What a Non-Compliant Cold Call Actually Costs You in 2026 (TCPA + State Mini-TCPA Exposure)

A single non-compliant B2B cold call can cost $500 to $1,500 per violation under the TCPA, and state mini-TCPAs add their own penalties and private lawsuits. Business landlines are largely exempt, but calls to personal cell phones, AI-voiced calls, and calls into states with their own DNC lists are not. Compliance is a cost line, not a footnote.

This article is operator guidance, not legal advice. For decisions about your own program, involve counsel.
‍

Top Questions About TCPA Compliance for B2B Cold Calling

Is B2B cold calling legal in 2026?

Yes. Cold calling a business landline, manually dialed, during legal hours remains legal in every US state. The exposure starts when your list includes personal cell phones, your team uses an autodialer or AI voice, or your calls cross into one of the 12 states that run their own registries. Most phone calls B2B teams place are legal... exposure per dial is the real question.

How much does a TCPA violation actually cost per call?

The Telephone Consumer Protection Act (TCPA) sets statutory damages of $500 per violation, and up to $1,500 per call for willful violations. There is no cap on total damages, and each illegal call or text counts separately. A campaign with 100 bad dials carries a statutory floor of $50,000 before legal fees.

Does the TCPA apply to business-to-business calls?

Partially, and that word does the damage. Calls to business lines sit outside the registry provisions that protect consumers on residential lines. But TCPA restrictions on autodialed, prerecorded, and AI-voiced calls to cell phones apply regardless of whether the number belongs to a CFO or a consumer. B2B is a context, not an exemption category.

Are calls to a prospect's cell phone a TCPA risk?

Yes, when technology is involved. A human SDR manually dialing a cell phone number is generally fine under federal law. The same number dialed by an automatic telephone dialing system (ATDS), or hit with pre-recorded messages, requires prior express written consent... which pure cold outbound almost never has. Mobile-heavy lists are where B2B teams quietly accumulate TCPA violations.

Do AI-voiced or autodialed cold calls need written consent?

AI-voiced calls do, full stop. The Federal Communications Commission confirmed in February 2024 that AI-generated voices count as "artificial or prerecorded voice" under the TCPA, so an AI voice agent placing unsolicited calls without prior express written consent is presumptively illegal at $500 to $1,500 per call. Autodialed calls to cell phones carry the same TCPA consent requirements.
‍

Key Takeaways

• The per-violation number is the one to model. $500 statutory, up to $1,500 willful, per call or text, with no aggregate cap (47 U.S.C. § 227).
• The B2B exemption breaks in three predictable places: personal cell phones dialed with technology, AI-voiced or prerecorded calls, and the 12 states that layer their own lists on top of the National Do Not Call Registry, including Pennsylvania, Mississippi, Colorado, and Texas.
• State mini-TCPAs stack on top of federal law. Texas SB140 (live since September 1, 2025) and Virginia SB1339 (live January 1, 2026) both carry their own penalties and private enforcement paths.
• Litigation is accelerating, not cooling. TCPA violations are being litigated at record pace: class-action filings through April 2026 are up 23% over the same period in 2025, and April 2026 alone ran 40% above April 2025 (TCPAWorld).
• Compliant calling is cheaper than exposure. A 100% US-based, manually dialed, DNC-scrubbed program costs $3,500 per month at Leadium. Twenty bad autodialed calls can match that number in statutory damages alone.
  ‍

Where the B2B Exemption Holds vs Breaks

The cost of one bad month vs one compliant month:

Is B2B Cold Calling Legal in 2026?

Yes. In plain language: no federal law bans cold calling businesses, and a human SDR manually dialing a business landline inside permitted hours (8 a.m. to 9 p.m. local under federal law, tighter in some states) is compliant conduct everywhere in the US.

The broader legal landscape is settled on that point. The financial question is not, because three exceptions carry all the cost: automated dialing systems or artificial voices reaching personal cell phones, AI-voiced telemarketing calls without proper consent, and calls into states that layer their own consent rules on top of the federal baseline. Such calls are where rules written to protect consumers reach into B2B outbound.

Our companion piece on cold calling laws in 2026 walks the full legal map. This article does the math instead.
‍

What Does a TCPA Violation Actually Cost?

The math is straightforward... and unforgiving. Under the Telephone Consumer Protection Act (TCPA), statutory damages run $500 per violation, trebled to as much as $1,500 for intentional violations (47 U.S.C. § 227). Every illegal call and every text is a separate violation. There is no cap.

Model a modest campaign: 1,000 dials a month, with 2% of the phone numbers wrongly autodialed to personal cells or state-registry numbers. That is 20 TCPA violations, a $10,000 statutory floor, and up to $30,000 if a court finds you knew better. The compliant alternative costs $3,500 a month, total (Reference Source: Leadium).

Class actions are where the number turns existential. TCPA laws allow a four-year lookback, so one plaintiff can represent every call recipient your dialer touched in that window. Ten thousand non-compliant calls is a $5 million statutory floor before you pay a single defense invoice, and before your legal team bills its first hour.

Separate from private suits, the Federal Trade Commission can seek civil penalties of up to $53,088 per violation under the Telemarketing Sales Rule. Different statute, same phone call. Charities and non-profit organizations get carve-outs here... commercial sales calls get none.
‍

Where Does the B2B Exemption Break Down?

Personal cell phones. TCPA restrictions on automated dialing and pre-recorded messages to any wireless number do not care that your prospect is a VP of Sales. Mobile-first work culture means business contacts now answer on personal mobile phones, and most data vendors do not reliably flag which phone numbers are which. Whether dials land on residential or cell phones versus business landlines changes the legal analysis entirely.

AI voice and autodialers. The FCC's February 2024 ruling put AI-generated voices squarely inside "artificial or prerecorded voice" (FCC). After Facebook v. Duguid narrowed the federal autodialer definition in 2021, several states wrote broader definitions of their own. A dialer that is legal federally can still violate Texas or Oklahoma law.

State registries. Twelve states run their own version of the National Do Not Call Registry: Colorado, Florida, Indiana, Louisiana, Massachusetts, Mississippi, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas, and Wyoming (CompliancePoint). In other jurisdictions, electronic communications regulations can add a comparable layer of outreach rules. Pennsylvania and Wyoming even run theirs through the Telephone Preference Service. When a number sits on a state registry, unsolicited calls to it can trigger state penalties that stack with federal robocall laws... and several of these states reach business to business calls more aggressively than the federal baseline does.
‍

What Changed in 2026?

Three things moved the risk needle since last year.

The FCC delayed the "revoke-all" consent rule to January 31, 2027. The rule will require treating one revocation as revoking consent for all future calls and texts on unrelated matters. The FCC pushed the effective date back a second time on January 6, 2026 (FCC), while it weighs giving consumers more tailored control over unwanted calls. Treat the delay as a preparation window, not a reprieve... every other revocation obligation is already live, and opt out requests across calls, texts, and other electronic communications already have to be honored.

State mini-TCPAs came online. Texas SB140 has covered telemarketing calls and text solicitation since September 1, 2025: sellers must register with the state, post a $10,000 surety bond, and face Attorney General enforcement of up to $5,000 per violation, with a private right of action through the state's consumer protection statute (Morgan Lewis). Virginia's SB1339 took effect January 1, 2026, adding text-message opt-outs that must be honored for 10 years and joint liability between solicitors and the sellers who hire them (Virginia LIS).

Filing volume jumped again. April 2026 saw 330 TCPA cases filed, 255 of them class actions, up 40% from April 2025. Year-to-date through April, class-action filings ran 23% ahead of 2025... and 2025 was already a record year (TCPAWorld). More filings mean more plaintiff firms hunting illegal telemarketing at scale, and dialer campaigns are the first place they look.
‍

How Do You Run Compliant Outbound Without Killing Pipeline?

You standardize it. We codified our practice as The Leadium Compliant Calling Standard, five disciplines we run on every campaign before a dial goes out.

1. List hygiene. Build lists from verified business sources, document where every number came from, note which data providers supplied it and standardize numbers before upload, and never dial purchased lists with no consent provenance.
2. DNC scrub cadence. Scrub against the national DNC registry and our internal Do Not Call list at least every 31 days, and before any new campaign launches. The National Do Not Call Registry holds hundreds of millions of numbers, and the 12 state lists get scrubbed on the same cadence.
3. Calling windows. Dial only within the strictest applicable window for the prospect's state, defaulting to 9 a.m. to 9 p.m. local and tightening where a state requires it.
4. Consent documentation. Record what consent exists, document legitimate interest assessments where the outreach program relies on that basis for data use or contact review, honor every opt-out within 10 business days, and keep the audit trail inside the sales process to maintain compliance.
5. Recording disclosure. Follow one-party and two-party recording laws by state, and disclose recording where required.

None of this slows a good SDR down. It removes the calls that were never going to become pipeline and would have become liability instead.

The Leadium True-Cost Framework applies here: a cheap vendor's per-dial price externalizes compliance risk onto you. The violation, the demand letter, and the class action all land on the company whose product was pitched... not the offshore call floor that dialed.
‍

Why Does US-Based, In-House Calling Lower Your Exposure?

Control. A 100% US-based human team, manually dialing, removes the highest-risk categories entirely: no AI voice on the line, no autodialer touching wireless numbers, no offshore floor dialing outside legal windows it never learned.

That is a structural position, not a marketing line. Leadium runs every campaign with US-based SDRs, caps the roster at 30 to 35 active clients, and launches in 7 to 10 days with the compliance checks built into onboarding (Reference Source: Leadium).

The pricing is public: $3,500 per month for cold calling, $4,000 to $5,000 per month multi-channel. Against a single trebled violation cluster, the compliant program is the cheap option... and run this way, compliance stops being legal risk management and becomes a competitive advantage.
‍

The Pre-Dial Checklist: Consent Requirements, Do Not Call Lists, and Records

Consent & Method

• [ ] Confirm whether each campaign uses manual dialing, an autodialer, or any artificial voice
• [ ] Require documented written consent for any autodialed or AI-voiced contact to wireless numbers
• [ ] Document consent status and written-consent triggers for every list segment
• [ ] Verify AI tools are copilots (briefing, transcription, scoring), never the voice on the line
• [ ] Identify caller and company at the start of every call

Geography & Timing

• [ ] Scrub against the national DNC registry and all 12 state lists on a 31-day cadence
• [ ] Build a state matrix covering every mini-TCPA state your list touches (TX, VA, FL, OK at minimum)
• [ ] Restrict dialing to 9 a.m. to 9 p.m. prospect-local, tighter where state law requires
• [ ] Confirm Texas registration and bond status before any TX solicitation campaign
• [ ] Flag mobile numbers and residential numbers for manual-dial-only treatment

Records & Accountability

• [ ] Log every opt-out and honor it within 10 business days, across all channels
• [ ] Maintain records for at least four years: call logs, consent documentation, scrub receipts (the TCPA lookback)
• [ ] Name one owner for compliance on every account... a person, not a policy document
• [ ] Put your vendor's compliance obligations in writing, with indemnification your legal team has reviewed
  ‍

Red Flags When a Vendor Says "We Handle Compliance"

They can't name the states with their own do not call lists

There are 12. A vendor who cannot list them is not scrubbing against them. This is a two-minute test you can run on your next vendor call.

AI-voice dialers with no disclosure step

If the demo shows an AI voice talking to prospects and nobody mentions consent, the vendor is selling you a machine for accumulating TCPA violations at $500 each. The FCC settled this question in 2024.

No written revocation process

Ask how an opt-out on Tuesday reaches every channel by Friday. If the answer is a shrug, revocations are being dropped, and each dropped one is a fresh illegal call waiting to happen.

Offshore teams calling US cells outside legal hours

Time-zone math fails quietly. An offshore floor dialing at 7 p.m. local can be hitting an 11 p.m. cell phone in a state with a 9 p.m. cutoff.

"We handle compliance" with nothing in writing

If compliance is real, it survives being put in a contract with indemnification. If the vendor resists that sentence, they are describing a vibe, not a process.

Per-dial billing that rewards volume over care

A vendor paid per dial has an economic reason to dial everything, including the numbers that should have been scrubbed. Incentives beat promises.

Silence on the revoke-all rule

January 31, 2027 is on the calendar. A vendor with no plan for cross-channel revocation is a vendor planning to make you the test case.

Frequently Asked Questions

What's the difference between the TCPA, the TSR, and state law?

The Telephone Consumer Protection Act is the federal statute with the $500 to $1,500 private right of action. The Telemarketing Sales Rule is the FTC's rule, enforced by regulators at up to $53,088 per violation. State TCPA laws and registries stack on top of both. One call can violate all three layers at once, and an established business relationship softens only the do-not-call piece... never the autodialer and AI-voice consent rules.

What counts as an autodialer after Facebook v. Duguid?

The Supreme Court narrowed the federal definition in 2021 to systems that use a random or sequential number generator. Most list-based power dialers fall outside it federally. But Texas, Florida, and Oklahoma wrote broader definitions and demand explicit consent for dialer traffic, so the same dialer can be fine in one state and a violation in the next.

Do I need consent to manually cold call a B2B prospect?

No. A human manually dialing a business number, in legal hours, with proper identification, needs no prior consent under federal law. That is the play that stays open... and the reason manual, human dialing is the backbone of compliant outbound.

What does "prior express written consent" actually mean?

A signed, written agreement (electronic counts) that names the specific company allowed to call, discloses that autodialed or prerecorded calls are included, and is not a condition of purchase. Plain prior express consent, which can be oral, only covers informational calls. A LinkedIn connection or a downloaded whitepaper does not come close to either standard.

Are ringless voicemails and voicemail drops covered?

Treat them as covered. The FCC and courts have consistently treated a ringless voicemail as a prerecorded message under the TCPA, prior express consent for a cold list rarely exists, and plaintiff firms actively hunt these campaigns because the violations are so clean to prove.

How often do I need to scrub against DNC lists?

Scrub the National Do Not Call Registry and state registries every 31 days at minimum, plus before any new campaign launches. Your internal list has no expiration... an opt-out is permanent until the person re-consents.

Can I text a B2B prospect instead of calling?

Texts are treated like calls, so cold texts sent by an automated platform without consent are TCPA violations, and Texas SB140 explicitly covers commercial texts, with each message a separate violation. Cold B2B texting is higher-risk than cold calling, not lower.

How do state mini-TCPAs stack with federal law?

They add, never replace. Most state statutes start from the Telephone Consumer Protection Act and go further, so a single autodialed text to a Texas cell can trigger federal TCPA damages, Texas SB140 enforcement, and registry violations simultaneously. Compliance means clearing the strictest applicable layer, not the federal baseline.

What records should we keep, and for how long?

Call logs, consent documentation, scrub receipts, vendor contracts, and your internal suppression list (the internal DNC list every opt-out feeds), retained at least four years to match the TCPA's statute of limitations. In a dispute, the company with the audit trail wins... the one with "we think we scrubbed" settles.

Should we ask vendors for indemnification on compliance?

Yes, and watch the reaction. A vendor confident in its process will negotiate reasonable indemnification language. A vendor that refuses to discuss it is telling you where the risk will land when something goes wrong.

Does the B2B exemption protect calls to sole proprietors?

Be careful. Sole proprietors and home-office numbers blur the business/residential line, and several state lists include small-business numbers. When you cannot tell whether numbers are residential or cell phones, the safe assumption is that consumer rules apply.

Is cold calling still worth it under all these rules?

Yes. The rules did not kill cold calling... they killed careless cold calling. Compliant cold calling works: human, US-based callers still book qualified meetings, and the teams that dial correctly inherit the pipeline their non-compliant competitors abandon. Our data on what makes cold calls convert is a good place to start.
‍

About the Author

Kevin Warner is Founder & CEO of Leadium, a boutique, 100% US-based B2B outbound agency. Over 12+ years and 1,700+ clients, he has run outbound under these rules daily... including scaling to 600 employees, concluding that quality SDR work doesn't factory-scale, and rebuilding Leadium as a deliberately capped, founder-led team.
‍

See Where Your Exposure Sits

See how Leadium runs compliant, US-based outbound that books meetings without the exposure. On a short call, we map your current calling method and the states your list touches, show you where your exposure sits, and build a compliant 90-day plan with cost-per-meeting math against your ACV. Book a call with Leadium.

Not legal advice. Statutes and penalty figures cited to primary sources as of July 2026.