Beyond the federal TCPA: the state mini-TCPA laws that actually trip up B2B cold-calling programs

Most B2B calling programs build their compliance checklist around the federal TCPA and stop there -- honor the National Do Not Call Registry, respect the 8am-9pm local-time calling window, flag mobile numbers for manual dialing only. That checklist is necessary but incomplete. A handful of states have passed their own mini-TCPA laws that layer stricter, state-specific rules on top of the federal floor, and a compliance program built only for the federal standard will violate several of them without anyone noticing until a complaint arrives.

Florida is the one most calling programs run into first, because its Telephone Solicitation Act is genuinely stricter than the federal rule: no more than three call attempts on the same subject matter within a 24-hour period, and a calling window that closes at 8pm rather than the federal 9pm cutoff. It also creates a private right of action, meaning an individual recipient -- not just a regulator -- can sue directly, with statutory damages of $500 per violation and up to $1,500 for a willful one. Oklahoma passed a near-identical statute shortly after, with the same $500 baseline and $1,500 treble-damages structure for willful violations.

The National Do Not Call Registry itself is often under-maintained even in programs that take it seriously. Numbers on the registry need to be rescrubbed against a fresh registry download at least every 31 days -- a program calling off a list scrubbed once at campaign launch, three months ago, is not compliant just because it was compliant on day one. This is the single most common gap we find auditing a client's existing calling process before we take it over.

The established business relationship exemption is where most of the state-versus-federal confusion actually lives. An EBR with a company can support outreach to a business landline without additional consent, but that exemption does not automatically extend to a personal mobile number just because the person answering it works at that company -- mobile numbers need their own consent basis, tracked separately from the landline-based EBR, or a program that's compliant on the office line becomes non-compliant the moment the same contact is dialed on their cell.

None of this means calling into Florida or Oklahoma isn't worth doing -- it means the compliance layer has to be state-aware, not just federally aware, before a program dials into either one. We build calling programs with state-specific attempt caps and calling windows applied automatically by area code and registered address, not as a manual exception list someone has to remember to check, because that's the difference between a program that scales cleanly across all 50 states and one that quietly accumulates exposure in the two or three states that actually wrote their own rules.