Compliance

TCPA Overview

The Telephone Consumer Protection Act (TCPA) is a federal law that governs telemarketing calls, auto-dialed calls, prerecorded voice messages, and text messages. Key requirements include:

• Prior express consent is required before making telemarketing calls. For calls using artificial or prerecorded voices (which includes AI voice agents), prior express written consent is required.
• Calling hours are restricted to between 8:00 AM and 9:00 PM in the called party's local time zone.
• Caller identification must be provided at the beginning of each call, including the name of the business and a callback number.
• Do-Not-Call requests must be honored. If a person asks not to be called, they must be added to your internal DNC list and not contacted again.
• National Do-Not-Call Registry must be consulted. Numbers on the federal DNC registry cannot be called for telemarketing purposes unless the caller has an established business relationship or prior express written consent.

CallTone automates many of these requirements, but the responsibility for compliance ultimately rests with you, the caller. The features described below are tools to help you comply, not guarantees of compliance.

Do-Not-Call (DNC) Management

CallTone maintains an internal Do-Not-Call list for your organization. Numbers on this list are automatically blocked from all outbound campaigns and manual calls. You can manage your DNC list from the Compliance > Do-Not-Call page in your dashboard.

Adding Numbers Manually

Click Add Number and enter one or more phone numbers. You can optionally specify the reason (e.g., "customer request", "verbal opt-out during call") and the source of the request. The number is immediately blocked from all outbound calling.

Importing DNC Lists

To import a bulk DNC list, click Import and upload a CSV file with phone numbers in E.164 format (e.g., +12125551234). The importer validates each number, deduplicates entries, and adds them to your internal list. You can use this to import numbers from the National DNC Registry or from other systems.

Automatic DNC Checking

Before every outbound call, CallTone automatically checks the target number against your internal DNC list. If the number is found, the call is skipped and marked as "DNC Blocked" in the campaign report. This check happens in real time, so numbers added to the list mid-campaign are respected immediately.

Automatic Opt-Out Detection

During active calls, if a contact says phrases like "stop calling me", "remove me from your list", "do not call", or "take me off your list", the voice agent recognizes the opt-out request and responds politely (e.g., "I understand. I've removed your number from our calling list. You will not receive any further calls from us."). The number is automatically added to your DNC list and the call is ended gracefully.

Consent Tracking

CallTone records consent information for every contact in your system. This creates a verifiable audit trail that you can reference if a compliance question arises.

What Is Recorded

For each contact, CallTone tracks:

• Consent status — whether the contact has given consent, and what type (express, express written, or implied).
• Consent source — how consent was obtained (e.g., web form, paper form, verbal during call, SMS opt-in, imported record).
• Timestamp — when consent was recorded, stored in UTC with your organization's timezone for display.
• Consent text — the exact language the contact agreed to, if available (e.g., the text of the web form disclosure).
• Revocation — if consent is revoked (through a DNC request, opt-out, or manual action), the revocation timestamp and reason are also recorded.

Managing Consent Records

You can view and update consent records from the contact detail page or from the Compliance > Consent dashboard. When importing contacts via CSV, you can include consent columns (consent_status, consent_source, consent_date) to populate records in bulk.

Calling Hours Enforcement

CallTone enforces calling hour restrictions to ensure outbound calls are only placed during permitted times. The TCPA requires that telemarketing calls be made between 8:00 AM and 9:00 PM in the recipient's local time zone.

How It Works

• Before placing each call, CallTone determines the recipient's timezone based on their area code and geographic data.
• If the current time falls outside the permitted calling window in the recipient's timezone, the call is deferred and rescheduled for the next available window.
• Your organization can configure a custom calling window that is narrower than the legal maximum. For example, you might set your window to 9:00 AM – 6:00 PM to be more conservative.
• Calling hour settings are configured under Settings > Organization > Calling Hours. Individual campaigns can also override the default hours if needed.

Holiday and Weekend Handling

By default, CallTone does not restrict calling on weekends or holidays (TCPA does not prohibit this). However, you can configure your campaigns to skip weekends, specific holidays, or both. This is available in the campaign scheduling settings.

Call Disclosure

Many jurisdictions require that automated or AI-powered calls disclose their nature at the beginning of the conversation. CallTone automatically plays a disclosure message at the start of every outbound call made by a voice agent.

Default Disclosure

CallTone ships with a sensible default disclosure message:

Customizing the Disclosure

You can customize the disclosure message under Settings > Organization > Disclosure Message. The message supports the following template variables:

• {{orgName}} — replaced with your organization's name.
• {{agentName}} — replaced with the voice agent's configured name.
• {{contactName}} — replaced with the contact's first name, if available.

The disclosure is spoken by the voice agent in the same voice and tone configured for that agent, ensuring a natural call experience.

Call Recording Consent

If call recording is enabled, additional consent requirements may apply depending on the state. The United States has a mix of one-party and two-party (all-party) consent states:

• One-party consent states require only one party in the conversation to consent to the recording. Since your organization is initiating the recording, this requirement is typically met. However, best practice is still to inform the other party.
• Two-party consent states (including California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington) require all parties to consent to the recording.

CallTone handles this by including recording disclosure in the call's opening message. When call recording is active, the disclosure message automatically includes a statement that the call is being recorded. If the contact does not object, implied consent is assumed per industry standards. If the contact objects, the agent can continue the call without recording (recording is paused or stopped).

Audit Logs

Every significant action in CallTone is recorded in the audit log. This provides a complete, tamper-resistant record of who did what and when, which is essential for compliance investigations and internal reviews.

What Is Logged

The audit log captures the following events:

• Call events — call initiated, call completed, call failed, call transferred, recording started, recording stopped.
• Campaign events — campaign created, started, paused, resumed, completed, contact added, contact skipped (with reason).
• Agent events — agent created, updated, deleted, published, unpublished.
• Contact events — contact created, updated, deleted, consent updated, DNC added, DNC removed.
• Team events — member invited, member joined, role changed, member removed.
• Settings events — organization settings changed, branding updated, API key created, API key revoked.
• Compliance events — DNC list imported, consent record updated, opt-out detected during call.

Viewing the Audit Log

Navigate to Compliance > Audit Log in your dashboard. You can filter by date range, event type, user, and resource. Each entry shows:

• Timestamp — exact date and time of the action.
• Actor — the user or system process that performed the action.
• Action — what was done (e.g., "contact.dnc_added").
• Resource — the entity affected (e.g., a specific contact or campaign).
• Details — additional context, such as the old and new values for a settings change.

Audit logs are retained for 12 months on all plans. Enterprise customers can request extended retention.

Opt-Out Handling

CallTone supports multiple opt-out mechanisms to ensure contacts can easily stop receiving calls:

• Verbal opt-out during a call — if a contact says "stop", "remove me", "do not call", "take me off your list", or similar phrases, the AI agent recognizes the request, confirms it verbally, and adds the number to your DNC list automatically.
• SMS opt-out — if you use the missed call text-back feature or two-way SMS, contacts can reply "STOP" to opt out of further SMS messages. Their number is automatically added to the SMS DNC list.
• Manual opt-out — your team can add numbers to the DNC list at any time from the dashboard.
• API opt-out — use the REST API to programmatically add numbers to the DNC list from your own systems.

All opt-out actions are logged in the audit trail with a timestamp, the method of opt-out, and the context (e.g., which call or campaign triggered the request).

Best Practices for Staying Compliant

Following these best practices will help you minimize compliance risk while using CallTone:

1. Always obtain consent before calling. Ensure you have prior express written consent before using AI voice agents for telemarketing calls. Document how and when consent was obtained.
2. Keep your DNC list current. Import the National DNC Registry regularly (at least every 31 days, as required by FTC rules) and process opt-out requests immediately.
3. Use the built-in disclosure message. Do not disable or skip the AI disclosure at the beginning of calls. Customize it if needed, but always include identification of the caller, the AI nature of the call, and recording notice.
4. Respect calling hours strictly. Use CallTone's automatic calling hour enforcement and consider setting a more conservative window than the legal maximum.
5. Review audit logs regularly. Check the compliance dashboard weekly to identify any anomalies, failed DNC checks, or unexpected opt-out volumes.
6. Train your team. Ensure everyone on your team understands TCPA requirements and how to use CallTone's compliance features correctly.
7. Consult legal counsel. Telemarketing regulations are complex and vary by state. Work with a qualified attorney to review your compliance program periodically.
8. Monitor state-specific rules. Several states have their own telemarketing laws that may be stricter than the TCPA. Be aware of the requirements in every state where your contacts are located.
9. Document everything. Use CallTone's consent tracking and audit logs as your system of record. If a complaint arises, this documentation is your first line of defense.

Next Steps

Learn more about related features:

• Team Management — configure organization settings, calling hours, and disclosure messages.
• Campaigns — learn how campaign scheduling interacts with calling hours and DNC checks.
• Webhooks & Integrations — use the API to sync DNC lists and consent records from external systems.