The Short Answer: Yes, But the Rules Have Shifted

TCPA does apply to outbound phone calls, but its application has changed significantly in recent years. The law governs calls using autodialers or prerecorded/AI voices to mobile numbers, though the Supreme Court’s 2021 Facebook v. Duguid decision narrowed the definition of an automatic telephone dialing system (ATDS) to equipment with random or sequential number generator capacity. This means many modern list-based dialers may not qualify as ATDS under federal law, shifting the compliance focus to consent requirements and state-level rules.

Under current federal TCPA rules, businesses need express written consent for marketing calls or texts to cell phones made using an ATDS or prerecorded/AI voice, while regular express consent may suffice for informational calls. As of April 11, 2025, the FCC requires opt-out or Do Not Call requests to be honored within 10 business days—down from the previous 30-day window. These baseline requirements carry real risk, with TCPA statutory damages ranging from $500 to $1,500 per violation and no aggregate cap, alongside a four-year statute of limitations.

For companies like CallMyLeads that use AI-powered voice technology to respond to leads, this creates a nuanced compliance landscape. While their systems may not trigger ATDS classification if they dial from predefined lists without random or sequential number generation, the use of AI voices still falls under the prerecorded voice rule and requires appropriate consent. Honoring opt-outs quickly and maintaining clear disclosures about AI use are not just best practices—they’re increasingly mandated by both federal timelines and evolving state laws that often impose stricter standards than the TCPA alone. Relying solely on federal compliance is no longer sufficient in this fragmented regulatory environment.

• TCPA lawsuits filed: ~2,588 between January-November 2025 (statistically flat vs prior year)
• As of April 11, 2025, businesses have 10 business days (down from 30) to honor opt-out or DNC requests
• TCPA statutory damages: $500 to $1,500 per call/text, no aggregate cap, 4-year statute of limitations

State Laws Are Now the Real Compliance Floor

If you're running outbound calls on the federal TCPA rulebook alone, you're following the loosest layer of the rules — and the riskiest. Since 2021, at least 12 states have enacted telemarketing statutes that go beyond federal standards, making federal law the floor, not the ceiling, as state-law analysis puts it.

The variations matter because they stack differently by state. Calling hours are the clearest example: federal rules allow calls from 8 AM to 9 PM, but Florida, Oklahoma, and Oregon cap at 8 PM, with Oregon's rule effective January 1, 2026. A call that's legal at 8:30 PM in Ohio could be a violation one state over.

Frequency limits create the same trap. Florida, Oklahoma, and Maryland each limit businesses to 3 calls per 24-hour period per consumer — a cap that doesn't exist at the federal level. Nurture sequences and repeat follow-up attempts, common in home services and real estate, need to respect these limits based on where the lead actually lives.

Opt-out rules are diverging too. Federal law requires honoring a do-not-call request for 5 years, but Virginia will require 10 years starting January 1, 2026. Meanwhile, the federal deadline to process opt-outs tightened to 10 business days as of April 2025, per compliance guidance — down from 30.

Then there's Texas. SB 140, effective September 1, 2025, expands "telephone solicitation" to cover texts and images, sets statutory damages up to $5,000 per violation, and adds treble damages plus mandatory attorney's fees under the state's Deceptive Trade Practices Act. Analysts expect other legislatures to copy this model next, and Pennsylvania's SB 992 — taking effect October 18, 2026 — signals the same direction, according to industry compliance tracking.

The practical takeaway for any business calling US consumers:

• Apply the strictest calling-hour rule for each contact's actual location, not a national average.
• Build frequency caps into follow-up workflows for states like Florida, Oklahoma, and Maryland.
• Honor opt-outs broadly and immediately, regardless of the minimum deadline.
• Treat Texas residents under the toughest standard and watch for copycat laws.

This is exactly why we built compliance into CallMyLeads rather than leaving it to clients to untangle — response rules, quiet hours, and automatic opt-out handling are set per contact, so fast follow-up never turns into a state-law violation. Speed wins jobs, but only when it stays inside the rules.

What Counts as an Autodialer — and What Doesn't

If you're dialing numbers from a CRM list, you might assume you're using an autodialer under the TCPA. After the Supreme Court's 2021 Facebook v. Duguid decision, that assumption is probably wrong — but the law still has teeth in places businesses often overlook.

The post-Duguid definition is narrow. The Court held that an automatic telephone dialing system (ATDS) is equipment with the capacity to use a random or sequential number generator (RoSNG) to store or produce phone numbers. As TCPA attorney Eric J. Troutman puts it, the ATDS definition covers systems that use a RoSNG "to either store or produce telephone numbers to dial" (ActiveProspect).

That means most modern dialing tools fall outside the definition. Systems that dial numbers in sequence from a CRM or a CSV file don't generate numbers randomly — they dial from a list you already built — so they typically don't qualify as autodialers under TCPA (CallHub).

Here's the catch: ATDS status isn't the only trigger for consent. The TCPA requires prior express consent for calls to mobile numbers made with an ATDS or with an artificial or prerecorded voice (CallHub). So even if your dialer isn't an ATDS, a prerecorded or AI voice calling cell phones still needs consent.

The FCC made that explicit for AI in February 2024, ruling that AI-generated voices are treated as prerecorded calls under the TCPA — same consent rules as traditional robocalls (MediaVaultPlus). For businesses using AI to respond to leads, this matters. CallMyLeads treats honest disclosure as a feature: callers always know they're talking to AI, and consent is collected explicitly during the booking flow.

The good news is there are safe-harbor scenarios where dialer use carries less risk:

• State or country laws don't mandate consent for cold calling in your market
• All the numbers you're calling are landlines, not mobile phones
• Every number on your list has confirmed consent on file

One more wrinkle: courts haven't fully settled the ATDS question. There's a split between courts requiring RoSNG functionality and those treating systems with automatic dialing capacity from a list as ATDS (ActiveProspect). And federal law is only the floor — at least 12 states have enacted telemarketing statutes since 2021 that exceed federal standards (MediaVaultPlus).

The practical takeaway: verify how your dialing technology works, get consent before any AI or prerecorded voice hits a cell phone, and calibrate to the strictest rule that applies to each contact based on where they actually live.

Consent, Disclosure, and Opt-Out Mechanics That Hold Up

Navigating TCPA compliance for outbound calls requires precision, as consent rules and opt-out mechanics vary significantly by use case and technology. Express written consent is mandatory for marketing calls or texts to cell phones when using an autodialing system (ATDS) or artificial/prerecorded voice, including AI-generated voices, per FCC guidance. For informational calls to mobile numbers, regular express consent may suffice, but businesses must still honor opt-out requests promptly. Landline calls face different limits: non-marketing prerecorded calls are allowed up to three per 30 days without consent, or three per week for healthcare-related purposes.

Opt-out honoring has accelerated under federal TCPA, with businesses now required to act within 10 business days of receiving a request—down from the previous 30-day window—as of April 11, 2025. A single confirmation message is permitted after a text opt-out, but it must be sent within five minutes, contain no marketing content, and be purely informational. Although the FCC’s "revoke-all" rule—which would allow one opt-out to apply across all communication channels—has been delayed to April 11, 2026, several states already mandate broader revocation honoring regardless of the federal timeline. The smarter compliance posture is to honor revocations broadly and quickly, treating every opt-out as a universal signal to cease contact, rather than waiting for deadlines or parsing message types.

For services like CallMyLeads, which uses AI to respond to leads via call, text, and booking flows, this means embedding clear, upfront disclosure that callers are speaking with an AI while ensuring opt-out requests trigger immediate, system-wide suppression. The platform’s design supports this by honoring opt-outs automatically and routing leads to human agents when requested, aligning with both the letter and spirit of TCPA’s evolving requirements. By prioritizing rapid, location-aware compliance—applying the strictest applicable rules based on the recipient’s actual location—businesses can reduce risk while maintaining responsive, trustworthy lead engagement.

Honoring opt-outs within 10 business days is now federal TCPA law, and express written consent is required for marketing calls to cell phones using ATDS or AI voices. These mechanics aren’t just legal checkboxes—they’re foundational to building trust in every outbound interaction.

• Express written consent required for marketing calls/texts to cell phones via ATDS or prerecorded/AI voice
• Regular express consent may suffice for informational calls to mobile numbers
• Up to three non-marketing prerecorded calls per 30 days to landlines allowed without consent (three per week for healthcare)

Implementation Checklist: Calibrate to the Strictest Rule

Federal TCPA rules set a baseline, but state laws have turned compliance into a location-based puzzle. A business that calibrates to the federal rulebook is now calibrating to the loosest, least certain layer of the stack. The workable approach is to apply the most restrictive rule that applies to each contact, by the recipient's actual location, rather than to a national average.

• Identify recipient location at dial time and apply that state's calling hours, frequency caps, and consent rules — federal allows 8 AM–9 PM, but Florida, Oklahoma, and Oregon cap at 8 PM
• Verify dialing technology classification — confirm no random or sequential number generator capacity if relying on non-ATDS status after Facebook v. Duguid
• Secure and document appropriate consent levels with timestamps and scope — express written consent for marketing to cell phones via ATDS or prerecorded voice
• Build opt-out workflows that honor requests within 10 business days across all channels — down from 30 days as of April 2025
• Monitor Texas, Florida, Oklahoma, Virginia, Pennsylvania, and other active states for legislative changes — Texas SB 140 enables up to $5,000 per violation plus treble damages and mandatory attorney's fees
• Use spam screening and consent-based routing to avoid billing for non-compliant calls

CallMyLeads bakes this framework into every outbound interaction. The system detects the lead's state at dial time and enforces the strictest applicable window — whether that's Florida's 8 PM cutoff or Oklahoma's three-call daily cap. Consent is captured explicitly during the booking flow with timestamps and scope recorded automatically. Opt-out requests trigger immediate suppression across all channels, well within the 10-business-day federal requirement and Virginia's 10-year honor period. Known spam numbers are screened before they ever reach your team, so you only pay for minutes handling real leads. When Pennsylvania's SB 992 takes effect in October 2026 with new caller ID and consent rules, the logic updates without you lifting a finger.