TCPA Compliance Checklist for Outbound Call Centers in 2026

A TCPA compliance checklist is a documented set of controls an outbound call center follows to stay within the US Telephone Consumer Protection Act when it dials or texts consumers. Get it wrong and the cost is real: the TCPA allows private lawsuits with statutory damages per call, and the numbers add up fast across a dialing campaign. This checklist walks through what a compliant US outbound operation needs in place in 2026, item by item.

One note before the list. This guide is general information, not legal advice, and TCPA rules change through FCC action and court decisions. Treat it as a starting map, confirm the current detail with the regulators cited and with qualified counsel, and remember that the obligation to comply sits with the business making the calls, not with any software it uses.

Key points at a glance

• The TCPA is US federal law, enforced by the FCC, with the FTC’s Telemarketing Sales Rule adding further duties.
• Core requirements include consent, do-not-call screening, permitted calling hours, caller identification, and honoring opt-outs.
• AI-generated voices now fall under the TCPA, and caller ID authentication rules apply to outbound calls.
• Penalties run per violation, so a single non-compliant campaign can carry serious financial risk.

What is TCPA compliance?

TCPA compliance means following the Telephone Consumer Protection Act, the US law that governs telemarketing calls, autodialed calls, prerecorded messages, and texts to consumers. Enforced by the Federal Communications Commission, it is designed to protect people from unwanted calls, and it gives consumers the right to sue over violations. Alongside it, the FTC’s Telemarketing Sales Rule adds disclosure, timing, and do-not-call duties for many telemarketers.

The important point for an outbound team is that the TCPA applies to how you contact people, and it follows the person being called. If you dial US consumers, US rules apply regardless of where your center sits. That makes TCPA a live concern for any operation, onshore or offshore, running outbound campaigns into the United States.

Who must comply and who enforces it

Any business that makes telemarketing or autodialed calls and texts to US consumers must comply with the TCPA, and both regulators and private individuals can act. The FCC enforces the TCPA and can impose penalties; the FTC enforces the Telemarketing Sales Rule; and state attorneys general have their own powers. Crucially, the TCPA also gives consumers a private right of action, so individuals and class actions drive much of the litigation.

That combination, regulators plus private lawsuits, is what makes TCPA risk unusually sharp. A single mistake repeated across a calling list becomes many violations, and plaintiffs’ attorneys actively pursue them. Compliance is not just about avoiding a regulator; it is about not becoming a class action.

The TCPA compliance checklist

The items below cover the controls a compliant US outbound operation needs. Treat them as a set, since a gap in one can undo the rest.

The table summarizes the checklist for quick reference; each item is explained below.

1. Obtain and document consent

Autodialed or prerecorded telemarketing calls and texts to consumers generally require prior express written consent, and other calls require at least prior express consent. Whatever the standard for your campaign, capture consent clearly, keep a record of when and how it was given, and be able to produce it. In TCPA litigation, the burden of proving consent falls on the caller, so undocumented consent is effectively no consent.

2. Scrub against the National Do Not Call Registry

Telemarketers must check numbers against the National Do Not Call Registry and refrain from calling registered numbers without an applicable exception. Scrub your lists on a regular schedule, since the registry changes, and keep evidence of when you scrubbed. Relying on a stale scrub is a common and avoidable violation.

3. Maintain an internal do-not-call list

Beyond the national registry, you must keep your own company-specific do-not-call list and honor any request from a consumer not to be called again, promptly and permanently. Add opt-outs immediately, apply them across campaigns, and never let a number that asked to stop reappear on a dialing list.

4. Call only within permitted hours

The FTC’s rule restricts telemarketing calls to between 8 a.m. and 9 p.m. in the called person’s local time zone. For a center calling across US time zones, that means the permitted window moves with the recipient, so your dialer must respect the customer’s local time, not your own. Getting this wrong is easy when a list spans coasts.

5. Identify yourself and your company

Callers must promptly state who is calling and provide the name and contact details of the business on whose behalf the call is made. Scripts should open with a clear identification, and agents should be able to give a callback number and address on request. Anonymous or vague openings breach the rules and erode trust at the same time.

6. Follow the rules for autodialers and prerecorded voice

Automated dialing technology and prerecorded messages carry heightened consent requirements under the TCPA. Know which dialing mode a campaign uses and whether it triggers those requirements, and make sure your consent matches the technology. Voiso’s overview of whether predictive dialers are legal is useful background here, though it is not a substitute for legal review of your specific setup.

7. Treat AI-generated voices as regulated

In February 2024, the FCC ruled that AI-generated voices are “artificial” under the TCPA, meaning calls using them require the same prior express consent as other artificial or prerecorded voice calls. If any campaign uses a synthetic or cloned voice, it falls squarely under these rules, and the same consent and disclosure duties apply.

8. Meet caller ID authentication rules

Under the TRACED Act, the FCC requires voice providers to use STIR/SHAKEN caller ID authentication to combat spoofing, and outbound operations need caller IDs that are accurate and properly attested. Transmit a valid, reachable number that identifies you, and avoid anything that looks like spoofing, which is both illegal and a fast way to get your numbers flagged as spam.

9. Check the Reassigned Numbers Database

Phone numbers get reassigned, and calling a number that once consented but now belongs to someone else is a common source of violations. Checking the FCC’s Reassigned Numbers Database before dialing helps confirm a number has not changed hands since consent was given, and it provides a defense if used correctly.

10. Honor opt-outs immediately

When a consumer asks to stop, on a call, by text reply, or otherwise, honor it right away and across every channel and campaign. Build opt-out handling into your workflow so a request is captured, applied, and never overridden. Continuing to contact someone who opted out is among the clearest and most litigated violations.

11. Respect state telemarketing laws

Several US states have their own telemarketing statutes that go beyond the federal TCPA, with stricter consent, timing, or registration rules. A campaign compliant with federal law can still breach a state one, so check the rules for each state you call into and adjust accordingly. State laws are also where much recent activity has concentrated.

12. Follow call recording consent rules

If you record calls, recording consent is set at the state level and varies: some states require all parties to consent, others one party. For a multi-state operation, announcing the recording at the start of the call is the safe default. Voiso’s contact center recording supports the capture; the duty to disclose and obtain consent stays with you.

13. Keep records and an audit trail

Underpinning every item above is documentation. Log consent, scrub dates, opt-outs, call times, and scripts, so you can demonstrate compliance if challenged. In TCPA disputes, the operation that can produce a clean audit trail is in a far stronger position than one relying on memory.

Common TCPA compliance mistakes

Even careful operations trip over a handful of recurring errors. Knowing them helps you audit your own program.

The most common is relying on stale or undocumented consent, where a business believes it has permission it cannot actually prove. Close behind is time-zone error, dialing a number in its own local morning that is still before 8 a.m. where the recipient sits. Others include failing to sync opt-outs across systems, so a customer who unsubscribes from texts still gets calls; scrubbing the do-not-call registry too infrequently; and calling reassigned numbers whose original owner consented but current owner did not. A subtler trap is assuming federal compliance covers everything, when a state law imposes stricter rules. Each of these is avoidable with the right controls and a periodic audit, and each is a frequent basis for litigation.

How to build a TCPA compliance program

A checklist is the what; a program is the how, and turning the items above into a durable program takes a few intentional steps. The goal is compliance that holds up under growth and scrutiny, not a one-time effort.

1. Assign ownership. Name someone accountable for TCPA compliance, so it is not everyone’s job and therefore no one’s.
2. Document your policies. Write down how you obtain consent, scrub lists, handle opt-outs, and record calls, and keep the documentation current.
3. Build controls into the tools. Configure dialer settings, suppression lists, and time-zone rules so compliance is enforced by the system, not left to memory.
4. Train agents. Make sure the people on the calls understand identification, opt-outs, and disclosures, and refresh the training regularly.
5. Audit and record. Review campaigns against the checklist, keep the audit trail, and fix gaps before they become claims.
6. Review the law periodically. TCPA and state rules change, so schedule a legal review rather than assuming last year’s setup still holds.

Built this way, compliance becomes part of how outbound runs rather than a scramble after a complaint, and the audit trail it produces is itself the best protection if a claim ever arrives.

TCPA penalties and why they add up

TCPA penalties are assessed per violation, which is what makes them dangerous for a high-volume dialer. The statute provides for damages of $500 for each negligent violation and up to $1,500 for each willful or knowing one, and because every non-compliant call or text is a separate violation, a single flawed campaign can reach into the millions across a large list.

That per-call structure is why TCPA is a favorite of class action attorneys. A modest error, calling a few thousand numbers without valid consent, multiplies into a claim no business wants to defend. The FTC’s Telemarketing Sales Rule carries its own separate penalties, which adjust for inflation, on top of TCPA exposure. The practical lesson is that prevention is far cheaper than defense. Beyond the direct damages, a TCPA claim carries legal costs, management time, and reputational harm, none of which show up in the statutory figure but all of which land on the business. For a high-volume outbound operation, a single unchecked list can turn a profitable campaign into a net loss once a claim is settled, which is why treating compliance as a cost of doing business, rather than an optional extra, is simply sound economics.

TCPA, AI voice, and caller ID in 2026

Two developments shape TCPA compliance in 2026. The first is the FCC’s treatment of AI-generated voices as artificial under the TCPA, which closed any notion that a synthetic voice sidesteps robocall rules. Any AI calling into US consumers needs the consent those rules demand, a point that matters as more outbound teams pilot AI voice agents.

The second is the continued rollout of STIR/SHAKEN caller ID authentication under the TRACED Act, aimed at spoofing. For legitimate outbound teams, the practical effect is that caller ID reputation and proper attestation now directly affect whether calls connect at all, since poorly authenticated or spam-flagged numbers get blocked or labeled. Compliance and answer rates have become the same conversation.

State telemarketing laws to watch

Federal TCPA compliance is the floor, not the ceiling, because a growing number of states layer their own rules on top. Some require additional consent, tighter calling windows, or registration, and several have created their own private rights of action that mirror the TCPA at the state level. A center calling nationally is, in effect, complying with many rulebooks at once.

The safest approach is to treat the strictest applicable rule as your standard for a given contact, and to track state developments actively, since this is where much of the recent change has happened. What was compliant last year may not be this year, so a periodic legal review by state is part of running outbound at scale. Several states have drawn particular attention for their so-called mini-TCPA statutes, which add consent and timing rules and their own private rights of action, and the list of active states keeps growing. If a meaningful share of your calls goes to one state, its rules deserve specific attention rather than a blanket federal approach.

How technology supports TCPA compliance

No software can make an operation TCPA-compliant on its own, since compliance is a matter of process, consent, and policy. What the right platform can do is provide the controls that make compliance practical to enforce at scale. Voiso positions itself as that supporting layer, not as a compliance guarantor.

On the tooling side, outbound call center software gives a team dialer controls, while call suppression helps enforce do-not-call and call-frequency limits, and local caller ID supports accurate, non-deceptive number presentation. Recording features support consent capture, and reporting supports the audit trail. Voiso also notes that regulated industries complete a country-by-country compliance procedure before going live, and it sets out its own posture on the Trust and Compliance Center. The platform supplies the levers; the operator sets the policy and remains responsible for meeting the law. That division is worth stating plainly, because no vendor can promise TCPA compliance on your behalf: consent lives in your sales process, your policies define how lists are handled, and your training shapes what agents actually say. Good tooling makes all of that easier to enforce consistently, but it cannot substitute for the judgment and accountability that compliance ultimately requires. Voiso’s guide to outbound calling best practices connects the compliance and conversion sides.

Frequently asked questions

What is a TCPA compliance checklist?

A TCPA compliance checklist is a documented set of controls an outbound call center uses to stay within the US Telephone Consumer Protection Act. It typically covers documenting consent, scrubbing the National Do Not Call Registry, keeping an internal do-not-call list, calling only within permitted hours, identifying the caller, following autodialer and AI-voice rules, meeting caller ID rules, honoring opt-outs, and keeping records. The checklist turns a complex law into repeatable operational steps, though it does not replace legal advice.

What are the TCPA calling time restrictions?

Under the FTC’s Telemarketing Sales Rule, telemarketing calls are restricted to between 8 a.m. and 9 p.m. in the called person’s local time zone. For a call center dialing across the United States, this means the permitted window shifts with each recipient, so a dialer must use the customer’s local time rather than the center’s. Calling outside these hours is a violation, and it is an easy mistake when a contact list spans multiple time zones, which is why time-zone-aware dialing is a core compliance control.

What are the penalties for TCPA violations?

The TCPA provides for statutory damages of $500 for each negligent violation and up to $1,500 for each willful or knowing violation. Because every non-compliant call or text counts as a separate violation, penalties scale with the size of a campaign and can reach millions of dollars across a large list. The TCPA also allows consumers a private right of action, which fuels class-action litigation. The FTC’s Telemarketing Sales Rule carries its own separate, inflation-adjusted penalties on top of TCPA exposure.

Does the TCPA apply to AI-generated voice calls?

Yes. In February 2024, the FCC ruled that calls using AI-generated voices are “artificial” under the TCPA, so they require the same prior express consent as other artificial or prerecorded voice calls. This means an outbound team using a synthetic or cloned voice to call US consumers must meet the TCPA’s consent and disclosure requirements. AI does not create an exemption; it falls inside existing robocall law. Operators piloting AI voice agents for outbound should build consent and disclosure in from the start.

Is a call center outside the US subject to the TCPA?

Yes, if it calls US consumers. The TCPA follows the person being contacted, so an offshore or nearshore center dialing into the United States must comply with US rules regardless of where it operates. This catches out BPOs and operations that assume local law is enough. Any campaign targeting US phone numbers should be built to the TCPA and the relevant state laws, with consent, do-not-call screening, permitted hours, and the other controls in place, exactly as a US-based center would.

Run compliant outbound campaigns with the right controls

TCPA compliance is not a one-time task; it is a set of controls you enforce on every campaign, backed by clean records. Voiso gives outbound teams the dialer controls, call suppression, caller ID, and recording that make those controls practical to run at scale, while the policy and legal responsibility stay with you. To see how Voiso supports compliant outbound calling across your campaigns and the markets you dial into, book a demo with the Voiso team, or start a free trial and build your controls in from the first call.