The Compliance Reality: Why Cold Calling Has Become a Legal Minefield

The Supreme Court's 2021 ruling in Facebook v. Duguid narrowed the ATDS definition, but it didn't make cold calling safer — it shifted the battlefield. Plaintiffs and regulators pivoted hard to Do Not Call and artificial-voice claims, and the FCC has since classified AI-generated voices as artificial/prerecorded under the TCPA, requiring prior express written consent for telemarketing calls to wireless numbers. The stakes are no longer theoretical: TCPA judgments have exceeded $925 million in recent years, and the FCC can assess up to $16,000 per violation (rising to $26,000 for intentional ones).

Regulators are increasingly naming owners and executives personally in enforcement actions. Meanwhile, professional litigators deliberately engage with businesses to manufacture TCPA claims, turning compliance gaps into paydays. Known-litigator lists are now a standard scrubbing layer for any responsible operation. My AI Call Center bakes this reality into every campaign: lists are scrubbed against the National DNC Registry (every 31 days), wireless ported numbers (every 15 days), state DNC lists, the FCC Reassigned Numbers Database, and known-litigator databases before a single dial is placed.

• No prior express written consent for AI/ATDS/prerecorded calls to wireless numbers
• Number appears on the National DNC Registry or a state DNC list without a valid exemption
• Consumer has made a company-specific DNC request or revoked consent by any reasonable means
• Number has been reassigned and consent cannot be verified via the Reassigned Numbers Database
• Calls would fall outside the 8 a.m.–9 p.m. local-time window or violate state mini-TCPA rules

The burden of proving valid consent — or an Established Business Relationship — rests entirely on the caller. There is no good-faith exception for a mistaken belief that consent existed. About 100,000 phone numbers are reassigned daily in the U.S., and each one represents a fresh compliance risk. That's why My AI Call Center treats list discipline as a launch gate: if the consent records and scrub results don't support the campaign, we tell you plainly before you spend anything.

Eight Situations Where You Must Not Cold Call

Cold calling stops being a strategy and starts being a liability the moment you cross any of eight clear legal red lines. The FCC can assess up to $16,000 per violation — rising to $26,000 for intentional breaches — while private actions carry statutory damages of $500 to $1,500 per communication and the Telemarketing Sales Rule allows penalties up to $43,280 per call. These are not theoretical numbers; TCPA judgments have exceeded $925 million in recent years.

• The number appears on the National DNC Registry or a state DNC list without an applicable exemption — federal rules require scrubbing every 31 days, and wireless ported numbers every 15 days
• You lack prior express written consent for AI voice, ATDS, or prerecorded calls to wireless numbers; the FCC treats AI-generated voices as artificial voices under the TCPA
• The consumer has made a company-specific DNC request or revoked consent by any reasonable means — including a simple text saying they no longer wish to be called
• The number has been reassigned and you have not verified consent through the FCC Reassigned Numbers Database; roughly 100,000 numbers reassign daily with no good-faith exception for mistaken belief
• Calls fall outside the 8 a.m.–9 p.m. local time window, or state mini-TCPA laws in Florida, Maryland, Oklahoma, and other states impose stricter quiet hours, registration rules, or criminal penalties
• You are dialing from an unverified third-party list without confirming consent records and DNC scrubbing
• Caller ID is misleading or deceptive, which independently violates the Truth in Caller ID Act
• The call targets a state with expanded mini-TCPA requirements that go beyond the federal floor

My AI Call Center builds every campaign around these boundaries — list and consent review happens before a single dial, AI disclosure runs on every call, opt-outs are logged and honored immediately, and scrubbing intervals are treated as hard gates, not suggestions. We run campaigns only against approved, permissioned, or reviewed lists because the cost of getting it wrong is measured in six-figure exposure, not just blocked numbers.

The Consent Burden: What 'Permissioned' Actually Requires

Most cold callers believe a verbal "sure, give me a call" or a phone number on a contact form gives them permission to dial. Under the TCPA, it doesn't — and that misunderstanding is one of the most expensive mistakes in outbound calling.

The FCC's standard for telemarketing calls to wireless numbers using automated technology, prerecorded messages, or AI-generated voices is prior express written consent (PEWC). According to compliance guidance from PossibleNOW, "oral or implied consent is no longer sufficient" for marketing calls made with automated dialing technology to cell phones. Because the FCC treats AI voices as artificial voices under the TCPA, every AI-voiced telemarketing call to a wireless number needs a signed, documented agreement — not a checkbox someone might have ticked years ago.

The definition of "telemarketing" is also broader than most callers assume. The TCPA defines it as any call encouraging the purchase, rental, or investment in property, goods, or services, per the National Association of REALTORS®. Critically, dual-purpose calls — say, an appointment reminder that also pitches an upgrade — are treated as telemarketing under TCPA attorney guidance from M&S Law Group. If any part of the call promotes a sale, the PEWC standard applies to the whole call.

Then there's the burden of proof, and it sits entirely on the caller. Attorney Josh Stevens puts it bluntly: "Proving valid consent is the caller's requirement and there is no exception for a good faith, but ultimately mistaken, belief that the caller had received consent." With roughly 100,000 phone numbers reassigned daily in the U.S., yesterday's consenting customer may be today's stranger — and your honest mistake is still a violation carrying up to $1,500 per call in willful private actions.

The Established Business Relationship exemption offers a narrow alternative, but it comes with strict clocks and its own proof burden:

• 18 months from the last transaction (order, ship date, or payment)
• 3 months from the last inquiry
• PossibleNOW
• A company-specific DNC request overrides EBR — and even prior written consent
• State EBR rules may be stricter than the federal timeframes

Relying on EBR without documentation is a gamble. You need the invoice, the CRM timestamp, or the inquiry record in hand before the call — not reconstructed after a complaint arrives.

This is why list and consent review has to happen before a single dial. At My AI Call Center, every campaign starts with a review of list source, consent records, and calling windows, and bought lists without clear permission records are flagged — in most cases declined. If a list can't produce PEWC records or documented EBR evidence for wireless telemarketing, the honest answer is that the list won't support the campaign. Better to hear that before you spend anything than after the demand letter arrives.

Operational Safeguards That Keep Campaigns Compliant

Compliance failures rarely happen because a company ignored the law — they happen because a list sat unscrubbed for six weeks or one opt-out never made it across systems. The fix is operational: a set of pre-launch safeguards that run every time, before a single dial.

Scrub on a federal clock, not a convenient one. Federal rules require calling lists to be checked against the National DNC Registry at least every 31 days, and against wireless ported numbers every 15 days, according to compliance guidance from PossibleNOW. A list that was clean on day 32 is a liability, not an asset.

Reassigned numbers are the quieter risk. Roughly 100,000 phone numbers are reassigned every day in the U.S., and there is no good-faith exception — the caller bears the burden of proving consent from the current subscriber, per TCPA attorneys at M&S Law Group. Checking numbers against the FCC's Reassigned Numbers Database before launch is the only reliable defense.

Then there are the people who litigate for a living. Compliance vendors report that some individuals intentionally engage with businesses to manufacture TCPA claims, which is why known-litigator list suppression has become a standard scrubbing layer. With private-action damages reaching $1,500 per willful violation, one professional plaintiff on a list can cost more than the entire campaign.

Geography matters too. States like Florida, Maryland, and Oklahoma have enacted mini-TCPA laws stricter than the federal floor, some carrying criminal penalties. Geo-entity blocking — suppressing calls to entire states when a campaign can't meet those rules — is now a recognized compliance tool.

A compliant pre-launch checklist looks like this:

• DNC scrub within the 31-day (National) and 15-day (wireless ported) windows
• Reassigned Numbers Database verification against daily reassignments
• Known-litigator and professional-plaintiff list suppression
• Geo-entity blocking for mini-TCPA states the campaign can't satisfy
• Caller ID transparency — the Truth in Caller ID Act prohibits misleading caller ID displayed with intent to defraud or wrongfully obtain value

Opt-out handling closes the loop. Consent can be revoked at any time by any reasonable means — a verbal request, a text saying "I do not want to hear from you," or keywords like STOP and REVOKE. Those requests must be honored immediately, across every campaign, and company-specific DNC records retained for a minimum of five years.

This is the hygiene layer My AI Call Center enforces before anything dials. Every campaign passes through a list and consent review — source, permission records, calling windows — and bought lists without clear consent documentation are flagged and, in most cases, declined. If the list won't support the campaign, you hear that before you spend anything.

The math is simple. TCPA judgments have topped $925 million in recent years, and regulators increasingly pursue owners personally. Prevention is cheaper than cure — and it starts before the first call, not after the first complaint.

How to Evaluate Your List Before You Dial

A single bad list can turn a campaign into a liability before the first call connects. Federal rules require scrubbing against the National DNC Registry every 31 days and wireless ported numbers every 15 days, yet approximately 100,000 U.S. numbers are reassigned daily with no good-faith exception for the caller. My AI Call Center treats the "list and consent review" step as a hard gate — nothing launches until the data passes every check below.

• Verify consent records match the dialing method — AI voice calls to wireless numbers require prior express written consent for telemarketing, not oral or implied permission.
• Confirm DNC scrub timestamps for both the National Registry and every applicable state list; flag any gap beyond the mandated window.
• Document Established Business Relationship evidence with invoice dates, payment records, or CRM inquiry timestamps — the burden of proof sits with the business.
• Flag regulated-area contacts (healthcare, debt collection, financial services) for stricter review; state mini-TCPA laws can impose criminal penalties.
• Route every "not sure" answer to manual review before any spend occurs.

This discipline is not optional. The FCC can assess up to $16,000 per violation ($26,000 for intentional violations), private actions reach $1,500 per communication for willful conduct, and the TSR allows penalties up to $43,280 per call. A clean list is the cheapest insurance you can buy.