Last updated 2026-07-09
TL;DR
89 FR 99069 is the Federal Register citation for the FTC's December 2024 final rule amending the Telemarketing Sales Rule. It tightens consent for prerecorded and AI-voice calls, narrows the business-to-business exemption, extends recordkeeping to five years, and sets civil penalties at $51,744 per violation. If you run outbound calls or texts to consumers, most of it took effect January 27, 2025.
What exactly is 89 FR 99069?
89 FR 99069 is the Federal Register volume and page number for the FTC's final amendments to the Telemarketing Sales Rule, published December 10, 2024. [1] The TSR has been around since 1995, built on the Telemarketing and Consumer Fraud and Abuse Prevention Act (15 U.S.C. § 6101 et seq.). [11] This is the biggest overhaul in over a decade.
The rule runs well over 200 pages in the Federal Register. The operative changes fall into a handful of buckets: consent for prerecorded and artificial voice calls, the scope of the B2B exemption, recordkeeping duties, and what counts as "telemarketing" in the first place. Each bucket has real teeth in enforcement.
You may also see references to 89 FR 26760. That's an earlier 2024 entry, the FTC's Notice of Proposed Rulemaking that preceded this final rule. [3] The NPRM is where the FTC laid out proposed changes and asked for public comment. 89 FR 99069 is the final version, after the agency read those comments. The two citations are related but not the same document. When someone says "the new TSR rule," they almost always mean 89 FR 99069.
Most provisions took effect January 27, 2025, with a longer runway on certain recordkeeping duties into mid-2025. If your team hasn't reviewed call scripts and consent workflows since late 2024, that review is overdue.
How does the TSR relate to TCPA, and why does that matter?
The TCPA (47 U.S.C. § 227) is an FCC-enforced law about the technology of the call: whether you used an autodialer, whether you left a prerecorded message, whether you sent an unsolicited fax. [4] The TSR is an FTC-enforced rule about the commercial transaction: whether you're selling something, whether you're deceiving anyone, whether you're calling a number on the Do Not Call Registry.
They overlap constantly. One outbound sales call using a predictive dialer to a consumer's cell can trip both regimes at once. The TCPA lets private plaintiffs sue for $500 to $1,500 per call. The TSR is enforced by the FTC and state attorneys general, with civil penalties that after 2024 reach $51,744 per violation. [5]
Your exposure on a bad campaign isn't one or the other. It's both. The FTC has said the TSR applies to calls made with technology that also triggers TCPA obligations, and courts have generally agreed.
For a wider view of cold calling law, keep this straight: the TSR is the FTC's main enforcement tool for outbound sales, and the TCPA is the FCC's. Neither agency defers to the other. Both can act independently on the same conduct, and both do.
What did 89 FR 99069 actually change?
Here are the substantive changes, without burying the lead.
Prerecorded call consent. Sellers now need signed written consent from a consumer before delivering a prerecorded telemarketing message, even when the consumer already does business with the seller. The old TSR let you send prerecorded calls to existing customers without separate written consent. That exemption is gone. [1]
Artificial voice calls. The 2024 amendments pull AI-generated voice calls under the same consent framework as traditional prerecorded messages. The FTC's stated reason: a consumer can't reliably tell a human-sounding AI voice from a live agent, so the same protections apply. This hits AI cold calling practices that have grown fast since 2023.
B2B exemption narrowed. Business-to-business calls used to be broadly exempt from most TSR requirements. The new rule tightens that. A call to a business is exempt only if the seller has a reasonable basis to believe it's calling a business entity, not a consumer who happens to work somewhere. Cold calls to a person's direct work line where you're actually pitching them as an individual (personal insurance, personal finance) are no longer automatically sheltered.
Recordkeeping expansion. Sellers and telemarketers must keep consent records for five years, including the specific consent mechanism, the date and time consent was obtained, and the product or service covered. That's a real operational load if you don't already have a consent system.
Caller ID tightened. The rule bars transmitting caller ID that doesn't accurately reflect the telemarketer or the seller on whose behalf the call is made. This turns what was once enforced as a deceptive practice into a standalone violation.
New take on "telemarketing." The FTC clarified that a single call can count as telemarketing if its purpose is to induce a purchase, even when it's dressed up as informational. That closes a common workaround where companies claimed the first outreach wasn't a sales call.
What are the penalties under the updated TSR?
Each TSR violation carries a maximum civil penalty of $51,744 as of 2024, and the FTC adjusts that amount annually for inflation under the Federal Civil Penalties Inflation Adjustment Act. [5] Each call is a separate violation. In some contexts, each day a violation continues counts separately too.
For scale, the FTC won a $120 million judgment against a travel scam operation in the Caribbean Cruise Line case, partly under the TSR. [10] More recently, the agency has used TSR enforcement in robocall and debt relief matters where company defendants faced eight-figure judgments.
State attorneys general can also bring TSR actions, and many states layer on their own statutes. For a small outbound team, the risk isn't only federal. A single state AG complaint that opens an investigation, even one that settles, can cost six figures in legal fees before any penalty lands.
| Violation type | Per-violation penalty (2024) |
|---|---|
| TSR violation (FTC enforcement) | Up to $51,744 |
| TCPA autodialer/prerecorded call | $500 to $1,500 (private suit) |
| TCPA willful violation | Up to $1,500 per call |
| National DNC Registry call | Up to $51,744 per call (FTC) |
Those numbers are per call, per text, per violation. A campaign that fires 10,000 prerecorded messages without proper consent is not a single $51,744 problem. Do the multiplication.
How does the new consent rule work for prerecorded and AI calls?
Under 89 FR 99069, valid consent for a prerecorded or artificial voice telemarketing call has to be in writing (electronic signatures count under the E-SIGN Act), signed by the consumer, specific to your company rather than a blanket third-party consent, and obtained before any prerecorded call goes out. [1]
The FTC borrowed language close to the FCC's prior express written consent standard under the TCPA. The two standards aren't identical, though, so don't assume compliance with one covers the other.
Here's what does not clear the bar:
- A checkbox buried in a website's terms of service the consumer never specifically acknowledged
- Consent obtained by one company and "transferred" to another seller without the consumer agreeing to that seller
- An oral agreement recorded on a call
- Consent obtained for one product category, then reused for a new product pitch
Lead generators who sell consumer data to multiple buyers should read this section twice. The FTC states in the preamble to 89 FR 99069 that consent must identify the specific seller, not a category of sellers. Blanket consent forms listing dozens of potential buyers are a direct target of this rule.
If you're building outbound from scratch, get clear on what is cold calling in sales and where consent obligations begin before you touch a dialer.
Does the updated TSR affect text message (SMS) campaigns?
Yes. The TSR reaches any "telephone solicitation" under the rule, and the FTC has consistently read that to include text messages used to induce a purchase. [2] The 2024 amendments don't add a separate SMS section, but the consent, recordkeeping, and disclosure requirements that apply to voice calls apply to text-based outreach that counts as telemarketing.
Most of your direct SMS framework comes from the TCPA and the FCC's rules, plus CTIA carrier guidelines that carriers enforce contractually. The TSR adds a layer on top. If your SMS campaign is selling something, the TSR's rules on deception, the DNC Registry, and consent for automated content all apply.
One practical consequence: if your SMS platform sends automated messages, and nearly all of them do, you need both TCPA-compliant written consent and TSR-compliant consent documentation. A well-drafted opt-in form usually covers both, but verify that explicitly instead of assuming it.
The overlap between SMS, TCPA, and the TSR is genuinely messy. LeadCompliant's free compliance checker can flag whether a specific opt-in flow meets both standards, which is often faster than paying outside counsel to audit a form from scratch.
What do the new recordkeeping requirements actually require?
Before 89 FR 99069, the TSR required sellers and telemarketers to keep certain records for 24 months. The 2024 amendments push the retention period to five years for consent records and spell out exactly what you have to capture. [1]
Required records now include:
1. The name and last known address of each person who gave consent 2. The date and time consent was obtained 3. The specific product or service the consent covers 4. The method used to get consent (online form, paper, voice recording, and so on) 5. The specific seller or telemarketer named in the consent
For a team running 500 calls a day, that's a lot of records. The FTC expects them retrievable on demand during an investigation, not reconstructed afterward. "We kept it in our CRM" is not enough unless your CRM actually captures all five elements and you can pull them by consumer.
The fix for most teams is a consent management system that timestamps and stores opt-in data the moment it's collected. Salesforce, HubSpot, and others have consent logging modules, and standalone tools exist for TCPA and TSR consent archiving. A basic consent log costs far less than reconstructing records mid-investigation.
A well-built cold call script process that captures consent at the right point in the call flow also keeps live-agent verbal interactions documented correctly.
How does the B2B exemption work now, and what changed?
The TSR's business-to-business exemption, at 16 C.F.R. § 310.6(b)(7), historically freed calls between businesses from most TSR requirements. The idea was that businesses can protect themselves and don't need the same consumer safeguards. [6]
The 2024 amendments narrowed it two ways. First, the exemption now requires the caller to have a reasonable basis for believing the person on the other end is acting in a business capacity, not as a consumer. Call someone's work number to pitch a personal financial product, a personal insurance policy, or anything they'd buy for themselves rather than their employer, and the exemption doesn't cover it.
Second, the FTC addressed using B2B data lists to reach consumers by the back door. If a lead list holds business contact info but the actual pitch is to the individual, not the business, the exemption doesn't apply. That's a live problem for benefits, insurance, and personal finance teams who buy business-contact data and pitch individual employees.
What didn't change: genuine B2B calls, where a seller calls a business to sell something the business would buy, stay broadly exempt from the TSR's core requirements. The DNC Registry generally doesn't cover business lines. Prerecorded call consent requirements don't apply to solicitations that are truly business-to-business.
How does 89 FR 99069 interact with the FCC's 2024 one-to-one consent rule?
In January 2024, the FCC issued its own one-to-one consent rule under the TCPA, requiring that prior express written consent for autodialed or prerecorded calls name a single, specific seller instead of a group. The Eleventh Circuit vacated that rule in January 2025 in Insurance Marketing Coalition v. FCC, holding the FCC had exceeded its statutory authority. [7]
So the FCC's one-to-one rule is not currently in effect. Here's where 89 FR 99069 gets interesting: the FTC's TSR amendments, published about two months after the FCC's rule, include a consent specificity requirement that lands in nearly the same place. The TSR consent standard requires identifying the specific seller, and the TSR was never part of the Eleventh Circuit case.
Put plainly, even with the FCC rule struck down, the FTC's TSR may reach much of the same result for calls that qualify as telemarketing. A lead generator selling consumer consent data to multiple downstream buyers still faces real exposure under the TSR without any FCC rule at all.
Nobody has fully settled answers here yet. The FTC hasn't published post-vacatur guidance on how 89 FR 99069 fills the gap the Eleventh Circuit left, and enforcement actions will likely do the clarifying over 2025 and 2026.
What should an outbound sales team actually do to comply?
Start with an honest audit. Pull your current opt-in flows, lead sources, and dialer configurations. Answer four questions for each:
1. Does every prerecorded or AI-voice call have written, specific, pre-obtained consent that names your company? 2. Can you retrieve that consent record on demand for any given contact? 3. Are your consent records retained for five years with timestamps? 4. Does your B2B strategy lean on the exemption for calls that might actually be consumer-purpose pitches?
Any "no" is your priority list.
For consent collection, the FTC's plain-language guidance on TSR compliance is a reasonable starting point. [2] Most consent problems come from forms drafted before 2024 that don't name a specific seller, don't identify the product category, or hide inside a broader set of terms. A standalone consent form the consumer affirmatively checks, with clear language about who's calling and what they're selling, is the safest design.
For recordkeeping, pick a system and document it. It doesn't have to be expensive. A structured database or a well-organized CRM with mandatory consent fields and export capability satisfies the TSR if it captures all five elements every time.
LeadCompliant's free compliance kit includes a consent form template and a recordkeeping checklist built around the 2024 TSR requirements, which shortcuts the drafting work.
For scripts, train agents on the new rules, especially prerecorded content and the B2B exemption. A good cold calling script process should have a checkpoint that verifies consent before any automated or prerecorded content fires.
Are there any safe harbors or defenses under the new TSR?
The TSR doesn't create a broad formal safe harbor the way some other frameworks do (the TCPA's established business relationship exemption is the closest familiar comparison).
There is a limited defense for sellers who have accessed the DNC Registry and checked a number within 31 days before calling it. [9] That defense predates 89 FR 99069 and the 2024 amendments didn't materially change it. It applies to DNC violations, not to consent violations for prerecorded calls.
For the new prerecorded call consent requirements, there's no parallel safe harbor. Call without valid consent and the violation is complete, good intentions or not. The FTC has historically weighed remediation and cooperation when calculating penalties, but that's prosecutorial discretion, not a legal defense you can bank on.
The most defensible position is documented compliance: records showing consent was obtained, when, how, and from whom. In any investigation or civil action, the burden shifts meaningfully once you can produce a clean consent record. Without one, you're arguing a negative, and that's a bad place to stand.
What is the timeline for the 2024 TSR rule, and what was the rulemaking process?
The FTC opened this rulemaking with an Advance Notice of Proposed Rulemaking in 2022. The NPRM landed as 89 FR 26760 in April 2024, asking for public comment on the proposed changes. [3] The agency took in thousands of comments from industry groups, consumer advocates, state attorneys general, and individual businesses.
The final rule, 89 FR 99069, published December 10, 2024. Most provisions took effect January 27, 2025, which gave companies about 48 days from publication to meet the core consent and disclosure requirements. Recordkeeping changes had a longer window, with some provisions phased in through mid-2025.
The short gap between publication and effective date drew criticism from several industry groups who argued 48 days wasn't enough to rebuild consent infrastructure. The FTC's answer, in the final rule's preamble, was essentially that the NPRM had put companies on notice more than eight months earlier and that the changes tracked principles the agency had been signaling for years.
More amendments are likely. The FTC left several areas open in the preamble, including expanded text messaging requirements and further restrictions on lead generation. Treat 89 FR 99069 as one big step in an ongoing process, not the finish line.
Frequently asked questions
What is 89 FR 99069?
89 FR 99069 is the Federal Register citation for the FTC's December 2024 final amendments to the Telemarketing Sales Rule. Published December 10, 2024, it tightens consent for prerecorded and AI-voice calls, narrows the B2B exemption, extends recordkeeping to five years, and raises civil penalties to $51,744 per violation. Most provisions took effect January 27, 2025.
What is the difference between 89 FR 26760 and 89 FR 99069?
89 FR 26760 is the April 2024 Notice of Proposed Rulemaking, where the FTC proposed changes and invited public comment. 89 FR 99069 is the December 2024 final rule, published after the FTC reviewed those comments and finalized its decisions. The NPRM is background; the final rule is what's legally binding.
Does the updated TSR apply to text messages?
Yes. The FTC reads the TSR to cover text messages used to induce a purchase, because they qualify as telephone solicitations under the rule's definition. The 2024 amendments don't add a separate SMS section, but the consent, disclosure, and DNC requirements that apply to voice calls apply equally to text-based telemarketing.
What consent is required for prerecorded calls under the new TSR?
You need signed written consent (electronic signatures count) obtained before the call, from the specific consumer, naming your specific company, and covering the product or service offered. Blanket consents obtained by third-party lead generators that don't name your company no longer satisfy the standard under 89 FR 99069.
How long do I need to keep consent records under the 2024 TSR?
Five years. The 2024 amendments extended the prior 24-month requirement to five years for consent records. You have to retain the consumer's identity, the date and time of consent, the specific product or service covered, the consent method, and the specific seller identified. Records must be retrievable on demand.
Does the TSR apply to B2B sales calls?
Mostly no, but the B2B exemption was narrowed in 2024. Calls between genuine businesses are still largely exempt. The change is that you now need a reasonable basis to believe you're calling someone in a business capacity. Call a business contact to pitch a personal product (personal insurance, personal finance) and the exemption likely doesn't apply.
What are the civil penalties for violating the TSR in 2024?
Up to $51,744 per violation as of 2024, adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act. Each call is a separate violation. State attorneys general can also bring separate enforcement actions under their own statutes, which multiplies the exposure fast.
How does the TSR interact with the TCPA?
They're separate laws enforced by separate agencies. The TCPA (47 U.S.C. § 227) is enforced by the FCC and allows private lawsuits. The TSR is enforced by the FTC and state AGs. A single bad outbound call can violate both at once. TCPA compliance doesn't mean TSR compliance, or vice versa. Audit both.
Does the TSR cover AI-generated voice calls?
Yes. The 2024 amendments pull artificial voice calls under the same consent framework as traditional prerecorded messages. The FTC's reasoning is that consumers can't reliably tell AI-generated voices from human agents, so the same protections apply. You need the same written prior consent for AI-voice calls as for prerecorded messages.
What happened to the FCC's one-to-one consent rule and how does that affect TSR compliance?
The FCC's one-to-one consent rule was vacated by the Eleventh Circuit in January 2025 (Insurance Marketing Coalition v. FCC). The FTC's TSR, which includes a similar requirement that consent name a specific seller, was not affected by that ruling. The TSR's consent specificity requirement stays in effect independently of what happened at the FCC.
Who enforces the Telemarketing Sales Rule?
The FTC is the primary federal enforcer. State attorneys general also have authority to bring civil actions under the TSR for state residents, and many are active here. Unlike the TCPA, the TSR does not create a private right of action for individual consumers, so enforcement comes from government agencies, not class-action plaintiffs.
Does the 31-day DNC safe harbor still apply after the 2024 amendments?
Yes. The defense for sellers who access the DNC Registry and check a number within 31 days before calling it was not materially changed by 89 FR 99069. That safe harbor applies to DNC-specific violations. It doesn't extend to prerecorded call consent violations or other substantive TSR requirements.
What industries are most affected by the 2024 TSR changes?
Lead generation companies, insurance sellers, mortgage originators, debt relief firms, home services companies, and anyone using prerecorded or AI-voice technology in outbound campaigns. The narrowed B2B exemption also hits financial services and benefits companies that call business contacts for individually-targeted pitches.
When did the 2024 TSR changes take effect?
Most provisions took effect January 27, 2025, 48 days after the rule published on December 10, 2024. Some recordkeeping provisions had a longer window into mid-2025. If your team hasn't updated consent forms and recordkeeping systems since then, you're currently operating outside the rule's requirements.
Sources
- Federal Trade Commission, Federal Register Vol. 89 No. 237, Telemarketing Sales Rule Final Amendments: 89 FR 99069 published December 10, 2024; most provisions effective January 27, 2025; requires signed written consent before prerecorded telemarketing calls and five-year recordkeeping
- FTC, Telemarketing Sales Rule (16 C.F.R. Part 310): TSR created under 15 U.S.C. § 6101 et seq.; applies to telephone solicitations including text messages used to induce a purchase
- Federal Register Vol. 89 No. 73, FTC Telemarketing Sales Rule NPRM (89 FR 26760): 89 FR 26760 is the April 2024 NPRM proposing amendments that were finalized as 89 FR 99069
- Congress.gov, Telephone Consumer Protection Act (47 U.S.C. § 227): TCPA is codified at 47 U.S.C. § 227 and enforced by the FCC; allows private suits for $500 to $1,500 per call
- FTC, Civil Penalty Inflation Adjustments (Federal Civil Penalties Inflation Adjustment Act): TSR maximum civil penalty adjusted to $51,744 per violation as of 2024 under the Federal Civil Penalties Inflation Adjustment Act
- FTC, TSR B2B Exemption, 16 C.F.R. § 310.6(b)(7): TSR B2B exemption codified at 16 C.F.R. § 310.6(b)(7); 2024 amendments require reasonable basis to believe call is to a business
- U.S. Court of Appeals, Eleventh Circuit, Insurance Marketing Coalition v. FCC, No. 24-10277 (2025): Eleventh Circuit vacated FCC's one-to-one consent rule in January 2025, holding FCC exceeded statutory authority under TCPA
- FTC, National Do Not Call Registry, 16 C.F.R. § 310.4(b)(3)(iv): Sellers who access DNC Registry and check a number within 31 days have a limited defense for DNC violations
- FTC, FTC v. Caribbean Cruise Line, Inc., press release and case documents: FTC obtained $120 million judgment in Caribbean Cruise Line case partly under TSR enforcement
- Congress.gov, Telemarketing and Consumer Fraud and Abuse Prevention Act (15 U.S.C. § 6101): TSR was created under 15 U.S.C. § 6101 et seq., the Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994