Cold Calling Laws in 2026: TCPA, Mini-TCPAs, and What B2B Outbound Teams Must Do

B2B cold calling is legal in the United States in 2026, but it is regulated. Federal rules... TCPA, the FTC's Telemarketing Sales Rule, and the Do Not Call registry... govern consent, hours, and autodialers. State mini-TCPAs like Texas SB140 add stricter windows and penalties. Compliant teams scrub DNC lists, respect calling windows, and document consent.

A note before we start. This is not legal advice. I run an outbound agency, not a law firm. We operate under these rules every day and we cite primary sources throughout so you can verify each point and take it to your own counsel before you change anything.

Top Questions on Cold Calling Laws

Is cold calling illegal in the US? No. B2B cold calling is legal in all 50 states. What is regulated is how you call: the technology you dial with, the hours you call, whether the number is on a Do Not Call list, and whether you have consent for automated or recorded calls. A manually dialed call to a business prospect during legal hours, scrubbed against the Do Not Call registry, is lawful.

Can you cold call cell phones for B2B sales? Yes, if a human dials manually. The catch is the technology. The TCPA treats every wireless number as residential, with no federal "business use" carve-out. Autodialed or AI-voiced calls to a cell phone need prior express written consent, even when the number sits on a business contact list. Manual dialing to that same number is generally fine.

Is AI cold calling illegal? Using an AI-generated voice to place outbound calls without prior express written consent is illegal. In February 2024 the FCC ruled that AI and cloned voices count as "artificial or prerecorded voice" under the TCPA (FCC). AI that assists a live human SDR is compliant. AI that is the caller is the exposure zone.

What hours can you legally cold call? Federal telemarketing rules set the window at 8 a.m. to 9 p.m. in the called party's local time. Several states are stricter. Texas, for example, allows solicitation only 9 a.m. to 9 p.m. Monday through Saturday and noon to 9 p.m. Sunday, Central time (Paul Hastings).

Does the TCPA apply to B2B calls? Yes, partially. The FTC's Telemarketing Sales Rule exempts most business-to-business calls from the Do Not Call registry. The TCPA does not offer the same break. Its rules on autodialers, prerecorded voice, and cell phone consent apply to a B2B call the same way they apply to a consumer call.
‍

Key Takeaways

• Cold calling is legal, but the rules tightened in 2025 and 2026. Federal courts loosened one rule while states added several stricter ones.
• The Eleventh Circuit struck down the FCC's one-to-one consent rule on January 24, 2025, in Insurance Marketing Coalition Ltd. v. FCC (Morrison Foerster).
• The FCC's "any reasonable means" opt-out rule took effect April 11, 2025. A prospect can revoke consent in any clear way, and you must honor it within 10 business days (BCLP).
• Texas SB140 took effect September 1, 2025. It extends telemarketing rules to texts, requires registration with a $10,000 surety bond, and carries penalties up to $5,000 per violation with a private right of action.
• TCPA statutory damages run $500 per call, or $1,500 for willful violations. FTC penalties for Do Not Call violations reach $53,088 per violation as of January 2025 (FTC).
• A 100% human, US-based calling model sidesteps the highest-risk category entirely: no AI voice, no autodialer to cell phones, no offshore compliance gap.
  ‍

The Federal and State Layers at a Glance

State law is a moving target. Treat this table as a starting map, not a final answer, and confirm the rules for every state your list touches.

Is Cold Calling Legal in 2026?

Yes. Picking up the phone to call a business prospect you have never spoken to is legal across the country. The legal landscape is a mix of federal law and stricter rules at the state level, so the illegality lives in the details: dialing technology, calling hours, list hygiene, and consent for automated contact.

Here is the honest operator read. Federal rules are loosening while state rules are tightening. The net effect is that a manual, well-documented calling program has more room than it did two years ago, and a sloppy automated one has far more risk.

The plaintiffs' bar is organized and active, and most TCPA suits are filed as class actions. That is the real cost driver, not the per-call number.
‍

What Federal Laws, Including the Telephone Consumer Protection Act, Govern Cold Calling?

Three federal pillars matter. These are the key laws governing cold calling at the federal level, and each one regulates a different slice of the call.

The TCPA (Telephone Consumer Protection Act). Passed in 1991, it governs autodialers, prerecorded and artificial voice, and calls to cell phones. It carries a private right of action, which is why it drives litigation. The consumer protection act TCPA includes key provisions around prior express consent for automated calls, texts, and robocalls that are meant to protect consumers.

The FTC's Telemarketing Sales Rule (TSR). It runs the National Do Not Call registry, bans deceptive tactics, and sets recordkeeping duties. It also requires you to transmit accurate caller ID information, prohibits false or misleading statements and high pressure sales tactics, and bans certain payment methods in telemarketing, including remotely created checks, remotely created payment orders, and cash reload mechanisms. The Federal Trade Commission amended the TSR in 2003, 2008, 2010, and 2015. Most B2B calls are exempt from the DNC portion (FTC).

The Do Not Call registry. Maintained by the FTC, it holds well over 200 million numbers, and telemarketers must scrub against it at least every 31 days (donotcall.gov). The national DNC registry began accepting registrations on June 27, 2003, and consumers can register both landline and wireless numbers. Telemarketers have three months to stop calling newly registered numbers.

A few terms cause most of the confusion, so here they are in plain language.

Autodialer (ATDS). An automatic telephone dialing system stores or produces numbers using a random or sequential number generator and dials them. The Supreme Court narrowed this definition in Facebook v. Duguid (2021), so many list-based dialers fall outside it federally (Supreme Court). Several states define it more broadly.

Prerecorded or artificial voice. A pre recorded voice message that plays without a live person speaking. As of 2024, AI-generated and cloned voices fall in this bucket alongside traditional prerecorded calls.

Prior express written consent. A signed agreement from the called party to receive automated or recorded telemarketing calls. Pure cold outbound rarely has it, which is why automation is the trap.

Established business relationship (EBR). A prior or existing relationship, formed by a purchase or inquiry, that can change which consent rules apply. A true cold call has no EBR, so do not lean on it to justify automated contact.
‍

What Changed in 2026?

The headline change started in early 2025 and it cuts both ways.

The one-to-one consent rule is gone. On January 24, 2025, the Eleventh Circuit vacated the FCC's one-to-one consent rule in Insurance Marketing Coalition Ltd. v. FCC, holding the agency exceeded its authority (Goodwin). Bundled consent for lead-generation remains permissible at the federal level.

Worth flagging: this was the Eleventh Circuit in January 2025, not the Fifth Circuit in 2026 as our internal brief stated. The brief's reference was off, and the corrected citation is above.

Opt-outs got easier for the prospect. Since April 11, 2025, a person can revoke consent through any reasonable method, not just a specific keyword, and you have 10 business days to honor it; doing so promptly helps maintain compliance and reduce legal liability.

Federal deregulation is in motion. In late 2025 the FCC opened a broad proceeding to review and potentially trim several TCPA and DNC rules. The direction of travel is fewer federal restrictions.

What this does not mean: state laws still bind you, the private right of action still exists, and suits still fly. Loosening one federal rule does not make a non-compliant program safe.
‍

What Are State Mini-TCPAs, and Why Are They the Bigger Risk Now?

A mini-TCPA is a state law that mirrors the federal TCPA, often with stricter terms and its own private right of action. As federal rules soften, these state laws have become the larger exposure for outbound teams.

Texas SB140 is the clearest example. Effective September 1, 2025, it expanded the state's telemarketing law to cover texts and images, kept the registration requirement with a $10,000 surety bond, and lets consumers sue under the Deceptive Trade Practices Act for up to $5,000 per violation (Blank Rome). Calling hours are tighter than federal: 9 a.m. to 9 p.m. Monday through Saturday, noon to 9 p.m. Sunday.

Florida and Oklahoma set the template. Florida has implemented stricter telemarketing regulations, and both states restrict automated sales calls, define autodialers broadly, run an 8 a.m. to 8 p.m. window, and grant a private right of action with $500 to $1,500 in statutory damages per call. Maryland is another example of a state that has implemented stricter telemarketing regulations.

The list keeps growing. Oregon, Virginia, Maine, and Washington added or expanded mini-TCPAs in 2025. If your list spans states, your compliance baseline is the strictest state you touch, not the federal floor, so multi-state outreach teams must account for stricter rules in some states.
‍

How Do the Rules Treat AI and Autodialers?

This is the area generating the most regulatory heat, and it is where most agencies are quietly exposed.

In February 2024 the FCC confirmed that AI-generated and cloned voices are "artificial or prerecorded voice" under the TCPA (FCC). That means an AI voice agent placing cold calls without prior express written consent is presumptively illegal, with damages of $500 to $1,500 per call.

Autodialers sit in a gray zone. A list-based power dialer often falls outside the federal ATDS definition after Facebook v. Duguid, but Florida, Oklahoma, and Texas read the term more broadly. Predictive dialers are also subject to abandonment-rate limits and should keep abandoned calls below 3%. A dialer that is safe in one state can be a violation in another.

Here is the rule we operate under: AI is a copilot, not a caller. AI that briefs a human SDR, transcribes a call, or scores intent is compliant everywhere we work. AI that speaks on the line or uses prerecorded voice messages increases exposure absent prior consent, and dialing autonomously across cell numbers needs consent that pure cold outbound almost never has.

This is also where a 100% human, US-based model earns its keep. No AI voice, no autodialer hitting cell phones, no offshore team operating outside US compliance training. The whole highest-risk category never enters the picture.
‍

What Does a Compliant Outbound Program Actually Do?

We codified our own practice into a framework we run on every campaign. We call it The Leadium Compliant Calling Standard. Five disciplines, in order.‍

1. ‍List hygiene. Build lists from verified business sources, document where every number came from, note which data providers supplied it and standardize numbers before upload, and never dial purchased lists with no consent provenance.‍
   ‍
2. DNC scrub cadence. Scrub against the national DNC registry and our internal Do Not Call list at least every 31 days, and before any new campaign launches.‍
   ‍
3. Calling windows. Dial only within the strictest applicable window for the prospect's state, defaulting to 9 a.m. to 9 p.m. local and tightening where a state requires it.‍
   ‍
4. Consent documentation. Record what consent exists, honor every opt-out within 10 business days, and keep the audit trail inside the sales process to maintain compliance.‍
   ‍
5. Recording disclosure. Follow one-party and two-party recording laws by state, and disclose recording where required.

None of this is exotic. It is the difference between an outbound program that compounds pipeline and one that compounds legal risk.

Compliance Checklist for B2B Cold Calling

Before the Campaign‍

• Scrub the list against the National Do Not Call Registry and your internal Do Not Call lists on schedule
• Cross-check against your internal Do Not Call list
• Document the data source, phone number status, and any prior consent tied to every record
• Build a state matrix for every state your list touches
• Confirm whether any numbers are cell phones or residential phone lines and flag them for extra review and manual dialing where required

During Calling‍

• Dial only within the strictest applicable calling window
• Use human SDRs, not AI voice agents, for cold outreach
• Avoid autodialers on cell phones; dial those manually
• Disclose recording where state law requires it
• Identify the caller and the company at the start of the call

Documentation and Response‍

• Log every opt-out and honor it within 10 business days
• Retain call records and consent documentation
• Handle complaints through a defined process
• Review the state matrix quarterly as laws change
• Loop in counsel before launching in a new state or with new technology
  ‍

7 Red Flags in How Agencies Handle Compliance

"TCPA is only a B2C problem, so relax."

Wrong, and a tell. The Telephone Consumer Protection Act is not just a B2C issue, because federal law still governs automated calls and calling cell phones in B2B outreach.

No National Do Not Call scrubbing written into the contract

If list scrubbing is not a contractual obligation with a stated cadence, including checks against the national DNC registry at that same interval, it will not happen consistently. Get it in writing.

AI voice agents calling without disclosure

An AI voice placing cold calls without consent is the single highest-risk practice in outbound right now because it may be treated as a prerecorded message for compliance purposes. If a vendor sells this as a feature, walk.

Offshore callers with no US compliance training

A rep dialing US prospects from outside the country, with no training on TCPA or state mini-TCPAs, is a liability you inherit.

No call recordings retained

Recordings are your evidence of how a call was conducted. A vendor who keeps none cannot prove compliance, and neither can you.

"We handle compliance" with nothing in writing

Verbal assurance is not a control. Ask for the written standard, the scrub cadence, the opt-out process, and the key provisions the vendor follows to maintain compliance.

Purchased lists with no consent provenance

A cheap list with no record of where the numbers came from is a lawsuit waiting for a plaintiff. Provenance is not optional.
‍

More Questions on Cold Calling Laws

How does the Do Not Call registry work for B2B? Most phone calls to business lines are exempt from the federal DNC rules under the TSR, but not all outreach is exempt. The exemption is narrower than teams assume: calls to a personal cell used for business still face TCPA rules, some states do not mirror the federal B2B exemption, and calls to business lines aimed at employees for personal purchases are treated differently.

What are the penalties per violation? TCPA statutory damages are $500 per call, or $1,500 for willful violations. FTC Do Not Call penalties reach $53,088 per violation. State mini-TCPAs add their own, such as up to $5,000 per violation under Texas SB140.

Do any states require registration or a bond? Yes. Texas requires telephone solicitors to register and post a $10,000 surety bond under Chapter 302, with limited exemptions. Several other states have registration regimes. Check each state before you dial into it.

Do the text-message rules apply to my SDRs? If your team sends sales texts, yes. Texas SB140 brought texts and images under its telemarketing law as of September 2025, and the TCPA already treats marketing texts like calls.

How does consent revocation work now? Since April 11, 2025, a prospect can revoke consent through any reasonable method, including a reply text or a verbal request on a call. You must honor it within 10 business days.

Are call recording laws one-party or two-party? It depends on the state. Some require only one party's consent to record; others require all parties. Set your policy to the strictest state on your list and disclose where required.

How is cold calling regulated outside the US? The frameworks differ. The EU and UK rely on legitimate interest and country-level opt-out registries, and Canada permits B2B calling but requires DNC scrubbing under CRTC rules plus CASL for related email. Treat each region as its own ruleset.

Who enforces these rules? The Federal Communications Commission (FCC) and Federal Trade Commission (FTC) enforce at the federal level, state attorneys general enforce state laws, and private plaintiffs drive most TCPA litigation through the statute's private right of action.

What are the safest practices for pure cold outbound? Dial manually with human reps, scrub the DNC every 31 days, respect the strictest applicable window, and have each sales rep treat compliance as part of the sales process, especially before initial contact and any sales pitch.

What should I ask an outbound agency about compliance? Ask where the reps sit, how often lists are scrubbed, whether they use AI voice or autodialers, how opt-outs are logged and honored, and whether the whole standard is in writing. If the answers are vague, that is your answer.
‍

See How a Compliant Outbound Program Runs

Compliance is not a tax on outbound. Done right, it helps protect consumers while reducing legal liability as a program scales.

See how Leadium would build your first 90 days of qualified pipeline with a 100% US-based team operating under the Compliant Calling Standard, including how cold callers can maintain compliance across states. On the call we map your ICP, the states your list touches, and the channel mix that fits your motion.

This article is for general information and is not legal advice. Verify every rule with qualified counsel before acting. Last reviewed June 2026.