TCPA compliance for sales teams: consent, opt-outs, do-not-call and state laws

What is the TCPA, and who does it apply to?

The Telephone Consumer Protection Act is a 1991 federal law, 47 U.S.C. § 227, that the FCC enforces through its rules at 47 CFR § 64.1200. It applies to anyone who makes calls or sends texts to US phone numbers, including small businesses, and it gives consumers the right to sue: $500 per violation, which a court can treble to $1,500 when the violation is willful or knowing.

A second federal rule runs alongside it. The FTC's Telemarketing Sales Rule (TSR, 16 CFR Part 310) covers telemarketing to consumers and repeats many of the same duties: the National Do Not Call Registry, calling hours, caller ID and abandoned calls. The TSR exempts most business-to-business calls and doesn't reach banks, federal credit unions, common carriers or nonprofits calling for themselves. The TCPA's rules on autodialed and prerecorded calls to cell phones have no business-to-business exemption.

Courts now interpret the TCPA without automatically deferring to the FCC. In McLaughlin Chiropractic v. McKesson (June 20, 2025), the Supreme Court held that district courts aren't bound by the FCC's reading of the statute in enforcement cases; they give it appropriate respect and decide for themselves. FCC rules still bind callers, but expect more variation between courts on what the statute itself means.

• The TCPA covers calls and texts. The FCC treats a text message as a call under these rules.
• It covers informational calls as well as sales calls, though sales calls (telemarketing) carry stricter consent and do-not-call duties.
• The FCC's rules apply wherever you're based if you call US numbers. Canadian teams calling US leads follow them too.

What consent does each kind of sales call or text need?

The consent you need depends on how the call is made and what it's for: a live call dialed by a rep needs no TCPA consent, while autodialed or prerecorded calls and texts need prior express consent, and prior express written consent when they're telemarketing.

Prior express written consent, defined in 47 CFR § 64.1200(f)(9), is a signed written agreement (an electronic signature under the E-SIGN Act counts) that clearly authorizes the seller to deliver telemarketing calls or texts using an autodialer or an artificial or prerecorded voice to a specific number, with a clear disclosure that consenting isn't a condition of buying anything. Keep the record: the form, the wording the person saw, the time and the number.

• Live sales call, manually dialed, to a cell or landline: no TCPA consent needed. Do-not-call lists, calling hours and identification rules still apply.
• Autodialed or prerecorded informational call or text to a cell phone (an appointment reminder, a delivery update): prior express consent, which can come from the person giving you their number for that purpose.
• Autodialed or prerecorded telemarketing call or text to a cell phone: prior express written consent.
• Prerecorded telemarketing call to a residential landline: prior express written consent.
• Calls made for emergency purposes are exempt from the consent rules.
• Whatever the consent, an opt-out ends it for future calls of that kind (see the revocation section below).

What counts as an autodialer after Facebook v. Duguid?

Under the federal TCPA, an automatic telephone dialing system is equipment that can store or produce telephone numbers using a random or sequential number generator; that's the Supreme Court's holding in Facebook v. Duguid, decided April 1, 2021.

Before Duguid, courts split over whether any system that dialed from a stored list was an autodialer. The Court rejected that broad reading. Dialers that call from a list of your own leads, such as most power and parallel dialers, usually fall outside the federal definition. Usually isn't always, and the definition only matters for the autodialer half of the rule. A prerecorded or artificial voice triggers the consent requirement whatever dialed the call.

Several states answered Duguid by writing broader definitions into their own laws. Florida's covers 'an automated system for the selection and dialing of telephone numbers'. Oklahoma's and Maryland's say 'selection or dialing', which reaches more equipment. Connecticut's covers any device that dials automatically. A dialer that's outside the federal definition can still be inside a state's, so a national team needs written consent for automated contact in those states.

Are prerecorded messages and voicemail drops covered?

Yes: a prerecorded message, a dropped voicemail and an AI-generated voice all count as an 'artificial or prerecorded voice', so they need the consent described above when they reach a cell phone, and written consent when they're telemarketing.

The FCC ruled in November 2022 (FCC 22-85) that ringless voicemail, which drops a message into a mailbox without ringing the phone, is a call under the TCPA. In February 2024 (FCC 24-17) it ruled that voices generated or cloned with AI are artificial voices. A voicemail drop that plays after a rep's call goes unanswered is a prerecorded message too, even though a live call came first.

Prerecorded calls also have content rules in 47 CFR § 64.1200(b): identify the business at the start, give a phone number during or after the message, and on telemarketing calls offer an automated way to opt out.

• Recorded in your own voice or generated by AI: the same rule applies.
• Leaving a live voicemail, spoken by the rep in the moment, isn't a prerecorded message.
• In TopReach, an unanswered call can drop a recorded or AI-voiced voicemail automatically. Use that only for contacts whose consent covers prerecorded messages, or leave a live message instead.

What happened to the FCC's one-to-one consent rule?

It never took effect: the 11th Circuit vacated it on January 24, 2025, in Insurance Marketing Coalition v. FCC, and the FCC restored the earlier consent definition in its rules on August 29, 2025.

The rule, adopted in December 2023, would have required written consent to name one seller at a time and to cover only calls 'logically and topically associated' with the website where consent was given. It was aimed at lead generators that collect one consent for hundreds of 'marketing partners'. The court held that both requirements went beyond the statute's 'prior express consent'. On the same day, the FCC's staff postponed the rule's effective date (DA 25-90); after the court's mandate, the FCC removed the text (DA 25-621, published August 29, 2025).

What didn't change: written consent for telemarketing robocalls and robotexts still applies, and it still has to identify the seller. Buying leads with consent 'from partners' remains a common source of lawsuits, because the caller has to prove the consent covered them. The court's reasoning invites future challenges to the written-consent rule itself, but as of this review it stands.

How do people revoke consent, and how fast must an opt-out be honored?

Under rules in effect since April 11, 2025, a person can revoke consent by any reasonable means, and the rule requires the request to be honored within a reasonable time of no more than 10 business days.

Replies such as stop, quit, end, revoke, opt out, cancel or unsubscribe count as a revocation by text. A caller may send one confirmation text within 5 minutes of an opt-out, as long as it only confirms the opt-out and contains no marketing.

The FCC changed these rules again in an order adopted September 30, 2026 (FCC 26-67), published October 26, 2026 and effective November 25, 2026. It replaces the 'revoke-all' provision that had been delayed twice, first to April 11, 2026 and then to January 31, 2027:

• An opt-out from an informational message can be limited to that category of message.
• An opt-out from a marketing call or text revokes consent to all of that caller's marketing calls and texts.
• A caller may name one exclusive opt-out method, such as a key press, the standard reply words or a set website or phone number, if it discloses that method on every call or text. A caller that doesn't name one has to accept any reasonable method.
• The 10-business-day limit and the optional confirmation text stay.
• A follow-up FCC proposal asks about a shorter honoring period and a revoke-all option; comments are due November 25, 2026.
• In TopReach, a reply of STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE, OPT OUT or OPTOUT stops every number in your workspace from texting that person, including rep texts, scheduled texts and automated follow-ups, until they text START back; the list includes REVOKE and OPT OUT, which the FCC's revocation rule recognizes. Treat other wording, such as 'please don't text me' or 'don't call me again', as an opt-out too, and add the person to your team's do-not-call list so nobody calls or texts them from another number.

What are the TCPA calling hours?

Federal rules allow telephone solicitations only between 8 a.m. and 9 p.m. in the called person's local time (47 CFR § 64.1200(c)(1) and 16 CFR § 310.4(c)). Several states are stricter, so a national team is safest calling within the narrowest window that applies to each lead.

Local time means where the person is. Area codes are a reasonable guide but not proof, because people keep their numbers when they move, so an address on the record is better evidence when you have one. Our calling hours tool shows the federal and state windows by state.

• Federal: 8 a.m. to 9 p.m., called person's local time.
• Florida, Oklahoma, Maryland and Washington: 8 a.m. to 8 p.m.
• Connecticut: 9 a.m. to 8 p.m. since October 1, 2023.
• Texas (ch. 301, residential numbers): 9 a.m. to 9 p.m. Monday to Saturday, noon to 9 p.m. on Sunday.
• Utah: no solicitations from 9 p.m. to 8 a.m., on Sundays or on legal holidays without prior consent.
• New York and Virginia: 8 a.m. to 9 p.m.
• In TopReach, dynamic lists only call people inside their legal hours in their own time zone, worked out from the area code (in the US, until 9 p.m.), and never on statutory holidays; an admin's quiet hours and business hours can narrow that further. Saved static lists and a rep's own calls aren't held to calling hours, so keep those inside the window yourself.

How do the National Do Not Call Registry and internal do-not-call lists work?

Telemarketing calls and texts to residential numbers on the National Do Not Call Registry are prohibited unless the person has an established business relationship with you or gave signed, written permission; and every telemarketer has to keep its own internal do-not-call list as well.

An established business relationship, under 47 CFR § 64.1200(f)(5), lasts 18 months after a purchase or transaction and 3 months after an inquiry or application. The FCC presumes that cell phones on the registry are residential, so B2B teams that call mobile numbers aren't automatically outside it. Since March 26, 2024, the FCC's rule has applied the registry's protection to texts as well as calls.

To stay inside the federal safe harbor, a telemarketer uses a version of the registry no more than 31 days old, keeps written do-not-call procedures, trains its staff and records requests. Access runs by fiscal year: for October 1, 2026 to September 30, 2027, each area code costs $85 a year ($43 for the second six months), the first five are free, and the annual cap is $23,425.

The internal list is separate and applies even to people you have a relationship with. The FCC's rule (47 CFR § 64.1200(d)) requires a written policy, trained staff, a do-not-call request honored within a reasonable time of no more than 10 business days, and the request kept for 5 years. Callers also have to give their name, the business's name and a phone number or address where the business can be reached.

• Scrub new lists against the registry before you call, and re-check at least every 31 days.
• Keep one internal list for the whole team, not one per rep.
• Record how each number got onto your list and any consent you hold.
• TopReach keeps a do-not-call list for the whole workspace, filled by hand, by import, from call outcomes or through the API, and won't dial a number on it. It doesn't check numbers against the National Do Not Call Registry, so scrub lists before you import them.

How does the TSR's 3% abandoned-call rule apply to parallel dialing?

A call is abandoned when the person answers and isn't connected to a live rep within 2 seconds of finishing their greeting, and the TSR and FCC rules limit abandoned telemarketing calls to 3% of calls answered by a person, per campaign, measured over 30 days.

Parallel dialing rings several numbers at once for one rep. When two people answer together, one of them can't be connected, so that call is abandoned wherever the rule applies. That doesn't make parallel dialing illegal; it means a consumer telemarketing campaign has to keep its drops under the cap and meet the rest of the safe harbor.

The FTC's safe harbor (16 CFR § 310.4(b)(4)) has four parts, and the FCC's rule (47 CFR § 64.1200(a)(6) and (a)(7)) mirrors them. The TSR exempts most business-to-business calls; the FCC's version has no B2B exemption in its text. The FCC proposed in October 2025 (FCC 25-76) to drop its abandonment rules, but nothing had been adopted as of this review.

• Keep abandoned calls at or below 3% of answered calls per campaign, measured over 30 days, or over the campaign if it's shorter.
• Let unanswered calls ring for at least 15 seconds or four rings.
• When no rep is free within 2 seconds, play a recorded message with the seller's name and a phone number for do-not-call requests. The FCC's version also asks for an automated opt-out.
• Keep records that show you met each condition.
• In TopReach, a person who answers a parallel dial when no rep is free hears a short recorded message and goes to the front of the line to be called back first. Check that the message names your business and a number for do-not-call requests, and use power dialing for consumer lists where you can't show you stay under 3%.

Which states have their own mini-TCPA laws?

Florida, Oklahoma, Maryland, Washington, Texas, Virginia and Connecticut have the state laws a national sales team is most likely to run into, and several of them let consumers sue for each call or text.

These laws apply based on where the person lives or the area code they use, not where you're based. Each one has its own exemptions, so check the statute before you rely on one.

• Florida: the Florida Telephone Solicitation Act (§ 501.059), amended effective May 25, 2023, requires written consent for sales calls and texts made with 'an automated system for the selection and dialing of telephone numbers' or a recorded message. Before suing over texts, the person has to reply STOP, and the sender gets 15 days to stop. Damages are $500 per violation, up to triple if willful. A separate law (§ 501.616(6)) limits sales calls to 8 a.m. to 8 p.m. and to 3 calls in 24 hours on the same subject.
• Oklahoma: the Telephone Solicitation Act (15 O.S. § 775C.1 and following), in force since November 1, 2022, requires written consent for an automated system 'for the selection or dialing' of numbers or a recorded message, limits calls to 8 a.m. to 8 p.m. and 3 in 24 hours on the same subject, and allows $500 per violation, up to triple, with no STOP-first step. One listed exemption reads only 'a commercial telephone seller', which looks like a drafting error; don't rely on it.
• Maryland: the Stop the Spam Calls Act (Com. Law § 14-4501 and following), in force since January 1, 2024, requires written consent for automated or recorded sales calls, bars calls between 8 p.m. and 8 a.m., and caps attempts at 3 in 24 hours on the same subject, with up to $500 per violation or actual damages, tripled if willful.
• Washington: RCW 80.36.390 limits sales calls to 8 a.m. to 8 p.m., requires the caller's name, company and purpose within 30 seconds, and requires ending the call within 10 seconds when asked. Commercial texts to Washington cell numbers need clear, affirmative consent in advance (RCW 19.190.060); for suits filed on or after June 11, 2026, damages for unlawful texts fell from $500 to $100.
• Texas: SB 140, effective September 1, 2025, extended the state's telephone solicitation law to texts and images. Chapter 302 requires sellers to register (a $200 filing fee and $10,000 security) unless an exemption applies, such as calls to current or former customers by a business that has used the same name for at least 2 years. Residential calls are limited to 9 a.m. to 9 p.m. Monday to Saturday and noon to 9 p.m. on Sunday (ch. 301).
• Virginia: since January 1, 2026, the Virginia Telephone Privacy Protection Act covers texts to numbers with a Virginia area code or registered to a Virginia resident, and a reply of STOP or UNSUBSCRIBE has to be honored for at least 10 years. Hours are 8 a.m. to 9 p.m., and damages are $500 for a first violation, $1,000 for a second and $5,000 for each one after that.
• Connecticut: since October 1, 2023, a sales call or text to a consumer needs prior express written consent whether or not an autodialer is used, calls are limited to 9 a.m. to 8 p.m., and callers have to identify themselves and their purpose within 10 seconds and ask whether to continue. Business-to-business calls, existing customers and replies to a consumer's inquiry are exempt.
• Also check New York (GBL § 399-z, 8 a.m. to 9 p.m., covers texts) and Utah (no solicitations on Sundays or legal holidays without consent).

What does a compliant calling and texting setup look like?

A compliant setup comes down to records and habits: know what consent you hold for each number, scrub against the registry, keep one shared do-not-call list, call within each lead's hours, and make opt-outs stick across the whole team.

Software can carry part of that load. TopReach keeps the do-not-call list, refuses to dial numbers on it, holds dynamic lists to legal calling hours, stops every number in the workspace from texting someone who opts out, and logs every call and text on the contact. It doesn't collect or store consent forms, check the National Do Not Call Registry or decide which state laws apply to you. Those stay with your team and your counsel.

• Before importing a list: scrub it against the National Do Not Call Registry and your internal list, and note the source and consent for each number.
• Before an automated step (voicemail drop, follow-up text): confirm the consent covers prerecorded or automated contact, in writing for telemarketing.
• During calls: give your name and company up front, and take do-not-call requests on the spot.
• After an opt-out: add the number to the shared do-not-call list the same day, well inside 10 business days.
• For parallel dialing on consumer lists: measure abandoned calls per campaign and keep them under 3%.
• For state laws: check the strictest hours and frequency limits for each lead's state, and the consent rules in Florida, Oklahoma, Maryland and Connecticut.