Whether a spam call is illegal depends on the details. For a U.S. consumer in 2026, consent, the call's purpose, the number reached, the technology used, and the caller's response to an opt-out usually decide the issue.

Some unwanted calls are lawful. Others break more than one rule.

Save the voicemail or screenshot either way. Caller ID can look familiar and still be wrong, so don't give out payment details or a one-time code.

The main federal pieces are the Telephone Consumer Protection Act (TCPA), FCC and FTC telemarketing rules, the National Do Not Call Registry, caller ID laws, and state law. No single federal rule makes every unwanted call illegal.

Which rule applies to your call?

Start with two details: why the caller contacted you and how the call was made. A sales robocall, debt reminder, political call, and spoofed scam can look identical on a phone while facing different rules.

These categories overlap. A marketing text can trigger telemarketing rules, and an automated voice call may be covered even if nobody uses the word "autodialer."

What the TCPA restricts

The TCPA is the federal statute behind many robocall and spam-text complaints. It reaches certain calls made with an automatic telephone dialing system, an artificial voice, or a prerecorded message.

For a telemarketing call or text to a wireless number using regulated technology, prior express written consent is generally required. That permission must fit the purpose of the contact.

If you still have the checkout page, form, or terms where you gave your number, save them. They may show what you agreed to receive.

A live caller isn't automatically acting lawfully. A sales call to a number on the Do Not Call Registry can still violate the rules, although permission or an established business relationship can create limited exceptions. A direct request to a company to stop calling matters too.

"Autodialer" doesn't settle the claim. The legal definition, the type of voice, the number called, and whether the message was marketing can all change the analysis.

You can withdraw consent through a reasonable method. Replying STOP is usually a clear request for a legitimate business text.

Save the text and your reply. If the company continues calling after a direct do-not-call request, that timeline may become useful evidence.

Emergency calls and some federal-debt communications receive different treatment. An ordinary seller still can't treat those exceptions as permission for unlimited automated calls.

How the Do Not Call Registry works

Registration is free through the National Do Not Call Registry, or by calling 1-888-382-1222. Covered telemarketers may need up to 31 days to update their lists.

Turns out, the Registry is narrower than its name suggests. It targets sales calls, not every unwanted communication.

It does not:

• stop scammers who ignore the law;
• cover political calls, many charitable solicitations, or surveys;
• cancel permission you already gave a company;
• by itself resolve unwanted text messages.

A registered number can still receive a call from a company with applicable permission or a qualifying relationship. You can also tell that company to place your number on its internal do-not-call list.

Write down the date, number used, business name, and your request. Keep that record.

The FTC's National Do Not Call Registry FAQs explain registration and complaint options. Registration can reduce calls from legitimate sellers, but fraudsters may disregard it.

Calling hours and opt-out requirements

Telemarketing calls to your home generally can't be made before 8 a.m. or after 9 p.m. local time. An out-of-hours call is worth recording, although the timing alone doesn't establish every violation.

A prerecorded telemarketing message must give you an opt-out option at the beginning. The caller should identify the business and provide a practical way to stop future calls.

The FCC guide to stopping unwanted robocalls and texts covers these protections. Use an opt-out mechanism only when you can identify and trust the sender. Don't provide payment details or account codes just because a caller offers an opt-out.

State laws can add protection

Federal rules are only one layer. A state may set stricter consent standards, different calling hours, registration requirements, or a private right to sue.

Which state law applies can depend on where you live, where the business operates, and how the call was made. A dollar amount from another state's website may not fit your situation.

Check your state attorney general's telemarketing guidance or the relevant statute before relying on a state-specific claim.

This is general consumer information, not legal advice. A qualified attorney can assess a private claim, especially if calls continued after a written opt-out.

Penalties and possible remedies

A private TCPA claim may seek $500 for each violation. If a court finds the violation was willful or knowing, it can raise the amount to as much as $1,500.

Those are possible statutory damages, not an automatic payment.

The FCC, FTC, and state attorneys general enforce different parts of the anti-robocall system. Depending on the conduct and the law, they may seek civil penalties, injunctions, or compliance orders.

A regulatory fine normally goes to the government. It doesn't automatically compensate the person who received the call.

Save evidence promptly. Legal deadlines vary, and the number displayed on your phone may not identify the company responsible.

What STIR/SHAKEN does and does not do

STIR/SHAKEN is a caller ID authentication framework. A participating originating provider signs the caller ID information, and another provider can check that signature as the call moves through the network.

Thing is, authentication doesn't test whether the caller has your consent. It doesn't verify the sales pitch, approve the business, or make the call safe.

A verified label is a clue, not a legal finding. An unsigned call isn't automatically illegal either. Authentication may be unavailable on part of a call's route.

A bad actor can also use a real number or a number it is authorized to present.

Treat caller ID as unconfirmed. If someone claims to be your bank, insurer, government office, or delivery company, hang up and use contact information from an official statement or website.

How to report an illegal or suspicious call

Act while the details are still fresh:

1. Protect your information. Hang up if the caller asks for a password, one-time code, payment, or sensitive identity information. Don't call back using the displayed number.
2. Record the facts. Note the date, time, number called, displayed caller ID, message, company name, callback number, and whether the call used a recording or menu.
3. Save what you received. Keep voicemails, screenshots, texts, written opt-out requests, and any reply confirming that the company received your request.
4. Contact a real company safely. If the caller is identifiable, use a number from the company's official website or your statement to ask that calls stop. Avoid links or phone numbers supplied by a suspicious message.
5. Register your number. Add it to the Do Not Call Registry if it isn't already registered. Wait 31 days before treating a covered sales call as a registry complaint.
6. File an FCC complaint. Use the FCC consumer complaint form for unwanted calls, robocalls, texts, or suspected spoofing. Explain what happened and attach available evidence if the form permits it.
7. Report fraud or repeated sales calls. Follow the FTC reporting instructions in its registry FAQs. Your state attorney general may also accept a complaint under state law.

The FCC may share complaint information with other enforcement agencies. The agency form doesn't award TCPA damages or guarantee an investigation.

Blocking and labeling options

Start with your phone's built-in spam filter, call screening, and blocking tools. Your carrier may offer additional blocking or call-labeling features, sometimes for a fee. Plan terms differ.

Block repeat numbers and report junk texts through your messaging app. Use the carrier's spam-reporting process when one is available.

Spoofing means the next call may come from another number, so blocking works best as one layer.

To be honest, a paid app isn't automatically safer. Check the access it requests, whether it shares call data, and whether a subscription renews before you install it. Read the cancellation terms too.

Questions people ask

Does the Do Not Call Registry stop robocalls?

No. It mainly limits covered sales calls from legitimate telemarketers. Scammers, political callers, charities, surveys, debt collectors, and some informational callers may follow different rules.

Is every robocall illegal?

No. Consent, emergencies, the message type, the number called, and specific exemptions can change the answer. Political calls may fall outside Do Not Call telemarketing rules, but the technology and number type still matter.

Does a "Spam Likely" label prove a violation?

No. The label is a warning from a carrier or app, not a legal decision. A call without that label can still be unlawful, while a labeled call may be misclassified.

Can I sue a spam caller?

Possibly. A private TCPA claim depends on facts such as consent, call technology, message purpose, registry status, and the caller's identity.

Keep your records and consult a qualified attorney if the calls continue or the potential damages are significant.

What if I never gave the caller permission?

That can support a complaint, but it doesn't answer every legal question. An investigator or court may still need to decide whether the call was marketing, whether it used a prerecorded voice, whether the number was residential or wireless, and which company actually placed it.

For the next suspicious call, save the voicemail or screenshot immediately and write down the date and time. Don't use the callback number; send the facts to the FCC, FTC, or your state attorney general through the route that fits the call.