Telemarketing sales rule violations: how the FTC classifies them and what they cost

Last updated 2026-07-10

What is the Telemarketing Sales Rule and who does it cover?

The Telemarketing Sales Rule (TSR) is a Federal Trade Commission regulation. It took effect in 1995 and has been amended several times since, most recently in 2024 with new rules on AI-generated voice calls. ^[1] It applies to any person or company that engages in "telemarketing," defined in 16 C.F.R. § 310.2(gg) as "a plan, program, or campaign which is conducted to induce the purchase of goods or services or a charitable contribution" by means of interstate telephone calls. ^[2]

Run outbound sales calls across state lines and you're almost certainly covered. The rule also reaches sellers who don't dial themselves but cause calls to be made. That means your lead vendor or call center partner can drag you into an enforcement action even if none of your own employees ever touched a phone.

Some categories get narrower treatment. Business-to-business calls are partly exempt from the TSR's do-not-call provisions, though they still face the ban on deceptive and abusive practices. Inbound calls a consumer starts are generally outside TSR scope unless a misleading ad prompted the call. For how those B2B carveouts play out, see FTC Telemarketing Sales Rule, B2B calls, and AI voice in 2024.

The FTC shares enforcement with the FCC (which runs the TCPA) and state attorneys general. The TSR and the TCPA overlap in several places, especially around robocalls and do-not-call lists. They are separate laws with separate penalty structures, and a single call can trip both.

How does the FTC actually classify TSR violations?

The TSR sorts prohibited conduct into four buckets. Knowing which bucket a practice falls into matters, because it drives both enforcement priority and the legal theory the FTC writes into a complaint.

Bucket 1: Deceptive acts or practices (16 C.F.R. § 310.3)

This is the biggest category. It covers misrepresentations about goods, services, earnings claims, refund policies, prize promotions, and the seller's identity. The FTC treats deception as a top priority. A caller who lies about the total cost of a product, implies a government tie that doesn't exist, or hides material restrictions on a "free" offer sits squarely here. ^[2]

Bucket 2: Abusive telemarketing acts or practices (16 C.F.R. § 310.4)

This bucket is about how you call, not what you say. It covers calling numbers on the National Do Not Call Registry without a valid exemption, calling outside the 8 a.m. to 9 p.m. local-time window, abandoning calls (failing to connect a live rep within two seconds of the greeting on more than 3% of answered calls per campaign per day), failing to transmit caller ID, and using threats or intimidation. ^[2] For the details on calling hours, see FTC Telemarketing Sales Rule 8 a.m. to 9 p.m. local time: what it means for your team.

Bucket 3: Payment method restrictions (16 C.F.R. § 310.4(a)(2)-(9))

The TSR restricts advance-fee arrangements, bars certain payment methods in specific contexts (remotely created checks and cash-to-cash money transfers in telemarketing, for example), and prohibits collecting payment before services are delivered in debt relief and credit repair. This is where a lot of fraud-adjacent schemes get caught.

Bucket 4: Recordkeeping failures (16 C.F.R. § 310.5)

Sellers and telemarketers must keep records of advertising, sales, employees, and certain verification recordings for 24 months. Failing to hold those records is a separate, independently chargeable violation. This one trips small teams that delete call recordings or never track consent in the first place. ^[2]

What are the civil penalty amounts for TSR violations?

The FTC can seek civil penalties up to $53,088 per violation for conduct after January 13, 2025, up from $51,744 for conduct after January 10, 2023. The number climbs every year under the FTC's inflation adjustment, required by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015. ^[3] Every call, every deceptive statement, and every day of recordkeeping failure can count as a separate violation.

That math is not hypothetical. Enforcement actions against high-volume dialers stack penalties across millions of calls, which is how the FTC lands on nine-figure settlements. The FTC's 2023 action against a robocall operation ended in a $299 million judgment, one of the largest in TSR history, though most of it was suspended based on inability to pay. ^[4]

Suspended judgments are a pattern worth knowing. The FTC often wins a full judgment in the hundreds of millions, then suspends most of it when defendants show they can't pay. What actually gets collected varies a lot. But a suspended judgment still sits on your record, follows the principals into their next business, and can be reinstated in full if the FTC later finds someone lied about their finances.

For smaller operations, realistic exposure from an investigation is more likely in the $500,000 to $5 million range if the volume is moderate and there's no pattern of intentional fraud. Nobody has clean public data on median settlements for small defendants. The FTC publishes no fixed penalty schedule.

Violation category	Per-violation penalty ceiling (2025)	Common trigger
DNC call to registered number	$53,088	Calling without scrubbing
Calling outside 8am-9pm window	$53,088	Time zone errors
Call abandonment above 3%	$53,088	Predictive dialer misconfiguration
Deceptive representation	$53,088	False earnings, pricing claims
Payment method violation	$53,088	Advance fee for debt relief
Recordkeeping failure	$53,088 per day	No call logs retained 24 months

What is a franchise telemarketing sales rule violation and how is it enforced?

A franchise TSR violation happens when a franchisor's telemarketers, franchisee call centers, or lead vendors break TSR rules while selling franchise opportunities. The FTC's Franchise Rule and the TSR meet here in a way that catches people off guard: selling a franchise by phone means the TSR governs the sales process itself, so misrepresentations about earnings, costs, or the franchisor's obligations violate both frameworks at once. ^[5]

Franchise TSR enforcement usually turns on the FTC arguing that the franchisor is a "seller" under the rule, responsible for the acts of telemarketers it hired or authorized. The FTC has pursued franchise and business-opportunity sellers who made income claims by phone without adequate substantiation, which is a straight deception violation under Section 310.3. ^[6]

The key legal idea is "causing" a call. If your franchisee runs outbound calls to sell your brand's franchise and makes a misrepresentation, the FTC's position is that the franchisor can be liable as the "seller" that caused those calls. This is not a theoretical risk. The FTC's guidance on telemarketer and seller liability states that a seller "may be held jointly and severally liable for violations by a telemarketer acting on its behalf." ^[2]

Franchisors who think they're safe because a franchisee made the calls should read that language twice. Your exposure depends on whether you knew about the violations, whether you handed over scripts or training that produced them, and whether you exercised real oversight. Handing a franchisee a dialing script and then claiming ignorance is not a defense that holds. See what the telemarketing sales rule is designed to do (and what it costs to ignore it) for the wider view on TSR purpose and liability scope.

What triggers an FTC TSR enforcement action and how does investigation start?

Most TSR actions start with consumer complaints funneled through the FTC's Consumer Sentinel database, which logs millions of telemarketing complaints a year. ^[7] When complaint volume on a single entity spikes, or a pattern becomes visible, the FTC's Division of Marketing Practices opens an investigation.

State attorneys general are the other big trigger. Many states run their own mini-TSR statutes or telemarketing fraud laws that sit parallel to the federal rule. State AG offices sometimes investigate first, refer to the FTC, or run joint actions. The Telemarketing and Consumer Fraud and Abuse Prevention Act (15 U.S.C. §§ 6101-6108) specifically authorizes state AGs to bring civil actions in federal court on behalf of state residents. ^[9]

Investigations also start from industry referrals. Phone carriers increasingly use STIR/SHAKEN call authentication data to flag suspicious traffic. The FTC works with telecom partners through the USTelecom Industry Traceback Group to trace illegal robocall traffic back to its origin, and that process has produced enforcement actions with no consumer complaint as the starting point. ^[12]

Once an investigation opens, you're likely looking at a Civil Investigative Demand (CID), the FTC's version of a pre-suit subpoena. You'll get document requests covering call records, consent documentation, scripts, training materials, payment records, and vendor contracts. Your ability to answer a CID depends entirely on whether you kept the records the TSR requires. That's why the recordkeeping bucket is a bigger practical risk than most teams realize.

Can sellers be held liable for their telemarketing vendors' violations?

Yes, and this is one of the most misunderstood points in TSR compliance. Under 16 C.F.R. § 310.3(c), a seller is liable for a telemarketer's violations when the seller knew or consciously avoided knowing about them, or failed to take reasonable steps to stop them after being told. ^[2]

The "conscious avoidance" standard is what makes a vendor contract useless as your only shield. Putting "comply with all laws" in a lead vendor agreement creates no safe harbor. The FTC will ask what you actually did. Did you audit the vendor's scripts? Did you sample call recordings? Did you review their DNC scrubbing? If the answer is no across the board, you've likely met the conscious avoidance threshold yourself.

The FTC addressed seller liability in the lead generation context directly in its 2010 TSR amendments. Sellers who buy leads generated through telemarketing must take reasonable steps to confirm the lead generators comply with the TSR. ^[1]

Here's the practical version. Your vendor diligence checklist should include verified evidence of DNC scrubbing with dates, written consent documentation for the leads passed to you, a sample of recorded calls, and a contractual right to audit. If a vendor refuses any of those, the refusal is itself evidence of a problem. For the broader framework on what legal cold calling requires, that article covers the full range of permissible and impermissible practices.

What are the specific TSR rules on robocalls and AI voice calls?

The 2024 TSR amendment, finalized in 2024, added an explicit prohibition on AI-generated voice calls in telemarketing without prior express written consent from the called party. ^[1] The FTC's concern was plain: AI voice synthesis makes it far easier to deceive consumers about who they're talking to, and the old disclosure rules didn't account for how convincing synthetic voices had become.

Under the amended rule, a telemarketer using an AI-generated voice has to get prior express written consent before making the call. "Prior express written consent" under the TSR tracks the TCPA standard in substance: the consumer must have agreed to receive such calls from the specific caller, in writing (electronic form counts). The FTC's rulemaking record indicates a checkbox on a web form can satisfy this, as long as the disclosure is clear and the box is not pre-checked. ^[1]

The AI voice rule sits on top of the existing robocall provisions, not instead of them. Prerecorded messages without consent were already barred under TSR Section 310.4(b)(1)(v), which prohibits outbound calls delivering prerecorded messages unless the person called gave prior express written consent and the call includes an automated opt-out. The 2024 amendment extends those limits to AI-generated voices, including calls that open with a live human and then hand off to AI.

For teams running AI sales dialers or conversational AI platforms, this is a classification risk that lands in Bucket 2 (abusive practices) and Bucket 1 (deception, if the AI voice isn't disclosed). Both buckets apply at once when the call is unconsented and the AI nature is hidden.

How does TSR classification interact with TCPA liability?

The TCPA (47 U.S.C. § 227) and the TSR are different laws run by different agencies, the FCC and FTC. They overlap heavily on robocalls, autodialed calls, and do-not-call restrictions. ^[10] A single call can violate both at once, which doubles your exposure.

The TCPA creates a private right of action. Any individual consumer can sue without waiting for a government agency. Statutory damages run $500 per violation, or $1,500 if the violation is willful. ^[10] The TSR has no private right of action; only the FTC and state AGs can bring TSR cases. That gap matters. The FTC brings dozens of TSR cases a year. TCPA plaintiffs file thousands of suits annually.

Here's where they converge. If your calling violates the TSR's do-not-call provisions, it almost certainly violates the TCPA's DNC provisions too. An FTC action for TSR violations can then serve as evidence of willfulness in a parallel TCPA class action. That link can turn a manageable regulatory fine into a private litigation disaster.

For the quiet-hours rules that show up in both frameworks, TCPA quiet hours: what times you can and cannot call or text compares the calling-time windows and shows where they differ.

One more thing worth knowing. The National Do Not Call Registry is jointly administered by the FTC and FCC. Calling a number on the registry violates both the TSR and the TCPA's DNC provisions. You get no credit for not knowing it was there.

What defenses actually work against TSR violation charges?

The TSR's affirmative defenses are narrow and specific. For do-not-call violations, 16 C.F.R. § 310.4(b)(3) gives a safe harbor if the seller or telemarketer has (1) established and implemented written procedures to comply with DNC requirements, (2) trained personnel in those procedures, (3) monitored and enforced compliance, (4) scrubbed calling lists against the registry within 31 days before any call, and (5) absent more recent information, relied on the registry version of the list. ^[2]

That safe harbor works only if all five elements are present. Miss one and the protection is gone. The FTC has rejected safe harbor claims where sellers bought the registry list but couldn't show written procedures, training records, or monitoring evidence. Documenting your process matters as much as having one.

For deception charges, the main defense is substantiation. If you made a claim, you needed a reasonable basis for it before you made it. "We believed it was true" without supporting evidence does not satisfy substantiation.

The established business relationship (EBR) defense applies to DNC restrictions for existing customers. A consumer who bought from you within 18 months, or made an inquiry within 3 months, can be called even if they're on the DNC registry, unless they've told you not to call. But this defense belongs only to the entity with the relationship. Your lead vendor's relationship with a consumer does not pass to you.

For teams building or auditing these systems, LeadCompliant's free compliance kit includes templates for the written procedures the safe harbor requires, including DNC scrub logs and training attestation forms. Getting those documents in place before an investigation starts is the difference between a defensible position and no position at all.

What does a TSR enforcement action actually look like in practice?

The FTC's process usually runs in a sequence. First, staff investigation, which can go six months to two years before the target knows anything is open. Then, if staff recommends a case, the Commission votes to authorize a complaint. The FTC files in federal district court and often seeks a temporary restraining order and asset freeze at the same time in cases with ongoing fraud.

For less egregious, non-fraud cases, the FTC often pursues a consent agreement instead of litigation. The target negotiates a settlement that includes a civil penalty, injunctive provisions barring future violations, compliance monitoring (often 20 years), reporting obligations, and record retention mandates. The consent agreement is then published for public comment and finalized.

Recent actions show the range. A 2022 FTC action against a mortgage lead generator ended in a $7.5 million civil penalty and a permanent telemarketing ban for the principals. ^[4] A 2023 action against a health insurance telemarketing operation produced a $100 million judgment, largely suspended, with roughly $14 million actually paid. ^[4]

Principals of companies caught in TSR actions get named individually more often than not. Individual liability means the penalty can follow someone into their next business and can include bans on operating in specific industries. If you're a founder or sales manager at a company with aggressive outbound practices, your personal financial exposure in a TSR case is real, not abstract.

For companies trying to understand what their cold call practices expose them to, working the TSR's four buckets against your current scripts and dialer setup is the most direct way to size up the risk.

How should a small outbound team assess and reduce their TSR violation risk?

Start with the four buckets and map every part of your calling operation to each one. Most small teams have clean Bucket 1 (deception) practices because they're selling something real. Buckets 2 and 4 are where they get hurt: calling behavior and recordkeeping.

For Bucket 2, the non-negotiables are simple. Scrub against the National DNC Registry every 31 days. Scrub your internal DNC list on every campaign. Confirm time zones before calling, not after. Configure your predictive dialer's abandon-rate monitoring so you have daily visibility. Transmit caller ID on every call. Get written consent before any prerecorded or AI-generated message goes out.

For Bucket 4, keep call records and consent documentation for 24 months minimum. That 24-month retention is the floor, not the goal. If you sell high-risk products or have any franchise telemarketing pieces, keep records longer. Store them where you can produce them fast if a CID lands.

On the vendor side, ask for a copy of your lead vendor's DNC scrub log on every list purchase. If they can't or won't hand it over, that's your answer. Review at least a sample of recorded calls from any vendor calling on your behalf. Keep those samples.

Running AI cold calling programs? Add the 2024 TSR consent requirements on top of whatever TCPA consent process you already run. The two frameworks want similar documentation, but the TSR now specifically covers AI voice, so your consent language has to address that disclosure directly.

LeadCompliant's free tools include a DNC lookup checker and a calling compliance checklist that walks each TSR bucket. Neither replaces legal counsel, but mapping your actual practices to the specific regulatory text is the first thing any attorney will ask you to do anyway.

The most honest thing to say about small-team risk is this. The FTC is not hunting companies making 500 calls a day. Its enforcement resources go toward high-volume operations and clear fraud. But a state AG with an election coming up runs a different calculus, and TCPA plaintiffs' attorneys have no volume threshold at all. Documented TSR compliance does double duty: it lowers regulatory risk and gives you a defense posture for private TCPA litigation.

Frequently asked questions

What is the maximum civil penalty for a single TSR violation in 2025?

The FTC's civil penalty ceiling for a single TSR violation is $53,088, adjusted for inflation effective January 13, 2025. Each call, each misrepresentation, and each day of recordkeeping failure can count as a separate violation. The FTC does not cap the total number of violations it can charge, so a high-volume dialing operation can face aggregate penalties in the tens or hundreds of millions.

Does the Telemarketing Sales Rule apply to B2B calls?

Partly. B2B calls are exempt from the TSR's do-not-call provisions, so you can call a business even if its number is on the National DNC Registry. But the TSR's bans on deceptive practices and abusive calling behavior (threats, harassment, calling outside permitted hours) still apply to B2B telemarketing. The exemption is narrower than most teams assume.

What is a franchise telemarketing sales rule violation?

A franchise TSR violation happens when a franchisor or its agents use telemarketing to sell franchise opportunities and break TSR rules, most often through deceptive earnings or income claims made by phone without adequate substantiation. The FTC treats the franchisor as the "seller" responsible for calls made by franchisees or vendors acting on its behalf, so the franchisor can face TSR liability even for calls it never made directly.

How does the FTC determine seller liability for a telemarketer's TSR violations?

Under 16 C.F.R. § 310.3(c), a seller is liable for a telemarketer's violations when the seller knew or consciously avoided knowing about them, or could have stopped them and didn't. The conscious avoidance standard means that failing to monitor, audit, or verify your telemarketer's compliance can create liability even if you never instructed anyone to break the rule.

What records must a seller keep to comply with the TSR's recordkeeping requirements?

Section 310.5 of the TSR requires sellers and telemarketers to retain advertising and promotional materials, sales records including the name and address of each purchaser, employee records, and verification of express informed consent for prerecorded calls. All of these records must be kept for 24 months from the date of creation. Failure to hold them is a separately chargeable violation, and being unable to produce them during an FTC investigation is treated as evidence of non-compliance.

Does the 2024 TSR amendment change anything for teams using AI voice in sales calls?

Yes, significantly. The 2024 TSR amendment requires prior express written consent before using an AI-generated voice in any outbound telemarketing call. This applies even if a human starts the call and AI takes over. The rule also requires disclosure that the caller is using AI. Using AI voice without these steps is a Bucket 2 abusive practice violation and potentially a Bucket 1 deception violation at the same time.

Can an individual founder or sales manager be personally liable for TSR violations?

Yes. The FTC routinely names corporate officers and founders as individual defendants in TSR actions when those individuals had authority to control the business's calling practices and either took part in the violations or knew about them and failed to stop them. Individual liability can include civil penalties, disgorgement of personal funds, and industry bans that survive the closure of the corporate entity.

What is the safe harbor defense for do-not-call violations under the TSR?

The TSR's DNC safe harbor requires five elements: written compliance procedures, personnel training on those procedures, monitoring and enforcement of compliance, scrubbing calling lists against the National DNC Registry within 31 days before each call campaign, and reliance on the current registry version. All five must be documented and provable. Miss any one and the safe harbor is gone, and the FTC has rejected claims where sellers had some but not all elements in place.

How does an FTC TSR enforcement action actually get started?

Most actions start from consumer complaints in the FTC's Consumer Sentinel database, which logs millions of telemarketing complaints per year. Volume spikes on a single entity trigger staff investigation. State AGs also initiate or refer cases. More recently, STIR/SHAKEN call authentication data and the USTelecom Industry Traceback Group have given the FTC a technical pathway to identify illegal robocall origins without relying solely on consumer complaints.

What is the call abandonment rate limit under the TSR?

Section 310.4(b)(1)(iv) of the TSR caps the call abandonment rate at 3% of all calls answered by a live person, measured per campaign per day. An abandoned call is one where a live representative is not connected within two seconds of the called person's greeting. Predictive dialers that overfire and leave consumers with silence or dead air are the most common cause of abandonment violations.

Can a TSR violation also create TCPA liability?

Often, yes. A call that violates the TSR's DNC or robocall provisions typically also violates the TCPA's parallel provisions. The TCPA allows private lawsuits for $500 to $1,500 per call, while the TSR is enforced only by the FTC or state AGs. An FTC finding of TSR violations can be used as evidence of willfulness in a private TCPA class action, compounding the financial exposure.

Do the TSR's calling hours rules match the TCPA's?

Both the TSR and the TCPA restrict calls to the 8 a.m. to 9 p.m. window in the called party's local time. The standards are functionally the same, though set by different regulations: 16 C.F.R. § 310.4(c) for the TSR and 47 C.F.R. § 64.1200(c)(1) for the TCPA. Calling outside this window violates both at once.

What payment methods does the TSR restrict in telemarketing transactions?

Section 310.4(a) of the TSR bars telemarketers from accepting remotely created checks, cash-to-cash money transfers, and cash reload mechanisms in most telemarketing transactions. For debt relief and credit repair services, collecting fees before services are delivered is prohibited. These restrictions exist because those payment methods are disproportionately used in fraud and are hard to reverse once a consumer realizes they've been deceived.

How often must a company scrub its call list against the National DNC Registry?

The TSR requires scrubbing against the National Do Not Call Registry no more than 31 days before any call is made. That is a maximum interval, not a minimum: scrubbing more often reduces the risk that a newly registered number slips through. Most compliant teams scrub at campaign launch and again after 30 days if the campaign continues. The FTC's safe harbor requires evidence of scrubbing within that 31-day window to apply.

Sources

1. FTC, Telemarketing Sales Rule final rule amendments (2024 AI voice): The 2024 TSR amendment added explicit requirements for prior express written consent for AI-generated voice calls in telemarketing.
2. FTC, 16 C.F.R. Part 310 Telemarketing Sales Rule text: The TSR classifies prohibited conduct into deceptive acts (Section 310.3), abusive practices (Section 310.4), payment method restrictions, and recordkeeping failures (Section 310.5), with sellers jointly and severally liable for telemarketer violations.
3. FTC, Legal Library (civil penalty inflation adjustments): The FTC's civil penalty ceiling was $51,744 per violation for conduct after January 10, 2023, adjusted to $53,088 for conduct after January 13, 2025, under the annual inflation adjustment.
4. FTC, Cases and Proceedings database: Recent TSR enforcement actions include a $299 million judgment against a robocall operation (2023) and a $7.5 million civil penalty against a mortgage lead generator (2022).
5. FTC, Franchise Rule (16 C.F.R. Part 436) overview: The FTC's Franchise Rule and the TSR interact when franchise opportunities are sold by telephone, exposing franchisors to TSR liability for telemarketing conducted on their behalf.
6. FTC, Cases and Proceedings database: The FTC has pursued franchise and business-opportunity sellers who made income claims by phone without adequate substantiation, a deception violation under Section 310.3.
7. FTC, Consumer Sentinel Network Data Book 2023: The FTC's Consumer Sentinel Network receives millions of consumer fraud and telemarketing complaints annually, which serve as the primary trigger for TSR enforcement investigations.
8. U.S. Code, 15 U.S.C. §§ 6101-6108 Telemarketing and Consumer Fraud and Abuse Prevention Act: 15 U.S.C. § 6103 authorizes state attorneys general to bring civil actions in federal district court to enforce the TSR on behalf of their residents.
9. U.S. Code, 47 U.S.C. § 227 Telephone Consumer Protection Act: The TCPA provides statutory damages of $500 per violation, or $1,500 for willful violations, and creates a private right of action that the TSR lacks.
10. FTC, National Do Not Call Registry for businesses: The TSR requires sellers and telemarketers to scrub call lists against the National DNC Registry no more than 31 days before making calls, and to maintain an internal DNC list of consumers who have requested not to be called.
11. USTelecom Industry Traceback Group: The USTelecom Industry Traceback Group works with the FTC and FCC to trace illegal robocall traffic to its origin, enabling enforcement actions without relying solely on consumer complaint volume.