TCPA lawsuits and eCommerce sites: what actually happens, what it costs, and how to avoid one
A TCPA lawsuit rarely arrives as a surprise about your SMS program. It arrives as a screenshot of your own checkout. This is the full lifecycle of a TCPA lawsuit against an online store — the demand letter, the class certification fight that decides the price, the defenses that actually work, whether insurance responds, and the record-keeping that prevents the case entirely.
Key takeaways
- A TCPA lawsuit is decided economically at class certification, not at trial — and certification turns on whether your consent records are individualized or uniformly defective.
- Statutory damages of $500 to $1,500 per message mean exposure scales with list size and send frequency, not with any harm the plaintiff suffered.
- The only defense that reliably works is a per-number consent record with a timestamp, source URL, and the exact disclosure version the consumer saw.
- Fixing the opt-in after a demand letter does not cure liability, and doing it without preserving the prior version can look like spoliation.
- Standard commercial general liability policies frequently exclude TCPA claims — confirm coverage in writing before you need it.
What triggers a TCPA lawsuit against an online store
The Telephone Consumer Protection Act (47 U.S.C. § 227) restricts marketing calls and texts sent without prior express written consent. For eCommerce brands, the practical trigger is almost never a rogue campaign — it is a phone-capture surface whose disclosure was never compliant, or stopped being compliant after a theme update, and which kept feeding numbers into an active SMS list.
Plaintiffs' firms find these surfaces the same way a shopper would. They load the storefront, complete the spin-to-win popup or the checkout phone field, and screenshot the disclosure exactly as rendered. If the language bundles consent with a discount, omits message frequency, or lacks the "consent is not a condition of purchase" statement, the defect is documented before any subpoena issues. That screenshot becomes Exhibit A.
What makes the theory attractive to file is uniformity. If every visitor saw the same defective popup, then every number collected through it shares the same consent defect — which is precisely the commonality a class action needs. Storefronts manufacture that uniformity by design.
The lifecycle of a TCPA lawsuit, stage by stage
01Pre-suit demand letter
Week 0A single-plaintiff letter alleging a handful of texts, usually asking for four or five figures. It is a discovery probe: counsel is testing whether you can produce a consent record with a timestamp, source URL, and disclosure version. A vague reply signals that your records are thin and invites a class filing.
02Complaint filed
Week 2–8The complaint is typically pleaded as a putative class on behalf of "all persons in the United States who received a marketing text from Defendant without prior express written consent" over a four-year window. Your live opt-in flow is attached as a screenshot exhibit.
03Litigation hold and early discovery
Month 1–4You must preserve ESP exports, consent logs, theme and app version history, and popup configurations. Plaintiff's first requests target the consent database schema and the disclosure text as rendered on specific dates — not the text in your current template.
04Class certification fight
Month 6–14The whole case turns here. If consent was collected identically for everyone through one defective surface, commonality is easy and certification is likely. If consent varies number-by-number with individualized records, you argue individual issues predominate and certification often fails.
05Settlement or judgment
Month 9–24The overwhelming majority resolve before trial. Class settlements commonly price out in the low single-digit dollars per class member plus fees and injunctive terms; individual claims settle for nuisance value. Certification denial usually collapses the case to a single-plaintiff posture.
Class certification is where the case is priced
Nearly every TCPA lawsuit that matters is resolved by one question: can the plaintiff prove consent failed the same way for everyone? If the answer is yes, the case is worth the class arithmetic. If consent must be examined number by number, the case is worth one plaintiff's nuisance value.
This produces a counterintuitive result. Brands with no consent records at all are the easiest to certify against, because uniform absence of evidence is itself a common question. Brands with granular, per-number, versioned records are the hardest, because every number tells a different story. Record-keeping is not just a defense to the individual claim; it is structural protection against class treatment.
What a TCPA lawsuit actually costs
| Posture | Typical duration | Defense cost | Typical resolution |
|---|---|---|---|
| Demand letter, answered with records | 2–6 weeks | Minimal | Withdrawn or nominal |
| Single-plaintiff suit | 3–9 months | $25k–$75k | Low five figures |
| Putative class, certification denied | 9–14 months | $150k–$400k | Collapses to individual |
| Certified or near-certified class | 12–24 months | $400k+ | High six to low seven figures |
These are observed ranges, not guarantees; every matter turns on its own facts, jurisdiction, and list size. The pattern that holds across all of them is that the cost curve bends at the moment you either can or cannot produce consent evidence.
Defenses that work — and defenses that do not
Documented prior express written consent
StrongestA per-number record with timestamp, source URL, IP, user agent, and a hash of the exact disclosure the consumer saw. This is the only defense that both defeats the individual claim and blocks certification, because it makes consent an individualized question.
The messages were transactional, not marketing
StrongOrder, shipping, and delivery notifications sit outside the express-written-consent requirement. The defense fails the moment a promotional line or discount code appears in the same message.
No automated technology within the statutory definition
ModeratePost-Facebook v. Duguid, the ATDS definition narrowed considerably. Many modern SMS platforms send from stored lists without a random or sequential number generator, which can take the autodialer theory off the table — though it does not touch the separate revocation, quiet-hours, and identification theories.
Individualized issues defeat class certification
ModerateWhere opt-ins arrived through many surfaces with different disclosures over four years, you argue that determining consent requires a number-by-number inquiry. Ironically, this defense is only available to brands that kept granular records.
The plaintiff is a serial filer
WeakProfessional plaintiffs are common and courts know it. Standing challenges occasionally succeed, but the argument rarely disposes of a case where the underlying opt-in was genuinely defective.
We fixed the flow after the letter arrived
WeakRemediation is good practice and worthless as a defense — liability attached at send. Worse, editing a live opt-in after notice without preserving the prior version invites a spoliation argument.
Whether your insurance responds
Many operators assume general liability or cyber coverage picks up a TCPA lawsuit. Frequently it does not. Insurers responded to a decade of TCPA class actions by adding violation-of-statutes exclusions that name the TCPA directly, and by treating statutory damages as an uninsurable penalty rather than covered loss.
Ask your broker three specific questions in writing: does the policy contain a violation-of-statutes or distribution-of-material exclusion; are defense costs covered even where indemnity is excluded; and is dedicated TCPA coverage available as an endorsement. Getting the answer after a complaint lands is materially worse than getting it now.
Eight controls that prevent the lawsuit
01Capture consent evidence, not consent status
Store timestamp, source URL, IP, user agent, and a hash of the disclosure version for every number. A row marked "subscribed" proves nothing in discovery.
02Version and freeze your disclosure text
Every change to opt-in language gets an effective date and an immutable copy, so you can prove what a consumer saw on a given day two years later.
03Unbundle SMS consent from every incentive
Discount capture and SMS agreement must be separate, unchecked, affirmative actions, with an explicit "consent is not a condition of purchase" line.
04Suppress revocation globally within hours
STOP on one program must suppress the number across every marketing program and every vendor. Cross-program leakage is what converts $500 violations into $1,500 willful ones.
05Schedule by recipient local time
One nationwide 6:00 p.m. Pacific send puts every East Coast recipient past the 9:00 p.m. quiet-hours boundary — a clean, list-wide, provable violation.
06Monitor for opt-in drift continuously
Theme updates, app installs, and A/B tests silently truncate disclosures. Scanning your live storefront on a schedule catches the regression before a demand letter does.
07Retain everything for four years
The limitations period runs four years from each message, so consent and revocation evidence must outlive the last send to that number.
08Confirm your insurance actually responds
Many CGL policies exclude TCPA claims outright. Check for a violation-of-statutes exclusion and price dedicated coverage before you need it.
For the specific opt-in defects plaintiffs screen for, see how TCPA claims against eCommerce sites start, and for disclosure language and retention specifics, the definitive TCPA compliance checklist.
Frequently asked questions about TCPA lawsuits
How much does a TCPA lawsuit cost an eCommerce company?
Individual claims typically settle in the low five figures including defense costs. A certified or near-certified class involving a mid-size SMS list commonly resolves in the high six to low seven figures once class relief, plaintiff's fees, and injunctive compliance terms are combined. Defense costs alone through class certification frequently exceed $250,000, which is why most cases resolve before that ruling.
How long does a TCPA lawsuit take?
A single-plaintiff claim usually resolves within three to nine months. A putative class action typically runs nine to twenty-four months, with class certification briefing landing somewhere between month six and month fourteen and driving the settlement value.
Can a TCPA lawsuit be filed over a single text message?
Yes. The statute provides a private right of action with statutory damages of $500 per negligent violation, so a single unconsented marketing text is a viable claim with no requirement to prove financial harm. Single-message cases are usually the opening move toward a class filing.
What is the difference between a TCPA demand letter and a TCPA lawsuit?
A demand letter is pre-suit correspondence seeking settlement and testing whether the sender can produce consent records. A lawsuit is a filed complaint, often pleaded as a putative class action. Roughly speaking, the quality of your response to the letter determines whether the complaint follows.
Does business insurance cover a TCPA lawsuit?
Frequently not. Many commercial general liability and cyber policies carry a violation-of-statutes exclusion that expressly names the TCPA. Coverage exists but must usually be bought deliberately as an endorsement or standalone policy, and it should be confirmed in writing before a claim arrives.
Are Shopify, Klaviyo, Attentive, or Postscript liable for my TCPA violations?
No. Platforms and SMS providers are the tools; the seller whose goods are marketed is the party on the hook for consent. Provider terms of service almost always place the compliance obligation and indemnity on the merchant.
Can a TCPA lawsuit be dismissed early?
Early dismissal is possible where the plaintiff fails to plead use of an automatic telephone dialing system under the narrowed post-Duguid standard, lacks Article III standing, or where a binding arbitration clause with a class waiver applies. Most cases survive the pleadings and are decided economically at class certification.
Does an arbitration clause stop a TCPA class action?
Sometimes. An enforceable arbitration agreement with a class-action waiver that the plaintiff actually agreed to — for example at account creation or checkout — can move the dispute out of court and defeat class treatment. It rarely helps against a plaintiff who never transacted with you and only received a text.
Find the opt-in defects before a plaintiff's firm does
ConsentTensor scans every phone-capture surface on your storefront, flags missing disclosures, and monitors for drift after theme and app updates.
Run a free compliance scanConsentTensor provides compliance guidance and monitoring, not legal advice. Consult qualified counsel about your specific circumstances.