Cold calling laws in 2026: TCPA, Do Not Call and B2B rules

Cold calling laws in the United States come from three places: the Telephone Consumer Protection Act (TCPA) and the FCC rules under it, the FTC's Telemarketing Sales Rule (TSR), and state telemarketing statutes. As of November 2026, a team that makes sales calls generally has to check residential numbers against the National Do Not Call Registry, keep and honor its own do-not-call list, call residential numbers only between 8 a.m. and 9 p.m. in the called person's time zone, send accurate caller ID, and get consent before using autodialers, prerecorded messages or artificial voices on calls to cell phones.

Business-to-business (B2B) calls get lighter treatment, not a free pass. The Do Not Call and calling-hour rules protect residential subscribers, but the TSR's ban on deceptive statements still reaches B2B calls, and the cell phone consent rules have no business exception.

The rules also moved between 2024 and 2026: an appeals court struck down the FCC's one-to-one consent rule, the FCC rewrote how consent is revoked, the Supreme Court said courts need not defer to the FCC, and another appeals court rejected the FCC's written-consent requirement for some robocalls. This is general information, not legal advice. Take your own call program to your attorney.

Three layers of rules apply to every call

No single statute is "the" cold calling law. One call can fall under all three layers at once, and a compliant program satisfies the strictest layer that reaches it.

The TSR reaches telemarketing campaigns that cross state lines. The FCC rules and the TSR overlap on Do Not Call, hours and caller ID.

Do Not Call: the registry, scrubbing and your own list

Telemarketers may not call a residential number on the National Do Not Call Registry unless an exception applies (47 CFR 64.1200(c)(2); 16 CFR 310.4(b)(1)(iii)(B)). Registrations are honored indefinitely, until the consumer cancels or the number is removed. The FCC rules extend these protections to wireless numbers, so a cell number can be covered.

"Scrubbing" means checking call lists against the registry. The safe harbors turn on freshness: the registry copy must be no more than 31 days old on the day of any call, with the process documented, plus written procedures and trained staff. Two exceptions come up most:

• Established business relationship. Under the FCC rule, a purchase or transaction in the previous 18 months, or an inquiry or application in the previous 3 months. The TSR uses 540 days and 90 days. A consumer's do-not-call request to your company ends it under the FCC rule.
• Signed permission. A signed written agreement that lists the number and authorizes calls from your company.

Separately, any telemarketing call to a residential subscriber requires a company-specific list (47 CFR 64.1200(d)): a written policy available on demand, trained personnel, recording each request and adding the number when it is made, honoring it within a reasonable time not to exceed 10 business days, and keeping it on file for 5 years. The caller must give the individual caller's name, the entity on whose behalf the call is made, and a number or address where it can be reached.

If a vendor keeps the list, the business on whose behalf the call is made is liable for any failure to honor a request. Sample wording, not a required script: "Understood, your number is being removed and you will not be called again."

Calling hours and caller ID

Hours. The FCC bars telephone solicitation to a residential subscriber before 8 a.m. or after 9 p.m., local time at the called party's location. The TSR sets the same window for calls to a residence absent consent to other times. Area codes are an imperfect guide to time zones when people keep their cell numbers after moving.

Caller ID. Anyone engaged in telemarketing must transmit caller identification (47 CFR 64.1601(e)): the calling number or automatic number identification and, when the carrier makes it available, the telemarketer's name. Substituting the seller's name and customer service number is allowed, that number must let people make a do-not-call request during business hours, and blocking caller ID is prohibited. The TSR has a parallel rule at 16 CFR 310.4(a)(8). Knowingly sending misleading caller ID with intent to defraud, cause harm or wrongfully obtain anything of value is separately unlawful (47 U.S.C. 227(e)).

Consent for autodialed, prerecorded and AI-voice calls

The TCPA bars calls to cell phones made with an automatic telephone dialing system or an artificial or prerecorded voice unless the caller has the called party's prior express consent (47 U.S.C. 227(b)(1)(A)(iii)). In Facebook v. Duguid (April 1, 2021), the Supreme Court held that equipment is an autodialer only if it can store or produce numbers using a random or sequential number generator. That narrowed the federal autodialer definition, not the rules on artificial or prerecorded voices, and some state laws are broader. Florida's covers "an automated system for the selection and dialing of telephone numbers or the playing of a recorded message."

The statute also bars prerecorded or artificial-voice calls to residential lines without prior express consent (227(b)(1)(B)). For advertising and telemarketing, the FCC's rule requires "prior express written consent": a signed agreement, electronic signatures included, that authorizes the seller to make the calls and lists the number (47 CFR 64.1200(a)(2) and (f)(9)). The TSR separately requires an express written agreement before a sales call delivers a prerecorded message.

AI voices. In a February 2024 declaratory ruling (FCC 24-17), the FCC held that voices generated with AI that simulate or resemble human voices are "artificial" under the TCPA. A cold call using one needs the consent above, though a court is free to read the statute differently, as discussed next.

Revoking consent. Under 47 CFR 64.1200(a)(10), a person may revoke consent by any reasonable method that clearly expresses a wish to stop. A keypress or automated opt-out, a text reply of "stop," "quit," "end," "revoke," "opt out," "cancel" or "unsubscribe," and a website or number designated for opt-outs are reasonable per se. Other wording counts if a reasonable person would understand it as a revocation, a text sender may not designate an exclusive method, and a voicemail or email creates a rebuttable presumption of revocation. Requests must be honored within a reasonable time not to exceed 10 business days.

One piece is not yet in force. The "revoke-all" requirement, under which revoking in reply to one kind of message would cover all future robocalls and robotexts from that caller, was pushed to January 31, 2027 by an FCC Consumer and Governmental Affairs Bureau order issued January 6, 2026.

What changed in 2024-2026

• One-to-one consent is gone. The FCC's 2023 order would have required consent to be given to one seller at a time. On January 24, 2025, the Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC, No. 24-10277, and the current text of 47 CFR 64.1200(f)(9) has no one-to-one requirement.
• Courts need not defer to the FCC. In McLaughlin Chiropractic Associates v. McKesson (2025), the Supreme Court held that courts in enforcement proceedings interpret the TCPA themselves rather than treating FCC interpretations as binding.
• The Fifth Circuit rejected written consent for prerecorded calls. On February 25, 2026, in Bradford v. Sovereign Pest Control of TX, the court held that the statute requires only prior express consent, oral or written, for any autodialed or prerecorded call, with no basis in the text for the FCC's added written-consent rule. That binds federal courts in Texas, Louisiana and Mississippi. The FCC's rule is still in the regulations, and other courts may decide differently.

So "the FCC says" and "the law is" can now differ by court. Which standard to follow is a question for your attorney.

How B2B calls are treated

"Calling only businesses" is the most common misreading of these rules. B2B reduces exposure in some places and leaves it in others.

Where B2B calls get relief:

• TSR exemption. The TSR exempts calls between a telemarketer and a business to induce the business to buy goods or services (16 CFR 310.6(b)(7)), so its Do Not Call, hours and disclosure requirements generally do not apply.
• Residential focus. The FCC's registry and calling-hour rules protect "residential telephone subscribers," and the statute's prerecorded-voice ban for non-cell lines is written for residential lines.
• State laws. Florida's covers consumer goods or services, meaning property normally used for personal, family or household purposes. Maryland exempts a B2B sale from its consent requirement when the solicitor has operated continuously for at least three years under the same business name.

Where B2B calls are still covered:

• Deception bans. The exemption does not reach the TSR's ban on misrepresenting material information such as total costs, restrictions or refund policies (310.3(a)(2)), or on false or misleading statements to induce payment (310.3(a)(4)).
• Office and cleaning supplies. Calls to induce the retail sale of nondurable office or cleaning supplies are not exempt.
• Cell phones. The ban on autodialed, prerecorded and artificial-voice calls to cell phones without consent has no business exception, and the FCC extends its Do Not Call rules to wireless numbers.
• Caller ID and Maryland's limits. The FCC's caller ID rule covers any call to encourage a purchase "transmitted to any person," and Maryland's B2B exemption is written for its consent subsection, not its hours and frequency limits.

The hard cases are sole proprietors, home offices and owners reached on personal mobiles, where a "business" number may also be personal. Whether a given call is residential is a question for your attorney.

State laws that are stricter than the federal rules

States differ on hours, call frequency, consent and who can sue. Three statutes were read for this post:

• Florida (Fla. Stat. 501.059). An unsolicited sales call involving an automated system for selecting and dialing numbers, or playing a recorded message, requires prior express written consent. Callers must screen against a state no-sales-solicitation list, and a called party can sue for the greater of actual damages or $500, up to triple for willful or knowing violations.
• Maryland (Commercial Law 14-4502). Solicitation calls are barred between 8 p.m. and 8 a.m. in the called party's time zone, and more than three times in 24 hours to the same party on the same subject, whatever numbers are used. Automated dialing and recorded messages require prior express written consent.
• Texas (Business and Commerce Code 301.051). Consumer telephone calls are allowed after noon and before 9 p.m. on Sunday and after 9 a.m. and before 9 p.m. on other days.

Other states have their own versions, and some add registration or licensing rules this post does not cover. A team calling nationwide needs a state-by-state review, using the tightest rule for any list that spans states.

Penalties and a practical checklist

• Private TCPA suits. Actual monetary loss or $500 per violation, whichever is greater, and up to three times that for willful or knowing violations (227(b)(3)). For Do Not Call violations, a person who got more than one call in 12 months from the same entity can sue for up to $500 per violation, also trebled, and reasonable practices and procedures are an affirmative defense (227(c)(5)). Since damages run per call, a hypothetical 1,000 violating calls at $500 each is $500,000 before trebling.
• FTC civil penalties. The FTC can seek civil penalties for TSR violations. The inflation-adjusted maximum in the eCFR in October 2026 was $53,088 per violation (16 CFR 1.98), a figure that changes periodically.
• Spoofing and states. Caller ID spoofing carries civil forfeitures of up to $10,000 per violation, and states attach their own remedies.

A checklist to take to your attorney:

1. Classify every list as residential, cell or business landline, and flag sole proprietors.
2. Scrub against a registry copy no more than 31 days old and keep the records.
3. Keep a written do-not-call policy and log, honor requests within 10 business days, and cover every rep and vendor.
4. Set dialer controls to 8 a.m. to 9 p.m. in the called party's time zone, tighter where a state requires.
5. Keep consent records (signature, date, number, seller) and accept revocation by any reasonable method.
6. Decide with counsel how prerecorded messages and AI voices are handled, and train reps on price and refund statements, since the deception bans apply to B2B too.

How Flux fits

Telemarketing compliance sits with your counsel, not your processor. Flux is a payment processor, and businesses that sell by phone can draw closer underwriting review. A person reviews every application, and approval is not promised. The high-risk processing guide covers what underwriters look at, and the post on payment processing for auto warranty companies walks through one outbound-phone category.

When a call ends in a yes, a rep can send a payment link or invoice instead of reading card numbers aloud. The customer pays by card, ACH or stablecoin from their own device. Ready to talk to a person? Apply here.