Call Center Compliance: Federal & State Rules

Call center compliance is the discipline of keeping outbound and inbound operations inside three rule layers at once: federal law (TCPA, TSR), state law (registration, consent, calling hours), and carrier-side requirements (STIR/SHAKEN, robocall mitigation). Federal law sets the floor, state laws raise the bar, and carrier policies add constraints of their own. A mistake at any layer can bring regulatory enforcement, carrier suspension or TCPA class-action exposure, so compliance works best as operational infrastructure built into your stack from the carrier layer up.

This guide maps call center compliance for outbound operations from the carrier side: which rules touch the trunk, which touch the dialer, and where the two meet. SIPNEX is an FCC-licensed carrier that provides SIP trunks for call centers. Text campaigns stack their own rules on top of the voice obligations below; the SMS side starts with A2P 10DLC registration. This is general information, not legal advice: confirm current federal and state requirements with counsel before you launch a campaign.

The call center compliance stack: who owns what

Call center compliance fails when everyone assumes someone else owns a layer. The stack has six layers, each with a distinct owner and a distinct failure mode. Map them explicitly before your first campaign:

Layer 1 — Consent (TCPA). Owned by lead acquisition. Every number your dialer loads needs a documented consent record before the first attempt. The TCPA compliance checklist covers what valid consent looks like and how to document it.

Layer 2 — DNC scrubbing. Owned by data operations. Federal, state, and internal DNC lists must be scrubbed before every campaign load, not once per lead lifecycle. The same checklist covers scrub cadence and the federal and state list sources.

Layer 3 — Calling hours and attempt frequency. Owned by the dialer administrator. The federal calling window, stricter state windows, and state attempt-frequency caps all live in dialer configuration. The checklist’s calling-hours section maps the federal and state windows to VICIdial hopper settings.

Layer 4 — Recording consent. Owned by QA. Recording disclosure must run on every call that touches an all-party consent state; the state layer below lists them.

Layer 5 — Caller ID integrity. Owned jointly by operations and the carrier. Accurate CNAM, verified DIDs, A-level signing, and number reputation monitoring — the spam label remediation guide covers recovery when this layer slips.

Layer 6 — Carrier obligations. Owned by the carrier. STIR/SHAKEN signing, robocall mitigation, and RMD registration happen at the network level. You cannot fix this layer yourself — you can only choose a carrier that already has it.

The federal layer: TCPA and TSR

Two federal rule sets form the foundation of call center compliance.

The Telephone Consumer Protection Act (TCPA) — 47 U.S.C. § 227 — governs autodialed calls, prerecorded messages, and text messages. The full TCPA compliance breakdown is covered in our dedicated guide. The key provisions for call centers: prior express written consent is required for telemarketing calls to cell phones made with an autodialer or prerecorded voice, and for prerecorded telemarketing calls to residential lines. The Do Not Call Registry must be honored, with lists scrubbed at least every 31 days. Calling hours run from 8 a.m. to 9 p.m. in the recipient’s local time zone.

Abandoned telemarketing calls may not exceed 3 percent of the calls answered by a live person, measured per calling campaign over each 30-day period. Private plaintiffs can recover $500 per violation, up to $1,500 when the violation is willful or knowing, with no cap on total damages. Two 2025 changes matter: the Eleventh Circuit vacated the FCC’s one-to-one consent rule on January 24, 2025, and most of the FCC’s consent-revocation rules took effect on April 11, 2025, with the separate “revoke-all” provision since delayed to January 31, 2027. The checklist above covers both.

The Telemarketing Sales Rule (TSR) — 16 C.F.R. Part 310 — is enforced by the FTC and applies to telemarketing (selling goods or services by phone). It requires disclosures beyond the TCPA’s: the caller must promptly identify the seller and the purpose of the call. It bars calls before 8 a.m. or after 9 p.m., matching the TCPA window, and it requires the caller to transmit caller ID with a number the consumer can call back.

The TSR also bans certain payment methods in telemarketing, including remotely created checks and cash-to-cash money transfers. Its civil penalty is up to $53,088 per violation, the figure set in the FTC’s 2025 inflation adjustment. In a September 2026 notice, the FTC said it will make no adjustment for 2026 and will keep applying the 2025 levels.

The interaction between the TCPA and the TSR matters because different agencies enforce them (the TCPA by the FCC, the TSR by the FTC), and state attorneys general can bring actions under both. A single calling campaign can violate both at once, exposing the operator to enforcement from two federal agencies plus private lawsuits under the TCPA’s private right of action.

The state layer: 50 jurisdictions, 50 rule sets

Federal law sets the minimum. States can and do impose stricter requirements. For a call center making interstate calls, the law of the state where the called party is located generally applies, so plan to the strictest state you call into.

State telemarketing registration. Many states require businesses engaged in telemarketing to register with a state agency before calling residents, and some charge a fee or require a bond. Failure to register is itself a violation, separate from any TCPA or TSR issue. If you call nationally, check the registration rules in every state you call into — or use a compliance vendor that tracks them for you.

State Do Not Call lists. About a dozen states keep their own DNC registries alongside the National Do Not Call Registry. The National Association of Attorneys General lists Colorado, Florida, Indiana, Louisiana, Massachusetts, Mississippi, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas and Wyoming. You must scrub against both the federal list and the applicable state lists. The state lists update on their own schedules, and state DNC penalties are separate from federal ones.

State calling hour restrictions. The federal window is 8 a.m. to 9 p.m. local time, and some states set narrower windows or attempt caps. Florida, for example, bars commercial telephone solicitation calls after 8 p.m. and allows no more than three such calls to the same person on the same subject within 24 hours (Fla. Stat. § 501.616(6)). Build a state-specific calling hours matrix into your dialer hopper configuration.

State call recording consent. Eleven states are generally treated as requiring all-party consent to record a phone call: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania and Washington. Four more (Connecticut, Michigan, Oregon and Vermont) are mixed or unsettled, so a cautious national program treats all fifteen as all-party states. If you record calls for quality assurance or compliance documentation, disclose the recording and obtain consent on those calls. Recording without consent can be a felony in some states, including Florida, Pennsylvania and Massachusetts.

State-specific TCPA equivalents. Florida’s Telephone Solicitation Act, California’s consumer protection statutes, and several other state laws impose requirements that go beyond or differ from the federal TCPA. Florida’s statute uses its own automated-dialing definition, not the federal ATDS test that Facebook v. Duguid narrowed. California’s Civil Code (§ 1770(a)(22)) requires a live, unrecorded voice to identify the caller and get the listener’s consent before an unsolicited prerecorded message plays, with exceptions such as existing relationships. Compliance with the federal TCPA alone is insufficient for national calling campaigns.

The carrier layer: STIR/SHAKEN, attestation, and network policies

This is where your carrier selection intersects with compliance, and it is the easiest layer to overlook.

STIR/SHAKEN attestation is not a legal requirement on the caller — no law says your calls must carry A-level attestation — but it shapes how your traffic is treated. Analytics engines treat partial (B) attestation as a lower-trust signal, though no carrier publishes a specific answer-rate gap. Fewer answered calls mean more dials to reach the same contacts, and every extra dial adds DNC and abandonment exposure. A-level attestation from a carrier that signs with its own certificate removes one variable from that chain.

Carrier Acceptable Use Policies. Every carrier has an AUP that governs what you can and cannot do on its network. SIPNEX’s Acceptable Use Policy prohibits misleading caller ID in violation of the Truth in Caller ID Act, and telemarketing that breaks the TCPA, the TSR, or federal and state Do Not Call and calling-time laws. Violating it can lead to suspended service or blocked calls — a carrier-level enforcement mechanism that moves faster than regulatory action.

Robocall Mitigation Database (RMD). FCC rules require voice providers to file robocall mitigation plans in the RMD, and SIPNEX is registered. Downstream providers are barred from accepting calls directly from a provider that is not listed, so if your carrier is missing from the RMD, your calls can be refused at the next network regardless of your own compliance practices.

Building a compliance infrastructure

Compliance is not a document you create once and file away. It is an operational system that must be integrated into your technology stack.

Consent management. Build consent capture into your lead acquisition process. Every lead should have a consent record: the exact disclosure language shown, the timestamp, the method (web form, verbal, paper), the phone number consented, and a unique record ID that links to the lead and to subsequent call records. Store consent records in a database separate from your CRM — if a class action firm sends a discovery request, you need to produce consent evidence for every number in the class. Your carrier’s CDR data provides the call records; your consent database provides the authorization records. The two together form your compliance evidence chain.

DNC management. Scrub every list against the National DNC Registry before loading into your dialer. Scrub against applicable state registries. Maintain your company-specific DNC list in your CRM or dialer with a suppression flag that blocks the number across all campaigns, not just the current one. When an agent receives a verbal DNC request, the system must add the number to the company DNC list in real time — before the agent’s next call, not at the end of the shift.

Calling hours enforcement. Configure your dialer to enforce 8 a.m. to 9 p.m. in the recipient’s local time zone. In VICIdial, use the hopper’s timezone filtering and the campaign’s local call time settings. Apply state-specific restrictions on top of the federal window. Test your timezone logic quarterly by checking CDRs for calls placed outside permitted windows — even a 1 percent error rate in timezone calculation can generate hundreds of violations in a high-volume campaign.

Abandon rate monitoring. Configure your predictive dialer to target an abandon rate well below 3 percent — a target of 1 to 2 percent gives you a safety margin. In VICIdial, use adaptive dialing with a drop percentage target. Track each campaign’s abandon rate over the 30-day period the FCC rule uses, and alert if it approaches 2.5 percent. A single day of aggressive dialing that pushes the daily rate to 5 percent can pull the campaign’s 30-day rate above the limit.

Recording and documentation. Record all calls in compliance with state recording consent laws (disclose on every call). Retain recordings linked to CDRs with timestamps. Retain consent records, DNC scrub logs, campaign configurations, and training records. Establish a retention period that covers the longer of your industry’s requirement or the statute of limitations for TCPA claims (typically 4 years from the date of the violation).

Frequently asked questions

What federal laws apply to call centers?

Two federal rule sets: the Telephone Consumer Protection Act (TCPA, 47 U.S.C. § 227), enforced by the FCC and through private lawsuits, and the FTC’s Telemarketing Sales Rule (TSR, 16 C.F.R. Part 310). The TCPA covers consent, Do Not Call, calling hours and abandonment for autodialed and prerecorded calls and texts. The TSR covers telemarketing disclosures, caller ID and payment methods, with civil penalties of up to $53,088 per violation. A single campaign can violate both.

Do I need to register in every state I call into?

Many states require telemarketing registration before you place telemarketing calls to their residents. The specific requirements — registration forms, fees, bonding, annual renewal — vary by state. If you call nationally, either register in every state with a registration requirement or use a compliance service that tracks state registration obligations. Failure to register is a separate violation from TCPA or TSR issues — you can be fully TCPA-compliant and still violate state law by calling without registration.

How does my carrier choice affect compliance?

Your carrier supplies part of your evidence and part of your risk. Attestation: analytics engines treat partial (B) attestation as a lower-trust signal, though no carrier publishes a specific answer-rate gap, and fewer answered calls mean more dials and more exposure. Call records: detailed CDRs help show when and how each call was placed if you are sued. Network standing: a carrier missing from the FCC’s Robocall Mitigation Database can have its traffic refused downstream. Ask any carrier who signs your calls, at what level, and how you get your CDRs.

What are the biggest compliance risks for call centers?

Three areas stand out. (1) Consent defects — invalid, expired, or poorly documented consent is a common basis for TCPA class actions, because statutory damages are large and consent records are easy to test in discovery. (2) State-level violations — operators who focus only on federal TCPA compliance and ignore state registration, state DNC lists, state calling hours, and state recording consent laws are exposed on multiple fronts. (3) Abandonment — a telemarketing campaign whose abandoned calls exceed 3 percent of live-answered calls over a 30-day period breaks the FCC’s rule, and a few days of aggressive pacing can push it over.

---

SIPNEX provides the carrier layer of call center compliance: A-level STIR/SHAKEN attestation under our own certificate, real-time CDR exports for your evidence chain, and registration in the FCC’s Robocall Mitigation Database. Talk to an operator about your campaign’s carrier layer.