrual | 28 U.S.C. 1658(a), per Giovanniello (2d Cir. 2013) |
| FCC forfeiture, general provision (A) | 1 year before the notice | 47 U.S.C. 227(b)(4)(E)(i) |
| FCC forfeiture, violation "with the intent to cause such violation" | 4 years before the notice | 47 U.S.C. 227(b)(4)(E)(ii) |
| FCC forfeiture for caller ID violations | 4 years before the notice | 47 U.S.C. 227(e), "4-year statute of limitations" |
The forfeiture text is specific: "no forfeiture penalty shall be determined or imposed against any person" under the ordinary provision "if the violation charged occurred more than 1 year prior to the date of issuance of the required notice or notice of apparent liability," and under the intent provision if it occurred "more than 4 years prior." The caller ID provision caps each forfeiture at $10,000 per violation, or three times that for each day of a continuing violation, up to $1,000,000 for a single act, and bars a penalty for anything older than four years.
What four years means for a calling operation
- Keep consent for at least four years after the last call, not after the sign-up. On our reading the claim accrues when the call is made, so a lead captured in 2024 and called through 2026 can be sued over until 2030. Some vendor contracts ask for longer retention; our Vapi vs Retell comparison looked at how two AI calling platforms write consent-record duties into their terms.
- Treat do-not-call requests as permanent. The FCC rules require a company do-not-call request to be recorded "at the time the request is made" and a national registry entry to be honored "indefinitely", so the limitation period on a stale request is rarely the question; see TCPA opt-out requirements.
- Log the facts a safe harbor needs. The do-not-call safe harbor in 47 CFR 64.1200(c)(2) turns on written procedures, training, a recorded do-not-call list and a registry copy no more than 31 days old at the time of the call. Those records only help if they still exist when the complaint arrives, which can be the fourth year. The same goes for the reassigned-numbers safe harbor we explained in Reassigned Numbers Database.
- Watch the class-action clock separately. Giovanniello shows that an earlier, failed class action can pause the four years for everyone in the proposed class until the district court denies certification. A campaign that looked clear of liability can be revived by someone else's lawsuit.
How much a late claim can still cost
Because the private damages are per call, the exposure on a four-year-old campaign is simple arithmetic. Under section 227(b)(3), 1,000 unlawful prerecorded calls are $500,000 at the statutory minimum and up to $1,500,000 if a court finds the violation willful or knowing. Under 227(c)(5) the figure is "up to $500" per violation, with a parallel provision for willful or knowing violations, and a defendant has an affirmative defense if it "has established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations" that break the rules. That defense is proven with records, which returns us to the retention point: the paperwork has to survive as long as the claim can.
If you want AI calls designed around stored consent and exportable logs, see AI calling built around TCPA consent and our AI call answering agent for inbound demand, which places no outbound calls. For how the rules reach a vendor placing calls for you, read our note on TCPA vicarious liability, and compare platforms in best AI voice agents. This is general information, not legal advice.
Frequently Asked Questions
Four years, under the Second Circuit's 2013 decision in Giovanniello v. ALM Media. The TCPA itself sets no period for private suits, so the court applied the general federal rule in 28 U.S.C. 1658(a), which gives four years from when the claim accrues to any action arising under a federal statute enacted after that section's own enactment in 1990.
When the cause of action accrues, which on our reading is the unlawful call itself. A lead collected years earlier does not start the clock; each call does.
Yes, but only for FCC forfeiture penalties: one year under the general forfeiture provision for section 227(b), four years where the FCC charges a violation made with intent to cause it, and four years for caller ID violations under section 227(e). None of these apply to a private lawsuit.
In Giovanniello the Second Circuit held that class-action tolling under American Pipe runs only until a district court first denies class status. So a pending class action can pause the four years for proposed class members, but the pause ends at that first denial.
Section 227(b)(3) gives actual loss or $500 per violation, whichever is greater, and a court may increase that to up to three times for a willful or knowing violation. Section 227(c)(5), for do-not-call violations, gives up to $500 per violation to a person who received more than one call in a 12-month period, with its own provision for willful or knowing violations.
At least four years after the last call made on that consent, because that is how long a federal claim can be filed. We would keep them longer where a vendor contract or a state law asks for it.