Telemarketing Sales Rule (TSR): the complete compliance guide

Last updated 2026-07-09

What is the Telemarketing Sales Rule and who enforces it?

The Telemarketing Sales Rule is a federal regulation the FTC issued under the Telemarketing and Consumer Fraud and Abuse Prevention Act, 15 U.S.C. §§ 6101 to 6108. It lives at 16 CFR Part 310. The FTC first published it in 1995 and has amended it several times since, with big changes in 2003, 2010, 2012, and 2021. ^[1]

The FTC enforces the TSR. The Department of Justice can bring civil actions on the FTC's behalf, and state attorneys general can sue under the rule too. That last part bites. A state AG can file in federal court on behalf of state residents even if the FTC hasn't moved yet. ^[13]

The rule reaches two roles. A "telemarketer" is the person or entity placing calls. A "seller" is the person or entity whose goods or services are being sold. Both can be liable. If you hire an outsourced call center that breaks the TSR while selling your product, you as the seller still face exposure unless you took real steps to prevent the violations and cut ties once you knew.

The TSR generally leaves business-to-business calls alone, though some provisions (especially parts of the Do Not Call rules) touch certain B2B transactions. Purely inbound calls the consumer started are mostly exempt too. But if a caller responds to an ad for certain high-risk categories, those calls can slide back under coverage.

Here's the plain version. For any team doing consumer telemarketing, the TSR is the federal floor. Your state can stack more on top.

What calls and transactions does the TSR actually cover?

The TSR defines "telemarketing" as a plan, program, or campaign to induce purchases of goods or services by phone, where more than one interstate call is made. ^[1] That's broader than most people expect.

Covered: outbound sales calls, calls following up on a direct mail piece, upsell calls to existing customers, and in many cases prerecorded message calls (robocalls). The 2012 amendments tightened the robocall rules hard, requiring express written consent before a seller delivers a prerecorded telemarketing message to a residential line. ^[2]

Not covered, or only partly covered:

• Purely inbound calls where the consumer called you first, unless a regulated category is involved
• Calls that induce no purchase (political calls, pure surveys with no offer attached)
• Business-to-business calls in most circumstances
• Calls by tax-exempt nonprofits, though professional fundraisers calling for them are covered

One category people miss: for-profit telemarketers soliciting on behalf of charities fall under the TSR. The charity itself may be exempt. The hired caller is not.

The TSR also covers text messages sent for telemarketing purposes. The FTC treats SMS messages meant to induce a purchase as subject to the rule, and the FCC's parallel rules under the TCPA (47 U.S.C. § 227) add another layer. ^[3] A text-based sales campaign puts you in front of both agencies at once.

If your team does any cold calling to consumers, assume the TSR applies until you have a specific, documented reason it doesn't.

What disclosures does the TSR require on every call?

This is where teams slip. The TSR makes you disclose certain things promptly on outbound calls. "Promptly" means at the start of the call, before the pitch. ^[1]

Required disclosures:

1. The identity of the seller (the company the call is made for). 2. That the purpose of the call is to sell goods or services. 3. The nature of those goods or services. 4. If a prize promotion is involved, that no purchase is necessary to win, plus the odds of winning.

For free trial offers, the TSR makes you disclose every material term before the consumer agrees to the charge: the total cost, the deadline to cancel, and the amount you'll charge if the consumer doesn't cancel. This came straight out of the FTC's long fight with negative option marketing. ^[4]

Prerecorded calls carry an extra job. The message must include a phone number the consumer can call to land on the seller's internal Do Not Call list, and that number has to work during normal business hours. ^[2]

The TSR also bars calling anyone who told that seller to stop. Once a consumer says "don't call me," you honor it for at least 10 years. That's the seller-specific DNC duty, separate from the National Registry. ^[1]

For a cold call to clear the TSR, the rep opens with company name, purpose, and product category before the qualifying questions. Sounds obvious. Plenty of scripts front-load the pitch and bury the identity line. A good cold calling script works those disclosures into the first 15 seconds without sounding like a Miranda warning.

What does the TSR prohibit outright?

The prohibited practices section, 16 CFR § 310.4, is where enforcement actions get built. The FTC doesn't only fine companies for missing disclosures. It goes after conduct. ^[1]

Hard prohibitions:

• Calling anyone on the National Do Not Call Registry without written consent or an existing business relationship inside the past 18 months.
• Calling before 8 a.m. or after 9 p.m. local time at the consumer's location.
• Making a false or misleading statement to induce a sale.
• Threatening, intimidating, or using obscene language.
• Ringing a phone repeatedly to harass.
• Abandoning more than 3% of calls answered by a live person in any 30-day period, measured per campaign. Abandoning means connecting someone and then failing to connect them to a rep within two seconds of their greeting. ^[1]
• Using technology that blocks or misrepresents caller ID.
• Charging a consumer's account without express verifiable authorization.
• Processing a payment in a way built to make disputes hard.

The abandonment rule catches predictive-dialer teams who never realize they're over the line. If your dialer drops more than 3% of live-answered calls in any campaign across any 30-day window, that's a TSR violation per dropped call. ^[1]

Credit card laundering (running charges through a merchant account to hide the seller's true identity) is banned outright. The FTC has used this provision against payment processors that knowingly helped fraud.

The 2021 amendments widened the misrepresentation ban to name government impersonation and tech support fraud specifically. ^[5] If a rep claims a government tie or pretends to call from a tech company to fix a problem, that's a TSR violation and possibly criminal fraud.

How does the TSR interact with the National Do Not Call Registry?

The FTC runs the National Do Not Call Registry, and it wired the registry straight into the TSR. Under 16 CFR § 310.4(b)(1)(iii), calling a registered number is a TSR violation unless an exception applies. ^[1]

Two exceptions do most of the work:

1. Express written agreement. The consumer signed (electronic signatures count) a clear, conspicuous agreement to receive calls from your specific company. General consent buried in terms of service does not count. 2. Established business relationship (EBR). The consumer made a purchase, rental, or financial transaction with you within the past 18 months, or made an inquiry or submitted an application within the past 3 months. The EBR clock runs out on its own. ^[1]

Sellers must access the registry at least every 31 days and drop any number that has been registered for 31 days or more. ^[6] There's a built-in grace window: a number has to sit on the registry for 31 days before you must stop calling it. Once it crosses that mark, your list needs scrubbing against a fresh pull.

The FTC charges for registry access. As of 2024, the first area code is free, each additional area code costs $75 per year, and the national cap for all area codes is $18,936. ^[6]

Most of the eye-watering per-call penalties in enforcement actions trace back to this DNC piece. Every call to a registered number is its own violation.

For teams running cold calling at scale, scrubbing against the registry before every campaign is the price of entry. The tools are cheap. Skipping the step is not.

What are the TSR penalties and how does the FTC calculate them?

TSR civil penalties reach $53,088 per violation as of 2024, after the FTC adjusted the figure for inflation under the Federal Civil Penalties Inflation Adjustment Act. ^[7] Every call that breaks the rule counts as a separate violation. A campaign that places 10,000 DNC-registered calls isn't looking at one fine. It's looking at up to $530 million in theoretical exposure.

The FTC settles most cases. The settlements still land hard. A few real numbers from public FTC actions:

• In 2023, the FTC obtained a $48 million judgment against a student loan debt relief operation for TSR violations that included DNC breaches and misrepresentations. ^[8]
• In 2022, the FTC and DOJ reached a $225 million settlement (mostly suspended for inability to pay) against a telemarketer alleged to have made billions of illegal robocalls. ^[9]

The FTC can also win injunctive relief: a court order barring a company or individual from telemarketing entirely. Lifetime bans are real and get imposed. ^[8]

State attorneys general pile on. Several states run their own telemarketing laws with separate penalty structures, and a TSR breach often kicks off parallel state enforcement.

For TCPA violations (the FCC's parallel statute), statutory damages run $500 to $1,500 per call or text, and private individuals can sue. The two regimes overlap heavily. One illegal robocall can trigger liability under both. ^[3]

Nobody has clean public data comparing annual TSR actions to privately filed TCPA suits, but TCPA class actions clearly outnumber them because of the private right of action. TSR enforcement comes from the government. Fewer cases, far bigger dollar figures.

TSR vs. TCPA: what's the difference and do you need to follow both?

Short answer: you probably need to follow both. They come from different agencies and cover different ground, but they overlap heavily for anyone doing outbound telemarketing.

Feature	TSR (FTC)	TCPA (FCC)
Governing statute	15 U.S.C. §§ 6101-6108	47 U.S.C. § 227
Enforced by	FTC, state AGs	FCC, private plaintiffs, state AGs
Private right of action	No	Yes
Robocall/ATDS rules	Yes (prerecorded calls)	Yes (autodialer + prerecorded)
Calling hours	8 a.m., 9 p.m. local	8 a.m., 9 p.m. local
DNC Registry	Yes (built in)	Yes (cross-reference)
Per-violation max	$53,088 [7]	$500, $1,500 [3]
B2B coverage	Mostly exempt	Partial (cell phone rules apply)

The TCPA runs on private class action lawsuits, which is why it generates so much litigation. The TSR has no private right of action. Only the government sues under it. That does not make TSR violations safer. FTC judgments run large and often carry injunctions.

For teams using autodialers or prerecorded messages, both rulebooks apply at once. The FCC's TCPA consent rules tend to be stricter on the technology side, while the TSR gets more granular on disclosures and prohibited practices. Compliant campaigns satisfy both. ^[3][1]

The Supreme Court's 2021 ruling in Facebook v. Duguid narrowed the TCPA's definition of an automatic telephone dialing system, which eased the autodialer question for some callers. It changed nothing about TSR obligations. ^[10]

What are the TSR rules for prerecorded calls and robocalls?

Prerecorded telemarketing calls sit among the most heavily regulated outreach under both the TSR and TCPA. The 2012 TSR amendments say that before a seller delivers a prerecorded telemarketing message to a residential phone, the seller must have the consumer's prior express written consent to receive such calls from that specific seller. ^[2]

That consent must be:

• In writing (electronic records count)
• Signed by the consumer
• Clear that the consumer agrees to receive prerecorded messages from the seller
• Free of any condition that ties it to a purchase

"Prior express written consent" under the TSR mirrors the standard the FCC adopted for the TCPA for prerecorded calls and texts to cell phones. The words line up even though the statutory sources differ.

Prerecorded messages under the TSR must also:

• State the seller's identity at the start of the message
• Include a phone number the consumer can call to join the seller's DNC list
• Include an automated, interactive opt-out available during the call

That last one matters. A robocall has to give the consumer a way to opt out during the call itself, more than a number to ring back later. If your message says "press 9 to be removed," that keypress has to actually work and process the opt-out on the spot. ^[2]

AI voice agents and AI-generated calls are the new frontier. The FCC ruled in February 2024 that AI-generated voices in robocalls need the same consent as any other prerecorded call under the TCPA. The FTC's TSR position follows the same logic. ^[11] If you're eyeing AI cold calling tools, the consent bar doesn't drop just because a machine is talking.

What records does the TSR require you to keep?

The TSR spells out a recordkeeping duty at 16 CFR § 310.5. Sellers and telemarketers keep records for 24 months from the date each one is created. ^[1]

Required records include:

• Advertising and promotional materials
• Sales records (name, address, phone, amount paid, description of goods or services, transaction date)
• Employee records (names, any fictitious names used, phone numbers, addresses)
• All verifiable authorizations for payment
• All consumer complaints, whether they came to you directly or through a third party
• All DNC requests and a list of the numbers you've suppressed
• Copies of scripts and other documents used in sales presentations

The 24-month window is the part people underrate. When the FTC opens an investigation, it wants documentation. Companies that can't produce call records, consent records, or DNC suppression logs have a much harder time defending themselves.

DNC compliance runs longer. The FTC expects a company-specific DNC list, and you honor requests on it for 10 years. That 10-year duty outruns the 24-month general window, so your internal suppression list needs its own long-term storage.

In practice, most modern CRMs and dialers log call records automatically. The gap is almost always consent documentation. If your team collects consent online before calling, keep the timestamp, the IP address, and the exact language the consumer saw. Screenshot it. That record is your defense.

LeadCompliant's free compliance kit includes a TSR recordkeeping checklist with the specific fields the FTC looks for in investigations, if you want a starting template.

Are there TSR exemptions your business might qualify for?

Several categories of calls sit outside TSR coverage entirely or qualify for partial exemptions. Knowing which ones fit your business shapes your whole compliance program.

Full exemptions:

• Calls between businesses where no consumer is the ultimate buyer (pure B2B)
• Calls from a company to its own employees
• Calls by newspaper publishers soliciting subscriptions from prior subscribers
• Calls entirely within one state (no interstate element), though state law will likely cover these
• Calls by tax-exempt nonprofit organizations (their hired fundraisers are not exempt)

Partial exemptions (some TSR provisions apply, others don't):

• Calls in response to a consumer's prior inquiry: the identity and purpose disclosure rules relax, but DNC and prohibited-practices rules still apply
• Calls to consumers with an existing business relationship: DNC Registry restrictions lift for 18 months after the transaction, but every other TSR provision still applies

One trap: the EBR exemption only covers the specific customer who had the relationship. You can't borrow one customer's EBR to call a referral they handed you.

In what is cold calling in sales terms, a true cold call to a consumer with no prior relationship and no consent is the highest-risk call you can place under the TSR. The exemptions do nothing for you there.

International calls get messy. If you're calling into the U.S. from a foreign call center on behalf of a U.S. seller, the TSR still binds the seller. The FTC has chased foreign operations by going after the U.S. seller and the U.S.-based payment processors involved.

How do you build a TSR-compliant outbound process in practice?

Compliance isn't one checkbox. It's a set of habits baked into how your team dials, scripts, and logs every call. Here's what holds up.

Before the campaign: 1. Scrub your list against the National DNC Registry (updated within the last 31 days). Then scrub against your own internal DNC list. Both are required. ^[1] 2. Confirm your calling hours stay inside 8 a.m. to 9 p.m. at the consumer's local time. For national campaigns, that means tracking every U.S. time zone. 3. Document consent for any numbers where you're leaning on prior express written consent instead of an EBR. 4. Review your script for the required disclosures: company name, purpose, and product nature in the first few exchanges. A good cold call script folds these in without sounding like fine print.

During calls: 5. Keep your dialer's abandonment rate under 3% per campaign across any 30-day rolling window. Pull that report weekly, not monthly. 6. Train reps on the prohibited practices list. The ban on threats and harassment sounds obvious. The rules around negative option offers and upsell disclosures are subtler and need real training. 7. Capture verbal DNC requests in real time. The system logs the timestamp and the agent who took it.

After the campaign: 8. Honor DNC requests within 30 days. Add the number to your internal suppression list. ^[1] 9. Store records for 24 months minimum. Keep consent documentation as long as you might rely on that consent. 10. Review complaint data. The TSR makes you keep consumer complaints, so read them for patterns before the next campaign.

For a team building this from zero, the cold calling definition matters more than it looks: know what kind of call you're making before you decide which rules apply. Mixing inbound-response calls with cold calls in your procedures is how gaps open.

LeadCompliant offers a free TSR and TCPA checklist at leadcompliant.com covering the pre-call, during-call, and post-call steps above, if you want a printable version.

What have recent FTC enforcement actions taught us about TSR risk?

Real FTC cases tell you more than the regulation text does. A few patterns repeat across enforcement actions.

Robocall volume is the clearest aggravating factor. The FTC's largest TSR cases run into the billions of calls. The 2022 action against Urth Access LLC and connected entities alleged roughly 5 billion illegal robocalls over three years. ^[9] Enforcement chases volume and harm.

Payment processing involvement widens liability. In case after case, the FTC has named payment processors and lead generators alongside the direct seller. If you're buying leads from a vendor whose collection practices are shaky, your downstream use can pull you in. The FTC's position is that sellers can be held responsible for a telemarketer's violations when they gave substantial assistance while knowing or consciously avoiding knowledge of the violations. ^[1]

Tech support scams and government impersonation are priority targets. The 2021 amendments and the enforcement that followed make clear these aren't fringe cases the FTC lets slide. The agency files suits and seeks asset freezes within days of spotting them.

Defendants rarely win outright. Most TSR civil actions settle. Injunctions are common. Individual officers and owners get named as defendants and held personally liable on a regular basis. "I didn't know the call center was doing that" has failed as a defense when the facts show the seller took the money.

The takeaway for legitimate outbound teams is narrow and useful. Document that you scrubbed the list, that you trained the reps, and that you handled complaints. Those records are what separate an honest oversight from a willful violation when the FTC comes knocking.

Frequently asked questions

According to the Telemarketing Sales Rule, what time can telemarketers call consumers?

The TSR limits outbound telemarketing calls to between 8 a.m. and 9 p.m. local time at the consumer's location. You have to localize by the consumer's time zone, not your call center's. Calling a consumer in Los Angeles at 6 a.m. Pacific while your team sits in New York at 9 a.m. Eastern is a TSR violation. Each out-of-hours call is a separate violation with a per-call penalty up to $53,088.

What is the difference between the TSR and the TCPA?

The TSR is an FTC rule under 15 U.S.C. §§ 6101-6108, focused on deceptive and abusive telemarketing, disclosures, and Do Not Call compliance. The TCPA (47 U.S.C. § 227) is an FCC statute focused on autodialer and prerecorded call technology. The TCPA allows private class action lawsuits; the TSR does not. Most outbound B2C teams need to satisfy both, since one robocall campaign can violate either or both.

Does the TSR apply to text messages?

Yes. The FTC treats SMS messages sent to induce a purchase as telemarketing under the TSR. The FCC's TCPA rules add parallel requirements for texts, including consent for messages sent with an autodialer or a prerecorded or artificial voice. Running a promotional text campaign puts you in front of both agencies. Treat text campaigns with the same consent documentation and DNC scrubbing you'd apply to voice calls.

What is the National Do Not Call Registry and how does the TSR enforce it?

The National DNC Registry, run by the FTC, lets consumers register numbers they don't want telemarketing calls on. Under 16 CFR § 310.4(b)(1)(iii), calling a registered number is a TSR violation unless you have express written consent from that consumer or an established business relationship (purchase within 18 months or inquiry within 3 months). Sellers must scrub their call lists against the registry at least every 31 days.

What is the TSR call abandonment rule?

Under the TSR, a telemarketer using a predictive dialer cannot abandon more than 3% of calls answered by a live person in any 30-day period, measured per campaign. Abandonment means connecting a consumer and then failing to connect them to a rep within two seconds of their greeting. Each abandoned call above that threshold is a separate TSR violation. Teams running high-volume predictive dialers should pull abandonment reports at least weekly.

How long do you have to honor a Do Not Call request under the TSR?

Once a consumer asks not to be called, the TSR requires you to honor that request for at least 10 years on your internal (seller-specific) DNC list. This is separate from the National DNC Registry. You must stop calling within 30 days of the request and add the number to your suppression list. The 10-year retention duty exceeds the TSR's general 24-month recordkeeping window, so it needs dedicated long-term storage.

What disclosures does the TSR require at the start of a telemarketing call?

The TSR requires telemarketers to promptly disclose: (1) the identity of the seller the call is made for, (2) that the purpose of the call is to sell goods or services, and (3) the nature of those goods or services. These come before the sales pitch. For prize promotions, callers must also state that no purchase is necessary and disclose the odds of winning. Prerecorded messages must include an automated opt-out mechanism.

What is 'express verifiable authorization' under the TSR?

Before charging a consumer's payment method, the TSR requires express verifiable authorization. You can get it through an audio recording of the consumer's oral agreement, a written authorization signed by the consumer, or a written confirmation sent before charging if payment is by check. The authorization must confirm the consumer's identity, the payment terms, and the specific date or dates of the charges. Skip this and the charge itself becomes a TSR violation.

Are B2B calls exempt from the TSR?

Most purely business-to-business calls fall outside TSR coverage, since the rule targets consumer transactions. The exemption has limits. If a seller markets goods or services usable for personal as well as business purposes, the call may still be covered. The DNC Registry rules generally don't apply to B2B calls, but other TSR provisions on fraud and deception can still bite if consumers end up harmed. When in doubt, ask an attorney.

What records does the TSR require sellers to keep?

Under 16 CFR § 310.5, sellers and telemarketers must retain records for 24 months from the date of creation. Required records include advertising materials, sales transaction records, employee records, payment authorization documentation, all consumer complaints, DNC suppression lists, and call scripts. The internal DNC list must be kept for 10 years. Being unable to produce these records during an FTC investigation badly weakens any defense.

Can individuals, rather than just companies, be held personally liable under the TSR?

Yes. The FTC routinely names individual corporate officers, owners, and managers as defendants in TSR actions. Personal liability attaches when someone either directly took part in the violations or had authority to control the company's practices and knew (or consciously avoided knowing) about them. Courts have entered injunctions and money judgments against individuals that bar them personally from the telemarketing industry.

What is the TSR penalty per violation in 2024?

The civil penalty ceiling for TSR violations is $53,088 per violation as of 2024, after inflation adjustments under the Federal Civil Penalties Inflation Adjustment Act. Each illegal call is a separate violation. The FTC doesn't impose the maximum in every case, but multi-call campaigns produce staggering exposure. The $53,088 figure applies to FTC TSR actions. TCPA statutory damages run separately at $500 to $1,500 per call under 47 U.S.C. § 227(b)(3).

Does the TSR cover AI-generated voice calls?

Yes. An AI-generated voice in a prerecorded telemarketing message is still a prerecorded message under both the TSR and TCPA. The FCC ruled in February 2024 that AI-generated voices in robocalls need the same prior express written consent as any other prerecorded call. The FTC's parallel TSR requirements apply equally. Using an AI voice agent doesn't change your consent obligations. It just automates the delivery of a message that still has to meet every disclosure and consent rule.

What is 'substantial assistance' liability under the TSR?

Under 16 CFR § 310.3(b), it's a TSR violation to provide substantial assistance or support to a seller or telemarketer when you know (or consciously avoid knowing) they're breaking the TSR. The FTC has used this against lead generators, payment processors, and technology vendors that enabled illegal telemarketing. If you supply call lists, payment processing, or software to a violating operation, you can face liability even if you never place a call.

Sources

1. FTC, Telemarketing Sales Rule, 16 CFR Part 310: TSR requirements for disclosures, prohibited practices, calling hours (8am-9pm), call abandonment (3%), internal DNC list (10 years), and recordkeeping (24 months)
2. FTC, 2012 TSR Amendments on Prerecorded Calls: 2012 amendments require prior express written consent before delivering prerecorded telemarketing messages to residential phones and require interactive opt-out mechanisms
3. FTC, Rules on negative option and free trial offers: TSR requires disclosure of all material terms of free trial and negative option offers before the consumer consents to the charge
4. FTC, 2021 TSR Amendments: 2021 amendments expanded TSR prohibitions to specifically cover government impersonation and technical support fraud
5. FTC, National Do Not Call Registry for Business: First area code free; additional area codes $75 each per year; national access cap $18,936; must scrub at least every 31 days; registry access required before calling registered numbers
6. FTC, Civil Penalty Adjustments (Federal Civil Penalties Inflation Adjustment Act): TSR civil penalty maximum is $53,088 per violation as of 2024 after inflation adjustment
7. FTC, Press Release: FTC Action Against Student Loan Debt Relief Operation, 2023: $48 million judgment obtained against student loan debt relief operation for TSR violations including DNC violations and misrepresentations
8. FTC and DOJ, Press Release: $225 Million Settlement for Illegal Robocalls, 2022: $225 million settlement against telemarketer alleged to have made billions of illegal robocalls over three years
9. U.S. Supreme Court, Facebook, Inc. v. Duguid, 592 U.S. ___ (2021): 2021 ruling narrowed the TCPA definition of an automatic telephone dialing system; did not affect TSR obligations
10. FTC, Telemarketing and Consumer Fraud and Abuse Prevention Act, 15 U.S.C. §§ 6101-6108: Statutory authority for the TSR; state attorneys general authorized to bring civil actions in federal court on behalf of state residents