Cold Calling Is Legal — But the Rules Have Teeth

Here's the short answer: no law bans cold calling — not in the US, Canada, the UK, or the EU. But "legal" and "risk-free" are two very different things, and the gap between them is where businesses get burned.

According to Martal Group's analysis of cold calling laws, liability doesn't come from picking up the phone. It comes from calling the wrong type of number, using restricted dialing technology, ignoring an opt-out, or skipping a required state registration. In the US, two federal frameworks do the heavy lifting: the Telephone Consumer Protection Act (TCPA) and the FTC's Telemarketing Sales Rule, which impose consent requirements rather than banning calls outright, per DNC.com's 2025 regulatory breakdown.

The penalty math is what should get your attention. TCPA statutory damages run $500 to $1,500 per violation — per call, per class member — with no cap and no requirement to prove actual injury, according to BCLP's legal analysis. Willful violations treble to $1,500. A single 200-call campaign on an uncleaned list carries $100,000–$300,000 in theoretical exposure; 10,000 calls pushes past $15 million.

And here's the part most businesses miss: regulators aren't your biggest threat. Litigation is. The TCPA includes a private right of action, meaning any consumer can sue — and plaintiffs' firms have industrialized the process. Key numbers from WebRecon litigation data:

• Q1 2026 set an all-time record for TCPA class actions, with March alone producing 283 filings and 220 class actions
• Filings climbed 34.3% year-to-date through June, with class actions making up 76.4% of June filings
• Roughly 42% of consumers filing suit have filed before — a professional plaintiff class exists and it's growing

Meanwhile, the rules keep shifting beneath your feet. Federal requirements are loosening while at least five states — Texas, Oregon, Virginia, Florida, and Washington — have rewritten telemarketing statutes with their own private rights of action and broader autodialer definitions. Oregon's new law narrows the calling window to 8 AM–8 PM with a three-contact cap per 24 hours; Texas set a 9 AM–9 PM window, Monday through Saturday only.

The FCC's 2024 ruling also pulled AI squarely into the frame: AI-generated voices now count as "artificial or prerecorded voices" under the TCPA, so an AI-voiced call to any cell phone without prior express written consent is illegal — even if that number came from a business contact list, as Legion AI's compliance guide explains. There is no federal B2B carve-out for mobile numbers.

This is exactly why compliance practices belong on your checklist when choosing an outreach partner. At Worqd, our outreach is built around permission-aware, personalized contact rather than list blasts — our booking funnel requires explicit consent before anyone hears from us. When you evaluate any provider, ask them to produce actual consent capture records, explain their opt-out processing across channels, and show how they handle AI-voice compliance. If they can't answer, the liability math above becomes your problem.

The 2025 Rule Changes Every Buyer Should Know

If your outreach playbook hasn't been updated since 2024, you're operating on outdated rules. The past year brought some of the biggest shifts in telemarketing regulation in a decade — and they cut in opposite directions.

The headline change is the FCC's new Opt-Out Rule, which took effect April 11, 2025. Under the rule, consumers can revoke consent "in any reasonable manner" — meaning businesses can no longer dictate a single opt-out channel. According to legal analysis from BCLP, revocations must be honored within 10 business days, and the burden falls on the business to prove an opt-out request was unreasonable.

One detail trips up even sophisticated teams: revocation is medium-agnostic. As the FCC's order confirms, a single "STOP" text revokes consent for both robotexts and robocalls. If your texting and calling systems don't talk to each other, every follow-up call after a STOP compounds your exposure at $500–$1,500 per violation.

Meanwhile, the FCC's stricter "one-to-one consent" rule never took effect. The Eleventh Circuit vacated it, concluding the agency overreached — though the court emphasized consent must still be "clear and unmistakable," per DNC.com's regulatory tracker. The broader definition of prior express written consent remains the standard.

For anyone evaluating AI-powered outreach, one 2024 ruling matters most: the FCC declared that AI-generated voices count as "artificial or prerecorded voices" under the TCPA. As compliance researchers note, AI-voiced calls without prior express written consent are illegal — which is exactly why Worqd builds its AI SDR and voice workflows around explicit, documented consent rather than cold list-blasting.

The bigger strategic picture is a split in direction:

• Federal rules are loosening, including a proposed "ten-for-one" deregulatory initiative at the FCC
• At least five states — Texas, Oregon, Virginia, Florida, and Washington — have rewritten telemarketing statutes with private rights of action
• Oregon's HB 3865 narrows calling windows to 8 AM–8 PM with a three-contact cap per 24 hours
• Texas set a 9 AM–9 PM, Monday–Saturday window with penalties up to $5,000 per violation

According to Martal Group's analysis, state mini-TCPAs are now the larger practical risk for multi-state campaigns — and litigation, not regulators, drives enforcement. TCPA class actions hit an all-time record in early 2026, with roughly 42% of consumer plaintiffs having sued before.

The takeaway for buyers: compliance is no longer a box to check once. When evaluating any outreach or growth partner, ask how they capture consent, detect revocations across every channel, and handle state-by-state calling windows. The providers who can answer those questions concretely are the ones who won't turn your pipeline into a plaintiff's exhibit.

The B2B Cell Phone Trap and Other Common Compliance Failures

Most B2B teams assume that calling a business contact list keeps them safe. It doesn't — and the single most dangerous assumption in outbound sales today is that "B2B" equals "exempt."

Here's the trap: the TCPA makes no distinction between a consumer's cell phone and a CEO's. As Martal Group's analysis of cold calling laws puts it, "Autodialed or AI-voiced calls to any wireless number require prior express written consent, even when the number sits on a business contact list. The TCPA treats every wireless number as residential, and there is no federal B2B carve-out for mobile."

That matters more than ever because the FCC's 2024 declaratory ruling classifies AI-generated voices as "artificial or prerecorded voices" under the TCPA. Any AI SDR or AI voice agent dialing a cell phone without prior express written consent is making an illegal call — full stop. And with statutory damages of $500 per call, trebled to $1,500 for willful violations with no cap, a 200-call campaign on an uncleaned list carries $100,000–$300,000 in theoretical exposure, according to the same analysis.

Beyond the cell phone trap, compliance experts tracking TCPA litigation flag a handful of failures that show up again and again in real lawsuits:

• Purchased lists with no consent trail — a vendor promises "opt-in" data but can't produce the actual capture record. As one compliance analysis warns, that's not consent; that's a lawsuit waiting to happen.
• Reusing "sales" consent for "marketing" — consent given for one purpose doesn't transfer to a different campaign type.
• No revocation detection in AI scripts — since the FCC's Opt-Out Rule took effect April 11, 2025, consumers can revoke consent "in any reasonable manner," and a STOP text kills consent for both texts and calls, per law firm BCLP's breakdown of the new rules. An AI agent that keeps calling after an opt-out compounds liability with every dial.
• Carrier blocking of legitimate calls — carriers now block or mislabel calls using self-defined analytics, and even fully consented calls sometimes never reach the recipient, per DNC.com's 2025 TCPA update.

The enforcement math makes these failures expensive. Q1 2026 set an all-time record for TCPA class actions, and roughly 42% of consumers filing suit have filed before — repeat litigators who know exactly which mistakes to look for, according to litigation data cited by Martal.

This is why consent capture sits at the center of how Worqd runs outreach — explicit opt-ins like "I agree to be contacted about my request," permission-aware follow-up, and AI agents built to respect revocations rather than blast through them.

When you're evaluating any outreach or AI SDR provider, ask one question first: can they show you the consent record for every number they dial? If the answer is vague, the risk is yours.

How to Vet an Outreach Provider's Compliance Practices

Most providers will tell you they're "fully TCPA compliant." The research says otherwise: purchased lead lists where the vendor promises "opt-in" but can't produce the actual capture record are among the most common compliance failures — and as one compliance analysis puts it, "that's not consent — that's a lawsuit waiting to happen." Here's how to separate real compliance from vendor promises.

Ask for actual consent capture records. With TCPA damages running $500–$1,500 per violation with no cap, according to legal analysis from BCLP, a 200-call campaign on an uncleaned list can mean $100,000–$300,000 in theoretical exposure, per industry research. If a provider can't show you the timestamped, documented consent trail for every number they dial, walk away.

Probe AI voice compliance specifically. The FCC's 2024 ruling treats AI-generated voices as "artificial or prerecorded voices" under the TCPA, meaning AI-voiced calls to wireless numbers require prior express written consent — and the TCPA treats every wireless number as residential with no B2B carve-out, as Martal Group explains. Ask how their AI SDR scripts detect revocations mid-conversation, since each call after an ignored opt-out compounds liability.

Your vetting checklist should cover:

• Consent records, not promises — documented capture trails retained for at least 4 years, matching the TCPA statute of limitations
• Revocation detection — opt-outs honored within 10 business days, in "any reasonable manner," across every channel per the FCC's Opt-Out Rule
• DNC and Reassigned Numbers Database scrubbing every 31 days — which earns federal safe harbor
• State-aware calling windows — at least 15 states are stricter than the federal 8 AM–9 PM rule, including Oregon's 8 AM–8 PM window with a three-contact daily cap

Favor permission-aware outreach over bulk dialing. With TCPA class actions hitting an all-time record and roughly 42% of consumers filing suit having filed before, per WebRecon data, volume-for-volume's-sake dialing is the riskiest strategy available. The safer path is explicit opt-in — Worqd's own booking funnel requires an "I agree to be contacted about my request" checkbox before any conversation happens — paired with personalized, permission-aware outreach to relevant accounts rather than template blasts.

When you evaluate a growth partner, treat compliance the way you'd treat financial due diligence. The provider that shows you records beats the one that shows you a pitch deck every time.

Compliant Outreach That Still Books Calls

The risk isn't cold calling itself — it's calling without a consent trail that holds up under scrutiny. The FCC's Opt-Out Rule, effective April 11, 2025, lets consumers revoke consent "in any reasonable manner" and requires businesses to honor that revocation within 10 business days, making list-based outreach increasingly fragile. A 200-call campaign on an uncleaned list carries $100,000–$300,000 in theoretical exposure, and 10,000 calls can exceed $15 million.

• Consent-based inbound with explicit opt-in avoids the riskiest outbound scenarios
• Every inquiry is qualified in under 60 seconds, 24/7, including after-hours and weekends
• AI voice agents answer, qualify, and book the moment interest arrives — no platform switch required
• Pipeline recovery turns contacts already in your CRM back into booked calls; you only pay for conversations that come back

Worqd builds the whole path from first click to booked call: paid ads, SEO, and targeted outreach bring buyers in, and instant response converts them. Our AI SDR and AI voice agents handle qualification and booking with full context, handing off to a real person when needed — all on your calendar, under your rules. The booking funnel requires explicit consent ("I agree to be contacted about my request") and uses details only to prepare for the call.

Compliance and pipeline growth aren't opposites. When follow-up is consent-aware, instant, and documented, you recover demand that unmanaged outreach leaves on the table. Book a growth call to review where your outreach is stuck and how a compliant follow-up path could recover it.