TCPA and Telemarketing Rules · September 28, 2026 · GrowthPros

Is outbound call cold calling?

Stop asking if outbound calls are cold calling. Learn the 4 factors that determine TCPA/TSR compliance and how consent-recorded leads reduce legal risk.

Flat illustration of a smartphone with shield and consent-document icons in lime green, symbolizing compliant outbound calling.

Key Facts

  • Regulators classify calls by purpose, consent, and technology — not by whether the contact feels 'warm' or 'cold' — under FTC telemarketing rules.
  • TCPA statutory damages run $500 to $1,500 per violation, while TSR civil penalties exceed $53,000 per non-compliant contact per compliance data.
  • Over 258 million active numbers sit on the National Do Not Call Registry, yet documented consent and established business relationships keep many lawfully callable according to PossibleNOW.
  • AI-generated voices count as 'artificial or prerecorded' under the TCPA, requiring the same consent as traditional robocalls per a 2024 FCC ruling.
  • Texas SB 140, effective September 1, 2025, allows damages up to $5,000 per call — with treble damages and mandatory attorney's fees under state law.
  • Roughly 2,588 TCPA lawsuits were filed between January and November 2025 — a steady, not shrinking, litigation machine per litigation tracking.
  • Sellers can initiate manual, non-automated calls without triggering FCC lead generator restrictions, while automated contacts require one-to-one written consent per legal analysis.

Why 'Is This Cold Calling?' Is the Wrong Question to Ask Compliance

Every time your team picks up the phone or fires off an SMS sequence, a quiet question follows: is this a cold call — and could it trigger a TCPA lawsuit? It's a reasonable fear. But the question itself is misleading, because regulators don't classify calls by how well you know the prospect.

The FTC's Telemarketing Sales Rule defines its jurisdiction by call purpose — a plan to induce a purchase — not by whether the contact is "warm" or "cold." Similarly, the TCPA turns on consent status, existing business relationships, and the technology used, not on caller familiarity. A manual call to a prospect you've never spoken with can be lawful, while an automated text to a past customer can be a violation.

What actually determines a call's regulatory classification:

  • Purpose — calls designed to induce purchases fall under telemarketing rules regardless of relationship
  • Consent — prior express written consent can exempt a number listed on the DNC Registry, where 258 million+ active numbers now sit
  • Relationship — an established business relationship from a qualifying transaction or inquiry creates exemptions
  • Technology — per an FCC ruling, AI-generated voices count as "artificial or prerecorded" under the TCPA, requiring the same consent as traditional robocalls

The stakes make the distinction urgent. TSR civil penalties reach more than $53,000 per non-compliant contact, while TCPA statutory damages run $500 to $1,500 per violation. And plaintiffs' attorneys are watching: roughly 2,588 TCPA suits were filed between January and November 2025, statistically flat year-over-year — a steady, not shrinking, litigation machine.

The compliance picture is also shifting beneath your feet. At least a dozen states have passed stricter telemarketing statutes since 2021, many exceeding federal requirements on calling hours, frequency, and damages. Texas SB 140, effective September 1, 2025, allows damages up to $5,000 per violation routed through the DTPA — with treble damages and mandatory attorney's fees. The binding constraint is now often the recipient's actual location, not federal baselines and not area codes.

This reframing matters for how you source leads. A lead with documented, one-to-one prior express written consent — disclosure text, timestamp, and named contacting party attached — is a fundamentally different legal object than a scraped list, even if both feel equally "cold" to the rep dialing. That's why GrowthPros treats the consent record as part of the product itself: every lead is DNC-scrubbed and consent-recorded before delivery, so the compliance question is answered before the first call, not litigated after.

The right question isn't "is this cold calling?" It's: what's the purpose, what's the consent status, and what technology are you using to make contact?

The Four Factors That Actually Determine How Your Outbound Call Is Regulated

Whether an outbound call counts as regulated "cold calling" isn't a yes-or-no question — it's a four-factor test that regulators and courts apply to every dial. Get one factor wrong, and a call that felt routine becomes a $500-to-$1,500 statutory damages claim under the TCPA, or a TSR penalty exceeding $53,000 per non-compliant contact.

Factor 1: Purpose. The FTC's Telemarketing Sales Rule defines telemarketing as any plan or campaign "to induce the purchase of goods or services or a charitable contribution" involving more than one interstate call, and the FTC explicitly uses the term "cold calls" when prohibiting prerecorded outreach. If your outbound call is designed to sell something, it is regulated as telemarketing — full stop.

Factor 2: Consent. With over 258 million numbers on the National Do Not Call Registry, most dialable numbers are protected. But as compliance experts at PossibleNOW note, DNC-listed numbers remain lawfully callable under documented prior express written consent, prior invitation or permission, or an established business relationship from a qualifying transaction or inquiry. Consent is what separates a lawful outbound call from a cold one.

Factor 3: Technology. This is where the rules diverge sharply. According to legal analysis of the FCC's lead generator rules, sellers may initiate non-automated (manual) calls and texts without triggering the order's restrictions — while automated contacts using autodialers or prerecorded voices require one-to-one prior express written consent. And in a February 2024 declaratory ruling, the FCC confirmed that AI-generated voices count as "artificial or prerecorded," meaning conversational AI dialing cell phones needs the same consent as a traditional robocall.

Factor 4: Relationship. Inbound inquiries and prior transactions create exemptions that survive DNC listing. This is precisely why GrowthPros attaches a consent trail — disclosure text, timestamp, IP address, and named contacting party — to every lead delivered, and why dead-lead reactivation targets only pre-existing, opted-in relationships rather than cold lists.

One more wrinkle matters: the FCC's one-to-one consent rule was vacated in July 2025, but the underlying direction survives. Florida still enforces one-to-one-style consent under state law, and legal analysts consistently advise that prior express written consent "remains the standard least likely to lose in court."

The practical takeaway for any outbound program:

  • Classify every campaign by purpose before dialing — sales intent triggers the TSR.
  • Scrub against the National DNC Registry and apply consent exemptions per contact.
  • Match consent level to technology — manual calls and automated/AI calls are regulated differently.
  • Document consent with timestamps and disclosures, because the burden of proof sits with the caller.

Consent, documented and specific, is the dividing line between a compliant outbound call and a regulated cold call. Businesses that treat it that way — building the consent record before the dial, not after the lawsuit — are the ones still calling next year.

State Law Is Now the Binding Constraint, Not the TCPA

Even if your TCPA paperwork is spotless, a single call to the wrong state can still cost you thousands. That's because since 2021, at least a dozen states have passed telemarketing statutes that are stricter than federal law on calling hours, frequency, consent, and damages — turning what used to be one federal rulebook into a compliance patchwork.

Texas is the headline example. Under Texas SB 140, effective September 1, 2025, violations can carry damages of up to $5,000 per call, routed through the state's DTPA with treble damages and mandatory attorney's fees. Compare that to the federal TCPA's statutory range of $500 to $1,500 per violation, and the stakes of misreading state law become obvious.

Frequency and timing rules vary just as widely. Florida, Oklahoma, and Maryland cap telemarketers at three same-subject calls per 24-hour period, while Oregon's HB 3865 tightens the window to 8 a.m.–8 p.m. starting January 1, 2026. Virginia will require opt-out requests to be honored for at least 10 years — double the federal five-year standard.

The consent landscape has fractured too. After the FCC removed the federal one-to-one consent rule in July 2025, businesses must now navigate varying state-level standards, with Florida still enforcing one-to-one-style consent under its own state law. Federal relief in one state is not relief everywhere.

The state rules most likely to trip up multi-state callers:

  • Texas SB 140 — up to $5,000 per violation, plus treble damages and attorney's fees
  • Frequency caps of three calls per 24 hours in Florida, Oklahoma, and Maryland
  • Oregon's 8 a.m.–8 p.m. calling window, one hour tighter than the federal standard
  • Virginia's 10-year opt-out retention requirement

Here is the rule that matters most: calibrate to the most restrictive requirement based on the recipient's actual location — not their area code. Area codes are portable, so a 305 number may belong to someone who moved to a state with entirely different rules. Compliance systems need to enforce per-state windows, frequency caps, and consent standards using the geolocation of the number being dialed.

This is why consent documentation has become the real defense. As compliance analysts note, prior express written consent remains the standard least likely to lose in court, and plaintiff's attorneys will hold your conduct up against the strictest rule that arguably applies. That's why GrowthPros attaches a full consent trail — disclosure text, timestamp, IP address, and the named contacting party — to every lead delivered, so multi-state callers can prove consent no matter which state's statute a plaintiff invokes.

State law, not the TCPA, is now the binding constraint on outbound calling programs. Businesses that build their compliance posture around the strictest applicable state rule — rather than the federal floor — are the ones that stay out of the courtroom.

How to Build a Call Program That's Compliant by Design

Building a compliant outbound call program requires more than just checking boxes—it demands a system designed from the ground up to honor consent, respect regulations, and adapt to evolving state laws. At GrowthPros, compliance isn’t an afterthought; it’s embedded in every lead we deliver and every follow-up sequence we initiate.

Start with layered DNC scrubbing: check each number against the National Do Not Call Registry, which now includes over 258 million active numbers, and cross-reference state-specific lists where stricter rules apply. Since state laws often exceed federal requirements—like Florida’s one-to-one consent rule or Virginia’s 10-year opt-out honor period—calibrate calling windows and frequency caps to the recipient’s actual location, not just their area code. This ensures you’re never calling outside permitted hours, such as before 8 a.m. or after 9 p.m. local time, with many states enforcing even tighter windows.

Maintain granular, one-to-one consent records for every contact, including disclosure text, timestamp, IP address, and the named contacting party. This level of detail is critical under the FCC’s lead generator rules effective January 2025, which invalidate mass-market consent and require explicit, seller-specific permission for automated sales calls and texts. Distinguish clearly between automated and manual outreach: while non-automated calls may avoid certain restrictions, AI-driven voice, SMS, and email follow-ups triggered by lead delivery are treated as automated under TCPA and thus require prior express written consent—something we build into every lead from day one.

Honor opt-outs immediately and permanently across all channels—SMS, voice, and email—and suppress those numbers indefinitely in your internal DNC list. Some states, like Virginia, require honoring opt-outs for at least 10 years, double the federal standard, making broad, permanent suppression not just compliant but risk-averse. Finally, ensure reactivation efforts target only pre-existing, opted-in relationships—never cold lists—so you’re re-engaging familiar contacts with consent already on file.

  • Scrub against National and state-specific DNC lists before every contact attempt
  • Maintain one-to-one consent records with disclosure, timestamp, IP, and contacting party
  • Distinguish between automated and manual outreach for TCPA compliance
  • Honor opt-outs immediately and permanently across SMS, voice, and email
  • Restrict reactivation to pre-existing, opted-in relationships only

Every lead we deliver comes consent-recorded and DNC-scrubbed, with AI follow-up engineered to meet FCC one-to-one consent standards from the first touch—because compliant outreach isn’t just safer, it’s more effective.

Here's the uncomfortable truth about cold lists: the same shortcuts that make them cheap are the ones that land companies in court. With roughly 2,588 TCPA suits filed between January and November 2025, the plaintiffs' bar is not slowing down — and every unconsented call is a potential exhibit.

Consent flips that equation. As compliance analysts note, "prior express written consent remains the standard least likely to lose in court." That is not just legal cover. It is a warmer call. A consumer who checked a box, saw clear disclosure, and expects contact from a specific seller picks up the phone — or at least does not hang up on principle.

The economics back this up. TCPA statutory damages run $500 to $1,500 per violation, and TSR penalties can exceed $53,000 per non-compliant contact. One bad shared list can erase the savings of buying leads at bargain prices. Consent, by contrast, is an asset: documented, timestamped, and defensible.

That is the moat. A consented lead is not merely safer — it performs better, because the consent trail itself signals intent. GrowthPros builds its lead product around exactly this: every lead is qualified, time-stamped, and consent-recorded, with the disclosure text, IP address, and named contacting party attached before it ever reaches your CRM. And because speed compounds consent — responding within minutes rather than hours dramatically raises contact rates — an AI voice, SMS, and email follow-up fires inside a five-minute window, 24/7.

What compliant outreach looks like in practice:

  • One-to-one consent, tied to a specific seller, not generic mass-market permission that new FCC lead generator rules invalidate.
  • DNC-scrubbed lists before any outbound contact, honoring exemptions the way regulatory guidance describes — documented consent and established business relationships.
  • Opt-outs honored immediately and permanently across SMS, voice, and email — the posture legal commentators recommend because it removes what plaintiff's attorneys hold up in court.
  • Exclusive or capped-shared delivery (max two buyers), so the consented lead is not burned by five competitors dialing the same number.

The cold list asks "will they pick up?" The consented lead already answered. If you want leads that arrive expecting your call — and the paper trail proving they asked for it — book the free 15-minute qualification call. It is honest about fit, commits you to nothing, and sets real numbers for your niche.

Frequently Asked Questions

Is every outbound call legally considered a cold call?
No. Regulators don't classify calls by how well you know the prospect — the FTC's Telemarketing Sales Rule defines jurisdiction by call purpose, and the TCPA turns on consent, existing business relationships, and the technology used. A manual call to a stranger can be lawful, while an automated text to a past customer can be a violation.
Can I legally call a number that's on the Do Not Call Registry?
Yes, in some cases. With 258 million+ numbers on the National DNC Registry, most dialable numbers are protected, but documented prior express written consent, prior invitation, or an established business relationship from a qualifying transaction or inquiry all create lawful exemptions.
What are the penalties if my outbound calls violate TCPA or telemarketing rules?
TCPA statutory damages run $500 to $1,500 per violation, and TSR civil penalties can exceed $53,000 per non-compliant contact, per compliance guidance from PossibleNOW. Roughly 2,588 TCPA suits were filed between January and November 2025 — a steady, not shrinking, litigation machine.
Do AI voice calls count as robocalls under the TCPA?
Yes. In a February 2024 declaratory ruling, the FCC confirmed that AI-generated voices count as "artificial or prerecorded", meaning conversational AI dialing cell phones needs the same prior express written consent as a traditional robocall. Manual calls, by contrast, are regulated differently — sellers may initiate non-automated calls without triggering the FCC lead generator restrictions.
Do I have to follow the strictest state law even if I'm calling from another state?
Yes — state law is now often the binding constraint, not the TCPA. At least a dozen states have passed stricter statutes since 2021, including Texas SB 140 with damages up to $5,000 per violation, and the rule is to calibrate to the recipient's actual location, not their area code, since area codes are portable.
Is buying leads still risky after the FCC changed the one-to-one consent rules?
The federal one-to-one consent rule was vacated in July 2025, but the direction survives — Florida still enforces one-to-one-style consent under state law, and legal analysts advise that prior express written consent remains the standard least likely to lose in court. That's why GrowthPros attaches a full consent trail — disclosure text, timestamp, IP address, and named contacting party — to every lead before delivery, so the compliance question is answered before the first call, not litigated after.

The Question That Actually Protects Your Outbound Program

So, is outbound calling cold calling? The honest answer: regulators don't care how well you know the prospect — they care about purpose, consent, technology, and relationship. A manual call to a stranger can be lawful; an automated text to a past customer can cost you $500 to $1,500 per violation, and TSR penalties exceed $53,000 per contact. With roughly 2,588 TCPA suits filed in 2025 and state laws like Texas SB 140 stacking damages on top, the winners build compliance before the dial, not after the lawsuit. That's why GrowthPros delivers every lead DNC-scrubbed with a full consent trail attached — disclosure text, timestamp, IP, and named contacting party — so the question is answered before your team picks up the phone. Your next step: audit your current outreach against the four factors, and if your lead source can't produce consent records on demand, book the free 15-minute qualification call. It's honest about fit and commits you to nothing.

This article is general information, not legal or financial advice. Benchmark figures are directional industry data, not guarantees of results.

Start

More booked calls. Not more form fills.

Tell us your niche and your goal. We will show you realistic volume, exclusivity options, and what follow-up looks like on a live call — no pressure, no 40-page deck.