Are you allowed to cold call businesses?

The Compliance Trap: Why B2B Cold Calling Is No Longer the Wild West

If you built your outbound playbook before 2024, the ground shifted under your feet. The B2B calling exemption you relied on is gone, and AI voices now carry the same legal weight as robocalls.

The first blow came in February 2024, when the FCC issued a Declaratory Ruling that AI-generated voices count as "artificial or prerecorded voice" under the TCPA. As one TCPA compliance analysis puts it, the legal status depends on how the voice is produced, not how human it sounds. The statute does not allow any carve-out for technologies that "purport to provide the equivalent of a live agent."

Then, in April 2024, the FTC's Telemarketing Sales Rule update explicitly extended regulation to B2B telemarketing, closing the gap that made business cold calling feel like the Wild West. The same update heightened record-keeping requirements and stretched DNC record retention from 2 years to 5.

The stakes are no longer theoretical:

• Up to $51,744 per TSR violation
• $500–$1,500 per TCPA call, with no aggregate cap
• Class settlements running $5M–$20M, with TCPA filings up 95% year over year

The QuoteWizard settlement alone hit $19 million — not for making bad calls, but for failing to trace consent through its vendor chains. That distinction matters: as the Lamb v. Mortgage One Funding case establishes, the entity on whose behalf calls are made bears liability regardless of who pressed dial. Hiring a third-party AI vendor transfers zero compliance risk.

There's a subtlety that trips up even experienced teams: an established business relationship does not save you. Your live SDR can dial a 16-month-old customer on the DNC list under EBR. Your AI agent cannot dial the same person without separate consent — the artificial voice itself triggers the requirement.

The FTC has also made clear that rules apply regardless of calling technology, whether low-tech equipment or the newest AI stack. And regulators assess purpose, not the opening sentence — an "account check-in" that pivots to an upsell is marketing in the eyes of the FCC and the courts.

This is why consent documentation has become the whole game. Every lead needs a paper trail: disclosure text, timestamp, IP address, and the named contacting party. It's the standard we hold every GrowthPros lead to before delivery, because in this environment, a lead without a consent record isn't an asset — it's a liability with a phone number attached.

What the Law Actually Requires: Consent, EBR Myths, and the Lead Generator Loophole

Consent is where most AI calling programs quietly break the law — not because the intent was malicious, but because the rules shifted faster than the playbooks. If you're running AI-assisted outreach, what counts as valid consent depends on where the recipient is, what technology you're using, and who sourced the lead.

The baseline: for marketing calls using an artificial voice, 47 states require prior express written consent. But in Texas, Louisiana, and Mississippi, the post-Bradford ruling means oral consent satisfies TCPA requirements for AI marketing calls — a jurisdictional split that complicates any national campaign, according to TCPA compliance analysis. Note that the FCC assesses purpose, not your opening sentence: an "account check-in" that pivots to an upsell is marketing.

The most dangerous myth is the established business relationship (EBR). EBR exempts manual calls from DNC Registry restrictions — but not AI calls. As one compliance playbook puts it bluntly: your live SDR can dial a 16-month-old customer on the DNC list under EBR; your AI agent cannot dial the same person without separate consent. The artificial voice itself triggers the consent requirement, regardless of how warm the relationship is.

Then there's the lead generator loophole. The FCC's 1:1 consent rule — which would have required consent naming your specific business — was vacated by the Eleventh Circuit in January 2025, as Kelley Drye's analysis explains. Consumers can now consent to contact from multiple sellers via one form. That reopened the market for co-registration leads — but courts remain skeptical of "and our partners" consent language, and the phrase "warm cold list" has no legal meaning. The stakes are real: TCPA class-action filings are up 95% year over year, with statutory damages of $500–$1,500 per call and no aggregate cap.

Before you dial a purchased list, verify three things:

• Does each lead carry a consent record — disclosure text, timestamp, and named contacting party — that traces to your business?
• Have co-registration leads been re-consented to your specific company before any AI dialing?
• Is your consent tiered by jurisdiction, distinguishing written from oral consent states?

This is why lead provenance matters more than lead volume. Vendors like GrowthPros attach a consent trail to every delivered lead precisely because the buyer — not the dialer — bears liability. The Lamb v. Mortgage One Funding case made that clear: the entity on whose behalf calls are made is liable, regardless of who pressed dial. A cheap list without a consent trail isn't a bargain; it's deferred litigation.

The Vendor Liability Myth: You Can't Outsource Compliance Risk

The Vendor Liability Myth: You Can't Outsource Compliance Risk

Many businesses assume that using a third-party AI calling platform shifts compliance responsibility to the vendor. This is a dangerous misconception. The entity on whose behalf calls are made bears liability regardless of who pressed dial, as established in Lamb v. Mortgage One Funding. This principle was reinforced by the QuoteWizard $19 million settlement for failing to trace consent through vendor chains. You cannot outsource TCPA or TSR risk—if your name is on the offer, you own the violation.

Civil penalties for TSR violations reach up to $51,744 per incident, while TCPA calls carry $500–$1,500 in statutory damages with no aggregate cap. These exposures compound quickly in class actions, where settlements routinely exceed $5 million. GrowthPros mitigates this by embedding consent records directly into every lead—disclosure text, timestamp, IP address, and the named contacting party—so liability stays traceable and defensible.

• Verify that every lead includes a complete consent trail before any outbound contact
• Require vendors to prove DNC scrubbing and opt-out honoring in real time
• Retain all telemarketing records for 5–7 years per updated TSR and TCPA guidance
• Confirm that AI disclosure protocols align with state laws like Texas SB 140
• Audit lead sources for co-registration gaps—'warm cold' lists hold no legal weight

Compliance isn't a vendor feature—it's a shared obligation where the beneficiary of the call ultimately answers for it. By insisting on consent-recorded leads and verifiable follow-up, GrowthPros ensures clients aren't just buying contacts—they're buying defensible outreach. This approach turns compliance from a liability into a competitive advantage in regulated markets.

Your Compliant AI Outreach Playbook: Practical Steps Before You Dial

Your Compliant AI Outreach Playbook: Practical Steps Before You Dial

Before hitting dial on any AI-assisted outreach campaign, businesses must build compliance into their workflow from the ground up. Skipping foundational steps like list hygiene and consent validation risks triggering TCPA violations that carry statutory damages of $500–$1,500 per call with no aggregate cap, a reality underscored by recent settlements exceeding $925 million in aggregate verdicts. GrowthPros embeds these safeguards directly into its lead delivery process, ensuring every contact begins with a verified consent trail and DNC-scrubbed data.

Start by scrubbing every outbound list against the National Do Not Call Registry before initiating contact—a non-negotiable step now requiring 5-year record retention under the April 2024 TSR update. Honor opt-out requests immediately and permanently across all channels: SMS, voice, and email, as the FTC emphasizes that technology choice doesn’t alter compliance obligations. Restrict calling to the 8 a.m.–9 p.m. window in the recipient’s local time, a rule that applies equally to AI and human agents since regulatory frameworks are technology-agnostic. For Texas-based calls, disclose AI use within the first 30 seconds per SB 140, preparing similar scripts for emerging federal disclosure rules expected within 12–24 months.

• Maintain consent records with disclosure text, timestamp, IP address, and named contacting party for each lead
• Re-consent co-registration and dormant-list contacts before AI dialing, as courts reject "warm cold list" assumptions
• Preserve TCPA-related records for 7 years (defense counsel recommendation given the 4-year statute of limitations)

By anchoring outreach in consent-recorded, DNC-scrubbed leads with AI follow-up inside five minutes, businesses can accelerate engagement—contacting leads within this window makes connection roughly 100x more likely than at thirty minutes—without betting the company on a class action. This approach transforms compliance from a bottleneck into a competitive advantage, turning regulatory rigor into faster, safer conversations that respect both the law and the recipient’s time.