Where the Legal Line Sits: What Makes a Call Harassment Under Federal Law

If you run a service business and you're sitting on a list of past customers you'd love to call, the fear is real: could picking up the phone get you sued or fined? The short answer is that federal law doesn't actually define "harassment" as its own legal standard. Instead, the Telephone Consumer Protection Act (TCPA) of 1991 defines which calls are prohibited — and those prohibited calls are what become legally actionable.

The TCPA's core rules center on technology and consent. The law prohibits initiating calls using an automatic telephone dialing system or an artificial or prerecorded voice without prior express consent, with limited exemptions, according to the FDIC's compliance examination manual. Since 2012, autodialed or prerecorded telemarketing calls have required prior express written consent. And AI voices are now in scope too — the FCC states that AI-generated voice calls are illegal unless the consumer has agreed to receive them or the caller is exempt.

Here's the part that surprises most business owners: "telemarketing" is interpreted broadly. As legal analysis of TCPA requirements explains, a call counts as telemarketing if it's predicated in part by the desire to achieve a future sale — even if no sale happens on that call, a later call, or an in-person transaction. So a win-back call to a past HVAC customer, with no booking made during the conversation, still falls under telemarketing rules.

Timing matters as well. The FCC prohibits telemarketing calls to home phones before 8 a.m. and after 9 p.m. local time, per the agency's consumer guidance on unwanted robocalls.

The financial stakes explain why businesses take this so seriously:

• Private individuals can seek $500 per communication, or $1,500 for willful violations, in statutory damages.
• The FCC can pursue up to $16,000 per violation — rising to $26,000 for intentional violations.
• TCPA judgments have exceeded $925 million in recent years.

One more sobering note: proving valid consent is entirely the caller's burden, and there's no exception for a good-faith but mistaken belief that consent existed. That's why reactivation services like CallMyCustomers work only from lists of real customers, where an established business relationship — a transaction within the past 18 months or an inquiry within 3 months — sits squarely within the TCPA's exemptions. The line between a welcome follow-up call and actionable harassment isn't about how friendly your intentions are; it's about whose list you're calling, what technology places the call, and whether consent is documented and honored.

Consent Is the Whole Ballgame — And Revocation Is the New Enforcement Frontier

Ask any TCPA lawyer what separates a legal follow-up call from actionable harassment, and you'll get the same three-word answer: consent, consent, consent. Whether a call violates federal law turns on the recipient's consent status, the technology used, and the relationship between the parties — and the burden of proof sits entirely on the caller.

That burden is unforgiving. As MS Law Group's TCPA guidance makes clear, proving valid consent is the caller's requirement, and there is no exception for a good-faith but ultimately mistaken belief that consent existed. For autodialed or prerecorded telemarketing calls, the FCC's 2012 revisions require prior express written consent, along with interactive opt-out mechanisms, per the FDIC Consumer Compliance Examination Manual.

Consent, however, is not permanent. Consumers may revoke it at any time "in any reasonable manner," and in February 2024 the FCC adopted a rule requiring businesses to honor revocations within 10 business days, effective April 2025, according to Goodwin Law's TCPA year in review. Plaintiffs have noticed. A rising wave of lawsuits now targets businesses that missed non-standard revocations — a customer texting "I do not want to hear from you" instead of the keyword "stop" — and then received another call.

The 2025 landscape adds further uncertainty:

• The Eleventh Circuit vacated the FCC's One-to-One Consent Rule in Insurance Marketing Coalition Limited v. FCC on January 24, 2025 — three days before its effective date — leaving bundled consent permissible for now, per Pierce Atwood's analysis.
• The FCC delayed by one year the revocation provisions requiring opt-outs to apply to all future communications, even on unrelated subjects, giving financial institutions and healthcare organizations time to comply.
• Proposed rules from July 2024 would require clear disclosure that consent may include AI-generated calls, and that callers using AI voice disclose it at the start of each call.

Goodwin Law cautions that litigants and regulators will still challenge consent forms inconsistent with the spirit of the one-to-one rule, so the vacatur hardly eliminates risk. With 1,210 TCPA lawsuits filed between January and August 2024 — a 4.4% increase over 2023 — the practical takeaway is simple: document consent, honor opt-outs immediately, and work only from lists of real customers. That's why CallMyCustomers builds every reactivation campaign from genuine customer lists with immediate opt-out honoring, rather than hoping a good-faith belief in consent will hold up. It won't.

Why Calling Your Own Customers Is Different: The Established Business Relationship

If you've ever hesitated to call a customer because you feared crossing a legal line, here's the good news: the TCPA treats calls to people you've actually done business with very differently from cold outreach. The law carves out an Established Business Relationship (EBR) exemption that places known-customer outreach in the statute's safest territory.

Under the EBR framework, a "telephone solicitation" excludes calls made to parties with whom the caller has an established business relationship, per the FDIC's compliance guidance. The relationship comes in two forms: a transactional EBR (a purchase within the previous 18 months) or an inquiry EBR (an inquiry within the previous 3 months), as outlined in TCPA compliance analysis. For an HVAC company calling last spring's tune-up customers, or a dental practice following up on unsold treatment plans, that exemption applies directly.

The EBR is not a blank check, however. Two critical caveats shape how reactivation outreach should work:

• Even calls covered by an EBR become actionable if the recipient has placed a company-specific Do Not Call request — which must be honored for at least 5 years, according to legal guidance.
• "Telemarketing" is interpreted broadly: a call counts if it's predicated on a future sale, even if no sale happens on the call itself.
• Consent can be revoked "at any time by any reasonable means," and the FCC's rules require honoring revocations within 10 business days.

State laws raise the stakes further, particularly when outreach is outsourced. Georgia's Senate Bill 73, effective July 2024, creates vicarious liability for third-party solicitations even without knowing violations — with civil penalties up to $2,000 per violation and private actions up to $1,000 each. A business hiring a lead-generation vendor can inherit the vendor's compliance failures.

This is why reactivation of known customers is structurally lower risk than cold lead generation. A customer who paid you within 18 months sits inside the EBR window; a stranger on a purchased list does not. The stakes of getting it wrong are real: private individuals can seek up to $500 per communication, or $1,500 for willful violations, per statutory damages analysis.

CallMyCustomers works exclusively from real customer lists — past jobs, old quotes, expiring memberships — where the established business relationship already exists, and honors opt-outs immediately. The safest call you can make is the one to someone who already chose your business once.

How to Stay Clearly on the Right Side of the Line

Knowing where the legal line sits is one thing; building outreach that never comes close to it is another. The good news is that the same rules that define harassment also draw a clear map for staying safely on the right side of it.

Start with your list. Because proving valid consent is entirely the caller's burden — with no good-faith exception for mistaken beliefs — every name you call should be a real customer with a documented relationship. The TCPA's established business relationship exemption covers transactions within the previous 18 months or inquiries within 3 months, which is exactly where reactivation outreach lives. This is why CallMyCustomers works only from genuine customer lists rather than purchased or scraped data.

Second, apply telemarketing-grade standards to everything. Courts interpret telemarketing broadly — a call counts if it's predicated on producing a future sale, even if the sale happens later or in person. So treat every win-back, renewal, or follow-up call as telemarketing, honor company-specific do-not-call requests for at least 5 years, and avoid calling before 8 a.m. or after 9 p.m. per FCC guidance.

Third, move fast on opt-outs. The FCC's rule gives businesses 10 business days to honor a revocation, and plaintiffs increasingly sue over slow or missed revocations — including non-standard ones like a casual text saying "I do not want to hear from you." Immediate honoring, the standard CallMyCustomers applies, comfortably exceeds the federal window.

Here's the practical checklist:

• Build lists only from real customers with documented consent or an active established business relationship.
• Honor every opt-out immediately — well inside the 10-business-day federal requirement — and log non-standard revocations.
• Skip autodialers and AI-generated voices, which the FCC considers illegal without explicit consumer agreement; use human-placed calls instead.
• Keep an owner-approved script on every message so judgment stays in the loop before anything goes out.
• Monitor the shifting 2025 landscape — state mini-TCPAs like Georgia's $2,000-per-violation law and pending FCC actions continue to move.

Finally, keep a human in the process. Automation handles scale well, but human judgment is what keeps every call on the right side of the line — a caller who can read a tone, respect a "not interested," and stop. With penalties running up to $1,500 per willful violation for private plaintiffs, the cheapest compliance strategy is the one built in from the start: real customers, real consent, real people on the phone.

ctaText: Turn your past customers into booked work — owner-approved outreach, run for you. Get your free list review. socialProofText: Reactivating a customer costs ~5x less than acquiring one — and one call is often all it takes.