A rep three seconds into a call skips the recording disclosure to save ten seconds. The lead list nobody scrubbed that morning still holds a contact who texted STOP last week.
Both of those calls are separate violations. Neither one shows up in a QA report, because nobody listened to either of them.
We work with inside sales floors running 10 or more dials per rep per day, and the same thing keeps surfacing. Teams read the statute correctly. Eight months later, when a plaintiff's lawyer asks, nobody can produce proof that the disclosure was read or the opt-out was honored.
By the end of this you'll know which federal rules apply to your dialer, which states go further than the TCPA, and what evidence you need on file before anyone asks for it.
What counts as an auto dialer under the TCPA
Whether your system is legally an autodialer changes how much of the TCPA lands on it. Everyone on the floor says "autodialer." The statute uses a narrower term, and that narrower term is what gets argued in court.
The legal definition (ATDS)
The Telephone Consumer Protection Act governs an automatic telephone dialing system (ATDS), which it defines as equipment with the capacity to store or produce telephone numbers using a random or sequential number generator, and to dial those numbers.
Nearly every word of that definition has been litigated.
What Facebook v. Duguid changed
In April 2021, the Supreme Court read the definition narrowly. In Facebook, Inc. v. Duguid, the Court held that equipment qualifies as an ATDS only if it uses a random or sequential number generator to store or produce the numbers it dials.
The practical read: a system that dials from a customer-supplied list, which describes most modern predictive and hosted predictive dialers, may fall outside the strict federal ATDS definition.
Why "we're not an ATDS" still doesn't get you off the hook
Falling outside the ATDS definition removes one theory of liability and leaves the rest standing. Prerecorded-voice rules, DNC rules, consent rules, and calling-hour rules apply regardless of how your system picks a number.
Courts have also kept splitting since Duguid over what "store" means, and several states wrote their own definitions that don't track the federal one at all. Treat "we're not an ATDS" as a conclusion that belongs to your counsel.
The 8 federal rules every dialing team must follow
Strip away the case law and a short list of rules covers nearly every outbound B2C program. These are the ones worth taping to the wall.
Consent. Marketing calls and texts to a cell phone need prior express written consent. Informational or transactional calls, like appointment reminders and fraud alerts, can often rely on a lighter prior express consent. Landlines are looser for non-marketing calls.
Calling hours. Telephone solicitations are limited to 8 a.m. through 9 p.m. local time at the called party's location under both the FCC's telemarketing rules and the FTC's Telemarketing Sales Rule. Several states cut that window shorter.
Do Not Call. The National DNC Registry covers calls and texts. Scrub before every campaign, keep your internal suppression list current, and check applicable state registries. Consent or an established business relationship can be an exception, so document which one you're relying on.
Prerecorded, artificial, and AI voices. Prerecorded and artificial-voice marketing calls need prior express written consent. The FCC confirmed in February 2024 that AI-generated voices count as "artificial" under the TCPA, so a synthetic voice inherits the same consent, identification, and opt-out obligations.
An automated opt-out mechanism. Prerecorded telemarketing calls have to offer an automated, interactive opt-out, voice or key press, within two seconds of the identification message.
Caller ID and identification. Display a real name and number, state who you are and why you're calling, and give a call-back number.
The 3% abandonment cap. Predictive dialers break this one most often. A call counts as abandoned if a live rep isn't connected within two seconds of the called person finishing their greeting, and no more than 3% of live-answered calls can be abandoned, measured across 30 days for a single campaign.
Emergency and patient lines. Autodialed and prerecorded calls to 911 lines, hospital and physician emergency lines, and patient or guest rooms in hospitals and care facilities are flatly prohibited.
Opt-outs and revoking consent: what's live and what's delayed
The most expensive mistake we see is a mishandled revocation.
Since April 11, 2025, a consumer can revoke consent by any reasonable means. A texted STOP, a spoken "take me off your list" on a live call, an email reply, a web form: all valid.
You have to honor the request within 10 business days. A revocation sent by text also stops the calls, so channel-siloed suppression lists are already a liability.
One piece of that rule is still on hold. The FCC's "revoke-all" provision, which makes a single revocation apply to all your future calls and texts on unrelated topics, has been pushed twice and now takes effect January 31, 2027. Every other part of the revocation rule is in force today.
Waiting for 2027 is a bad bet anyway, because the common failure has nothing to do with unrelated topics. Someone texts STOP to your SMS campaign, gets removed from that list, then a fresh CRM import drops them into a voice queue two weeks later.
Every one of those calls is its own violation, and the rules already in force cover it. If your reps run both text and call outreach, one revocation has to suppress the contact in every system that can dial.
Penalties: what a violation costs
The TCPA gives consumers a private right of action worth $500 per violation, which a court can treble to $1,500 for willful or knowing violations, counted per call and per text.
At call-center volume, that math turns ugly fast. One unscrubbed list of 3,000 numbers, dialed twice, is 6,000 violations at $500 apiece before anyone files a class action.
State damages stack on top. Illinois adds its own $500 per violation plus treble actual damages, and Florida and Oklahoma each carry a private right of action of their own.
Volume is the business model. Volume is also what turns one broken process into a seven-figure number.
State auto dialer laws: the mini-TCPAs
Federal rules are the floor. Several states build higher, and if you dial into more than one, each contact inherits the strictest rule that reaches them.
🗺️ State | ⚖️ Added rule | ⚠️ Why it matters |
Florida | Written consent for automated selection or dialing | The regulator's answer is a flat no without it |
Oklahoma | Same automated-system standard as Florida | Broader than the federal ATDS test |
Illinois | 30-second disconnect, or live-operator consent | $500 per violation, plus treble actual damages |
Oregon | 8 p.m. cutoff, 3 solicitations per 24 hours, texts count | A 9 p.m. dial is a violation there |
California | Two-party consent to record calls (CIPA) | Recording without disclosure is its own claim |
Florida's Department of Agriculture and Consumer Services answers the question about as plainly as a regulator can: if an automated system selects or dials the numbers, you may not use it for sales calls without written consent or a narrow exception.
Oklahoma copied that structure in its 2022 Telephone Solicitation Act, which is the part that catches people. "Automated system for the selection or dialing of telephone numbers" reaches list-based dialers that Duguid arguably freed at the federal level.
Oregon moved the goalposts in September 2025. Any dialer still enforcing a 9 p.m. stop is out of compliance there, and the cap of three solicitations per 24 hours applies to each contact you dial.
Then there's the reassigned-numbers problem. Consent belongs to the person who gave it. When a carrier reassigns that number, the new subscriber never agreed to anything, and your CRM still shows a valid consent record.
Tag every contact by state, then default to the strictest rule that could reach them.
Where regulated verticals add another layer
Every outbound team lives under the rules above. Some inherit a second rulebook on top, and the teams dialing hardest tend to sit in those categories.
Medicare
Medicare sales carry CMS and TPMO rules alongside the TCPA. Unsolicited outbound marketing calls to beneficiaries for Medicare Advantage and Part D plans are heavily restricted, so lead flow is mostly inbound by design.
Every call needs recording, a Scope of Appointment, and specific disclaimers. That load is why Medicare sales strategy and coaching are inseparable at brokerages like AskChapter, which run hundreds of advisors under exactly this stack.
A skipped disclaimer there costs the sale and creates a compliance finding at the same time.
Life and health insurance
Insurance telesales adds NAIC model rules and state insurance regulations to the TCPA. Consent, disclosure timing, and replacement-of-coverage language all get scrutinized.
Final-expense and direct-to-consumer life teams run heavy outbound and warm transfers, so the consent and scripting around each dial carries real exposure.
Consumer-direct mortgage
Mortgage lenders stack TILA, RESPA, and state rules on top of the TCPA. Recording disclosure usually has to happen at the top of the call, and "not a commitment to lend" language has to be consistent across every rep.
None of this is unique to those three verticals. Any team whose calls get recorded and audited faces the same problem: the rule has to hold on the individual call, and someone has to be able to show that it did.
How high-volume call centers stay compliant
Enforcement is where programs break, and the arithmetic explains why.
A 200-rep floor at 12 dials per rep per day runs roughly 12,000 calls a week. If every manager reviews five calls per rep, that's 1,000 calls scored. The other 11,000 go out unexamined.
Why sampling fails at scale
A rep runs late, skips the recording disclosure to save ten seconds, and moves on. On the coverage math above, the odds nobody ever hears that call are better than nine in ten.
Multiply it across a month and you have a pattern that no report shows, sitting inside recordings you're legally required to keep.
A compliant outbound workflow
Build compliance into the dialing workflow itself, so it runs before a call connects:
Scrub every list against the National DNC Registry and any applicable state registry before each campaign.
Verify record-level consent, company-named, topic-linked, and timestamped, before a number enters the queue.
Detect and honor revocations across SMS, voice, and email, and never re-add a contact without fresh consent.
Enforce the local calling window at the system level, using the tightest applicable local window, which can land earlier than the federal 9 p.m. cutoff.
Monitor your abandonment rate per campaign over a rolling 30 days, so predictive pacing can't drift past 3%.
Log consent, revocations, scrubs, attempts, and disclosures so you can produce proof months later.
From an 8% sample to full coverage
Coverage is the variable that moves risk. Going from an 8% sample to scoring all of your calls, with QA and compliance in the same view, means a missed disclosure or a fumbled opt-out surfaces the day it happens rather than during discovery.
At the sentence level, automated quality management can flag the exact moment a required disclosure was skipped, which gives a manager something specific to coach on that Monday.
A practical auto dialer compliance checklist
Run this before your next campaign:
Scrub first: check every list against the National DNC Registry and any applicable state list before dialing.
Verify consent at the record level: each contact needs a timestamped consent record naming your company and the call topic.
Honor revocations everywhere: detect opt-outs across SMS, voice, and email, and suppress the contact across all campaigns at once.
Enforce the tightest calling window: block calls outside the strictest applicable local window at the system level, which is 8 p.m. in Oregon.
Watch your abandonment rate: stay under 3% of live-answered calls per campaign across any 30-day window.
Disclose recording where required: two-party states need a clear disclosure, and you need the log to prove it happened.
Keep audit-ready records: consent, scrubs, revocations, attempts, and disclosures, all retrievable fast.
One caveat worth stating plainly: this is a practical overview, not legal advice. The ATDS definition shifts by court and by state, so run your program past qualified counsel before you rely on any of it.
Proving compliance on every call your floor runs
Auto dialer laws apply to each of those 12,000 calls individually, which is why the proof burden grows faster than the floor does.
Reviewing a handful of calls per rep leaves the large majority unscored, and that unscored majority is where missed disclosures and mishandled opt-outs live.
Alpharun sits on top of your existing dialer and call-center stack and scores every call against your own compliance rules and sales playbook, so coverage stops being a sampling gamble.
With Alpharun, teams can:
Monitor 100% of calls at the sentence level for required disclosures and opt-out adherence.
Flag missed disclosures automatically, from TPMO scripts to recording notices, on the specific calls where they were skipped.
Keep audit-ready transcripts and clips ready for CMS, TPMO, or state review.
Coach reps on the exact moment a disclosure was dropped or a revocation was mishandled.
Surface script drift across the floor before it becomes a pattern of violations.
Send managers weekly digests that point straight to the reps and calls that need attention.
Your human team keeps selling. The repetitive part, listening for one skipped sentence across twelve thousand calls, gets handled for them.
Book a demo with Alpharun to see how it holds compliance steady across every call your team makes.
Frequently asked questions
Is it legal to use an auto dialer?
Using an auto dialer is legal. Auto dialer laws restrict how you use one, mainly around consent, calling hours, and Do Not Call rules, and they don't ban autodialers outright. Legality depends on who you're calling and whether you have the right consent on file.
Are power dialers legal?
Power dialers are legal. A power dialer works through a stored list one number at a time, so it usually falls outside the federal ATDS definition after Duguid, though consent, DNC, calling-hour, and revocation rules still apply to every call it places. Florida and Oklahoma reach it anyway.
Do I need written consent to call cell phones?
Marketing calls and texts to cell phones need prior express written consent under the TCPA. Informational or transactional calls, like appointment reminders, can often rely on a lighter prior express consent. Landline non-marketing calls are less restricted.
What are the TCPA calling hours?
TCPA calling hours run from 8 a.m. to 9 p.m. in the recipient's local time under federal rules. Several states set tighter windows, including Oregon at 8 p.m., so multi-state teams should default to the strictest applicable rule.
What is the 3% abandoned call rule?
The 3% rule caps abandoned telemarketing calls at 3% of calls answered live, measured over 30 days for a single campaign. A call counts as abandoned when a live rep doesn't come on the line within two seconds of the called person's greeting. That makes predictive dialer pacing a compliance setting as much as an efficiency one.
What is the penalty for a TCPA violation?
TCPA violations carry $500 per violation, which a court can treble to $1,500 for willful or knowing violations, counted per call or text. Class-action lawsuits and state statutory damages multiply that exposure quickly at call-center volume.
Did the FCC one-to-one consent rule take effect?
The FCC's one-to-one consent rule did not take effect. The Eleventh Circuit vacated it in Insurance Marketing Coalition v. FCC on January 24, 2025, days before its scheduled January 27, 2025 start date. Standard prior express written consent rules still apply.
