This page is orientation, not legal advice. It is written for people who make calls and need to know which questions to ask a lawyer. If you dial consumers at volume, get counsel.
The one distinction that determines everything
Calling a business line for a business purpose is lightly regulated in the US. The National Do Not Call Registry does not generally apply, the FTC's Telemarketing Sales Rule exempts the call, and most of the TCPA's consent machinery is aimed elsewhere.
Calling a consumer, including a personal mobile, sits inside the TCPA, the Telemarketing Sales Rule and the DNC rules, with real damages attached.
The line is blurry. A sole trader's mobile is both. A founder's cell number on a business card is both. Where you are unsure, apply the consumer rules.
TCPA calling hours: 8am to 9pm, on the prospect's clock
The FCC's rule, 47 CFR 64.1200(c)(1), reads: "No person or entity shall initiate any telephone solicitation to any residential telephone subscriber before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)." The FTC's 16 CFR 310.4(c) sets the same 13 hours for calls "to a person's residence". Both count from the called person's location. Where your rep sits is irrelevant.
Who the hours cover is where most guides go vague, so here it is from the text:
| Who you are calling | FCC hours rule | FTC hours rule |
|---|---|---|
| Consumer landline | Applies | Applies |
| Consumer mobile | Applies, via 64.1200(e) | Applies |
| Business landline, B2B offer | Written for residential subscribers | Exempt under 310.6(b)(7) |
| A founder's or sole trader's mobile | Treat as covered | Treat as covered |
| Business, selling office or cleaning supplies | Written for residential subscribers | Covered |
The trap is time zones. A team that opens the dialer at 8:30am Eastern reaches the Pacific coast at 5:30am local, 150 minutes before the window opens. On one clock across the four mainland time zones the safe hours run from 11am Eastern to 9pm Eastern, which is 10 hours, unless the dialer reads each number's zone and holds it until its own 8am.
States go further. 10 states we have verified are stricter than the federal rule, Rhode Island by 39 hours a week, and only 5 of them say whose clock governs. Our state-by-state calling hours guide quotes each rule from its source.
What a TCPA violation costs
The statute has two damages provisions, and they work differently. Both are in 47 U.S.C. 227.
Autodialer and prerecorded-voice violations, 227(b)(3): $500 for each violation. A call or text is the unit.
Do Not Call and calling-hours violations, 227(c)(5): up to $500 for each violation, and only for "a person who has received more than one telephone call within any 12-month period by or on behalf of the same entity". One early call to one person is outside the private right of action. A cadence of three attempts is inside it.
Either one, willful or knowing: the court may raise the award to "not more than 3 times" the amount, so $1500 a call. There is no cap on the total.
Here is how that scales. Take 2,000 consumer mobiles in California, dialed 3 times each from 8:30am Eastern:
| Calls | At $500 | Trebled | |
|---|---|---|---|
| One attempt each | 2,000 | Outside 227(c)(5): one call each | n/a |
| 3 attempts each | 6,000 | $3,000,000 | $9,000,000 |
That exposure is theoretical, and it is the number a class action is built on. WebRecon's data, published by TCPAWorld, put class actions at 75.5 to 83.1 percent of TCPA filings each month in 2025, against 32.0 to 68.1 percent in 2024, with 1,052 TCPA class actions in the first half of 2025 against 539 a year earlier.
The same subsection carries the defence. A caller that "has established and implemented, with due care, reasonable practices and procedures" to prevent violations has an affirmative defence under 227(c)(5). Written procedures, a dialer that enforces local time, and logs that prove it are what that defence looks like in practice.
The FTC can also sue for Telemarketing Sales Rule breaches, including the hours rule, at up to $53,088 per violation under 16 CFR 1.98(d).
The autodialer question, after Duguid
For years the TCPA's definition of an automatic telephone dialing system was read broadly enough to threaten ordinary sales dialers. In 2021 the Supreme Court resolved it unanimously in Facebook v. Duguid: equipment qualifies only if it uses a random or sequential number generator to store or produce the numbers it calls.
A dialer working from a list you uploaded does not do that. That holding is why power dialers and list-based parallel dialers are a mainstream product category.
Three caveats matter more than the headline:
State mini-TCPA statutes. Florida's Telephone Solicitation Act covers an "automated system for the selection and dialing of telephone numbers", the wording since HB 761 was signed on 25 May 2023. Before that it read "selection or dialing". Even narrowed, it does not require a random or sequential number generator, so a dialer that is safe federally still needs a look before it calls Tampa. Oklahoma and other states have their own statutes.
Prerecorded and artificial voice messages are regulated separately from autodialers and need prior express written consent for consumer telemarketing whatever the dialing equipment. Ringless voicemail sits in contested territory here.
The abandonment cap. Under 64.1200(a)(7) a telemarketer may not abandon more than three percent of calls answered by a live person, measured over 30 days per campaign, and a call is abandoned if no rep is on the line within two seconds of the greeting. Predictive pacing produces abandoned calls by design, so a team running one needs someone accountable for that percentage.
The Do Not Call Registry and opt-outs
If you make telemarketing calls to consumers:
- Scrub against the National DNC Registry before every campaign. A list scrubbed once at purchase goes stale.
- Keep your own internal do-not-call list. 64.1200(d)(3) says a request must be recorded when it is made and honored within ten business days at most.
- Know your state registries, several of which exist separately.
- Understand your exemptions properly. An established business relationship creates one, it is narrower and shorter-lived than most salespeople assume, and a website visit is not one.
Since 11 April 2025, revocation of consent is broader. Under 64.1200(a)(10) a consumer can revoke by any reasonable means, and a text reply of stop, quit, end, revoke, opt out, cancel or unsubscribe counts outright, with the same ten-business-day limit.
The most likely path to a complaint is calling someone who already asked you not to. That is an operational failure, and a dialer with proper internal suppression prevents it.
The one-to-one consent rule, and what happened to it
In 2023 the FCC adopted a rule that would have required separate, one-to-one consent for each seller named in a lead-generation form, ending the practice of one form consenting to dozens of buyers.
The Eleventh Circuit vacated it on 24 January 2025 in Insurance Marketing Coalition v. FCC, one business day before it took effect. The current definition of prior express written consent at 64.1200(f)(9), read on 5 October 2026, has no one-to-one language. Bundled consent remains permissible under the federal rules.
For anyone buying leads, the underlying standard is unchanged: consent must be prior, express and written for the calls that require it. Diligence the consent chain on any purchased list, because the seller's compliance becomes your exposure.
STIR/SHAKEN, and why it does not save you
STIR/SHAKEN is a caller ID authentication framework the FCC required US carriers to implement by 30 June 2021 under the TRACED Act. It signs calls with an attestation level:
- A, full attestation: the carrier knows the customer and has verified their right to use the number
- B, partial: the carrier knows the customer but not their right to the number
- C, gateway: the call entered from elsewhere and the carrier can vouch for nothing
Two things are commonly misunderstood.
Attestation says who you are. The spam engines score what you do. An A-attested number that places 500 short unanswered calls a day will still be labelled Spam Likely.
The labels come from separate systems. Hiya for AT&T, TNS for Verizon and First Orion for T-Mobile each score numbers independently. Clearing a label with one leaves the other two as they were, and there is no single place to fix it.
Outside the US, briefly
UK: the Privacy and Electronic Communications Regulations and the Telephone Preference Service. Business-to-business calls must be screened against the Corporate TPS, which is a real and frequently ignored obligation.
Canada: the National DNCL and CRTC rules, with distinct requirements for identification and calling hours.
EU: GDPR governs the lawful basis for processing the contact data, before you reach any telecoms rule. Legitimate interest is the usual basis for B2B and it requires an assessment you should actually document.
Australia: the Do Not Call Register Act, with a mandatory 30-day washing requirement.
A working checklist
- Know whether each list is business or consumer, and treat ambiguous mobiles as consumer
- Hold every consumer and mobile number until 8am and stop at 9pm in its own time zone, or dial 11am to 9pm Eastern on one clock
- Check the state rules for the states on your list
- Scrub the DNC before every campaign
- Record do-not-call requests on the call and suppress them within ten business days
- Do not use a predictive dialer unless someone owns the abandonment rate
- Identify yourself and your company on every call
- Diligence the consent chain on every purchased list
- Get state-specific advice before dialing consumers nationally
- Write the procedures down and keep the logs, because that is the 227(c)(5) defence
Frequently asked questions
- What are the TCPA calling hours?
- Telemarketing calls to a residential subscriber, which the FCC extends to mobile numbers, may only be placed between 8am to 9pm local time at the called party's location under 47 CFR 64.1200(c)(1). The FTC's Telemarketing Sales Rule sets the same 13-hour window at 16 CFR 310.4(c). The clock that counts is the prospect's, so a rep in New York cannot dial Los Angeles until 11am Eastern. Several states set shorter windows.
- Do TCPA calling hours apply to B2B cold calls?
- Mostly no, with one large exception. The FCC's hours rule is written for calls to a "residential telephone subscriber", and the FTC exempts calls "between a telemarketer and any business" at 16 CFR 310.6(b)(7), apart from nondurable office and cleaning supplies. The exception is mobiles: 64.1200(e) applies the hours and Do Not Call rules to wireless numbers, so a founder's cell is the call to keep inside 8am to 9pm.
- Is cold calling legal in 2026?
- Yes. Cold calling businesses in the US is legal and lightly regulated. Cold calling consumers is legal under the Telephone Consumer Protection Act, the Telemarketing Sales Rule and the National Do Not Call Registry, inside the 8am to 9pm window, with statutory damages of up to $500 a call and three times that for willful violations. The burden depends almost entirely on whether the number belongs to a business line or a person.
- Are power dialers legal under the TCPA?
- Generally yes. In Facebook v. Duguid in 2021 the Supreme Court held unanimously that equipment only qualifies as an automatic telephone dialing system under the TCPA if it uses a random or sequential number generator to store or produce numbers. A power or parallel dialer working from an uploaded list does not do that. State statutes such as Florida's define autodialers differently, so the federal answer is half of it. This is orientation, not legal advice.
- What are TCPA damages?
- The TCPA gives $500 per call for autodialer and prerecorded-voice violations under 47 U.S.C. 227(b)(3), and up to $500 per call for Do Not Call and calling-hours violations under 227(c)(5), which requires more than one call to the same person within 12 months. Courts can treble either for willful or knowing violations. There is no cap, and in 2025 75.5 to 83.1 percent of TCPA filings each month were class actions.
- How long do you have to honor a do not call request?
- Ten business days at most. 47 CFR 64.1200(d)(3) requires a caller to record a do-not-call request when it is made and honor it "within a reasonable time" that "may not exceed ten (10) business days". Since the FCC's revocation rule took effect on 11 April 2025, a consumer can revoke consent by any reasonable means, including replying stop, quit, end, revoke, opt out, cancel or unsubscribe, under the same ten-business-day limit in 64.1200(a)(10).
- What happened to the FCC one-to-one consent rule?
- The Eleventh Circuit vacated it on 24 January 2025 in Insurance Marketing Coalition v. FCC, one business day before it was due to take effect, holding that prior express consent can cover more than one seller. The current definition of prior express written consent at 47 CFR 64.1200(f)(9), read on 5 October 2026, contains no one-to-one requirement. Bundled consent on a lead form remains permissible federally, and the buyer still carries the risk of a bad consent chain.
How to cite this page
Abhi Chawla. "TCPA cold calling rules in 2026: calling hours, DNC and damages." MRR Nerds, 2026-10-05. https://www.mrrnerds.com/guides/cold-calling-laws-tcpa. Accessed 2026-10-20.
The underlying vendor data is published at /data under CC BY 4.0. Cite the dataset for numbers, this page for the analysis.