How to transition from cold calling to warm calling compliantly

Last updated 2026-07-11

What is the difference between cold calling and warm calling, legally speaking?

A cold call goes to someone who never asked to hear from you and has no relationship with your business. A warm call goes to someone who gave you permission or has an established business relationship (EBR) with you. The EBR is usually a transaction or inquiry within the last 18 months for goods and services, or a financial transaction within the last 3 years for certain financial products.

The legal gap between the two is huge.

The TCPA (47 U.S.C. § 227) draws a hard line between residential lines and cell phones. For residential landlines, calling someone on the National Do Not Call Registry is the main risk. For cell phones, the statute bans using an automatic telephone dialing system (ATDS) or a prerecorded voice without prior express consent ^[1]. That consent requirement is what makes the cold-to-warm shift so useful. Once you have consent, you have a documented defense.

An EBR gives you a limited carve-out for residential landline calls under the FTC's Telemarketing Sales Rule and FCC rules. It does not override a consumer's specific do-not-call request, and courts have been inconsistent about whether it protects ATDS calls to cell phones. The safe read: treat cell phone marketing outreach as always requiring prior express written consent, full stop ^[2].

The legal difference is bigger than politeness. It is the difference between having a statutory defense and having nothing to stand on.

Why does shifting to warm calling reduce your TCPA lawsuit risk?

TCPA cases are built to favor plaintiffs. Statutory damages start at $500 per violation and jump to $1,500 if a court finds willfulness ^[1]. Class actions multiply those numbers fast. The Cash App TCPA class action settlement and the Credit One TCPA settlement both show companies paying tens of millions because they could not prove consent or proper DNC scrubbing on their outbound lists.

Warm calling shrinks that exposure in three concrete ways.

Documented consent is your primary affirmative defense. If a plaintiff claims they never wanted your calls, you produce the signed form, the web submission record, or the recording where they opted in. The case gets much harder to pursue.

Warm lists are almost always smaller and better maintained than cold bought lists. Fewer numbers dialed means fewer chances to hit a reassigned number, a DNC registrant, or a plaintiff's attorney sitting on ten recycled phone numbers.

Warm calling forces process discipline. You need a CRM, consent timestamps, scrubbing workflows, and training. That documented infrastructure signals good faith if you ever get sued. Courts and the FCC both look at whether you ran a compliance program.

Nobody has clean data on exactly how much warm-list dialing cuts litigation frequency versus cold-list dialing, because most companies never publish their call practices. The directional evidence from settlement disclosures is clear enough. The companies paying nine-figure TCPA judgments were overwhelmingly running high-volume cold outreach to purchased lists with no documented consent.

What counts as prior express written consent for outbound calls and texts?

The FCC's 2012 TCPA Order tightened the definition a lot. Prior express written consent for autodialed or prerecorded marketing calls to cell phones has to be a signed written agreement (electronic signatures count) that clearly authorizes your company to call that specific number, using an ATDS or prerecorded voice, for telemarketing ^[2]. The consumer cannot be required to sign as a condition of purchase.

The FCC said the consent must be unambiguous and must identify the seller receiving it. A generic privacy policy that says "we may share your information with partners" does not cut it. Neither does a checkbox buried in fine print the consumer never actually saw.

For purely informational calls (appointment reminders, fraud alerts, package delivery notices), prior express consent without the "written" piece is enough. The moment the call carries any marketing element, you need the written version.

For text message marketing, the same written standard applies. Peer-to-peer SMS from a personal cell phone to an existing customer sits in a grayer zone, but if you push any volume through a platform, plan for the written consent bar.

Here is what good consent capture looks like in practice:

• A standalone checkbox on a web form (not pre-checked) that reads something like: "By checking this box, I agree to receive autodialed marketing calls and texts from [Company Name] at the number I provided. Consent is not required to purchase."
• A timestamp and IP address recorded at submission
• The exact language of the consent stored and retrievable by phone number
• A confirmation message sent to the consumer restating what they agreed to

If your inbound lead forms do not capture consent this explicitly, that is your first fix.

How do you build a warm contact list without buying cold data?

Small teams push back here: "We don't have leads with consent. That's why we cold call."

Fair. But you have more consent-eligible contacts than you think.

Start with your existing customers. Anyone who transacted with you in the last 18 months qualifies for the EBR carve-out on residential calls. If you collected their phone number during the transaction and they agreed to your terms, you likely have at least implied consent for informational calls. Review your intake forms to confirm.

Next, audit your inbound inquiry history. Web form submissions, chat transcripts, email replies, people who called you first. These are warm. They showed interest. Add consent language to every inbound form right now.

For net-new lead generation, the model changes. Instead of buying a list and dialing blind, you run inbound campaigns (paid search, content, referral programs) that drive people to opt-in forms. The economics look worse upfront. The liability profile is far better, and connect rates on people who raised their hand run well above cold lists.

If you do use a list vendor, demand a consent audit trail for every number. Ask for the exact consent language the consumer agreed to, the date and source, and confirmation they can produce it in litigation. Most list vendors cannot do this. If they cannot, do not use their list for cell phone dialing.

Scrub every list, warm or cold, against the National Do Not Call Registry before each campaign. The FTC requires DNC data no more than 31 days old for telemarketing calls ^[3]. Access the registry through the FTC's dedicated portal at telemarketing.donotcall.gov.

What DNC scrubbing steps are legally required before you dial?

DNC scrubbing is not optional and it is not a one-time task. Here is the minimum legal requirement for any outbound telemarketing campaign.

Federal National DNC Registry: scrub against data no more than 31 days old ^[3]. The FTC's registry access is at telemarketing.donotcall.gov. Annual fees apply based on the number of area codes you access, though the first five area codes are free ^[8]. See the do not call list for access details.

Your internal DNC list: FCC rules require you to maintain your own company-specific DNC list and honor opt-out requests within 30 days ^[1]. Someone who asked you to stop calling must never get another call. Keep this list indefinitely.

State DNC lists: many states run their own registries, some stricter than the federal one. Florida, Texas, Indiana, and Wyoming, among others, have state-specific rules that add requirements or shorten grace periods. Check every state where your contacts live.

Cell phone numbers: despite the common myth, there is no separate federal mobile phone do not call list. Cell phones sit on the National DNC Registry the same as residential landlines once registered. The bigger cell phone issue is the ATDS and consent requirement above.

Here is a simple scrubbing workflow:

Step	Tool/Source	Frequency
National DNC scrub	FTC telemarketing.donotcall.gov	Before each campaign, data max 31 days old
Internal DNC scrub	Your CRM	Before every dial session
State DNC scrub	State-specific portals	Before each campaign to that state
Reassigned numbers check	FCC Reassigned Numbers Database	Before each campaign
Litigator/TCPA plaintiff scrub	Third-party scrub services	Monthly or before large campaigns

The FCC opened its Reassigned Numbers Database in 2021 ^[4]. Calling a number reassigned to a new person who never consented is a TCPA violation even if you had consent from the previous holder. Check it.

How do you train your reps to verify consent before they dial?

Process without training fails. Your reps are the last line before a call goes out, and they need to know what they are looking for.

Every rep should be able to answer three questions before dialing any number:

1. Is this number on our internal DNC list? 2. Do we have documented consent for this number, and is it current? 3. When did we last speak to or hear from this person, and what was the context?

Build these checks into your CRM as required fields that must be confirmed before a call can be logged as initiated. Do not make it optional. If a rep skips the check and you get sued, that skip becomes evidence of willful disregard.

Warm calling also changes the script. Reps should name the reason the call is warm: "You filled out a form on our site last Tuesday asking about X" or "You're a current customer and I noticed Y." That opener does two things. It tells the consumer this is an expected call, and it reminds the rep to speak only to people with that relationship.

Record your calls where legally permitted. Single-party consent states allow recording with just the rep's knowledge. Two-party (all-party) consent states like California, Florida, and Illinois require notifying the consumer. Know your state rules. Recordings work as contemporaneous evidence if a consent dispute shows up later.

Run quarterly compliance reviews. Pull a random sample of calls, verify the consent was in the CRM before the call was made, and check that the script matched your approved language. Document these reviews. They matter in litigation.

What technology do you need to run a compliant warm-calling operation?

You do not need an expensive call center stack. A small outbound team can run a solid compliant warm-calling operation on a CRM, a consent management layer, and a DNC scrubbing integration.

CRM requirements: your CRM needs to store, per contact, the consent record (source, date, exact language), opt-out history, and a call log with timestamps. Salesforce, HubSpot, and most modern CRMs handle this with proper setup. The default setup in most CRMs does not capture consent correctly. You have to configure it.

Dialers: if you use a predictive or power dialer that autodials numbers without a rep manually starting each call, you may be operating an ATDS. The Facebook v. Duguid ruling narrowed the definition in 2021, but plaintiffs still argue ATDS status depending on your equipment ^[5]. The safest approach for cell phone outreach is click-to-call dialing, where the rep manually starts every call. Slower, yes. But it drops ATDS exposure hard.

DNC scrubbing integrations: several services plug into your CRM or dialer to run real-time DNC scrubs before a call connects. Worth the cost. Services that also flag known TCPA litigants add a layer many small teams skip.

Consent capture: your web forms, landing pages, and intake tools need consent language that meets the FCC standard. Have a lawyer review the exact wording once. The legal review costs almost nothing next to a single TCPA settlement.

LeadCompliant's free compliance tools help you check numbers and flag DNC issues before you dial. Think of it as a pre-flight checklist for your outbound list, handy in the middle of a cold-to-warm transition when your lists are mixed.

Documentation storage: keep consent records somewhere you can pull a specific record by phone number in hours, not days. When a demand letter lands, response speed matters.

How do you handle the transition period when your list is a mix of cold and warm contacts?

Most teams are not starting from zero. You have an existing list, some contacts are warm, some are cold, and you need to sort which is which before your next campaign.

Here is the practical approach.

Segment by source first. Separate contacts who came through inbound channels (filled out a form, called you, replied to an email) from contacts who came through outbound list purchases or manual prospecting. The inbound group is almost certainly warmer and may already have consent. The purchased group needs scrutiny.

For the inbound group, go back to whatever capture mechanism brought them in. Review the form they filled out. If there was no consent checkbox, or the form just grabbed contact info without explicit telemarketing consent language, you have partial warmth but not documented ATDS consent. For landline calls, the EBR may protect you if they inquired within 18 months. For cell phones, with no documented consent for autodialed calls, treat them as cold for ATDS purposes.

For the purchased or cold group, your realistic options are:

• Scrub them hard against DNC and litigant databases and use only manual click-to-call (not ATDS) for any remaining calls
• Run a re-engagement campaign by email first to get them to opt in before you call
• Retire the list and replace it with consent-captured leads over time

Buying a list and dropping consent language into a follow-up email does not create retroactive TCPA consent. The FCC has been explicit that consent has to come before the call.

Expect the transition to take three to six months if you run meaningful outbound volume. The list shrinks. Connect rates climb. Litigation risk drops. That trade is worth it.

What are the biggest compliance mistakes teams make during this transition?

These are the errors that show up in demand letters and class action complaints.

Assuming an EBR covers cell phone ATDS calls. It does not. The EBR carve-out applies to residential line calls under the federal DNC rules. For autodialed or prerecorded calls to cell phones, you need prior express written consent no matter the prior relationship ^[2].

Using consent from a third-party lead generator without verifying it. If a lead gen company promises "TCPA-compliant leads" but cannot show you the specific consent language the consumer signed, that language naming your company, and a retrievable record of it, that is not defensible consent. The FCC has said the consent must identify the specific seller ^[2]. Generic consent to "marketing partners" has been rejected by courts.

Not honoring internal DNC requests fast enough. Federal rules give you 30 days to process a do-not-call request, but California's state rules can be stricter. Build opt-out processing as an immediate workflow, not a monthly batch job.

Using a predictive dialer for cell phones without understanding ATDS exposure. Post-Facebook v. Duguid, the ATDS definition narrowed, but the litigation risk did not vanish ^[5]. Some plaintiffs still win on ATDS claims, and prerecorded voice calls to cell phones face a separate strict liability standard. Know what your dialer actually does at the technical level.

Skipping the Reassigned Numbers Database. This is a newer requirement many teams never built into their process. A reassigned number violation carries the same damages exposure as any other TCPA violation ^[4].

Running with no written compliance policy. The FCC and courts look for evidence of good faith compliance effort. A written internal policy, even a simple one, helps establish that. No written policy is much harder to defend.

How do state laws affect your warm-calling compliance requirements?

Federal TCPA compliance is the floor, not the ceiling. Several states have passed laws stricter in meaningful ways, and the trend runs toward more state regulation, not less.

California's CCPA and its amendments (CPRA) give consumers rights over data that affect how you can use contact information for outreach ^[6]. If you call California residents, understand whether your lead data qualifies as personal information under CCPA and whether your consent language meets both TCPA and CCPA standards.

Florida's Telephone Solicitation Act (Mini-TCPA), effective July 2021, is one of the most aggressive state laws in force ^[7]. It bans using an auto-dialer for calls or texts to Florida area codes without prior express written consent, and it allows a private right of action with statutory damages of $500 to $1,500 per violation, mirroring the federal TCPA. Florida has turned into a hotspot for TCPA-style litigation under state law.

Texas, Indiana, and Wyoming run their own DNC registries with access requirements separate from the federal registry. Pull these separately before calling into those states.

Washington State passed legislation in 2024 adding restrictions on commercial communications that overlap with TCPA-style practices. The rules keep changing. Check with a compliance attorney when you expand to new state markets.

The safest operational approach is to build your program to the strictest applicable standard, which today usually means Florida plus federal TCPA. Then document that you applied those standards. Extra work upfront. It protects you when you dial into multiple states without segmenting by each state's rules.

How do you measure whether the transition to warm calling is working?

Compliance is more than a legal question. It produces measurable operational outcomes, and tracking them tells you whether the transition is actually working.

Connect rate is the first signal. Cold list connect rates usually run in the 1 to 5 percent range for outbound B2C calls, depending on source quality. Warm lists with real consent and a recent trigger should hit 10 to 25 percent, though this swings by industry and time of day. If connect rates are not improving after the transition, your "warm" list may not be warm.

Complaint and opt-out rate tracks the other direction. A flood of "how did you get my number" reactions or immediate opt-out requests tells you the consent capture or list segmentation is off.

DNC scrub rejection rate shows how many contacts you strip before dialing. If 30 percent or more of your list hits DNC or internal suppression, that is useful: the scrubbing is working. If it stays that high, your lead sources need review.

Legal demand letters received is an obvious lagging indicator. Track them over time, including the implied volume from contacts who complain but never sue, and you get a trend line.

Cost per conversation shifts too. Fewer wasted dials against non-consenting contacts means reps spend more time on calls that matter. The transition often pays for itself in rep efficiency within three to six months, before you even count reduced legal risk.

Set a 90-day baseline when you start the transition so you have a real before and after.

Frequently asked questions

Does an established business relationship (EBR) let me call cell phones without consent?

No. The EBR exemption applies to residential landline calls under federal DNC rules. For autodialed or prerecorded calls to cell phones, you need prior express written consent regardless of any prior transaction. Courts have consistently applied this distinction. Treat any cell phone outreach through a dialer as requiring documented written consent, period.

Can I buy a TCPA-compliant lead list and start warm calling immediately?

Only if the vendor can show you the specific consent language the consumer agreed to, the date it was collected, and confirmation the consent names your company. Generic "opted in to marketing partners" consent has been rejected by courts. If the vendor cannot produce a retrievable per-number consent record, do not use that list for autodialed cell phone outreach.

How long does it take to build a warm list from scratch?

For most small outbound teams, building a meaningful warm base from inbound consent capture takes three to six months of consistent effort. Paid inbound campaigns speed it up. The list starts smaller than a cold purchased list, but connect rates run measurably higher and legal exposure drops sharply. Expect the volume-to-conversion economics to settle within two quarters.

What is the minimum consent language required on a web form?

The FCC requires the consumer to expressly agree, in writing, to receive autodialed or prerecorded marketing calls from your company at the number provided. The form must name your company, include a clear disclosure, and use an unchecked checkbox. Consent cannot be bundled as a purchase condition. Something like: "I agree to receive autodialed marketing calls/texts from [Your Company] at this number. Consent not required to purchase."

How often do I need to re-scrub my list against the National DNC Registry?

The FTC requires you to scrub against data no more than 31 days old before making telemarketing calls. In practice, run a fresh scrub at the start of each campaign cycle. If a campaign runs longer than 31 days, re-scrub mid-campaign. Access the registry at telemarketing.donotcall.gov. Annual fees apply based on area codes accessed; the first five area codes are free.

Does the Facebook v. Duguid Supreme Court ruling mean I can use a predictive dialer on cell phones now?

Not safely. The 2021 ruling narrowed the ATDS definition to systems using a random or sequential number generator, but it did not erase risk. Prerecorded voice calls to cell phones stay strictly regulated regardless of how the equipment is classified. Many plaintiff attorneys still argue ATDS status depending on the dialer's architecture. For cell phone outreach, manual click-to-call remains the safest approach.

What happens if I call a reassigned number where the previous holder gave consent?

It is still a potential TCPA violation. The FCC opened its Reassigned Numbers Database in 2021 to address exactly this. Consent from a previous number holder does not transfer to the new one. Check the FCC Reassigned Numbers Database before any campaign. The database lets callers confirm whether a number was reassigned since a given consent date.

Do I need separate consent for texts versus calls?

Yes, as a practical matter. The TCPA treats autodialed texts the same as calls for consent purposes, but consumers often expect to opt in separately to text versus voice. Your consent forms should name both channels explicitly if you plan to use both. Bundling them into one checkbox is legally defensible if the language is clear, but separate opt-ins give you cleaner records if one channel gets disputed later.

How do I handle a contact who consented but has gone quiet for 18 months?

The written consent does not expire automatically under TCPA rules, but an 18-month gap raises two issues. The EBR clock has reset for DNC exemption purposes. And the number may have been reassigned. Re-scrub against the FCC Reassigned Numbers Database and your internal DNC list before calling. If the number was reassigned, you cannot call it. If not, the original written consent is technically valid, but re-confirming interest by email first is a sensible precaution.

What records do I need to keep for TCPA compliance, and for how long?

Keep consent records for as long as you might call that number plus the statute of limitations, which is four years under TCPA's federal limitations period. If you call someone today on consent captured last year, hold those records at least five years from the call date. Store the consent source, exact language, timestamp, and phone number in a retrievable format. Keep call logs with timestamps on the same schedule.

Is warm calling to business numbers (B2B) subject to the same TCPA rules?

B2B calling has more flexibility. The TCPA's residential line provisions and DNC rules do not apply to business-to-business calls in most cases, and most cell phone cases involve consumer numbers rather than business lines. But if you call someone's personal cell for a business purpose, TCPA protections still attach to that number. The safest B2B practice is still to verify numbers and avoid autodialing cell phones without consent.

What should my internal DNC list include and how quickly must I honor opt-out requests?

Your internal DNC list must include every number from which you received a do-not-call request, by any channel: phone, email, web form, or verbal. Federal rules allow up to 30 days to process the request, but immediate suppression is the right operational target. Keep the list indefinitely and check it before every outbound campaign. Failing to honor an internal DNC request is a separate violation from the national registry issue.

How does Florida's Mini-TCPA change my warm-calling compliance for Florida numbers?

Florida's Telephone Solicitation Act, effective July 2021, applies to calls and texts to Florida area codes using an auto-dialer. It requires prior express written consent and carries $500 to $1,500 per-violation statutory damages, like the federal TCPA. Courts have allowed class actions under it. If you dial Florida numbers, your consent documentation and DNC scrubbing need to meet this standard independent of your federal baseline.

Can I use email to warm up cold contacts before calling them?

Yes, and it is one of the more practical transition strategies. Sending a cold contact an email asking them to opt in to calls does not violate the TCPA (CAN-SPAM governs email, not TCPA). If they reply and agree, document that agreement as your consent record before you dial. That turns a cold contact into a warm one with a real paper trail. It also filters out disinterested people before you spend rep time on them.

Sources

1. U.S. Government Publishing Office, 47 U.S.C. § 227 (Telephone Consumer Protection Act): TCPA statutory damages are $500 per violation, trebled to $1,500 for willful violations; the statute prohibits autodialed or prerecorded calls to cell phones without prior express consent
2. FTC, Complying with the Telemarketing Sales Rule: Telemarketers must scrub against National DNC Registry data no more than 31 days old before placing calls
3. FCC, Reassigned Numbers Database (reassigned.us official site): The FCC opened the Reassigned Numbers Database in 2021 to allow callers to verify whether a number has been reassigned to a new user since a given consent date
4. U.S. Supreme Court, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): Supreme Court narrowed the ATDS definition in 2021 to systems using random or sequential number generators, but did not eliminate TCPA risk for prerecorded voice calls
5. California Attorney General, California Consumer Privacy Act (CCPA): CCPA gives California residents rights over personal information including contact data used in outbound marketing; compliance affects consent and data use requirements
6. Florida Legislature, Florida Telephone Solicitation Act, Section 501.059, Florida Statutes: Florida's 2021 Mini-TCPA prohibits auto-dialed calls and texts to Florida area codes without prior express written consent, with $500-$1,500 statutory damages per violation
7. FTC, National Do Not Call Registry (Do Not Call Registry topic page): Telemarketers must access and maintain compliance with the National DNC Registry; first five area codes are free, fees apply for additional area codes
8. FTC, Telemarketing Sales Rule, 16 C.F.R. Part 310: TSR established business relationship exception for residential calls applies for 18 months after a transaction; does not override specific do-not-call requests