Call center laws and regulations in 2026: A practical compliance guide
TL;DR
- In 2026, the biggest U.S. call center regulations issues are still the TCPA, FCC revocation-of-consent rules, the FTC’s Telemarketing Sales Rule, National Do Not Call rules, and data privacy/security laws that affect how call centers collect, use, and protect consumer data.
- The FCC’s 2024 one-to-one consent rule is gone: It was postponed in January 2025 and then formally removed in July 2025 after the Eleventh Circuit struck it down.
- The FCC’s revocation rules are partly in force, but the broad rule that would require a single revocation to stop all robocalls and robotexts from the same sender has been delayed again until January 31, 2027.
- The FTC’s TSR still matters for many outbound programs: It limits calling hours to 8 a.m.–9 p.m. local time, restricts abandoned calls, prohibits most calls to numbers on the National Do Not Call Registry, and now requires broader five-year recordkeeping in several areas after the FTC’s 2024 amendments.
- A major new issue to watch is the FCC’s March 2026 proposal on offshore call centers. It is only a proposal for now, but it would seek comment on English proficiency, caps on offshore customer-service handling, customer disclosure when calls are handled abroad, and anti-robocall measures tied to foreign call centers.
Overview
This guide is for call center managers, operations leaders, QA leaders, and compliance officers at U.S.-based businesses that run or oversee inbound and outbound calling. If you are responsible for helping keep agents, dialers, scripts, vendors, and lead sources compliant, this is for you.
Why this matters: Call center compliance is no longer just about “don’t call too early” or “scrub DNC.” In 2026, call center laws and regulations span consent, revocation, prerecorded and autodialed outreach, recordkeeping, call abandonment, caller ID, data privacy rights, and security obligations. Violations can create litigation risk under the TCPA, regulatory exposure under the FTC Act and TSR, and privacy/security liability under state and sector-specific laws.
For call centers, being compliant is crucial for three reasons. First, it protects the business from fines, lawsuits, and operational disruption. Second, it protects vendor and brand relationships. Third, it protects performance: Contact strategies built on valid consent, accurate DNC handling, and clean data tend to create healthier connection rates and fewer downstream complaints.
That makes compliance an operational discipline, not just a legal review step.
What call center regulations are
Call center regulations are the federal, state, and sector-specific rules that govern how contact centers communicate with people and how they handle the data collected in those interactions.
In practice, they affect:
- When you can call
- Who you can call
- What consent you need
- How consumers can revoke consent
- How fast you must honor do-not-call requests
- Whether prerecorded calls or texts are allowed
- What records you must keep
- How you protect personal information
- How third-party vendors and offshore operations are managed
For most U.S. businesses, the main regulatory buckets are:
- FCC call center regulations under the TCPA
- FTC telemarketing rules under the TSR and National Do Not Call framework
- State telemarketing laws
- Data privacy/security laws like California’s CCPA and, for insurance and some financial operations, GLBA and the FTC Safeguards Rule
The main call center rules and regulations to watch in 2026
Here is a practical compliance map for 2026.
| Regulation area | Main regulator | What it covers | 2026 watchpoint | Why call centers care |
| TCPA | FCC / private litigation | Robocalls, robotexts, consent, calling times, prerecorded/artificial voice rules | One-to-one consent rule is gone; revocation rules remain important | Determines whether calls/texts can be made lawfully |
| Revocation of consent | FCC | How consumers can revoke consent and when callers must stop | Broad “stop all from same sender” rule delayed to Jan. 31, 2027 | Affects opt-out handling, texting logic, and suppression controls |
| Offshore/onshoring proposal | FCC | Proposed limits and disclosures for offshore call centers | March 2026 NPRM only; not final yet | Could reshape offshore staffing, scripts, disclosures, and vendor requirements |
| TSR | FTC | Calling times, disclosures, misrepresentations, abandonment, prerecorded sales calls, recordkeeping | 2024 amendments expand recordkeeping and B2B protections in some contexts | Core rulebook for many outbound sales programs |
| National Do Not Call | FTC | Registry scrubbing and entity-specific DNC | Still a major enforcement risk area in 2026 | Requires list hygiene, vendor controls, and proof of suppression |
| Data privacy and security | State AGs / FTC / sector regulators | Consumer rights, notices, opt-outs, safeguarding personal data | More state privacy enforcement and continuing Safeguards Rule obligations | Affects recordings, lead intake, vendor contracts, retention, and security controls |
FCC call center regulations in detail
TCPA
The TCPA remains the centerpiece of federal FCC call center regulations for autodialed or prerecorded calls and texts. The statute restricts robocalls and robotexts absent the required consent or an exemption, and telemarketing calls are generally limited to certain calling hours.
Consumers can sue and seek up to $500 per violation, or up to $1,500 per violation for willful or knowing misconduct.
A key 2026 point: The FCC’s one-to-one consent rule is no longer moving forward. The FCC postponed its effective date in January 2025 pending judicial review, and after the court decision the Commission formally removed the nullified rule in July 2025. That means your 2026 TCPA program should not be built around a one-to-one rule that no longer exists, but it still should be built around valid consent, honest seller identification, and strong documentation.
Operational takeaway: Keep your TCPA program focused on three basics:
- Know whether your calls/texts require consent
- Know what proof you have
- Know how quickly you can suppress a consumer after an opt-out or complaint
Revocation of consent
The FCC’s revocation rules are one of the most important current changes for call centers. The FCC said consumers can revoke consent by any reasonable method, and once consent is revoked, the caller may not continue making robocalls or sending robotexts absent an exemption. The FCC announced an April 11, 2025 effective date for those rules.
But there is an important nuance for 2026. The broad requirement, which would make revocation definitively stop additional robocalls and robotexts from the same sender using any reasonable method, was first delayed to April 11, 2026 and then delayed again by FCC order to January 31, 2027.
Operational takeaway: Do not use the extension as an excuse to wait. The safer 2026 play is to behave as though revocations should be honored broadly and fast anyway. Put in place:
- Universal stop-word handling for texts
- Centralized suppression shared across vendors and lines of business where appropriate
- Agent scripting that records revocation clearly
- QA checks to confirm no post-opt-out calls or texts slip through
The FCC’s 2026 offshore/onshoring proposal
In March 2026, the FCC released a Notice of Proposed Rulemaking (NPRM) that seeks comment on ways to encourage onshoring of call centers, improve customer service and communications security, and address illegal robocall scams originating in foreign call centers.
Among the ideas listed in the FCC summary: Requiring providers and affiliates to ensure call center staff are proficient in American Standard English, limiting the percentage of customer service calls made from or answered at offshore call centers, and informing customers when a call is being handled outside the United States.
This is only a proposal, not binding law yet. But for any U.S.-based business using offshore inbound or outbound operations, it is a serious 2026 watch item.
Operational takeaway: If you use offshore vendors, start now with a gap assessment:
- Which programs are handled offshore?
- Where would you be forced to disclose offshore handling if rules change?
- What service levels, language standards, fraud controls, and audit rights are in your contracts?
- How quickly could you rebalance work onshore if the FCC moves from proposal to final rule?
FTC call center regulations in detail
Telemarketing Sales Rule (TSR)
The FTC’s TSR is still a major part of federal call center laws and regulations. The FTC explains that the rule requires specific disclosures, prohibits misrepresentations, limits calling times, requires caller ID transmission, prohibits abandoned outbound calls subject to a safe harbor, and prohibits most outbound prerecorded sales calls without the required written agreement and interactive opt-out. It also sets recordkeeping obligations.
The TSR generally limits outbound telemarketing calls to a person’s home to 8 a.m. to 9 p.m. local time unless the person previously consented otherwise. It also defines an “abandoned” call as one where a person answers and the telemarketer does not connect the call to a sales representative within two seconds of the completed greeting.
The FTC’s 2024 TSR amendments also expanded recordkeeping in several areas, including five-year retention for certain entity-specific DNC and registry-related records.
Operational takeaway: For outbound sales teams, the safest baseline is:
- Apply 8 a.m.–9 p.m. local time controls
- Enforce low abandonment
- Ensure seller identity and required disclosures are prompt and clear
- Store DNC and consent records in an audit-ready format for years, not weeks
National Do Not Call (DNC)
The FTC’s DNC rules prohibit calls to numbers on the National Do Not Call Registry and also require honoring entity-specific do-not-call requests. The FTC notes that a consumer whose number is not on the national registry can still prohibit individual telemarketers from calling by asking to be put on the company’s own do-not-call list. The FTC also explains that a consumer inquiry or application can create a limited three-month window for calls, absent a do-not-call request.
Operational takeaway: Call centers need two DNC systems, not one:
- National registry scrubbing
- Internal entity-specific suppression that takes effect fast and survives vendor handoffs
Rules and compliance best practices for call center agents
These are the most practical rules and regulations for call center agents to operationalize in 2026:
1. Treat consent as a live status, not a one-time checkbox
Before calling or texting, agents and supervisors should know whether the contact record reflects valid permission and whether that permission has been revoked. If the consumer says “stop,” “don’t call me,” or similar, the agent should capture it in the system immediately.
2. Use local-time controls and timezone logic
Do not rely on the area code alone if better location data exists. Both the FCC/TCPA and FTC/TSR frameworks depend on local time at the called party’s location.
3. Honor DNC requests at the seller level and the campaign level
If a consumer says not to call again, the request should not die in one agent’s notes. It needs to flow into the suppression system used across teams and vendors.
4. Keep scripts accurate and specific
The TSR prohibits material misrepresentations and requires prompt disclosures. Agents should know exactly who they are calling on behalf of, why they are calling, and what they can and cannot claim.
How TrustedForm can help call centers manage compliance
TrustedForm helps call centers by giving them a record of how consent was obtained before a lead or contact enters the dialing or texting workflow. For outbound teams especially, one of the hardest problems is proving what the consumer actually saw and agreed to at the moment of lead creation.
TrustedForm is designed to document that event and retain the evidence so compliance, QA, vendor managers, and legal teams are not forced to reconstruct it later.
Practically, that helps call centers in four ways:
- It strengthens proof-of-consent files before calls begin
- It gives buyers and compliance teams a way to reject leads that do not meet requirements
- It improves vendor accountability
- It creates a more audit-ready trail if a complaint or lawsuit appears later
For a call center manager, the operational value is straightforward: Better proof upstream means fewer arguments downstream about whether the consumer really opted in, what disclosures were shown, and whether the contact should ever have entered the queue.
FAQs
1. What are the main call center regulations in the U.S.?
The main U.S. call center regulations are the TCPA and related FCC rules on robocalls, robotexts, consent, and revocation; the FTC’s Telemarketing Sales Rule and National Do Not Call rules; state telemarketing laws; and data privacy/security laws such as California’s CCPA and, for covered financial institutions, GLBA and the FTC Safeguards Rule.
2. What are the FCC call center regulations?
The main FCC call center regulations are the TCPA rules governing autodialed and prerecorded calls and texts, consent standards, revocation of consent, and calling-time restrictions. In 2026, businesses should pay special attention to the delayed revocation rule and the FCC’s proposed offshore/onshoring call center rulemaking.
3. What rules and regulations apply to call center agents specifically?
The main rules and regulations for call center agents are: Call only when legally permitted, use the right consent basis, honor revocations and DNC requests immediately, make required disclosures accurately, avoid misrepresentations, connect live answers quickly enough to avoid abandonment where applicable, and protect personal information in recordings and customer records.
4. What is the penalty for violating TCPA call center regulations?
Under the TCPA’s private right of action, a consumer can seek up to $500 per violation, and a court may increase that to up to $1,500 per violation for willful or knowing violations. Depending on the program size, that can escalate quickly in class actions or repeated-campaign cases.
Final thoughts
In 2026, the smartest way to think about call center laws and regulations is not as a stack of separate legal chores. Think of them as one operating system for compliant customer contact: Valid consent, fast suppression, clean scripts, controlled dialers, documented records, and defensible data practices.
For most teams, the practical next move is a simple three-step audit:
- Map every outbound and inbound workflow that touches consumers
- Identify where consent, DNC, abandonment, privacy, and vendor controls can fail
- Fix those failure points before regulators, plaintiffs, or customers find them first
That is the real compliance advantage in 2026: Fewer surprises, cleaner operations, and a contact strategy your business can actually defend.
