TCPA compliance for outbound calling: the practical guide

The Telephone Consumer Protection Act is unusual among regulations in that it is enforced mostly by private plaintiffs rather than by a regulator. Damages are statutory, per call, and uncapped, which means a modest campaign against the wrong list produces exposure that dwarfs the revenue it was meant to generate. That structure is why TCPA compliance is an engineering problem, not a policy document.

The consent question, answered properly

Almost every TCPA claim turns on consent. The standard depends on what you are calling, how you are calling it, and why.

What “prior express written consent” actually requires

Four things, all of which have to be true simultaneously:

1. A clear and conspicuous disclosure that the person will receive marketing calls or texts, that they may be automated or pre-recorded, and that consent is not a condition of purchase.
2. An affirmative act by the consumer: a ticked box they ticked, a signature, a keyed reply. Pre-ticked boxes fail. Consent buried in terms of service fails.
3. Identification of the specific seller the consent is given to. Consent given to a lead aggregator does not automatically extend to whoever buys the lead.
4. A record you can produce years later: the exact language shown, the timestamp, the channel or IP, and the specific phone number consented to.

Consent obtained through a lead vendor is only as strong as the record the vendor can produce on demand. If your contract does not require them to hand over the disclosure text, timestamp, and IP for any lead you call, you are buying exposure alongside the lead.

Do Not Call: two lists, both binding

The national registry and your own internal list are separate obligations and both apply.

• The national registry must be scrubbed against on a regular cycle. Treat it as a pre-dial gate, not a post-campaign report; a scrub that happens after the calls is an audit finding, not a control.
• Your internal list records anyone who has asked you specifically to stop. Requests must be honoured promptly and kept indefinitely, and an internal request overrides an existing business relationship and any prior consent.

The internal list is where teams most often fail, because the request usually arrives verbally, mid-call, and has to survive the rep's memory. It should be a single keystroke in the dialer that suppresses the number across every campaign immediately. See call disposition codes for how that gets wired into the workflow.

Calling hours, and why area code is the wrong input

The federal window is 8am to 9pm in the called party's local time. Several states narrow it further, and some restrict Sundays and holidays.

The trap is deriving the time zone from the area code. Number portability means people keep their mobile number when they move: a 212 number may sit in California and a 415 number in Texas. Any system that infers the calling window from the area code alone will call outside the window for a meaningful slice of every list, and each of those is an independent violation.

The workable approach is to use the best location data you actually hold (billing address or stated location), fall back to area code only when you have nothing better, and be conservative at the boundaries. Nine in the morning Eastern is safe everywhere in the continental US; eight is not.

Abandoned calls and the 3% safe harbour

This is the rule that constrains predictive dialing, and it is widely misunderstood.

An abandoned call is one a live person answers where no agent is connected within two seconds of their greeting. The FCC safe harbour caps these at 3% of calls answered by a live person, measured over each successive 30-day campaign period.

The safe harbour also requires that when no agent is available you play a recorded message identifying the caller and the purpose, within two seconds of the greeting, and that you retain records demonstrating compliance. Staying silent does not avoid the classification; it just makes the call worse.

The practical consequence: pacing must be governed by the system against a hard ceiling, not watched on a dashboard. A power dialer sidesteps the rule entirely because one call per agent means an agent is always waiting.

Revocation

Consumers can revoke consent at any time and by any reasonable means: a reply of STOP, a verbal request on a call, an email, a letter. You cannot require a specific channel or form, and you cannot make revocation harder than granting consent was.

Operationally, that means every channel through which a person might say stop needs to write to the same suppression list, and it needs to apply across campaigns rather than only to the one they were called from.

What a defensible setup looks like

The uncomfortable summary

Almost every serious TCPA loss traces to the same root cause: a control that existed as a rule people were supposed to follow rather than as behaviour the system enforced. Reps forget, lists get loaded from the wrong file, a campaign starts an hour early, a stop request never leaves someone's notebook.

Put the controls in the dialer and the compliance question becomes boring, which is exactly what you want it to be.