The DNC Rules That Catch Businesses Off Guard

Most businesses discover do-not-call rules the hard way — through a complaint, a fine, or a class action. The numbers explain why: the FTC's official data book shows more than 253 million active registrations on the National DNC Registry in FY 2024, and the agency received over 2 million DNC complaints that same year. Those complaints aren't filed into a void; they feed the FTC's Consumer Sentinel Network, where law enforcement uses them to spot trends and build cases.

The financial exposure is real. According to regulatory analysis from ActiveProspect, state fines range from $500 to $25,000+ per violation, and class action settlements averaged $6.6 million in 2024–2025. At the federal level, TCPA statutory damages run $500–$1,500 per unsolicited call or text, with no aggregate cap in class actions.

What trips businesses up is that DNC compliance isn't one rule — it's a stacked, multi-layered regime. Miss a layer and the others don't save you.

• The federal registry: Telemarketers must check the National DNC Registry every 31 days and scrub their lists. A compliance guide from Plura AI is blunt: a list scrubbed 45 days ago is non-compliant.
• The TCPA: Prior express written consent, caller ID disclosure, calls limited to 8 a.m.–9 p.m. local time, and immediate honoring of opt-out requests.
• State "Mini-TCPA" laws: Stricter rules that stack on top of federal ones. Florida's calling window ends at 8 p.m. with fines up to $10,000 per violation; Oregon's HB 3865 restricts calls to 9 a.m.–7 p.m., caps solicitations at three per consumer per 24 hours, and extends coverage to texts.

Because state rules stack, national campaigns should default to the most restrictive state requirements, per Nexdial's TCPA reference guide. That means 9 a.m.–7 p.m. calling hours and tight caps — not the looser federal baseline.

There's one more layer that catches AI-driven outreach specifically. The FCC's February 2024 Declaratory Ruling, adopted unanimously and effective immediately, confirmed that AI-generated voices count as "artificial or prerecorded voice" under the TCPA — no AI exceptions, per legal analysis from DarrowEverett. Compliance attorney Hannah L. Sfameni notes that AI voices "fall squarely within the TCPA's restrictions, which creates numerous liability traps for those who fail to comply."

The good news: the same systems that create risk can manage it. Legal analysis notes AI tools can flag DNC numbers, track consent and opt-outs as they occur, and monitor communication patterns for compliance. That's exactly how Worqd's AI SDR is built — permission-aware outreach with explicit consent captured up front ("I agree to be contacted about my request"), instant opt-out handling, and no template blasts. When you evaluate any outreach partner, ask how their systems handle the 31-day scrub, state calling windows, and consent records — because documented consent is the strongest defense against a violation.

Why AI Calling Changed Everything in February 2024

If you're evaluating an AI SDR, one date matters more than any other: February 2024. That's when the FCC settled, once and for all, whether AI voice calling sits inside or outside America's telemarketing laws.

In a unanimous Declaratory Ruling, the FCC confirmed that AI-generated voices count as "artificial or prerecorded voice" under the TCPA — effective immediately, with no AI-specific exceptions. If your AI system places calls, it faces the full weight of do-not-call rules, exactly as a robocaller does.

The stakes are not theoretical. TCPA statutory damages run $500 to $1,500 per unsolicited call or text with no aggregate cap in class actions, and class action settlements averaged $6.6 million in 2024–2025. Enforcement is consumer-driven, too: the FTC logged over 2 million do-not-call complaints in FY 2024 alone.

The ruling established three core requirements for any AI-generated call:

• Prior express consent before the call is placed — not implied, not assumed
• Proper identification of who is calling and why
• Immediate honoring of opt-out requests, recognized through any reasonable means — including keywords like "stop," "cancel," or "unsubscribe"

Legal counsel reading the ruling see a clear trajectory. Hannah L. Sfameni of DarrowEverett notes that AI-generated voices "fall squarely within the TCPA's restrictions," creating "numerous liability traps for those who fail to comply" — and that requirements will likely continue to become more stringent over time. The FCC followed up in August 2024 with proposed AI-specific disclosure rules, confirming the direction of travel.

This is why a provider's compliance practices now matter more than its features. The right question isn't "how fast can your AI follow up?" but "how do you capture, document, and prove consent — and how fast do you honor an opt-out?" The operational gold standard is processing opt-outs within minutes, not days, across every channel.

There's a constructive flip side, though. The same ruling acknowledges that AI can actively support compliance — flagging DNC-listed numbers, tracking consent as it's captured, and monitoring opt-outs in real time. Done right, an AI SDR can respect do-not-call rules more reliably than a manual team ever could.

That's the standard we hold ourselves to at Worqd. Our AI SDR handles every conversation with permission-aware outreach and explicit consent capture — the same documented, auditable approach legal analysts call the strongest defense against violations.

Want follow-up that's fast and compliant? Book a Growth Call and see how our AI systems turn inbound interest into booked calls without cutting legal corners.

The Four Pillars of Compliant Outreach

Compliance isn't a checklist you complete once — it's an operating rhythm. The FCC's February 2024 Declaratory Ruling made that unmistakably clear: AI-generated voices are "artificial or prerecorded voice" under the TCPA with no AI-specific exceptions, so every call an AI SDR places carries the full weight of federal and state DNC rules. Legal analysis from DarrowEverett confirms the ruling took effect immediately and compliance requirements "will likely continue to become more stringent over time."

• Documented prior express written consent — the strongest defense against violations, creating a verifiable audit trail that turns liability into proof
• 31-day registry scrubbing — DNC data must be no more than 31 days old at the time of each call; a list scrubbed 45 days ago is already non-compliant
• Calling-hour restrictions — federal window is 8 a.m.–9 p.m. local time, but Florida and Maryland end at 8 p.m., Connecticut restricts to 9 a.m.–8 p.m., and Oregon's HB 3865 (effective September 2025) narrows it further to 9 a.m.–7 p.m.
• Immediate opt-out honoring — consent revocation recognized through any reasonable means (stop, quit, end, revoke, opt out, cancel, unsubscribe) must be processed across all channels within minutes, not days

The one-to-one consent rule — requiring prior express written consent "one seller at a time" — was vacated by the Eleventh Circuit on the eve of its January 2025 effective date, but stricter consent practices remain a defensible best practice. Consent records should be retained at least five years, and internal suppression lists honored within 30 days. ActiveProspect notes that documented consent is the strongest defense, while Plura AI's compliance guide details the 31-day scrub requirement and five-year retention standard. Nexdial's reference guide emphasizes that real-time revocation is now the operational gold standard.

Worqd's AI SDR is built around these pillars: the booking funnel captures explicit consent ("I agree to be contacted about my request") and states details are only used to prepare for the call, while the system flags DNC numbers, tracks consent, and honors opt-outs in real time — turning AI from a compliance risk into a compliance asset. With over 253 million active DNC registrations and 2 million complaints filed in FY 2024 alone, the stakes are measurable: TCPA statutory damages run $500–$1,500 per call with no aggregate cap in class actions, and state fines reach $25,000+ per violation.

Why an AI SDR Can Be More Compliant Than Manual Follow-Up

Many assume AI-powered outreach increases compliance risk, but research shows it can actively strengthen adherence to do-not-call rules when designed responsibly. The FCC’s February 2024 ruling confirmed that AI-generated voices fall under TCPA restrictions as "artificial or prerecorded voice," eliminating any assumption of AI-specific exemptions. This means compliance now hinges on the same pillars for AI and human agents: documented consent, frequent DNC scrubbing, and immediate opt-out handling.

Worqd’s AI SDR operationalizes these requirements through its permission-aware outreach model. Every interaction begins with explicit consent captured in the booking funnel — users check "I agree to be contacted about my request" — creating a verifiable audit trail that ActiveProspect identifies as the strongest defense against violations. The system scrubs contact lists against the National DNC Registry every 31 days, ensuring data never exceeds the regulatory freshness threshold, and honors opt-outs instantly across all channels, aligning with Nexdial’s emerging standard of processing revocations "within minutes, not days." Unlike manual follow-up, which risks delayed responses or inconsistent logging, the AI SDR enforces calling-hour restrictions (8 a.m.–9 p.m. federally, with stricter state windows like Oregon’s 9 a.m.–7 p.m. limit) and prevents calls to numbers on internal suppression lists.

By embedding compliance into the workflow — flagging DNC numbers pre-dial, tracking consent in real time, and monitoring opt-out patterns — Worqd’s approach turns a potential liability into a controllable, auditable process. This contrasts sharply with manual follow-up, where human error in consent tracking or list hygiene can trigger TCPA penalties ranging from $500 to $1,500 per violation, with state fines reaching $25,000+ and class action settlements averaging $6.6 million. For providers evaluated under "Choosing a Provider > Checking Compliance Practices," this built-in rigor offers a clearer path to lawful, effective outreach. Book a Growth Call to see how permission-aware AI SDR operates within legal boundaries while accelerating lead conversion.

Checklist: How to Vet a Provider's Compliance Practices

Checking a provider’s compliance practices is critical when AI-powered outreach is involved, especially since AI-generated voices are now fully covered by the TCPA with no exceptions. Start by verifying that the provider scrubs calling lists against the National Do Not Call Registry at least every 31 days, as required by federal law. Next, confirm their systems enforce calling-hour restrictions — federal rules limit calls to 8 a.m.–9 p.m. local time, with some states like Florida and Oregon imposing even tighter windows. Ensure they honor opt-out requests immediately across all channels, recognizing keywords like “stop,” “quit,” or “unsubscribe” as valid revocations. Ask for proof of documented prior express written consent capture and retention for at least five years, which serves as the strongest defense against violations. Finally, request evidence of auditable trails showing consent, scrubbing logs, and opt-out timing.

• 31-day DNC registry scrubbing verified
• Calling-hour controls aligned with federal and strictest state rules
• Opt-outs processed within minutes, not days
• Consent documented and retained for five+ years
• Full audit trails for consent, scrubbing, and opt-outs

Non-compliance risks are steep: TCPA violations carry $500–$1,500 per call, with no cap in class actions, and state fines can exceed $25,000 per violation. Before booking a Growth Call with Worqd, ask how their AI SDR meets these exact standards — because permission-aware outreach isn’t just compliant, it’s the foundation of sustainable growth.