top of page
Search

The center of gravity in telemarketing law has moved to the states

In late 2024, compliance teams across lead generation and the contact center world spent real budget preparing for the FCC's one-to-one consent rule, rebuilding consent forms so a consumer had to agree to each individual seller by name. Then the Eleventh Circuit vacated the rule in January 2025, and the FCC formally removed it from its books that July. The federal mandate everyone braced for simply evaporated.

That sequence is a fair summary of where federal TCPA enforcement sits right now. The most consequential recent rulemakings have been struck down, delayed, or left pending, while the constraints that actually decide whether an outbound program gets sued have migrated to state capitals. A business that calibrates its calling operation to the federal rulebook is now calibrating to the loosest, least certain layer of the stack.


The federal floor still stands

None of this means the Telephone Consumer Protection Act went away. The statute at 47 U.S.C. § 227 still governs autodialed and prerecorded calls and texts, and it still carries the feature that makes it dangerous: a private right of action. Any individual can sue without waiting for a regulator, which is why plaintiff firms file hundreds of cases a month, many as class actions. Statutory damages run from $500 to $1,500 per call or text, with no aggregate cap and a four-year statute of limitations, so a single campaign can generate exposure that compounds well past the value of the campaign itself.


The consent baseline is unchanged. Informational and transactional calls require prior express consent, the kind a consumer gives by handing over a number and reasonably expecting contact. Marketing calls require prior express written consent, a signed or e-signed agreement that names the caller and the number to be dialed. Telemarketing calls are generally confined to 8 a.m. through 9 p.m. in the recipient's local time. And since the FCC's February 2024 declaratory ruling, AI-generated voices count as "artificial or prerecorded" under the statute, regardless of how convincingly human they sound, which means a conversational AI agent dialing a cell phone needs the same consent a traditional robocall would. The FTC's Telemarketing Sales Rule sits alongside all of it, governing do-not-call mechanics, abandoned calls, and (after the 2024 amendments) broader five-year recordkeeping.


That is the floor. The trouble is that the floor has been getting softer and harder to read at the same time.


The federal rules that didn't land

Three of the rulemakings that dominated compliance planning over the past two years are now either dead or in limbo.


The one-to-one consent rule is gone. The FCC postponed it in January 2025 pending judicial review, the Eleventh Circuit struck it down, and the Commission formally removed the nullified rule in July 2025. Any 2026 program built around per-seller consent at the federal level is built around a rule that no longer exists.


The "revoke-all" rule keeps slipping. The 2024 TCPA Consent Order would require that a single revocation, made by any reasonable method, stops all robocalls and robotexts from a sender, even across unrelated business units. Its broad requirement was first pushed to April 2026 and has now been delayed again to January 31, 2027, and in January 2026 the FCC's Consumer and Governmental Affairs Bureau extended a waiver of the "revoke all" mandate to that same date. The Commission opened a proceeding in October 2025 to consider modifying or eliminating the rule entirely, on the theory that it could keep consumers from receiving calls they actually want. So the most operationally demanding consent rule on the books may never take full effect in its current form.


The AI-calling rule is still a proposal. The FCC's notice of proposed rulemaking on AI-generated calls would add a formal definition, mandatory in-call AI disclosure, and consent language that specifically references AI. A final rule is expected somewhere around late 2026 or early 2027, though the current Commission under Chairman Carr has signaled lighter-touch priorities that could push it further.

The temptation in all this is to read the delays as breathing room. That reading is risky on the revocation point in particular. The smarter operating posture is to honor revocations broadly and quickly regardless of the deadline, because the conduct the rule describes is exactly what a plaintiff's attorney will hold up in court, and several states already require it.


Where the rules actually bite now

At least a dozen states have passed their own telemarketing statutes since 2021, and many run stricter than the federal baseline on the things that generate lawsuits: calling hours, call frequency, consent standards, and damages. Federal law has become the floor rather than the ceiling, and the states have been moving faster than the FCC.

Florida set the template. The Florida Telephone Solicitation Act defines an autodialer so broadly that almost any workflow tool can qualify, caps telemarketing calls at 8 p.m. rather than the federal 9 p.m., and carries a private right of action. It also continues to enforce one-to-one-style consent under state law; the fact that the federal version was struck down offers no protection to a defendant standing in a Florida state court.


Oklahoma followed with its own Telephone Solicitation Act, which requires written consent before contacting consumers with an autodialer and treats nearly any electronic dialing tool as one, effectively closing the state to telemarketers who can't document express written consent unless they're dialing manually. It caps commercial solicitation calls at three per 24-hour period and, like Florida, gives consumers a private right of action. Maryland applies a similar three-calls-per-day ceiling on the same subject matter.


Texas is now the most aggressive jurisdiction in the country. Senate Bill 140, effective September 1, 2025, broadened "telephone solicitation" to cover text messages and images, set statutory damages as high as $5,000 per violation, and routed enforcement through the state's Deceptive Trade Practices Act, which opens the door to trebled damages plus mandatory attorney's fees. The amendments removed the requirement that consumers file a complaint with regulators before suing and expressly allow repeat actions for repeat violations. A January 2026 case in the Western District of Texas, Callier v. Holistic Choice Labs, is an early test of the framework, combining a do-not-call claim with a registration-statute claim under the new law. For any team running outbound into Texas, a timing error on a text now carries a very different price than a $500 federal slip.


The pattern is spreading. Oregon's HB 3865, effective January 1, 2026, caps calls at three per consumer per day and narrows the window to 8 a.m. through 8 p.m. Virginia's updated solicitation law, also effective at the start of 2026, recognizes "STOP" and "UNSUBSCRIBE" as opt-outs and requires that an opt-out be honored for at least ten years, double the federal five-year standard. Georgia's SB 73 eliminated damage caps, removed the "knowing" element that made violations harder to prove, added vicarious liability up the chain, and permitted class actions, turning a moderate-risk state into one that demands attention. Maine now requires telemarketers to scrub against the Reassigned Numbers Database before dialing. California's Invasion of Privacy Act imposes two-party consent for call recording, a live problem for any center that records for quality or compliance. New York requires an opt-out opportunity within three seconds of a call's start.


Litigation volume reflects the shift in where the action is. Roughly 2,588 TCPA suits were filed between January and November 2025, statistically flat against the prior year, but the consensus among compliance attorneys is that state-level enforcement and private suits are the growth area as these mini-TCPA statutes mature and plaintiff firms get comfortable with them.


The operational problem this creates

A single national calling standard no longer maps to the legal reality. Calling windows differ by state, with several capping at 8 p.m. against the federal 9 p.m. Frequency caps differ, with Florida, Oklahoma, and Maryland limiting same-subject contact to three attempts in a day. Consent standards differ, with Florida still demanding the per-seller specificity the FCC abandoned. Suppression obligations differ, with Virginia's ten-year honor period creating a data-retention burden that outlives most CRM records.


All of this turns on the recipient's location, which means area code is no longer a safe proxy when better location data exists; a 305 number can belong to someone who has moved to a state with a tighter rule. Most state statutes do exempt business-to-business non-telemarketing calls, including Florida, Oklahoma, Washington, Maryland, and Georgia, but the definitions of "telemarketing" vary enough that some B2B sales calls get pulled in. Where the line is unclear, treating the call as covered is the cheaper mistake.


What a defensible program looks like

The workable approach is to calibrate to the most restrictive rule that applies to each contact, by the recipient's actual location, rather than to a national average. That means per-state calling windows and frequency caps enforced in the dialer, not in an agent's memory. It means documenting consent at the moment of capture and retaining the evidence, because prior express written consent remains the standard least likely to lose in court even as a few 2026 rulings have started debating whether oral consent can suffice. It means honoring revocation broadly and fast, ahead of any federal deadline. It means treating AI-generated voice as prerecorded voice for consent purposes, full stop.


It also means watching parts of the call path that have nothing to do with consent. The FCC put revised Robocall Mitigation Database rules into effect in early 2026, opened an annual recertification window, and removed more than 1,200 providers for noncompliant filings in 2025; when a provider gets cut, downstream carriers must stop accepting its traffic, and a legitimate campaign can lose deliverability without anything changing on the campaign side. Provider hygiene and STIR/SHAKEN attestation now sit inside the compliance picture rather than beside it.

The federal deadlines that keep sliding make waiting feel reasonable. But the suits that empty bank accounts are increasingly filed in state court under statutes that write their own damages math, and Texas's model of treble damages plus attorney's fees is the version other legislatures are most likely to copy next.


Sources

Comments

Commenting on this post isn't available anymore. Contact the site owner for more info.
bottom of page