TCPA compliance for cold calling (DNC, quiet hours, consent)

Cold calling in the United States is governed by two separate parts of the TCPA that most guides merge into one, and the merge is why teams build the wrong controls. Section 227(b) restricts autodialed and artificial-or-prerecorded-voice calls and carries $500 per violation, trebled at a court's discretion. Section 227(c) is the do-not-call regime — calling hours, the national registry, your own suppression list — and it comes with a statutory compliance defence that section 227(b) does not have. Different triggers, different remedies. This describes what the rules say; take advice on your own programme from a lawyer.

Two statutes wearing one name, and only one of them forgives a good process

Read the remedies side by side and the design consequence falls out immediately.

47 U.S.C. 227(b)(3) lets a person recover "actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater", and adds that where the court "finds that the defendant willfully or knowingly violated this subsection… the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available". That is where the familiar $1,500 comes from. It is a discretionary treble of $500, not a separate statutory tier, and nothing in the subsection offers a defence for having tried hard.

47 U.S.C. 227(c)(5) is shaped differently in three ways that matter operationally. It is available only to "a person who has received more than one telephone call within any 12-month period by or on behalf of the same entity". It allows "up to $500" rather than a flat $500. And it ends with a sentence that has no counterpart in 227(b): "It shall be an affirmative defense in any action brought under this paragraph that the defendant has established and implemented, with due care, reasonable practices and procedures to effectively prevent telephone solicitations in violation of the regulations prescribed under this subsection."

So your written policy, your training records and your suppression process are a statutory defence to a do-not-call claim and are not a defence to an autodialer claim. Teams routinely invest in the paperwork and skip the question of what their dialer technically is, which gets the protection backwards. Both matter, but they protect against different suits.

What the calling-hours rule actually says, and whose clock it uses

The rule is short enough to quote in full. 47 CFR 64.1200(c)(1): "No person or entity shall initiate any telephone solicitation to any residential telephone subscriber before the hour of 8 a.m. or after 9 p.m. (local time at the called party's location)."

Three details in that sentence get lost in summaries.

It says solicitation. A telephone solicitation is defined in the rule as a call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods or services. A genuine transactional or service call is outside that definition. Labelling a sales call a service call does not move it, and the content of the script is what a court will read.

The clock belongs to the recipient. The parenthetical is not decorative. Your 9 a.m. in Bengaluru or in New York is not the standard; the called party's local time is. And because US numbers are portable, the area code is a billing artefact rather than a location. A number that starts +1 415 may sit in a pocket in Boston. Inferring a time zone from the NPA is an assumption you are choosing to make, and it should be recorded as one.

It says residential subscriber, and then 64.1200(e) widens it. That paragraph reads: "The rules set forth in paragraph (c) and (d) of this section are applicable to any person or entity making telephone solicitations or telemarketing calls or text messages to wireless telephone numbers to the extent described in the Commission's Report and Order, CG Docket No. 02-278, FCC 03-153." Mobile numbers are in scope for calling hours, for the registry and for the company-specific list.

The Federal Trade Commission runs a parallel regime for entities within its jurisdiction. Its Telemarketing Sales Rule at 16 CFR 310.4(c) sets the same window: no outbound calls to a person's residence "at any time other than between 8:00 a.m. and 9:00 p.m. local time at the called person's location". Two agencies, two rulebooks, the same eight-to-nine boundary.

Do-not-call is three lists, and only one of them is national

Most calling stacks implement one list and call it done. There are three, they have different owners, and a number can be absent from one and present on another.

The national registry. 47 CFR 64.1200(c)(2) prohibits telephone solicitations to numbers on the national do-not-call registry, and the FTC's parallel prohibition sits at 16 CFR 310.4(b)(1)(iii). The registry is not something you download once. The safe harbour at 64.1200(c)(2)(i)(D) is conditioned on "employing a version of the national do-not-call registry obtained from the administrator… no more than 31 days prior to the date any call is made", and the FTC's safe harbour at 16 CFR 310.4(b)(3) uses the identical 31-day period. Access is a subscription your organisation takes out in its own name through the FTC's telemarketing portal. A vendor cannot hold it for you as a shared resource.

The company-specific list. 47 CFR 64.1200(d) is a procedural rule with four obligations that are trivially auditable and frequently missing. Paragraph (d)(1) requires "a written policy, available upon demand, for maintaining a do-not-call list". Paragraph (d)(2) requires that personnel engaged in any aspect of telemarketing "must be informed and trained in the existence and use of the do-not-call list". Paragraph (d)(3) requires that on receiving a request, the entity "must record the request and place the subscriber's name, if provided, and telephone number on the do-not-call list at the time the request is made" — at the time, not at the end of the shift. And paragraph (d)(6) sets the duration: a request "must be honored for 5 years from the time the request is made".

Your own cross-channel do-not-contact list. This one is not a legal category, and it is the one that prevents the embarrassing failure. A person who replies STOP to your text and is then called by a rep has been protected by a phone-only list and harmed anyway. Suppression that lives on a single channel is suppression with a hole in it, which is the same argument that makes a shared list worth building for SMS opt-outs and calling suppression together.

Consent, and the two things that genuinely changed

This is the section where stale guides do the most damage, because two of the load-bearing facts changed inside eighteen months.

Prior express written consent is defined at 47 CFR 64.1200(f)(9) as "an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller to deliver… advertisements or telemarketing messages using an automatic telephone dialing system or an artificial or prerecorded voice". Written consent is the higher bar and attaches to marketing delivered by those means.

What an autodialer is narrowed in 2021. In *Facebook, Inc. v. Duguid*, decided 1 April 2021, the Supreme Court held that to qualify as an automatic telephone dialing system a device must have the capacity either to store or to produce a telephone number using a random or sequential number generator. Dialing from a stored customer list, without such a generator, falls outside that definition. That decision moved a great deal of ordinary sales calling out of 227(b) — which is precisely why the 227(c) do-not-call analysis, and the state statutes below, now carry more of the risk than they used to.

The one-to-one consent rule was vacated. In December 2023 the FCC adopted an order that would have required consent to be given to one identified seller at a time and to be logically and topically associated with the interaction that produced it. In *Insurance Marketing Coalition Ltd. v. FCC*, No. 24-10277, the Eleventh Circuit vacated Part III.D of that order on 24 January 2025, one business day before it would have taken effect, holding that the restrictions were inconsistent with the ordinary statutory meaning of prior express consent. The current text of 47 CFR 64.1200 contains no one-to-one or logically-and-topically-associated language. If a compliance checklist you are following still lists it, that checklist has not been updated since January 2025.

Revocation became a hard rule, with one narrow carve-out. 47 CFR 64.1200(a)(10) took effect on 11 April 2025. A called party may revoke consent "by using any reasonable method", and the rule names several that are reasonable per se: an automated, interactive voice or key-press opt-out mechanism on a call; a website or telephone number the caller designated to process opt-outs; and "the words 'stop,' 'quit,' 'end,' 'revoke,' 'opt out,' 'cancel,' or 'unsubscribe' sent in reply to an incoming text message". Revocation must be honoured "within a reasonable time not to exceed ten business days from receipt".

The carve-out is narrow and worth stating precisely, because it is easy to overread. By Order DA 26-12, released 6 January 2026 in CG Docket No. 02-278, the FCC's Consumer and Governmental Affairs Bureau extended a waiver of 64.1200(a)(10) only to the extent the rule requires a caller to treat a revocation made in response to one type of informational message as applying to all future robocalls and robotexts from that caller on unrelated matters — running to 31 January 2027. Everything else in (a)(10) has been in force since April 2025. The waiver is an implementation grace period on one clause for organisations with many separate business units, not a finding that cross-channel suppression is unnecessary. Building it now costs less than retrofitting it in January 2027.

The predictive-dialer rule almost nobody configures

If you run a predictive or power dialer, 47 CFR 64.1200(a)(7) sets a number you can measure today. The safe harbour is conditioned on not abandoning "more than three percent of all telemarketing calls… as measured over a 30-day period", and the rule defines the term: "A call is 'abandoned' if it is not connected to a live sales representative within two (2) seconds of the called person's completed greeting."

Two seconds is short enough that it is an engineering constraint rather than a policy one, and the 30-day window is long enough that a single bad afternoon washes out while a bad fortnight does not. That shape argues for alerting below the cap rather than at it. Autocloz ships abandonment_rate_cap_percent defaulted to 3 and a separate abandonment_alert_pct defaulted to 2, so ops hears about the trend while there is still room to correct it. The same settings group carries calling_window_enforcement — strict, warn or off, defaulting to strict, where strict blocks the dial rather than logging it — plus call_window_start at 08:00 and call_window_end at 21:00, a recording_disclosure_text read at call start, and a two_party_consent_states list that turns disclosure on automatically for the state codes it names. Whether a predictive dialer is right for your list at all is a separate question from whether it is configured legally, and the difference between auto, power and predictive dialing is where that decision belongs.

How to build a pre-dial gate a rep cannot route around

You cannot un-ring a phone. Every one of these checks has to happen before the carrier API is touched, which means they belong at one chokepoint rather than in each caller.

In Autocloz there is no single function every worker funnels through — each channel's dispatcher runs the checks itself against one shared suppression table — but every refusal it returns carries a machine-readable reason rather than a silent skip, which is the property that actually matters for an audit. The reason vocabulary is fixed: account_paused, account_error, account_pending, quiet_hours, dnc_listed, min_gap, hourly_limit, daily_limit. Checks run cheapest first: account status in memory, then the time-zone arithmetic, then one indexed query each for suppression, minimum gap since the last touch, the hourly cap and the daily cap.

Three implementation details are where this goes wrong in practice.

• Normalise the identifier on both sides of the comparison. The historical failure is a suppression row stored as +14155551212 being checked against a raw lead field of (415) 555-1212, producing no match and a call to somebody who opted out. Both sides collapse to E.164 before the comparison, so +1 (415) 555-1212, 4155551212 and +14155551212 are the same key.
• Give suppression a wildcard channel. A row written against * blocks the next touch on every channel, which is what makes a STOP on text also stop the call.
• Fail closed on garbage, not open. An unparseable time-zone string must not evaluate to "inside business hours". The safe degradation is to evaluate the window in UTC and let other gates trip, never to treat the check as passed.

Autocloz's free plan covers 5 users and 10 mailboxes and puts that pre-dial gate, the shared suppression list and the audit trail on every campaign from the first call — start free and configure the window before you import a list, not after. If you are bringing your own carrier, the Telnyx voice integration is the path most teams take, and the gate sits in front of it either way.

State statutes add rules the federal analysis will not surface

A programme that clears the TCPA can still fail under state law, and the state layer has grown faster than the federal one since *Duguid* narrowed what counts as an autodialer. Florida's Telephone Solicitation Act, Oklahoma's Telephone Solicitation Act of 2022, Washington's Commercial Electronic Mail Act and Maryland's Stop the Spam Calls Act are the ones most often cited, and several of them define an automated system more broadly than the federal definition, carry their own private rights of action, or set calling windows narrower than 8 a.m. to 9 p.m.

The specifics move — Florida's statute was materially amended in 2023 — so the honest instruction is procedural rather than substantive: identify the states you actually dial into, read the current text of each statute for those states, and have counsel confirm the analysis before you scale. Anyone who hands you a single national rule set for all fifty states is selling you a simplification.

What a pre-dial gate cannot do, and what Autocloz does not do

Being exact about the gaps is more useful than another paragraph of reassurance, and these are the gaps.

Autocloz does not scrub against the National Do Not Call Registry. The suppression list it enforces is the one your workspace maintains — manual entries, STOP keywords captured from inbound replies, and auto-suppression after a configurable number of failed attempts. Registry access is a subscription your organisation holds in its own name, and the safe harbour requires a version obtained no more than 31 days before the call. That scrub is yours to run, and it is the single most common thing teams assume a dialer is doing for them.

Quiet hours in the send gate are evaluated in the sending account's time zone, not the recipient's. The per-lead time zone is honoured by the campaign sending window, which resolves lead.timezone first, then the campaign's configured zone, then the workspace default, then UTC. The account-level quiet-hours check is a different gate and uses the account's zone. If your list spans several US time zones, set the account to the strictest zone you dial into or segment campaigns by region, and do not assume one setting covers both behaviours.

Autocloz does not sign your calls with STIR/SHAKEN. Caller-ID authentication is performed by voice service providers in the call path, and the attestation level is assigned by your originating provider rather than chosen by you. Autocloz stores the attestation you have been given as a setting so it appears in your compliance record; it does not create or upgrade it.

Opt-in enforcement is off by default and is per channel. A workspace switches it on for a channel once it has back-filled its evidence, because turning it on globally would stop every campaign already running in every existing workspace. Consent rows carry a status, a source, free-text evidence, a capture timestamp and an optional expiry, so the record exists whether or not the block is armed.

No software can tell you whether a specific call is lawful. Whether your script is a telephone solicitation, whether your consent is adequate, whether an established business relationship applies, and how a state statute reads on your facts are questions with legal answers, and the TCPA is enforced largely through private litigation where the facts a product cannot see are the ones that decide the case. Treat everything above as a description of published rules — the FCC's at 47 CFR 64.1200, the FTC's at 16 CFR 310.4, the statute at 47 U.S.C. 227 — and take advice for your own situation. If your programme also touches text, the consent and registration rules for SMS are a different regime again, and the pre-dial and pre-send checks only ever enforce what you have configured them to enforce.