Understanding the Federal Baseline: TCPA and TSR Requirements

Understanding the Federal Baseline: TCPA and TSR Requirements

Navigating cold calling regulations starts with the federal floor established by the Telephone Consumer Protection Act (TCPA) and Telemarketing Sales Rule (TSR). These laws set the minimum standards that all U.S. businesses must follow, regardless of industry or call purpose. For service businesses using reactivation campaigns, understanding this baseline is essential before layering on state-specific requirements.

The TCPA requires prior express written consent for any marketing call made using an autodialer or prerecorded message, a standard that applies equally to AI-generated voices under the FCC’s 2024 ruling. Calling is restricted to the hours of 8 a.m. to 9 p.m. in the recipient’s local time zone, a window designed to prevent disturbances during early mornings or late evenings. Additionally, businesses must honor the National Do Not Call Registry by scrubbing their lists at least every 31 days for landlines and every 15 days for cell phone numbers, with full registry access costing approximately $17,000 annually after the first five free area codes.

The TSR complements the TCPA by mandating clear disclosures at the outset of any telemarketing call, including the seller’s identity and the commercial purpose of the call. It also requires businesses to maintain specific records—such as scripts, training materials, and consent documentation—for 24 months to support compliance audits. Violations of either rule can trigger statutory damages ranging from $500 to $1,500 per call, with higher penalties possible for willful or repeated infractions.

• Prior express written consent required for autodialed or prerecorded marketing calls
• Calling permitted only between 8 a.m. and 9 p.m. recipient local time
• National Do Not Call Registry scrubbing every 15 days for cell phones, 30 days for landlines
• TSR requires real-time disclosures and 24-month recordkeeping
• TCPA/TSR violations carry $500–$1,500 statutory damages per call

For companies like CallMyCustomers managing outreach on behalf of U.S. service providers, these federal rules form the non-negotiable foundation of compliant campaigns. Adhering to them ensures that reactivation efforts—whether for past customers, old quotes, or lapsed memberships—begin within legal boundaries before addressing additional state-level obligations.

Navigating State-Level 'Mini-TCPA' Laws and Variations

If your business calls customers in more than one state, the federal TCPA is no longer your real compliance standard — the strictest state law your customer lives in is. As one compliance analysis puts it, "Federal law has become the floor rather than the ceiling, and the states have been moving faster than the FCC."

Since 2021, at least twelve states have enacted their own "mini-TCPA" statutes, and five states introduced new legislation in 2024 alone, according to regulatory tracking. Federal law does not preempt these state laws, so businesses must satisfy both layers simultaneously. That patchwork creates real traps for companies running customer outreach across state lines.

The variations matter most in four areas:

• Calling hours: Florida and Oregon enforce an 8 p.m. cutoff — an hour earlier than the federal 9 p.m. standard — with Oregon restricting calls to an 8 a.m.–8 p.m. window.
• Frequency caps: Florida, Oklahoma, and Maryland limit telemarketers to three same-subject calls per 24 hours.
• Opt-out retention: Virginia requires honoring opt-outs for at least 10 years — double the federal 5-year standard.
• Penalties: Texas SB 140 allows damages up to $5,000 per violation, trebled under the DTPA plus attorney's fees, while New York raised fines from $11,000 to $20,000 per violation.

Consent requirements diverge too. Oklahoma requires written consent for autodialer contact, and Texas SB 140 — effective September 1, 2025 — extends coverage to texts and images, not just calls. Oklahoma's Telephone Solicitation Act of 2022 carries penalties of $500 to $1,500 per call or text.

The practical rule that emerges from this landscape: calibrate every campaign to the most restrictive standard applicable to the recipient's actual location. Area codes are an unreliable proxy — customers move, and portable numbers travel across state lines. The safest approach applies the strictest rules to every call.

For businesses that run reactivation campaigns — like CallMyCustomers does for service businesses working their past-customer lists — this is why honoring opt-outs immediately and building state-aware calling windows into the workflow isn't optional. It's the difference between a second revenue engine and a stack of statutory damages.

Courts have reinforced how seriously this patchwork is taken. The Seventh Circuit's recent ruling in Steidinger v. Blackstone Medical Services clarified that TCPA's Do-Not-Call private right of action covers voice calls only — but state mini-TCPA laws continue to govern text messaging, and TCPA consent rules for autodialed calls and texts remain fully in force. Texting is not a loophole; it's simply a different compliance lane.

Eleven states — including Colorado, Florida, Pennsylvania, and Texas — also maintain their own Do Not Call lists alongside the federal registry, requiring dual list scrubbing before any campaign goes out.

Practical Compliance Steps for Service Businesses Using Done-For-You Outreach

Compliance isn't a one-time checkbox — it's an operating system that has to run underneath every reactivation campaign. For service businesses working with a done-for-you outreach partner like CallMyCustomers, the goal is simple: turn a known customer list into booked work without ever touching a number that shouldn't be dialed. Here's how that translates into practice.

Calibrate compliance by location, not by assumption. Federal law is the floor, not the ceiling — and states have been moving faster than the FCC. Florida and Oregon enforce an 8 p.m. calling cutoff instead of the federal 9 p.m., while Florida, Oklahoma, and Maryland cap same-subject calls at three per 24 hours. A compliant campaign applies the most restrictive standard based on where the recipient actually lives, not just their area code.

Process opt-outs in days, not weeks. A 2025 telemarketing rule update cut the required opt-out processing window from 30 days to 10 days, and experts recommend honoring revocations broadly and quickly regardless of the deadline, since delayed responses are exactly what plaintiff attorneys hold up in court. Immediate opt-out handling should be standard on every campaign.

Scrub against dual DNC lists on a strict schedule. Eleven states — including Florida, Texas, Pennsylvania, and Colorado — maintain their own Do Not Call lists alongside the National Registry, so list hygiene means checking both. Cell numbers require scrubbing every 15 days, landlines every 30, per Do Not Call scrubbing guidance.

Apply one consent standard to every voice, human or AI. Since the FCC's February 2024 declaratory ruling, AI-generated voices count as "artificial or prerecorded" regardless of how human they sound, requiring the same prior express written consent as traditional robocalls. Consent records also need to be stored securely and be audit-ready, with consent tied to the specific communication method.

Keep voice and text protocols separate. The Seventh Circuit held in Steidinger v. Blackstone Medical Services that TCPA's Do-Not-Call private right of action covers voice calls only — but consent rules for autodialed calls and texts remain fully in force, and state mini-TCPA laws still govern text messaging. Separate protocols mean honoring "STOP" requests on texts while maintaining distinct voice-side calling rules.

Practical safeguards for a permission-based reactivation campaign include:

• Calling only from lists of real, known customers — never purchased or scraped data
• Owner approval of every script, offer, and message before outreach begins
• Explicit consent collected at the point of booking, tied to calls, texts, or emails
• Location-aware dialing windows and frequency caps applied to every contact
• Documented opt-out handling that clears the 10-day standard with room to spare

The stakes justify the discipline: TCPA statutory damages run $500 to $1,500 per call or text with no aggregate cap, and Texas SB 140 allows penalties up to $5,000 per violation, trebled under the DTPA plus attorney's fees. For clinics and wellness clients, outreach also operates under the required privacy agreements, including HIPAA and A2P 10DLC in practice. Where the line is unclear, treating the call as covered is the cheaper mistake — and that's the posture a reactivation partner should bring to every list review.