Yes, You Can Get in Trouble — Here's Why

Yes, you can get in trouble for cold calling — but probably not for the reason you think. Cold calling itself is legal in the US, Canada, the UK, and the EU. What creates liability is how you call, not whether you call.

According to current guidance on cold calling laws, the risk comes from dialing the wrong type of number, using autodialers or AI voices without written consent, ignoring opt-outs, calling outside permitted hours, or skipping Do Not Call list scrubbing. The act is legal; the execution is where businesses get burned.

Under the TCPA, statutory damages run $500 to $1,500 per call with no cap. That sounds manageable until you do the multiplication. One vendor's liability estimate puts a 200-call campaign on an uncleaned list at $100,000–$300,000 in theoretical exposure — and a 10,000-call campaign clears $15 million.

As Martal Group's analysis puts it, "one non-compliant campaign can generate seven-figure exposure inside a month." And the enforcement pressure is rising: TCPA filings were up 34.3% year-to-date through June 2026, with roughly 76% of June filings structured as class actions.

Keller Williams was named in a class-action lawsuit accusing one of its agents of unwanted telemarketing calls and texts in violation of the TCPA and the Do Not Call Registry. The company has denied wrongdoing, but the case illustrates a critical point: brokerages and businesses can be ensnared by the calling practices of individual agents and vendors.

Matt Troiani, senior counsel at the National Association of REALTORS®, warns that with rising FCC enforcement and consumer lawsuits, it's "more important than ever" that professionals ensure their telemarketing complies with the TCPA and the growing wave of state mini-TCPA laws.

Most liability traces back to a short list of avoidable mistakes:

• Calling cell phones with autodialers or AI voices — the TCPA treats every wireless number as residential, with no B2B carve-out
• Skipping Do Not Call scrubbing, which regulators require at least every 31 days
• Calling outside the federal 8 a.m.–9 p.m. local window — or stricter state windows
• Failing to honor opt-outs within 10 business days
• Assuming a client's exemption covers you — it doesn't; exemptions belong to the entity, not the vendor

That last point catches agencies and outsourced callers constantly. Per the FTC's Telemarketing Sales Rule guidance, third-party telemarketers calling on behalf of exempt organizations must still comply in full.

The penalty stack is real: FTC TSR violations can reach $53,088 each, DNC violations over $43,792 per call, and state penalties pile on top. Litigation, not regulation, is now the primary risk driver — and roughly 42% of TCPA plaintiffs are repeat filers who know exactly what they're looking for.

This is why permission-aware outreach matters more than ever. At Worqd, our approach to B2B outreach is built around personalized, consent-based contact with relevant accounts — the opposite of a template blast — because compliance is not a one-time audit. It's an operating discipline, and the businesses that treat it that way are the ones that keep dialing.

The Traps That Actually Trigger Lawsuits

Most companies don't get sued because they cold call — they get sued because of how they cold call. The enforcement center of gravity has shifted from federal regulators to private litigation, with roughly 42% of TCPA plaintiffs filing repeat suits and class actions hitting record highs in early 2026. A single non-compliant campaign can generate seven-figure exposure when statutory damages run $500–$1,500 per call with no cap.

The biggest trap is the cell phone. The TCPA treats every wireless number as residential — there is no federal B2B carve-out for mobile — so autodialed or AI-voiced calls to any cell require prior express written consent even when dialing business contacts. The FCC's February 2024 ruling classified AI-generated voices as "artificial voices" under the TCPA, making AI-voice marketing calls illegal without that same written consent. Skip DNC scrubbing — required at least every 31 days — and you've handed plaintiffs' firms their easiest exhibit. Ignore opt-outs beyond the 10-business-day window, call outside the 8 a.m.–9 p.m. local-time window (or stricter state windows like Oregon's 8 a.m.–8 p.m. or Texas's Monday–Saturday 9 a.m.–9 p.m.), and you've stacked violations that compound fast.

• Calling cell phones without prior express written consent — no federal B2B exemption exists for wireless numbers
• Using AI-generated voices without prior express written consent under the FCC's February 2024 ruling
• Skipping National Do Not Call Registry scrubbing at least every 31 days
• Failing to honor opt-out requests within 10 business days
• Calling outside permitted hours — federal 8 a.m.–9 p.m. local time, with at least 15 states imposing stricter windows

Worqd builds compliance into every outreach motion — from consent capture in the booking funnel to scrubbing cadences that align with the strictest state rules — because the cost of a cleanup is always higher than the cost of doing it right the first time.

The State Law Problem Nobody Saw Coming

While the FCC has spent the past two years loosening federal calling rules, state legislatures have quietly been writing stricter ones — and that mismatch is where most companies now get burned. As one telemarketing compliance analysis puts it, "the real constraints now live in fifty separate places instead of one."

The FCC has repealed the one-to-one consent rule and delayed the "revoke-all" rule to January 31, 2027. But state "mini-TCPAs" in Texas, Oregon, Florida, Georgia, and Washington carry broader autodialer definitions and private rights of action than federal law, meaning a call that is perfectly legal in one state can be a lawsuit in the next.

The numbers behind these state laws are unforgiving. Texas allows penalties of up to $5,000 per violation, while Oregon imposes actual damages or a $200 minimum plus punitive damages. Georgia's amendments, effective July 1, 2024, eliminated the "knowing" violation requirement and allow class actions with no cap on damages, according to a law firm mid-year telemarketing review.

State rules also tighten the daily mechanics of calling:

• Oregon caps contact at three calls plus texts per 24 hours, with an 8 a.m.–8 p.m. window starting January 1, 2026.
• Texas restricts calls to 9 a.m.–9 p.m., Monday through Saturday, as of September 2025.
• At least 15 states impose stricter hours than the federal 8 a.m.–9 p.m. standard.
• Maine now requires scrubbing against the FCC's reassigned number database before dialing — a first-of-its-kind rule.

Two federal traps compound the state problem. First, a March 2024 amendment expanded parts of the Telemarketing Sales Rule to some B2B calls and broadened recordkeeping obligations, effective May 16, 2024 — even though the FTC's own compliance guide still describes most B2B calls as exempt. Second, exemptions belong to the entity, not the vendor. Banks, credit unions, and nonprofits may be TSR-exempt, but the third-party telemarketer calling on their behalf is not — and, as the analysis notes, "agencies and BPOs get caught by this regularly."

This is why vetting whoever runs your outreach matters as much as vetting the list. Before handing your dialing to any partner — an agency, an outsourced SDR team, or an AI calling service like the follow-up systems Worqd deploys — ask how they scrub lists, log consent, and cap contact frequency. Roughly 42% of consumers filing suit under these statutes have filed before, so a sloppy campaign doesn't just annoy prospects; it feeds a professional plaintiff's pipeline.

How to Call Without Getting Sued

The difference between a legal call and a lawsuit often comes down to process discipline. Cold calling remains legal across the US, Canada, UK, and EU, but liability attaches to how you dial — not whether you dial. One non-compliant campaign can generate seven-figure exposure inside a month, with TCPA statutory damages of $500–$1,500 per call and no cap on total liability. The enforcement center of gravity has shifted from federal regulators to state laws and private class-action litigation, where roughly 42% of consumers filing suit have filed before.

Start with prior express written consent — the gold standard per NAR counsel — before any autodialed, prerecorded, or AI-voiced call, especially to cell phones. The TCPA treats every wireless number as residential with no B2B carve-out, and the FCC's February 2024 ruling classifies AI-generated voices as "artificial voices" requiring that same written consent. Scrub the National Do Not Call Registry at least every 31 days and the FCC's Reassigned Numbers Database, which earns a federal safe harbor. Honor every opt-out within 10 business days and suppress those numbers for at least four years.

• Use a safe national calling window of 11 a.m.–8 p.m. Eastern, Monday–Friday — this clears every state rule, including Oregon's 8 a.m.–8 p.m. limit and Texas's 9 a.m.–9 p.m., Monday–Saturday window
• Document consent records, scrubbing logs, opt-out handling, and agent training for at least four years to prove violations are isolated, not systemic
• Verify vendor compliance before any multi-state campaign; TSR exemptions belong to the entity, not the telemarketer calling on their behalf

Clean, verified lead data and permission-aware outreach are the first line of defense. At Worqd, we build compliance into the outreach path from day one — consent capture, list hygiene, and documentation are baked into how our AI SDR and lead conversion systems operate, not bolted on after the fact. The same rigor applies to our B2B cold email & outreach and pipeline recovery work: if the data isn't clean and the consent isn't documented, we don't dial.

Compliant Outreach That Still Converts

The phone is becoming the riskiest place to start a sales conversation — and the data suggests it's also becoming one of the least effective. Cold call success rates for SaaS reportedly dropped from 4.8% in 2024 to 2.3% in 2025, while email outreach shows 5–15% reply rates with far lower compliance complexity, according to one B2B outreach analysis.

The math on risk compounds the problem. With TCPA statutory damages of $500–$1,500 per call and no cap, legal analyses estimate that a single 200-call campaign on an uncleaned list could theoretically generate $100,000–$300,000 in liability. Meanwhile, TCPA filings are up 34.3% year-to-date, driven largely by repeat plaintiffs' firms rather than regulators.

The smarter play is to stop dialing strangers and start responding to interest. When someone raises their hand — fills out a form, replies to a message, clicks your ad — the compliance picture changes dramatically. Prior express written consent is what legal counsel calls "the gold standard" for protecting against TCPA liability, and inbound interest is exactly where that consent naturally lives.

What compliant, high-converting outreach looks like in practice:

• Permission-aware B2B outreach — personalized messages to relevant accounts, the opposite of a template blast, with consent captured explicitly before any contact.
• Fast follow-up on inbound interest — qualifying every inquiry in under 60 seconds, 24/7, so interested buyers never go cold waiting for a callback window.
• Pipeline recovery from your existing CRM — reactivating contacts who already know you, where consent history and context already exist.

Speed matters as much as permission. A buyer who filled out your form at 9 p.m. Friday is far more likely to book if someone — or something — responds in under a minute rather than Monday morning. That's the principle behind Worqd's approach: AI SDRs that answer, qualify, and book the moment interest arrives, handing off to a real person with full context when it makes sense. No cold-call volume, no autodialer exposure, no 31-day DNC scrubbing treadmill — just fast, personalized conversations with people who asked to talk.

There's also a practical argument for working demand you already have. Reactivating old leads from your existing CRM carries lower compliance complexity than cold outreach to strangers, and you only pay for the conversations that come back. Growth doesn't have to mean risk.

Want to see what compliant, fast-follow-up growth looks like for your pipeline? Book a Growth Call with Worqd — more demand, faster follow-up, and better creative, all under one plan.