10 Dialer Misconfigurations That Generate Six-Figure TCPA Fines (And How to Fix Each One)

TCPA class actions jumped 112% in Q1 2025. The FTC can now fine you $53,088 per call. One auto warranty scheme drew a $300 million penalty. If you're running outbound campaigns in 2026, this is the checklist that keeps you out of the crosshairs. --- The compliance landscape for outbound call centers changed more between 2024 and 2026 than it did in the previous decade. The FCC rewrote consent revocation rules. The FTC expanded TSR coverage to B2B calls. AI voice calls got classified as robocalls overnight. And several states passed mini-TCPA laws stricter than the federal rules. TCPA litigation is at an all-time high -- 2,788 cases filed in 2024, up 67% from 2023. Q1 2025 class action filings ran 112% above the prior year. Average settlement: $6.6 million. This post covers every federal and state regulation that applies to your outbound operation, the dialer settings you need to configure (with VICIdial admin GUI paths), and the 10 misconfigurations that get call centers sued. ## What Changed in 2025-2026 Four major regulatory shifts redefined compliance for outbound call centers. If you haven't updated your setup since early 2024, you're exposed. ### The One-to-One Consent Rule: Born and Killed In December 2023, the FCC adopted a rule (CG Docket No. 02-278) that would have required lead generators to obtain consent for one seller at a time -- killing the model where a single checkbox on a comparison site authorizes calls from a dozen companies. The rule was supposed to take effect January 27, 2025. It never did. On January 24, 2025, the Eleventh Circuit vacated it in Insurance Marketing Coalition Ltd. v. FCC (No. 24-10277), ruling that the FCC exceeded its authority. The court held that the one-to-one restriction impermissibly altered the ordinary statutory meaning of "prior express consent" under the TCPA. By April 2025, the FCC announced it wouldn't challenge the ruling. In August 2025, they formally reinstated the pre-2023 consent standard. What this means now: Lead generators can still collect consent for multiple sellers in a single interaction. You still need prior express written consent (in writing, with a signature, with clear disclosures per 47 C.F.R. § 64.1200), but the one-to-one requirement is dead. For now. ### Consent Revocation: 10 Business Days, Any Method This one is in effect and actively enforced. As of April 11, 2025 (47 C.F.R. § 64.1200(a)(9)(i)(F), (a)(10), (a)(11), and (d)(3)): - Consumers can revoke consent through any reasonable method -- text, email, voicemail, verbal request during a call, carrier-level blocking, anything - You must honor revocation within 10 business days (down from the previous 30-day standard) - The FCC designated seven mandatory opt-out keywords: stop, quit, revoke, opt out, cancel, unsubscribe, end Important carve-out: the "revocation-all" provision (where opting out of one message type revokes ALL consent from that caller) was stayed on April 7, 2025 (DA 25-312) and delayed until January 31, 2027 (DA 26-12). You don't have to treat a text opt-out as revoking phone call consent yet. Build the systems now anyway. ### AI-Generated Voices = Robocalls The FCC's February 2024 declaratory ruling (FCC 24-17, CG Docket No. 23-362) classified AI-generated voices -- including voice cloning -- as "artificial or prerecorded voice" under TCPA § 227(b)(1). This applies retroactively. If you use AI voices for voicemail drops, IVR prompts, or outbound messages, every existing TCPA restriction applies. No AI-specific exemption exists. You need the same level of prior express consent as any prerecorded human voice call. ### TSR Amendments: B2B Coverage and 5-Year Records Effective January 9, 2025 (89 FR 98,220): - B2B calls are no longer partially exempt. The TSR's prohibitions against misrepresentations and misleading statements now apply to business-to-business telemarketing calls. If your B2B agents are making claims about ROI or product capabilities, those claims are now TSR-regulated. - Recordkeeping extended to 5 years. All records related to telemarketing transactions must be retained for at least 5 years. Not 3. Not "until we run out of disk space." Five years. ## Federal Requirements: The Full List Here's every federal requirement that applies to outbound call centers, with the specific citation and the VICIdial configuration that addresses it. ### DNC (Do Not Call) Compliance Law: TCPA § 227 + TSR 16 CFR § 310.4(b)(1)(iii) | Requirement | Detail | VICIdial Setting | |---|---|---| | Federal DNC scrub | Scrub all calling lists against the National DNC Registry every 31 days | Import FTC data via DNC.com integration or manual upload. Admin > DNC Numbers for bulk import | | Internal DNC list | Maintain a company-specific DNC list. When someone says "don't call me," add them immediately | Campaign Detail > Use Internal DNC List = Y | | Per-campaign DNC | Separate DNC lists scoped to individual campaigns | Campaign Detail > Use Campaign DNC List = Y | | Opt-out processing | Honor opt-out requests within 10 business days | Train agents to disposition as DNC immediately. Verify DNC lists propagate system-wide | | State DNC registries | 11 states maintain separate DNC lists: CO, FL, IN, LA, MA, MO, OK, PA, TN, TX, WY | Scrub via DNC.com before importing lists. VICIdial does not auto-sync state DNC data | | EBR time limits | Existing Business Relationship exemption expires 18 months after last transaction, 3 months after last inquiry | Track in CRM. Automate EBR expiration checks before building call lists | | Reassigned Number Database | Query the FCC RND before calling numbers with consent older than 30 days. One query = one protected call | Use DNC.com or similar service. 47 CFR § 64.1200(n) provides safe harbor | VICIdial note: Do NOT load the entire federal DNC registry (240+ million numbers) into VICIdial's internal DNC table. The hopper checks every lead against it on every pass -- 240M rows will crush database performance. Pre-scrub through a third-party service before importing. Registry access fees for FY 2026: $82 per area code, $22,626 max for nationwide access. First 5 area codes are free. ### Calling Hours Law: TSR 16 CFR § 310.4(c) Outbound telemarketing calls are permitted only between 8:00 AM and 9:00 PM in the called party's local time zone. Not your time zone. Theirs. VICIdial configuration: 1. Admin > Call Times -- create a Call Time Definition (e.g., "TCPA_8am_9pm") with start 0800, stop 2100 for each weekday 2. Campaign Detail > Local Call Time -- assign this Call Time to your campaign 3. The hopper script (AST_VDhopper.pl) checks each lead's gmt_offset_now against the campaign's Local Call Time before loading it into the hopper. Leads outside the window are skipped. 4. Critical: Use "Postal Code First" timezone lookup when loading lists (List Loader screen). Area code lookup is unreliable because of number portability -- a 312 (Chicago) number might belong to someone who moved to Denver. ZIP code mapping is more accurate. ### Abandoned Call Rate Law: TSR 16 CFR § 310.4(b)(4)(i) / FCC 2008 Declaratory Ruling No more than 3% of calls answered by a live person may be abandoned, measured per campaign over each 30-day period. An "abandoned" call is one where a live person answers but no agent is available to take the call. | VICIdial Setting | Location | Compliant Value | |---|---|---| | Drop Percentage Limit | Campaign Detail | 2% or lower (gives buffer below the 3% legal max) | | Drop Action | Campaign Detail | CALLMENU (not HANGUP) | | Safe Harbor Call Menu | Campaign Detail | Custom call menu that identifies your company, provides callback number, offers DNC opt-out | | Drop Call Seconds | Campaign Detail | Match to your safe harbor message length | | Dial Method | Campaign Detail | ADAPT_HARD_LIMIT or ADAPT_TAPERED (never RATIO for compliance campaigns) | | Adaptive Intensity | Campaign Detail | 0.2-0.5 (above 0.5 causes high abandon rates during traffic spikes) | Setting up the safe harbor call menu: 1. Admin > Call Menus > Create new (e.g., "FTC_safe_harbor") 2. Add an audio file that: identifies your company by name, states the call was made on behalf of [company], provides a callback number 3. Add a keypress option (e.g., press 1) that triggers cm_dnc.agi to add the caller to your DNC list 4. In Campaign Detail, set Drop Action = CALLMENU and Safe Harbor Call Menu = FTC_safe_harbor ### Caller ID Requirements Law: TSR 16 CFR § 310.4(a)(8) + Truth in Caller ID Act, 47 U.S.C. § 227(e) You must transmit a valid caller ID on every outbound call -- your company's phone number and, when technically possible, your company's name. Displaying a number that doesn't ring back to your business or using a number you're not authorized to use is a federal crime under the Truth in Caller ID Act. Penalties: up to $10,000 per violation. VICIdial configuration: Campaign Detail > Campaign CallerID -- set to a valid, registered 10-digit number you own or are authorized to use. For multi-number setups, use Admin > CID Groups with type AREACODE or STATE to match caller ID to the lead's location. ### STIR/SHAKEN Law: TRACED Act (Pub. L. 116-105) STIR/SHAKEN is a caller ID authentication framework. Your carrier assigns an attestation level to each call: | Level | Meaning | What Happens | |---|---|---| | A (Full) | Carrier verified you're authorized to use this number | Calls go through normally | | B (Partial) | Carrier authenticated you but can't verify the specific number | Calls may be flagged | | C (Gateway) | Carrier has no relationship with the originator | Calls likely blocked or voicemail-only | VICIdial doesn't implement STIR/SHAKEN directly -- your SIP carrier does. But your configuration determines your attestation level. Use numbers registered to your account, verify your business identity with your carrier, avoid unregistered or improperly ported numbers. For carriers that don't handle signing, VICIdial has native TILTX Call Shaper integration -- TILTX verifies your CID, creates a signed PASSporT token, and VICIdial passes it in the SIP INVITE header. Key deadlines: September 18, 2025, providers can only use third parties for signing if attestation decisions use their own certificate. March 1, 2026 was the first annual RMD (Robocall Mitigation Database) recertification deadline. ### Call Recording Law: 18 U.S.C. § 2511 (Wiretap Act / ECPA) Federal law requires one-party consent -- the agent's knowledge that recording is on is sufficient at the federal level. But 12 states require all-party consent: California (Cal. Penal Code § 632), Connecticut (§ 52-570d), Delaware (11 Del. C. § 2402), Florida (§ 934.03), Illinois (720 ILCS 5/14-2), Maryland (§ 10-402), Massachusetts (ch. 272, § 99), Michigan (MCL § 750.539c), Montana (§ 45-8-213), New Hampshire (§ 570-A:2), Oregon (ORS § 165.540), Pennsylvania (18 Pa. C.S. § 5703), and Washington (RCW § 9.73.030). Interstate rule: When a call crosses state lines, the stricter state's law applies. If your call center is in Texas but you're calling someone in California, you must comply with California's all-party consent. VICIdial configuration: - Campaign Detail > Campaign Recording = ALLFORCE (records every call; agents cannot stop recording) - Play a "this call may be recorded" announcement at the start of every call, regardless of destination state. Configure this in your IVR or Asterisk dialplan. VICIdial does NOT automatically play this announcement -- you must set it up. - For Massachusetts calls specifically, implied consent (continuing the call after hearing the announcement) may not be sufficient. Train agents to get verbal confirmation for MA numbers. ### Caller Identification Disclosure Law: TSR 16 CFR § 310.4(d) Within the first few seconds of every outbound call, your agent must identify: themselves (name), their company, and the purpose of the call. For prerecorded messages, the same information must be in the recording. This is agent training, not a VICIdial setting. Enforce it with VICIdial's Agent Script feature (Campaign Detail > Script) -- create a script with mandatory disclosure language as the first thing agents see when a call connects. ## State Laws: Where It Gets Ugly Federal law is the floor. Several states have built

Read the full article

About

Built by ViciStack — enterprise VoIP and call center infrastructure.

• VICIdial Hosting & Optimization
• Call Center Performance Guides
• Full Article: 10 Dialer Misconfigurations That Generate Six-Figure TCPA Fines (And How to Fix Each One)

License

MIT