AI contact center compliance: PCI, HIPAA, GDPR, and TCPA explained

Last updated 2026-07-09

Why do AI contact centers face more compliance risk than traditional ones?

A human agent who dials the wrong number makes one bad call. An AI dialer set up with the wrong consent rules fires off a million bad calls before anyone notices. That scale multiplier is the whole reason regulators and plaintiffs' attorneys watch AI-powered outbound so closely.

AI contact centers stack several technologies at once: predictive dialers, voice AI or conversational IVR, SMS automation, call recording with transcription, and real-time sentiment scoring. Each layer opens a new compliance surface. The dialer may trigger TCPA. The recording system may capture card data and breach PCI DSS. If the list includes patients, HIPAA applies. If any EU residents sit in the CRM, GDPR applies on top of all of it.

The FCC treats the statutory definition of an automatic telephone dialing system (ATDS) under 47 U.S.C. § 227(b)(1)(A) as technology-neutral ^[1]. Whether the gear uses a random-number generator from 1991 or a modern prediction model, what matters is whether it has the capacity to store or produce numbers and dial them without human intervention. Courts have wobbled on the exact test since the Supreme Court's 2021 Facebook v. Duguid decision narrowed ATDS to equipment using a random or sequential number generator ^[2], but plaintiff-side lawyers still argue many AI systems clear that bar. Don't assume your AI dialer is exempt.

Here's the short version. Traditional contact centers ran on compliance checklists. AI contact centers need compliance built into the system design itself.

What does TCPA require specifically for AI-powered calls and text messages?

The Telephone Consumer Protection Act, 47 U.S.C. § 227, bars any call (and by FCC rule, any text) using an ATDS or prerecorded voice to a cell phone without prior express consent ^[1]. For telemarketing, the bar is higher: prior express written consent, defined in 47 C.F.R. § 64.1200(f)(9) as a signed written agreement that clearly authorizes the specific seller to send autodialed messages ^[11].

The FCC's one-to-one consent rule, effective January 27, 2025, tightened this further ^[3]. A checkbox on a lead-gen form that bundles 50 advertisers no longer counts. Each AI contact center has to be named on its own in the consent language. If you bought leads from a third-party aggregator and your company's name wasn't on the opt-in form the consumer actually saw, that consent is dead under the current rule.

Per-violation damages are $500 for negligent violations and $1,500 for willful or knowing ones ^[1]. The FCC updated its civil forfeiture maximum to $23,727 per violation per day, indexed for inflation, though the number class actions actually run on is the $500/$1,500 statutory figure ^[4]. A class of 500,000 contacts, one unlawful text each, is $750 million of exposure. That's not a thought experiment. See the UnitedHealthcare TCPA settlement and the Credit One TCPA settlement for how fast these cases scale.

Three AI-specific TCPA traps come up over and over. First, AI dialers that "preview dial" and then drop the call when no agent is free generate abandoned-call complaints and can breach the FTC's 3% abandoned-call rule for telemarketing. Second, AI-generated voice messages that sound like a live person without disclosing they're pre-recorded violate 47 C.F.R. § 64.1200(b) ^[11]. Third, AI SMS chatbots that start outbound text threads with no valid opt-in get treated exactly like robocalls under current FCC rules.

Time-of-day limits apply no matter how clever the dialer is: no calls before 8 a.m. or after 9 p.m. local time at the called party's location ^[1]. An AI system that doesn't map each number to its time zone will manufacture violations on its own.

How does PCI DSS apply when AI handles payment card data over phone calls?

PCI DSS (Payment Card Industry Data Security Standard) version 4.0, published by the PCI Security Standards Council in March 2022, covers any system that stores, processes, or transmits cardholder data ^[5]. An AI contact center that takes card payments over voice calls is squarely in scope.

The rule that bites first in a call environment is the ban on storing sensitive authentication data (the full magnetic stripe, CVV/CVC codes, or PINs) after authorization. Requirement 3.2.1 of PCI DSS v4.0 says sensitive authentication data must not be retained even if encrypted ^[5]. An AI system that transcribes calls and saves a transcript with a spoken CVV breaks this rule on its face.

The standard fix is DTMF masking, sometimes called "pause and resume" recording. When the caller hits the card-entry step, the system pauses recording and the customer keys in the card number as tones that get masked in the audio. Recording picks back up after the transaction. Some platforms go further with a fully hosted payment page that pulls the AI out of PCI scope for that step entirely.

AI transcripts create a newer problem most teams haven't solved. Real-time speech-to-text running on a third-party cloud may buffer card data in a way that counts as storage. If your transcription vendor processes calls that contain card numbers, you need to either (a) confirm they're a PCI DSS-validated service provider listed on the Visa or Mastercard global registry, or (b) build the call flow so card entry lands in a DTMF-only segment that never reaches the AI.

PCI DSS v4.0 Requirement 12.8 requires written agreements with every third-party service provider that could affect cardholder data security ^[5]. Your AI platform vendor, your cloud telephony provider, and your transcription API vendor each need a documented PCI scope assessment or a Responsibility Matrix. Auditors will ask for it.

When does HIPAA apply to an AI contact center, and what does it require?

HIPAA applies when a contact center handles protected health information (PHI), meaning any individually identifiable health information, for a covered entity (health plans, healthcare clearinghouses, most healthcare providers) ^[6]. AI contact centers at health insurers, hospital systems, pharmacy benefit managers, and healthcare debt collectors handle PHI on nearly every call.

The HIPAA Privacy Rule (45 C.F.R. Parts 160 and 164) and the Security Rule set the terms. For AI contact centers, the load falls in three places.

First, business associate agreements (BAAs). Any AI platform vendor, cloud telephony provider, or transcription service that processes calls containing PHI is a "business associate" under HIPAA and must sign a BAA before you send it a single record ^[6]. If a vendor refuses to sign a BAA or claims one isn't needed, stop there. You can't use that vendor for calls that may carry PHI.

Second, minimum necessary disclosure. Configure the AI to touch only the PHI the specific interaction actually needs. A collections AI calling about a medical bill has no reason to pull a patient's full diagnosis history into its context window. Over-permissioned models that load entire records for a simple appointment reminder create exposure for nothing.

Third, audit logging. The Security Rule requires covered entities and their business associates to put in place hardware, software, and procedural mechanisms that record and examine activity in systems holding PHI. AI platforms that process call audio, write transcripts, or pull from an EHR have to produce audit logs. "The model decided X" is not an audit trail. You need logs showing which PHI records were touched, when, by which component, and why.

HIPAA civil penalties run in tiers from $137 to $68,928 per violation depending on culpability, with annual caps per violation category of $2,067,813 (2023 inflation-adjusted figures from HHS) ^[7]. Criminal penalties under 42 U.S.C. § 1320d-6 reach $250,000 and 10 years for knowing misuse. AI doesn't move these numbers. It just scales how many violations pile up before anyone catches them.

What GDPR obligations apply to AI contact centers reaching EU residents?

GDPR (Regulation (EU) 2016/679) applies to any organization that processes personal data of individuals in the European Union, no matter where the organization sits ^[8]. If your AI contact center dials or texts EU residents, even from a U.S. base, GDPR is in play.

The core duties for AI outbound are short to list and hard to do. You need a lawful basis for every processing activity. Automated marketing calls to EU residents usually require explicit consent under Article 6(1)(a) with Article 7, or a legitimate interests assessment under Article 6(1)(f) that you can defend in writing. Recital 47 of GDPR notes that data subject interests can override legitimate interests where people would not reasonably expect the processing, which covers most cold outreach.

Article 22 of GDPR restricts fully automated decision-making that produces legal or similarly significant effects ^[8]. An AI system that decides on its own to call a contact, sets the script from their profile, and logs outcomes with no human in the loop may trip Article 22. You need either explicit consent or a documented policy showing human review of significant AI-driven decisions.

Data subject rights under Articles 15 through 22 include access, rectification, erasure, and portability. Your CRM and conversation logs have to execute a verified erasure request inside 30 days. Transcripts, sentiment scores, AI call summaries, and any profiles derived from a call are all personal data and all deletable.

Fines under Article 83(5) reach 4% of global annual turnover or 20 million euros, whichever is higher ^[8]. The Irish Data Protection Commission's 2023 fine against Meta (1.2 billion euros) is the largest to date, but smaller shops have taken six-figure fines for badly configured automated messaging. The penalty structure does not scale down gently for small businesses.

For UK operations, the UK GDPR (retained after Brexit) and the Privacy and Electronic Communications Regulations (PECR) run in parallel. PECR governs electronic marketing directly and requires prior consent for most automated calls and texts to individuals.

How do these four regimes interact, and where do the conflicts sit?

These four regimes don't fight each other so much as pile up. Clearing one clears none of the others. The table below lines up the key requirements.

Requirement	TCPA	PCI DSS v4.0	HIPAA	GDPR
Consent needed before contact	Yes (written for telemarketing)	N/A	Yes (for marketing)	Yes (or lawful basis)
Call recording rules	State law governs; TCPA silent	Must pause during card entry	Must have BAA with recorder	Must notify, retain lawfully
Data retention limits	No TCPA rule; state laws vary	Cannot retain CVV/auth data	Minimum necessary; 6-yr records	Storage limitation principle
Third-party vendor contracts	Consent chain documentation	PCI Responsibility Matrix	BAA required	DPA (data processing agreement)
Individual rights (opt-out/deletion)	Opt-out must be honored	N/A	Access rights under Privacy Rule	Articles 15-22 rights
Enforcement body	FCC, state AGs, private plaintiffs	Card brands, QSA auditors	HHS OCR	DPAs, national regulators

The sharpest conflict lands on call recording. TCPA doesn't restrict recording, but state wiretapping laws do (California, Illinois, and Florida require all-party consent). HIPAA requires recordings with PHI to be stored securely with access controls. GDPR requires recordings to be disclosed, kept only as long as needed, and deleted on request. PCI requires the recording to pause or mask any card data. Put a California contact on the phone about a healthcare bill, paying by card, and one four-minute call touches all four regimes.

Consent documentation is the other friction point. TCPA pushes you to keep proof of written consent for up to 4 years (the FCC's recommended retention window, though the statute of limitations really drives it). GDPR requires you to show the lawful basis for processing on demand, so consent records have to be retrievable fast. HIPAA authorization records have to be kept for 6 years from creation or last effective date. Build one consent record system that meets the longest retention window (6 years) and is queryable enough to answer a GDPR data subject access request inside 30 days.

What specific AI features create the most compliance risk?

Real-time transcription and AI note-taking are the riskiest features teams underestimate. Every major AI contact center platform now transcribes automatically. That transcript is a written record of everything said on the call: card numbers, Social Security numbers, diagnoses, prescription names. Audio needs playback to extract. A text transcript is machine-searchable and far easier to walk out the door in a breach. Under PCI DSS, a stored transcript with a CVV in it is a violation the second it hits disk, even if the audio was masked correctly.

AI-generated customer profiles built from call history carry GDPR and HIPAA exposure that's easier to miss. If your platform builds a behavioral profile on each contact (call duration patterns, sentiment trends, topics), that profile is derived personal data. GDPR's data minimization rule under Article 5(1)(c) requires data to be "adequate, relevant and limited to what is necessary" ^[8]. A sentiment score that sits forever in a CRM against an EU resident's record is hard to defend under that rule.

Voice cloning and synthetic voice are a fast-moving surface. In February 2024 the FCC ruled that AI-generated voices count as "artificial voices" under the TCPA's prerecorded voice ban, so any AI voice message to a cell phone needs the same prior express consent as a robocall ^[9]. Several states, Texas and Florida among them, have layered on synthetic-voice disclosure rules. If your AI speaks in a voice that wasn't recorded from a real human agent, disclosure requirements attach.

Predictive dialers that use AI to time calls off behavioral data ("call X at 2 p.m. Tuesday, the model says they answer then") don't create new legal exposure on their own. They just make more calls, faster. If consent is missing or expired, the optimization feature simply speeds up the violation rate.

See the Cash App TCPA class action settlement for how automated messaging cases scale, and text message marketing for the SMS-specific rules that apply when AI drives the sequence.

What does a practical compliance architecture for an AI contact center look like?

Most teams try to bolt compliance onto a system that's already running. That works right up until it doesn't. Building it in from the start is cheaper by orders of magnitude.

Start with data classification. Every field in your CRM and every element that flows through the AI needs a label. Is it cardholder data? PHI? PII under GDPR? That label drives every downstream call about storage, retention, access control, and vendor terms. Skip it and you're guessing.

Consent management needs its own layer, not a checkbox in Salesforce. You need a system that records the exact consent language each contact saw, when they agreed, the channel that collected it (web form, inbound call, SMS keyword), and which entities that consent authorizes. The FCC's one-to-one consent rule ^[3] makes this non-negotiable for any AI outbound operation buying third-party leads. LeadCompliant's free TCPA tools include a consent record checker that flags whether your documentation would survive FCC scrutiny, without a lawyer reviewing every record.

For call recording, put DTMF masking at the telephony layer before the audio ever reaches your transcription service. Configure the transcription rules to flag and redact 13-16 digit sequences (card numbers), 9-digit sequences (SSNs), and HIPAA-covered condition codes when they show up in transcripts. It isn't foolproof, but it shrinks your exposure a lot.

Vendor contracting is dull and non-negotiable. Your AI platform, cloud telephony provider, transcription API, and CRM each need a BAA (if any PHI reaches them), a GDPR data processing agreement (if any EU resident data reaches them), and a PCI Responsibility Matrix (if card data reaches them). Keep these in a vendor register with review dates. Terms drift. A BAA signed in 2019 may not cover the AI features your vendor shipped in 2023.

For TCPA, run real-time DNC scrubbing at the dialer, not as a nightly batch. A contact who opts out at 10 a.m. has to be suppressed before the next campaign fires. The Truist Bank TCPA settlement and Albertsons/Safeway TCPA settlement both turned on DNC suppression failures that a real-time system would have caught.

What are the actual penalties and recent enforcement cases for AI contact center violations?

TCPA private class actions are the top threat for most small contact centers, because the statute gives a private right of action with no requirement to prove actual damages ^[1]. The $500/$1,500 per-call structure is what makes class certification so tempting for plaintiff lawyers. Even at $500 per violation, 100,000 calls is $50 million in statutory damages.

Recent settlements give you a feel for the scale. The Kaiser TCPA settlement ran into the millions over automated healthcare calls. UnitedHealthcare paid $2.5 million to resolve TCPA claims over automated calls, and we broke that down at our UnitedHealthcare writeup. These aren't outliers. Healthcare, financial services, and retail all generate large TCPA class actions on a regular basis.

FCC enforcement against AI-related violations picked up after the 2024 AI voice ruling. The FCC proposed a $6 million fine against a political consultancy in early 2024 over AI-generated robocalls mimicking President Biden's voice, citing the prerecorded voice provisions ^[9]. It didn't stop at the fine. The FCC referred the matter to state attorneys general in all 50 states at once.

HIPAA enforcement by the HHS Office for Civil Rights has seen per-case settlements averaging roughly $1.5 million to $3 million for medium-sized covered entities in recent years ^[7]. The biggest fines land on organizations that had policies and didn't follow them, which is exactly the failure mode AI contact centers court: you have a HIPAA policy, but nobody checked whether the transcription vendor signed a BAA.

GDPR enforcement is still uncommon against U.S. companies with no EU establishment, but that's shifting. The Irish DPC and UK ICO have both fined non-EU companies under GDPR's extraterritorial reach in Article 3. Dialing EU residents? Assume it applies.

PCI non-compliance works on a different track. Card brands can levy monthly fines ($5,000 to $100,000 depending on merchant level and how long the violation runs) and can pull your ability to accept cards, which for many contact centers means the lights go off ^[5].

What should a compliance checklist for an AI contact center actually include?

Skip the generic list. Here's what has to get done and who owns it.

For TCPA, before any AI campaign launches: confirm prior express written consent exists for every number in the list, with records showing what the contact saw and agreed to; scrub against the National DNC Registry (which costs $75 per area code per year, or a flat $18,936 for all U.S. area codes as of 2024) ^[10]; confirm the dialing tech's ATDS status under post-Duguid analysis; verify time-of-day compliance by local time zone for each record; and set up opt-out processing that suppresses a number within seconds.

For PCI DSS: put DTMF masking or a hosted payment page on every card transaction; confirm your transcription vendor is a PCI-validated service provider or is kept out of the card-entry segment; complete a Responsibility Matrix with each relevant vendor; and run an annual internal review of which components are in PCI scope.

For HIPAA: execute BAAs with every vendor that touches call audio, transcripts, or records containing health data; set AI access to minimum necessary PHI; keep audit logs for all AI access to PHI; run an annual Security Risk Assessment (required by 45 C.F.R. § 164.308(a)(1)) ^[6]; and train everyone who configures or operates the AI on HIPAA.

For GDPR: document the lawful basis for every processing activity; build a process for data subject access and erasure requests with a 30-day turnaround; execute GDPR data processing agreements with all vendors handling EU resident data; review your AI profiling for Article 22 compliance; and appoint a Data Protection Officer if required (generally required where large-scale systematic monitoring or processing of sensitive data is a core activity).

For the cross-cutting stuff: keep one vendor register tracking BAA, DPA, PCI Matrix, and TCPA consent-chain status per vendor; set calendar reminders for annual reviews; and set consent retention at 6 years minimum to cover HIPAA, with GDPR retrieval inside 30 days.

LeadCompliant's compliance kit covers the TCPA consent documentation and DNC scrubbing. For PCI, HIPAA, and GDPR you'll need a qualified security assessor, a HIPAA privacy officer, and a data protection attorney. Self-service tools have limits, and this article is not legal advice.

How does the FCC's 2024 one-to-one consent rule change AI outbound operations specifically?

The FCC's December 2023 order (FCC 23-107), effective January 27, 2025, killed the lead-gen industry's bundled-consent practice, where one opt-in form authorized dozens of marketers to contact a consumer through automated means ^[3].

Under the old reading, a consumer checking a box agreeing to hear from "our partners and affiliates" could hand valid TCPA consent to a long list of companies whose names they never saw. AI contact centers built on third-party lead buys leaned hard on that structure. It's gone.

The new rule requires consent that is: logically and topically related to the website where it's collected (a mortgage site can't mint valid consent for an insurance dialer), obtained from one named company per consent interaction (not a list), and clearly and conspicuously presented, not buried in fine print.

The practical hit for AI operators is real. If you buy leads from aggregators, you have to audit every source's opt-in flow and confirm your company's name shows up explicitly in the consent language. Leads that miss this bar should be dialed only by a live agent without an ATDS (which drops the autodialer claim, though Do Not Call rules still apply), or not dialed at all.

Some operators are rebuilding lead acquisition around inbound traffic and hand-raiser forms where their own brand name sits on the consent. That's the cleanest path under the new rule. It's also slower to scale. The tcpa-news feed tracks the ongoing litigation testing the edges of this rule, since several lead-gen industry groups took it to court.

Frequently asked questions

Does TCPA apply to AI-generated voice calls the same way it applies to robocalls?

Yes. The FCC ruled in February 2024 that AI-generated voices qualify as 'artificial voices' under the TCPA's prerecorded voice prohibition ^[9]. Any AI voice call to a cell phone requires prior express consent, and to a residential landline it requires either consent or that it be a non-commercial call. The technology used to generate the voice doesn't change the legal standard.

What is the maximum TCPA fine per violation in 2025?

For private litigation, TCPA statutory damages are $500 per violation for negligent violations and $1,500 per willful violation under 47 U.S.C. § 227(b)(3). The FCC's administrative forfeiture maximum is $23,727 per violation per day (inflation-adjusted), but class action plaintiffs use the $500/$1,500 figure. A class of 100,000 consumers at $500 each equals $50 million in exposure.

Does my AI contact center need a BAA with every software vendor?

Only if that vendor processes, stores, or transmits PHI as part of its service. If your AI platform receives call audio or transcripts from healthcare calls, it needs a BAA. If your cloud telephony provider routes calls with patient names or appointment details, it needs a BAA. Vendors that only handle metadata (call duration, timestamp) without PHI content may not need one, but get a legal opinion before deciding.

Can an AI contact center be fully PCI compliant while still using call recording?

Yes, with DTMF masking or a hosted payment page. DTMF masking pauses the recording and masks keypad tones during card entry, so no card numbers land in the stored audio. A hosted payment page routes the customer to a PCI-compliant system for card entry, taking the AI platform out of PCI scope for that step. PCI DSS v4.0 Requirement 3.2.1 is the rule prohibiting retention of sensitive authentication data.

Does GDPR apply to a U.S. company calling EU residents?

Yes. GDPR Article 3(2) sets extraterritorial reach: GDPR applies to any organization outside the EU that processes personal data of EU data subjects in connection with offering goods or services to them or monitoring their behavior. Outbound telemarketing to EU residents fits. Not having an EU office is not an exemption. UK GDPR and PECR apply for UK residents under the same logic post-Brexit.

What is the FCC's one-to-one consent rule and when did it take effect?

The FCC's one-to-one consent rule (FCC Order 23-107) took effect January 27, 2025. It requires that TCPA-compliant written consent for automated marketing calls or texts name one specific seller per consent interaction. Bundled consent forms authorizing a list of advertisers no longer meet the prior express written consent standard. Lead-gen operations that buy or sell consented leads must update opt-in flows to name each advertiser individually.

How long do I need to keep TCPA consent records?

The TCPA statute of limitations is 4 years under 28 U.S.C. § 1658 (the federal catch-all), or shorter in some states. The FCC recommends keeping consent records at least 4 years. If those records also hold PHI, HIPAA requires 6-year retention from creation or last effective date. Practically, keep consent records for 6 years and make them retrievable within 30 days to answer GDPR data subject access requests.

Are AI chatbots that send SMS messages subject to TCPA?

Yes. The FCC treats text messages as calls under TCPA for the autodialer rules. An AI SMS chatbot that starts outbound texts without prior express written consent from the recipient violates 47 U.S.C. § 227(b)(1)(A). The consent has to meet the same standard as voice calls: clear, specific to the sender, and obtained before the first outbound message. Opt-in keywords or web form checkboxes are the standard collection methods.

What HIPAA penalties apply if an AI vendor processes PHI without a BAA?

Operating without a required BAA is a HIPAA violation by the covered entity. HHS OCR can impose civil penalties of $137 to $68,928 per violation (2023 inflation-adjusted figures), with an annual cap of $2,067,813 per violation category. Criminal penalties under 42 U.S.C. § 1320d-6 can reach $250,000 and 10 years for knowing violations. Both the covered entity and the AI vendor can face separate penalties.

What is the National DNC Registry and how do AI dialers use it?

The National Do Not Call Registry, run by the FTC, lists residential phone numbers whose owners have opted out of telemarketing. Under 47 C.F.R. § 64.1200(c), you must scrub outbound lists against the registry before dialing. Access costs $75 per area code or $18,936 for all U.S. area codes annually (2024 rates). AI dialers should scrub at the campaign level before launch and in real time to catch numbers added since the last scrub.

How does Facebook v. Duguid affect whether an AI dialer counts as an ATDS?

The Supreme Court's 2021 Facebook v. Duguid ruling held that an ATDS must use a random or sequential number generator to store or dial numbers. Equipment that dials only from a stored list without random or sequential generation may not qualify. But many AI predictive dialers use algorithmic number selection that plaintiff attorneys argue meets the test, and state courts sometimes read the definition more broadly. The safe move is to assume ATDS status and run with full consent.

Can AI sentiment analysis data collected during calls trigger GDPR data subject rights?

Yes. GDPR's definition of personal data in Article 4(1) covers 'any information relating to an identified or identifiable natural person.' AI-generated sentiment scores, behavioral profiles, or topic classifications derived from a call with an EU resident are personal data. Data subjects can access this under Article 15, correct it under Article 16, and in some cases demand erasure under Article 17. Your systems have to execute these requests within 30 days.

What's the difference between TCPA and state telemarketing laws for AI contact centers?

TCPA sets the federal floor. States go further. California's CCPA adds data rights on top of consent rules. Illinois's Biometric Information Privacy Act (BIPA) may apply if your AI analyzes voiceprints. Florida and Washington have state mini-TCPA laws with per-violation penalties that can top TCPA's $1,500 cap in some scenarios. Indiana, Oklahoma, and other states have tightened DNC rules. Always layer state law analysis on top of federal TCPA for each target market.

Do I need a different compliance approach if my AI contact center only does inbound calls?

Mostly yes. TCPA's autodialer restrictions apply only to outbound calls you initiate, so inbound calls don't trigger the initiation-consent requirements. But HIPAA, PCI DSS, and GDPR apply fully to inbound calls if those data types are present. And if your inbound system calls a customer back (callback scheduling, IVR-initiated transfers), those outbound legs bring TCPA exposure back. Call recording consent under state wiretapping laws applies to inbound calls in all-party consent states.

Sources

1. Cornell Law School LII, 47 U.S.C. § 227 (TCPA statute text): TCPA prohibits autodialed/prerecorded calls to cell phones without prior express consent; $500 negligent and $1,500 willful per-violation damages; 8am-9pm time restrictions under implementing regulations
2. Supreme Court of the United States, Facebook Inc. v. Duguid, 592 U.S. 395 (2021): ATDS definition requires use of a random or sequential number generator to store or produce numbers to be called
3. PCI Security Standards Council, PCI DSS v4.0: PCI DSS v4.0 Requirement 3.2.1 prohibits retention of sensitive authentication data (CVV, full magnetic stripe) after authorization; Requirement 12.8 requires written agreements with third-party service providers affecting cardholder data security
4. HHS, HIPAA for Professionals (Privacy and Security Rules): HIPAA requires business associate agreements with vendors processing PHI; Security Rule at 45 C.F.R. § 164.308(a)(1) requires annual Security Risk Assessments; minimum necessary standard applies to PHI access
5. HHS Office for Civil Rights, HIPAA Enforcement Results and Civil Money Penalty Amounts: HIPAA civil penalties range from $137 to $68,928 per violation (2023 inflation-adjusted); annual cap $2,067,813 per violation category; criminal penalties up to $250,000 and 10 years under 42 U.S.C. § 1320d-6
6. EUR-Lex, Regulation (EU) 2016/679 (GDPR full text): GDPR Article 3(2) establishes extraterritorial reach; Article 5(1)(c) sets data minimization; Article 22 restricts fully automated decision-making; Article 83(5) sets maximum fines at 4% of global annual turnover or 20 million euros; Articles 15-22 establish data subject rights
7. FTC, National Do Not Call Registry (data and access for sellers/telemarketers): National DNC Registry access costs $75 per area code annually; $18,936 for all U.S. area codes annually (2024 rates)
8. eCFR, 47 C.F.R. § 64.1200 (implementing TCPA regulations): Prior express written consent definition for telemarketing at 47 C.F.R. § 64.1200(f)(9); time-of-day restrictions; prerecorded message disclosure requirements at 64.1200(b)