Cold Calling Compliance: TCPA, DNC, and What Agencies Actually Need to Know

AI cold calling is one of the fastest ways to scale outbound prospecting — but dial the wrong number the wrong way and you're looking at fines that dwarf any revenue you generated. The Telephone Consumer Protection Act (TCPA) and the National Do Not Call Registry aren't bureaucratic noise; they're enforceable federal law with per-call penalties. If you're running outbound campaigns for clients or building your own lead pipeline, you need to understand the rules before you press send on a thousand-call batch.

What the TCPA Actually Covers

The TCPA, passed in 1991 and significantly updated since, regulates unsolicited calls and texts to consumers. The law distinguishes between calls to residential landlines, mobile phones, and business lines — and the rules are not the same for each.

Calls to Mobile Phones

This is where most modern outbound teams get into trouble. The TCPA requires prior express written consent before placing auto-dialed or prerecorded calls to a mobile number. An AI-powered TTS voice call qualifies as a prerecorded call under the statute. That means if you're dialing cell numbers scraped from a directory, you need a defensible consent chain — not just a reasonable belief that the number belongs to a business.

Calls to Business Lines

B2B calls to direct business landlines sit in a more permissive space. The TCPA's auto-dialer restrictions historically applied less strictly to business-to-business calls, and FCC guidance has generally treated commercial entities differently from residential consumers. However, this does not mean business lines are a free-for-all. If a business number routes to an employee's cell, consent rules may still apply. Always verify whether you're reaching a business line, not a mobile forwarded to one.

The National Do Not Call Registry and State Lists

The FTC's National DNC Registry applies to residential numbers. Telemarketers are required to scrub their call lists against the registry before dialing, with a maximum 31-day lag between scrubs. Calling a registered number carries fines up to $51,744 per violation as of recent FTC adjustments.

Beyond the federal list, at least a dozen states maintain their own DNC registries — Florida, Texas, Indiana, and Wyoming among them — with their own scrubbing requirements and penalty structures. If you're running campaigns across multiple states, you need to account for each jurisdiction, not just the federal list.

For agencies managing campaigns on behalf of clients, the liability question matters too. Both the calling party and the company on whose behalf the call is made can be held responsible. Don't assume your client's indemnification clause fully insulates you.

How AI Calling Fits Into the Compliance Picture

AI voice calls — where a synthetic TTS voice delivers a prerecorded or dynamically generated message — are treated as prerecorded calls under the TCPA. The practical implications are significant:

• B2B scraping workflows (like pulling leads from Yelp or Google Maps) typically surface business phone numbers, which carry less TCPA exposure — but always verify line type before dialing at scale.
• Press-1 IVR flows, where a prospect presses a digit to connect to a live rep, are common in compliant outbound. Properly structured, the AI delivers the message and transfer only happens on affirmative action by the recipient.
• Texting hot leads after a call introduces a second compliance layer. SMS to mobile numbers requires its own consent analysis under the TCPA, separate from the original call.

QALRA's architecture — dialing business leads sourced from Yelp or Google, using a press-1 connect flow, and only texting numbers that have engaged — aligns with lower-risk outbound patterns. That said, no platform eliminates compliance responsibility. The human using the tool is still accountable for list hygiene, consent documentation, and call timing rules.

Practical Compliance Checklist for Agencies

• Scrub every list against the federal DNC registry within 31 days of dialing.
• Check applicable state DNC lists for every state in your campaign geography.
• Verify line type (mobile vs. landline vs. VoIP) before using prerecorded or AI-generated voice.
• Document your consent chain for any mobile numbers in your list.
• Respect calling hours: federal rules restrict calls to between 8 a.m. and 9 p.m. in the recipient's local time zone.
• Maintain internal DNC lists and honor opt-out requests immediately.
• Brief your clients on shared liability before launching campaigns on their behalf.

Compliance isn't a one-time checkbox. It's an ongoing operational practice — and the agencies that treat it that way are the ones that scale without legal exposure pulling the rug out from under them.

Frequently Asked Questions