The rule everyone worries about is written for residential subscribers. The rule that actually reaches your calls keys on the type of number you dialled.

Read the regulations rather than the compliance blogs and the picture inverts. The national Do Not Call Registry, the 8am to 9pm window and the internal do-not-call list obligation are each expressed in the communications rules as applying to “any residential telephone subscriber”. A business line is not that.

Meanwhile the prohibition on automatic dialling systems and artificial or prerecorded voices is written to cover “any telephone number assigned to a paging service, cellular telephone service, specialized mobile radio service, or other radio common carrier service”. There is no residential qualifier anywhere in that paragraph. Your prospect’s mobile is covered whether or not the phone belongs to a company.

So the operative questions are not the ones usually asked. They are: what kind of number is this, and how am I dialling it.

Two regimes, and almost everyone conflates them

Rules keyed on the person called against rules keyed on the number dialledTwo column comparison of United States outbound calling rules according to what triggers them. The left column groups the rules whose trigger is the status of the person called, each written in the communications regulations to apply to a residential telephone subscriber, and therefore not reaching a call placed to a business line. These are the national do not call registry, the calling window running from eight in the morning to nine at night in the called party time zone, and the obligation to maintain an internal company specific do not call list. The trade commission rule separately exempts calls between a telemarketer and a business to induce the purchase of goods or services by that business, with two carve outs preserved, one for misrepresentation and one for false statements made to induce payment. The right column groups the rules whose trigger is the number dialled or the method of dialling, which contain no residential qualifier and therefore apply to business numbers. These are the prohibition on using an automatic telephone dialling system or an artificial or prerecorded voice to call any number assigned to cellular telephone service, the requirement that caller identification transmit a number that permits a person to make a do not call request during regular business hours, the prohibition on blocking caller identification transmission by anyone engaged in telemarketing, and the call authentication framework that carriers were required to implement by the thirtieth of June two thousand twenty one. The figure concludes that the useful questions are what type of number is being dialled and by what method, rather than whether the person answering is at work.What triggers the rule: the person, or the numberKeyed on the person calledWritten for “residential telephone subscriber”.The national Do Not Call RegistryThe 8am to 9pm windowThe internal do-not-call listPlus an express B2B exemption in thetrade commission ruleDoes not reach a business line.Misrepresentation rules survive regardless.Keyed on the number dialledNo residential qualifier anywhere.Auto-diallers and prerecorded voicesto any number assigned to cellular serviceA callback number that worksNo blocking your own caller IDCall authentication, since June 2021Reaches business numbers in full.
One family of rules protects residential subscribers. The other attaches to the number type and the dialling method, and it does not care whose phone it is.

The trade commission’s rule is the more generous of the two. Its business-to-business exemption covers “telephone calls between a telemarketer and any business to induce the purchase of goods or services”, and because it exempts the call from the whole part, the Do Not Call machinery falls away with it. Two carve-outs survive, both about honesty rather than permission: the prohibitions on misrepresentation and on false statements made to induce payment.

But the exemption has a boundary that is stated in plain words, and it is the one most likely to catch a modern outbound team. The commission’s own compliance guidance says that calls to business lines “that solicit individual employees to buy products or services for their own use or make personal charitable contributions, also are not business-to-business solicitations and are not exempt”. Selling a seat licence to a company is B2B. Selling a personal subscription to someone who happens to be at work is not.

And there is a presumption that shifts the burden onto you. When the commission allowed wireless subscribers onto the registry, it reasoned that deciding whether a given wireless subscriber is residential “may be more fact-intensive” than for a wireline number, and resolved it by presuming that wireless subscribers who register are residential. Since a great many decision-makers’ working numbers are personal mobiles they registered years ago, the practical effect is that you are the one who has to be able to show the number is a business number.

The rule that was never in force

A large amount of compliance content, some of it still being sold, describes a one-to-one consent requirement as current law. It is not, and it never operated for a single day.

The rule was adopted in December 2023 with a compliance date in January 2025. Days before that date, a federal appellate court vacated the relevant part of the order, holding that the new consent restrictions “impermissibly conflict with the ordinary statutory meaning of ‘prior express consent’”. The agency then conformed its regulations and recorded the sequence in the Federal Register in a single decisive sentence: “Prior to the court’s mandate, the Commission had postponed the effective date of the revised rule and the revised rule had not gone into effect.”

We checked the live rule text rather than the commentary. The current definition of prior express consent contains no “one-to-one”, no “single seller” and no “logically and topically associated” language. It is the pre-2023 definition.

The one to one consent rule, in sequenceTimeline of the one to one consent rule in United States telemarketing regulation, in four stages. In December two thousand twenty three the communications agency adopted an order introducing new consent restrictions, published in the Federal Register in January two thousand twenty four, with a compliance date subsequently fixed at the twenty seventh of January two thousand twenty five. Before that compliance date arrived, the agency postponed the effective date of the revised rule. On the twenty fourth of January two thousand twenty five a federal appellate court granted a petition for review, holding that the agency had exceeded its statutory authority because the new consent restrictions impermissibly conflicted with the ordinary statutory meaning of prior express consent, and vacated the relevant part of the order, remanding for further proceedings. The court mandate issued on the thirtieth of April two thousand twenty five. In August two thousand twenty five the agency conformed the Code of Federal Regulations, and stated in the Federal Register that prior to the court mandate it had postponed the effective date of the revised rule and that the revised rule had not gone into effect. A direct reading of the current rule text confirms that the definition of prior express consent contains no reference to one to one consent, to a single seller, or to sellers being logically and topically associated, and is the definition that preceded the two thousand twenty three order. The timeline concludes that the rule never operated for a single day, and that a considerable volume of compliance material still describes it as current law.A rule that never governed a single callDec 2023AdoptedNew consent restrictions, compliance date later set for January 2025.Before it bitPostponedThe agency postponed the effective date of the revised rule.Jan 2025VacatedA federal appellate court held it conflicted with the statutory meaning of consent.Aug 2025Removed from the rules“the revised rule had not gone into effect”. The prior definition stands today.
Adopted, postponed, vacated days before its compliance date, then removed from the rules. It never governed a single call.

What did come into force, in April 2025, is a set of revocation rules, and they are worth knowing precisely because they are real. A person may revoke consent by any reasonable method; certain methods are reasonable per se, including replying with words such as stop, quit, end, revoke, opt out, cancel or unsubscribe; the request must be honoured within a reasonable time “not to exceed ten business days”; and a caller “may not designate an exclusive means to request revocation”. These govern robocalls, robotexts and registry-covered solicitations rather than manually dialled business calls, but the ten-day figure is the one to build your process around.

Authentication, attestation, and a myth worth killing

Carriers were required to implement the call authentication framework in their internet protocol networks by 30 June 2021. That much is in the regulations.

Attestation levels are not. The A, B and C labels everyone repeats appear nowhere in the Code of Federal Regulations. They come from an industry specification, and the clearest official description of them sits in the agency’s own 2020 order: full attestation where the provider can confirm both the identity of the subscriber and that the subscriber is entitled to the number, partial where it can confirm the subscriber but not the number, and gateway where it is merely the point of entry for a call that originated elsewhere.

Two consequences follow, and the second is the one that matters operationally.

Carriers are not required to block calls for lacking full attestation. There is no such rule. What does get blocked, at the provider level rather than the call level, is traffic from any voice provider whose filing is missing from the robocall mitigation database. Confusing the two produces a lot of wasted effort.

Your dialler probably cannot get full attestation, and the agency has said so. The 2020 order acknowledges that where an enterprise places outbound calls through a provider other than the one that assigned its numbers, the call “will not pass through the authentication service of the voice service provider that controls the numbering resource”. That is the ordinary configuration for a team using a third-party dialler or a communications platform. Expect partial attestation, and understand that this is a structural artefact of how your stack is wired rather than a judgement about your calls.

Attestation levels and what is actually blockedTable describing the three call authentication attestation levels used in the United States telephone network and clarifying what carriers are and are not required to block. Full attestation, commonly labelled A, applies where the originating provider can confirm both the identity of the subscriber placing the call and that the subscriber is entitled to use the telephone number presented. Partial attestation, commonly labelled B, applies where the provider can confirm the identity of the subscriber but not the subscriber right to the number presented. Gateway attestation, commonly labelled C, applies where the provider is merely the point of entry to the internet protocol network for a call that originated elsewhere, such as a call originating abroad or on a domestic network that has not implemented the framework. The table notes that these three labels appear nowhere in the Code of Federal Regulations, deriving instead from an industry specification described in a communications agency order of two thousand twenty, and that the regulations mention attestation only to require that providers make all attestation level decisions themselves. It further notes that no rule requires a terminating carrier to block a call for carrying less than full attestation, the blocking obligations being separate, and that what is blocked at provider level is traffic from any voice provider whose filing is absent from the robocall mitigation database. Finally it records that the same agency order acknowledges that an enterprise placing outbound calls through a provider other than the one that assigned its numbers will not pass through the authentication service of the provider controlling the numbering resource, which is the ordinary configuration for a sales team using a third party dialling platform.Attestation, and the blocking mythLevelThe originating provider can confirmIn the rules?FullThe subscriber and their right to the numberNoPartialThe subscriber, but not the numberNoGatewayOnly that it is the entry point for the callNoWhat carriers must blockNot calls with partial attestation. Traffic from any providermissing from the robocall mitigation database.Why your dialler gets partialCalls placed through a provider other than the one holding yournumbers bypass that provider’s authentication service.
The A, B and C labels are not in the regulations. And no rule requires a carrier to block a call for carrying less than full attestation.

Being labelled “Spam Likely”, and the free way out

No regulation governs spam labelling. It is done by private analytics engines under contract to carriers, largely on the strength of user reports and calling patterns. That has one good consequence: because it is not a sanction, there is a remediation path, and it is free.

A single industry form submits your numbers to the three main analytics providers at once. Separately, the main trade body publishes a directory of per-carrier and per-analytics redress contacts, covering roughly seventeen carriers and five analytics and registry services, with direct links to each one’s review process. Neither charges a fee.

Two honest caveats. The registry form says in its own words that “registration of phone numbers does not guarantee redress”, and that it is not a substitute for monitoring your own reputation. And branded calling, where your company name renders on the handset, is a paid commercial product, not an entitlement.

The operational lesson. If connect rates fall without anything else changing, check the label before rewriting the script. Call your own outbound numbers from a handset running one of the common screening apps. Changing numbers without understanding why the old one was flagged simply restarts the cycle.

Note also what is not required: displaying your company name. The rule requires that caller identification carry a number, and that the number “permit any individual to make a do-not-call request during regular business hours”. A working callback line is the obligation. The name is a product you buy.

The state that does reach business calls

Federal law leaves B2B calling hours unregulated. Some states do not, and the most instructive is Florida, because the usual summary of it is backwards.

Florida’s business to business exemption and its carve backDiagram explaining the structure of the Florida telemarketing statute as it applies to business to business calling. Florida has two relevant statutes. The first, the state mini telephone consumer protection act, defines a telephonic sales call as a call to a consumer and defines a consumer as an actual or prospective purchaser, lessee or recipient of consumer goods or services, so it does not reach a genuine business to business call. The second, the Florida Telemarketing Act, contains a general exemption for business to business sales, available where the commercial telephone seller has been lawfully operating continuously for at least three years under the same business name and derives at least fifty per cent of its dollar volume from repeat sales to existing businesses. However the exemption provision opens with the words that the provisions of this part, except two named sections, do not apply, and one of the named exceptions is the section imposing calling hours and a frequency cap. The practical result is that even a caller who qualifies for the business to business exemption remains bound by the prohibition on commercial telephone solicitation calls before eight in the morning or after eight at night in the called party time zone, and by the limit of three such calls from any number to a person over a twenty four hour period on the same subject matter or issue. The diagram concludes that this is a verifiable state rule reaching business to business calls and stricter than federal law on both hours and frequency, and that most published summaries state the opposite.An exemption with two holes cut in itThe exemption existsB2B sales are exempt, where the seller has traded three years under the same name and draws half its volume from repeat business sales.But it is expressly carved backThe provision opens: the provisions of this part, “except” two named sections, do not apply. One of them is the hours and frequency section.HoursNo call before 8am or after 8pm,in the called party’s time zone.FrequencyNo more than three calls from anynumber in 24 hours on one subject.
The exemption is real, and two provisions are expressly excluded from it. Hours and call frequency still bind a B2B caller.

Two statutes operate in Florida. The consumer-facing one defines its subject as a call “to a consumer” and does not reach genuine business calls. The Telemarketing Act does reach them, and it contains a business-to-business exemption conditioned on three years of continuous trading under the same name and at least half of dollar volume coming from repeat sales to existing businesses.

The trap is in how the exemption is written. The provision opens: “The provisions of this part, except ss. 501.608 and 501.616(6) and (7), do not apply to”, and the excepted section is the one imposing the 8am to 8pm window and the three-calls-per-24-hours cap on the same subject. An exempt B2B caller in Florida is still bound by both.

We checked one state’s text directly and will not vouch for summaries of others. The lesson generalises anyway: the federal position is permissive for B2B, and the exposure sits in state law, which has to be read one state at a time rather than taken from a compliance vendor’s map.

Recording, where the answer is simple

Federal law permits recording with the consent of one party, which can be your own representative. Roughly eleven states require all parties to consent, and a handful more require it for some conversation types but not others. The compilations that list them, including the most careful one, hedge with words like “about” and “primarily”, which reflects real legal ambiguity rather than sloppiness.

Courts also disagree on whether the law of the recorder’s location or the recorded party’s location governs an interstate call, and you cannot reliably infer where a mobile user is standing from their area code.

So the per-state routing rule that vendors sell is fragile by construction. The robust answer is duller: announce recording on every call and capture the response. There is no jurisdiction where clear disclosure plus consent is insufficient.

Nobody neutral publishes connect rates

We looked specifically, because this is the number every plan is built on.

Who publishes cold calling connect rates and what they sellTwo column comparison of what United States institutions publish about outbound calling against what commercial publishers provide. The left column lists what federal bodies measure. The labour statistics agency publishes employment counts and wage estimates for the telemarketer occupation and for sales occupations generally, and nothing about performance. The census bureau publishes establishment counts, employment and payroll by industry classification, and is prohibited by statute from releasing data that would disclose the operations of an individual employer, applying noise infusion to protect confidentiality. The communications agency regulates call signalling and consent and publishes complaint counts, but publishes nothing about whether calls are answered. The trade commission publishes enforcement actions. No federal statistical agency publishes connect rates, dial to conversation ratios or conversion data of any kind. The right column lists the categories of commercial publisher whose figures circulate as benchmarks, together with what each sells: revenue intelligence platforms that record and analyse the very calls in their datasets, contact database and dialling software vendors, sales training companies, and outsourced sales development agencies. None publishes a sampling frame, a definition of a connect, exclusion criteria or confidence intervals. The figure concludes with the least commercially motivated study available, a two thousand eleven residential real estate experiment in which fifty agents placed six thousand two hundred and sixty four calls over two weeks, of which twenty eight per cent were answered, fifty five per cent were not answered and seventeen per cent reached non working numbers, noting that the study is fifteen years old, is not business to business, was conducted in partnership with a real estate franchise whose research department supplied the script, and that its most durable finding concerns list decay rather than persuasion.Who measures this, and who only sells itFederal agencies publishEmployment in the occupationWagesEstablishment counts and payrollComplaint volumesNothing about whether calls areanswered. Nothing at all.Who publishes connect ratesRevenue intelligence platformsthat record the calls in the datasetContact databases and diallersSales training companiesOutsourced calling agenciesNo sampling frame. No definition of“connect”. No confidence intervals.The least commercial study we found is from 2011, in residential real estate: of 6,264 calls, 28 % answered, 55 % unanswered,and 17 % non-working numbers. Fifteen years old, not B2B, and run with a franchise partner. Read it for list decay, not persuasion.
No federal statistical agency publishes performance data. Every figure in circulation is produced by a company that sells something to cold callers.

The most widely quoted average comes from a platform whose dataset is its own customers’ recorded calls. That is a self-selected population of the most heavily instrumented sales teams in the world, described as though it were a population estimate. The figure may well be right for companies like those. It is not a benchmark.

The most interesting number we found is not a conversion rate at all. In a 2011 experiment, fifty agents placed 6,264 calls over two weeks: 28 per cent were answered, 55 per cent were not, and 17 per cent were non-working numbers. It is residential real estate, it is fifteen years old, and it was run with a franchise partner that supplied the script, so treat it accordingly. But the one durable thing in it is the 17 per cent, and that is a statement about list decay rather than about persuasion or scripting.

Where a US B2B phone list comes from, and why it decays

We queried the data rather than reading about it, and the result is consistent across states.

Colorado’s full business entity dataset returns 34 fields: entity identifier and name, principal and mailing addresses, status, jurisdiction, entity type, registered agent name and addresses, formation date. No phone field. The same check against Oregon’s and New York’s published business datasets returns the same answer.

The federal contractor registry does hold point-of-contact phone numbers, but its own data dictionary places them in the restricted tier alongside email and fax, while names and postal addresses sit in the public tier. A commercial marketer cannot reach them. The statistical business register is confidential by statute.

This is structural rather than accidental. Registries exist so that a company can be served with legal process. That requires an address. A phone number serves no statutory purpose, so states never ask for one and therefore never hold one.

Which means every commercial US B2B phone list is assembled privately, by scraping, data co-operatives, contributed contact data, purchase and inference, then matched onto the public registry spine. The firmographics can be traced to a public record. The phone number cannot. That provenance gap is also the best explanation for a 17 per cent non-working rate: nobody in the chain has a source of truth to correct against.

What to do with this

Sort your list by number type before you sort it by anything else. Direct dial landlines, switchboards and mobiles carry different rules, and the only one that constrains you is the mobile, where auto-dialling and prerecorded voices are out regardless of business status.

Dial mobiles by hand, and reserve any automation for landlines. That single rule removes most of the federal exposure from a B2B programme, and it costs you less than the compliance tooling sold to manage the alternative.

Check your caller ID before you change your script. Call your own numbers from a screened handset, use the free remediation forms if you are labelled, and expect partial attestation if your dialler is not the carrier that owns your numbers.

Announce recording on every call, everywhere, and stop trying to route by state.

And treat every published connect rate as a sales document. The number worth tracking is your own non-working rate, because it tells you something true about your list that no vendor benchmark can.

The related pieces are what US law actually allows in cold email and running a cold email campaign.