Do Not Call Compliance in 2026: A Rule Guide to Calls, Texts, Penalties and Consumer Rights

Ray is not a real client. He is a composite, drawn from the kinds of conversations we have with owners of HVAC, plumbing, dental, med spa and legal businesses who do their own outbound marketing. Change the industry and the details shift. The pattern stays the same.

Ray runs a twelve-truck heating and cooling company. Fall is his busiest season, so he bought a list of 4,000 local homeowner phone numbers and asked his newest salesperson to work it. She called from the office line during the day. In the evening, she loaded the same list into a texting tool and scheduled a tune-up offer for 8:30 the next morning.

Nobody had compared the list with the National Do Not Call Registry. Nobody had compared it with the short list of customers who had asked Ray's office to stop calling. The texts went out with no business name and no way to opt out. A few people replied STOP. The tool did not treat that as an opt-out, so the follow-up text went out three days later anyway.

Two weeks after that, a letter arrived from a lawyer representing a homeowner who had been on the national registry for nine years. The letter listed every call and every text by date and time.

Ray did not set out to break any rules. He set out to fill his schedule. That is exactly why this topic matters: most Do Not Call problems come from busy teams, borrowed lists and tools that were never set up to respect a person's choice.

Three things make 2026 a year to take this seriously.

Lawsuits are at a high. The Lex Machina 2026 Consumer Protection Litigation Report found that Telephone Consumer Protection Act (TCPA) filings rose from 1,682 cases in 2024 to 2,748 in 2025, with another 1,658 filed in the first half of 2026, according to a summary by Ginsburg Law Group. Most TCPA cases are filed as class actions, which is how a few calls to the wrong numbers can become a case about thousands of people.

The rules on opting out changed this fall. The Federal Communications Commission (FCC) adopted new consent revocation rules that take effect on November 25, 2026. Businesses that use automated calls or texts need to know what changed and what did not. We explain it below.

States are moving faster than Washington. Texas now treats marketing texts as telephone solicitations with a private right of action, and Pennsylvania's amended telemarketing law took effect on October 18, 2026 with tighter calling hours, a Sunday ban and express coverage of texts. If you contact customers in more than one state, federal compliance is the minimum, not the finish line.

Here are the rules that apply to most small businesses making sales calls or sending marketing texts in the United States. Treat this as a summary, not legal advice.

1. Check the National Do Not Call Registry before every campaign

Under the FTC's Telemarketing Sales Rule, sellers and telemarketers may not make sales calls to a number on the National Do Not Call Registry unless they have the person's express written agreement or an established business relationship that the person has not ended. The FCC's rule says registrations must be honored indefinitely until the consumer cancels or the number is removed.

The list you use must be fresh. To claim the safe harbor for an honest mistake, you must use a version of the registry obtained no more than 31 days before the call, and keep records showing you did it. A list cleaned on the first day of a 60-day campaign has to be cleaned again before you call on day 32.

2. Keep your own internal Do Not Call list

The national registry is only half of it. If anyone asks your business not to call them, you must record that request and add the number to your own internal list when the request is made. The FCC rule requires you to honor it within a reasonable time not exceeding 10 business days and to keep honoring it for 5 years. You also need a written Do Not Call policy available on request, and staff trained to use it.

If a vendor or call center keeps the list for you, the business on whose behalf the calls are made is still liable when a request is missed.

3. Respect calling hours

Federal rules prohibit telephone solicitations to residential subscribers before 8 a.m. or after 9 p.m. in the called person's local time. Several states are stricter. Pennsylvania now allows solicitations only between 9 a.m. and 7 p.m. and bans them on Sundays and legal holidays, according to Greenspoon Marder's summary of the amended law. Always schedule by the recipient's time zone, not your office's.

4. Identify yourself every time

A telemarketing call must give the name of the individual caller, the business on whose behalf the call is made, and a phone number or address where the business can be reached. Marketing texts should do the same in plain words, with the opt-out method stated clearly.

5. Get written consent before automated or AI voice marketing

Calls or texts that include an advertisement or telemarketing and use an automatic dialing system, a prerecorded voice or an artificial voice need the person's prior express written consent. That is a signed agreement (an electronic signature counts) that names the phone number, clearly authorizes marketing calls of that kind, and tells the person that agreeing is not a condition of buying anything.

This includes AI. In February 2024 the FCC confirmed that the TCPA's restrictions on artificial or prerecorded voices cover AI technologies that generate human voices, including voice cloning. An outbound AI voice agent selling your services needs the same consent as a prerecorded robocall.

6. Do not share or resell consent

A person who agreed to hear from your business agreed to hear from your business. They did not agree to hear from every company that bought a lead list. Consent captured on one website does not transfer to a different seller.

The penalties are the reason this topic keeps owners up at night. Each call or text can be its own violation.

• FTC civil penalties: Under the Telemarketing Sales Rule, calling a number on the national registry, or calling someone who asked you not to, can bring a civil penalty of up to $53,088 per violation. The FTC announced that it will keep the 2025 penalty levels for 2026 because the usual inflation adjustment was cancelled.
• TCPA private lawsuits: Consumers can recover $500 per violation for unlawful autodialed or prerecorded calls, and up to three times that amount for willful or knowing violations. A person on the national registry who receives more than one telemarketing call from the same company within 12 months may have a separate claim, as Ginsburg Law Group explains.
• Texas: Statutory penalties in private actions can reach $1,500 per violation, and the Texas attorney general can seek $5,000 per violation, according to Morgan Lewis.
• Pennsylvania: Civil penalties of up to $1,000 per willful violation, rising to $3,000 when the person contacted is 60 or older, according to Privacy World.
• Marketing email: The CAN-SPAM Act makes each separate email in violation subject to penalties of up to $53,088, and it makes no exception for business-to-business email.

Large companies are not immune. Sirius XM paid $28 million into a settlement fund to resolve claims that it called consumers on national, state or internal Do Not Call lists, and the court entered final approval on July 6, 2026.

Compliance itself is affordable by comparison. For fiscal year 2027, the FTC charges $85 per area code to access registry data, the first five area codes are free, and nationwide access is capped at $23,425. Many local businesses need only a handful of area codes.

Behind every rule in this guide is a person who answered a phone while cooking dinner, driving or caring for a child. The National Do Not Call Registry exists because people asked for a simple way to say "not interested, please stop." The FTC's consumer guidance explains that the registry does not block calls; it tells legitimate businesses which numbers not to call. The registry only works if businesses choose to respect it.

That is a business decision as much as a legal one. A person who asks to stop and is left alone may still call you next spring when the furnace fails. A person who asks to stop and is contacted again becomes a complaint, a one-star review or a plaintiff.

What respecting the wish looks like in practice

• Stop means stop, the first time. When someone says "don't call me again," your caller says one sentence: "Understood, I've added your number to our Do Not Call list. Have a good day." No rebuttal, no "can I just ask one question."
• Honor the words people actually use. For texts, treat STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE as opt-outs. The FCC's new rule lists those words, and Pennsylvania's amended law now requires sellers to honor them.
• Do not make opting out hard. The Telemarketing Sales Rule treats denying or interfering with a person's right to be placed on a do-not-call list, including harassing someone who makes the request, as an abusive practice.
• Apply it everywhere. An opt-out given to your receptionist, your chat widget, your text line or your sales rep is one request. Your systems should share one record of who opted out and when.
• Keep the record. Write down the date, time, channel and number for every opt-out. That record protects the customer, and it protects you.

The FCC's new consent revocation rules have caused confusion, so here is the plain version, drawn from the CommLaw Group summary and Brownstein's summary.

• You may designate how people opt out. A business can name one or more official methods: an automated key-press option on a call, a reply of a standard keyword such as STOP to a text, or a designated website or phone number. The method must be disclosed clearly and conspicuously on each call or text.
• If you do not designate a method, any reasonable request counts. Businesses that skip the disclosure must still process opt-outs made by any reasonable means, such as a reply that says "please stop texting me."
• The narrower scope applies to informational messages only. A person who opts out of appointment reminders may still receive other categories of informational messages. Marketing is different: revoking consent for marketing still applies to all of your marketing calls and texts.
• The deadline did not change. Opt-outs must still be honored within 10 business days, and the FCC is asking whether that window should be shorter.

Our practical advice: even where the law allows a narrow reading, treat a clear "stop" as a stop for all marketing from your business. It is simpler to run and kinder to the customer.

Federal law is the floor. Two recent examples show how far states can go.

Texas. Senate Bill 140, effective September 1, 2025, expanded the definition of telephone solicitation to include text and image messages and gave consumers a private right of action under the Texas Deceptive Trade Practices Act. Businesses making non-exempt telephone solicitations generally must register with the Texas Secretary of State. The state has since confirmed that businesses sending texts with the consumer's prior consent do not need to complete that registration statement. Cold outreach is a different story.

Pennsylvania. As of October 18, 2026, Pennsylvania's Telemarketer Registration Act covers calls, voicemails, ringless voicemails and texts. It narrows calling hours to 9 a.m. through 7 p.m., bans Sunday solicitations, requires written consent for robocalls, and reaches anyone who initiates "or causes to be initiated" a solicitation, which can include the business that hires a calling vendor, as Privacy World notes.

Other states, including Florida and Oklahoma, have their own telemarketing statutes. Before a campaign reaches a new state, check its calling hours, registration rules, state Do Not Call list and consent standard.

"We only call businesses, so the rules don't apply." Business-to-business calls to real business lines are treated differently under parts of the federal rules, but many owners list a personal cell phone as their business number, and purchased "business" lists often contain them. Email has no business exception at all under CAN-SPAM. If you cannot tell what kind of line it is, treat it as a consumer line.

"Courts said texts are not covered." Some federal courts, including the Seventh Circuit in Steidinger v. Blackstone Medical Services, have held that the TCPA's private Do Not Call lawsuit provision does not reach text messages. Other courts disagree, the FCC's rules still apply to texts, and states like Texas and Pennsylvania cover texts expressly. Building a texting program around a court split is a gamble you do not need to take.

"The lead vendor said the list was compliant." You are still the seller. If calls are made on your behalf, the liability can land on you. Ask for consent records that name your business, the phone number, the date and the exact wording the person agreed to.

"We'll fix it if someone complains." The safe harbor only protects businesses that already had written procedures, training, an internal list, a 31-day registry process and monitoring in place before the call, as the Telemarketing Sales Rule spells out. It cannot be assembled after a demand letter arrives.

Use this list before your next calling or texting campaign.

• Written policy: a short Do Not Call policy that says who owns compliance, how requests are recorded and how quickly they are honored.
• Training: every person who calls or texts for you has read the policy and practiced the one-sentence opt-out response.
• Registry access: an active subscription to the area codes you call, with a scrub against the registry no more than 31 days before each call.
• Internal list: one shared suppression list across your phone system, CRM, texting tool and email platform, kept for at least 5 years.
• Consent records: for automated, prerecorded or AI voice marketing and for marketing texts, a signed consent record that names the phone number and your business.
• Calling windows: sending and dialing limited to 8 a.m. to 9 p.m. in the recipient's time zone, or the stricter state window where it applies.
• Identification: every call and text names your business and gives a way to reach you and to opt out.
• State check: a list of the states you contact and their extra rules, reviewed at least once a year.
• Vendor review: written terms with any calling or texting vendor covering consent, suppression and who is responsible for each step.
• Monitoring: a monthly spot check of opt-outs, complaints and campaign logs, with fixes recorded.

Back to Ray. After his lawyer handled the letter, Ray asked a better question than "how do we avoid getting caught." He asked, "how do we make it hard for my team to make this mistake at all?"

That is the work VKTIS does. We are not a law firm, so legal decisions go to your attorney. What we build is the system that makes the right choice the easy one:

• Suppression that syncs. A Do Not Call flag set in your CRM, on a call or by a STOP reply reaches every tool that can contact that person, so one request stops everything.
• Quiet-hour sending windows. Campaigns send only in the recipient's local window, with stricter state windows applied automatically where we can identify the state.
• Consent capture with a paper trail. Website and intake forms record the exact consent wording, the phone number, the time and the page, and store it where you can find it later. See how this connects to our compliance commitments and our missed-call text-back service.
• AI voice with guardrails. Our AI receptionist work focuses on answering inbound calls. Any outbound automated or AI voice use is designed around documented consent, identification and an opt-out on every call.
• Documentation you own. At handover you receive your written policy draft, a map of where opt-outs are recorded and a monthly checklist, ready for your attorney to review.

If you want to see how this fits with privacy and data security more broadly, read our guide to compliant AI automation.

Do Not Call compliance is not about memorizing statutes. It is about three habits: check the list before you contact anyone, get and keep real consent before you automate, and honor every request to stop, quickly and everywhere. The rules are getting stricter, the penalties are counted per call and per text, and the lawsuits are not slowing down.

The good news is that the habits that keep you compliant are the same habits that earn trust. People remember the businesses that respected their time. If you would like help building those habits into your phones, CRM and texting tools, book a free intro call and we will walk through your current setup with you.

This article is general information, not legal advice. Telemarketing rules vary by state and change often, so confirm your specific situation with a qualified attorney.