Are Auto Dialers Illegal? TCPA Rules for 2026

Are Auto Dialers Illegal? What Sales Teams Actually Need to Know

Your VP just pinged the sales channel: "Hey, is our dialer actually legal?" Nobody has a confident answer. The SDR manager opens 14 tabs of contradictory legal jargon, and everyone's still unsure by end of day.

The short version: no, auto dialers aren't illegal. But misusing one can cost you $500 to $1,500 per call - and with 880 TCPA lawsuits filed in just the first four months of 2025 (a 44% jump year-over-year), enforcement heading into 2026 isn't slowing down. It's accelerating.

The Quick Version

• The tool itself is legal. How you use it is what matters. After the Supreme Court's 2021 Duguid ruling, most modern sales dialers - power, preview, click-to-call - don't even qualify as "auto dialers" under federal law.
• Consent is everything. You need prior written consent for prerecorded telemarketing calls to cell phones. Without it, every single call is a separate violation.
• Your data has to be fresh. Reassigned numbers are a major TCPA risk, and stale contact data is the fastest way to rack up liability. (If you’re tightening list hygiene, start with data enrichment.)
• Scrub your lists. Check against the National DNC Registry and your internal DNC list before every campaign. 78% of TCPA lawsuits are class actions - one bad list can become a seven-figure problem.

The fact that a yes/no question requires this much explanation tells you everything about how poorly these rules are communicated. Let's fix that.

What the TCPA Actually Says

The Telephone Consumer Protection Act dates back to 1991, written when robocalls meant a machine randomly dialing phone numbers and blasting prerecorded messages. The law defines an Automatic Telephone Dialing System (ATDS) as equipment with the capacity to store or produce phone numbers using a random or sequential number generator, and to dial those numbers.

That definition matters because the restrictions are tied to it. If you're using an ATDS to call a wireless number, you need the recipient's prior oral or written consent. If you're making prerecorded telemarketing calls to a home or wireless number, you need prior written consent. The distinction between "autodialed" and "prerecorded" calls trips people up constantly - they're separate restrictions under the same law.

There's a third category people forget entirely: purely informational calls like appointment reminders and fraud alerts have different consent thresholds than telemarketing calls. The FCC has guidance on this distinction, but most sales teams never read it because they assume all outbound falls under the same rules. (If you’re building a repeatable outbound motion, see sales prospecting techniques.)

The penalty structure is straightforward. $500 per violation, or $1,500 if the court finds the violation was willful. "Per violation" means per call. A campaign that dials 5,000 numbers without proper consent creates 5,000 separate violations - at the willful rate, that's $7.5 million in statutory damages before anyone even talks about a settlement.

Other rules worth knowing: telemarketing calls are prohibited before 8 a.m. and after 9 p.m. at the called party's location. You must honor opt-outs within 10 days. You're required to maintain records of internal Do Not Call requests for at least five years. These aren't suggestions.

What Changed After Duguid (2021)

In April 2021, the Supreme Court decided Facebook v. Duguid and fundamentally narrowed what counts as an automated dialing system. Justice Sotomayor, writing for a unanimous court, held that an ATDS must use a random or sequential number generator to either store or produce the numbers it dials. A system that simply stores and dials from a pre-loaded list doesn't qualify.

This was a big deal.

Before Duguid, the FCC had interpreted the ATDS definition broadly enough to capture predictive dialers and essentially any automated calling system. The Court rejected that interpretation, noting it would make "virtually all modern cell phones" into auto dialers. The ruling effectively rewrote the TCPA autodialer rules that sales teams had been operating under for years. Through 2024, appellate courts reinforced this - the Third Circuit in Perrong, the Second Circuit in Soliman, and the Ninth Circuit in Davis all rejected attempts to expand the ATDS definition back beyond what Duguid established.

Here's the part dialer companies love to skip: Duguid only narrowed the ATDS definition. Every other TCPA restriction still applies. You still can't make prerecorded or artificial voice calls without consent. You still have to scrub against the DNC registry. You still have to honor opt-outs. The Congressional Research Service has noted that Duguid left the meaning of "capacity" unresolved, and some circuits are still wrestling with edge cases. Don't treat Duguid as a free pass. It narrowed one definition - it didn't repeal the TCPA.

AI Calling Rules Under the TCPA

In February 2024, the FCC unanimously ruled that calls made with AI-generated voices are "artificial" under the TCPA. AI voice calls now carry the exact same consent requirements as any prerecorded robocall. No consent, no call. That ruling remains the governing standard heading into 2026.

There's a persistent misconception on r/sales and r/gohighlevel that AI calls are only legal to business landlines. One poster on r/sales wrote that "per TCPA, AI calls are allowed to business landlines only" - that's not accurate. The actual rule is simpler: AI-generated voice calls require prior consent, just like any other prerecorded or artificial voice call. The cell phone vs. landline distinction matters for ATDS consent requirements, but the artificial voice restriction applies broadly. (If you’re also automating email touches, compare options in AI tools for automating sales follow-ups.)

The FCC didn't ban AI voice agents outright. If someone consents to receive calls from you, you can use AI to make those calls. The technology isn't illegal - using it without consent is. If you're exploring AI-powered outbound in 2026, the compliance framework is identical to what you'd follow for any prerecorded message campaign. Get consent first, document it, make sure your opt-out mechanism works.

State Laws That Go Further

Federal law is the floor, not the ceiling. Several states have enacted "mini-TCPA" statutes with shorter calling windows, attempt limits, and penalties that dwarf the federal range.

New York's $11,000-per-violation penalty stands out. Maryland can pursue criminal penalties, including imprisonment. Florida and Oklahoma both cap you at three call attempts per number in a 24-hour window - a rule that's easy to violate if your dialer's cadence settings aren't configured correctly.

When you're running outbound campaigns across multiple states, you need to comply with the strictest applicable law for each recipient's location. "We follow federal rules" isn't enough when you're dialing into Florida or New York.

I've seen teams with $50,000 dialer setups and no idea that their Florida cadence was triple the legal limit. The dialer isn't the compliance problem. Your operational ignorance is. (If you’re standardizing rep workflows, document them as sales activities.)

What Happens When You Get Caught

The settlement numbers tell the story better than any legal analysis.

That auto-warranty case involved ten companies that placed over 5 billion illegal robocalls in roughly three months in 2021. The FCC levied a $300 million penalty in 2023. These aren't edge cases - they're what happens when compliance is treated as optional.

The trend is accelerating. 507 TCPA class actions were filed in Q1 2025 alone - a 112% increase over Q1 2024. TCPA defense attorney Eric Troutman has called the statute the "biggest cash cow in history" for the plaintiffs' bar, and the numbers back him up. When 78% of TCPA lawsuits are class actions - compared to 2-5% for other consumer statutes - you're looking at a legal environment specifically designed to generate large settlements. We've seen teams rack up six-figure liability from a single stale list that should have been scrubbed weeks earlier.

The Compliance Checklist

This is what actually keeps you safe.

Get documented consent with timestamps. Every call needs a consent trail. Store the date, time, method, and specific language the person agreed to. "They filled out a form" isn't enough - you need the form, the timestamp, and proof it was that person.

Scrub against the National DNC Registry before every campaign. Not once a quarter. Every campaign. Calling a registered number is a per-call violation.

Honor opt-outs within 10 days, cross-channel. If someone opts out of calls, treat it as opting out of texts too. Accept any reasonable opt-out language - "stop," "remove me," "quit," "don't call again." Don't make people jump through hoops. (For compliant multi-touch, keep your messaging tight with sales follow-up templates.)

Maintain your internal DNC records for at least 5 years. Some states require 10. If someone says "don't call me" and you call them 18 months later because you purged the record, that's a willful violation at $1,500.

Subscribe to the FCC's Reassigned Numbers Database. This gives you safe harbor protection - if you query the RND before calling and the number hasn't been flagged as reassigned, you've got a defense. Skip this step and you're exposed.

Control abandoned calls. If your dialer connects and nobody's there when the person picks up, that's an abandoned call. Configure pacing, staffing, and retry logic so you're not generating dead-air pickups.

Verify your contact data before dialing. Stale data means calling reassigned numbers, disconnected lines, and people who never gave you consent. A data provider with a 7-day refresh cycle means the numbers in your dialer were checked this week, not six weeks ago. (If you’re evaluating vendors, start with sales prospecting databases.)

Your Data Is the Real Risk

This scenario plays out constantly: your SDR gets a demand letter. Your dialer called a reassigned number 14 times over three weeks. The person who now has that number never consented to anything. At $1,500 per willful violation, that's $21,000 in exposure from a single phone number.

Multiply that across a campaign of 2,000 contacts with even a 5% stale rate, and you're looking at potential liability that dwarfs your entire outbound budget.

Your biggest TCPA exposure isn't your dialer - it's your data. In our experience, the data problem is always worse than teams think. The RND safe harbor helps, but it only covers you if you actually query it. The better solution is to never load stale numbers into your dialer in the first place.

This is where data quality becomes compliance infrastructure, not just a sales optimization. Prospeo's 125M+ verified mobile numbers run on a 7-day refresh cycle with 98% email accuracy, compared to the 6-week industry average for data freshness. Numbers get reverified weekly, and reassigned or disconnected numbers are flagged before they ever reach your dialer. At roughly $0.01 per lead, it's the cheapest insurance policy against a $1,500-per-call violation you'll find. (If you’re building the rest of the stack around it, see the best SDR tools.)

FAQ

Is cold calling with AI legal in 2026?

Yes, but AI-generated voice calls require prior consent under the FCC's February 2024 ruling. Without documented consent, AI voice calls carry the same $500-$1,500 per-call penalties as illegal robocalls. The technology itself is legal; deploying it without a consent trail isn't.

Are power dialers considered auto dialers under the TCPA?

No. After Facebook v. Duguid (2021), dialers that call from stored contact lists - including power dialers and preview dialers - fall outside the ATDS definition under federal law. You still must comply with DNC rules, consent requirements for prerecorded messages, and state-level restrictions.

What's the penalty for a single TCPA violation?

$500 per violation, or $1,500 if the court finds it willful. In class actions this multiplies across every call made - a 5,000-call campaign without proper consent could generate $2.5M to $7.5M in statutory damages before settlement negotiations even begin.

Do TCPA rules apply to B2B calls?

Yes, when you dial a prospect's mobile number. The TCPA applies to calls made to cell phones regardless of whether the recipient is a consumer or business contact. B2B calls to business landlines have fewer restrictions, but mobile numbers trigger full TCPA protections.

How do I avoid calling reassigned numbers?

Subscribe to the FCC's Reassigned Numbers Database for safe harbor protection, and use a data provider that refreshes records weekly. Prospeo's 7-day verification cycle flags reassigned and disconnected numbers before they enter your dialer, eliminating the stale-data risk that drives most reassigned-number violations.