Debt Collection Call Compliance: FDCPA, TCPA and Reg F
Collections is the call type regulators actually pull transcripts of. Most of the exposure comes from a small number of rules that are easy to state and easy to breach at volume, which is exactly the combination that produces lawsuits.
This is a plain-language summary of what the main US rules require. It is not legal advice, and it does not cover every state. Where money is at stake, ask a lawyer who knows your jurisdiction.
The three rulebooks
Three separate regimes apply to a collection call, and they overlap awkwardly.
FDCPA, the Fair Debt Collection Practices Act, governs how third-party collectors may behave: what they can say, who they can tell, and when they must stop.
Regulation F, the CFPB rule that implements the FDCPA, added the concrete numbers the statute lacked. The call frequency limit lives here.
TCPA, the Telephone Consumer Protection Act, governs the technology used to place the call rather than the debt itself. It is the one that bites on automated dialling and prerecorded messages.
The practical consequence: you can be fully compliant with the FDCPA on what was said and still be exposed under the TCPA for how the call was placed.
The 7-in-7 rule
Regulation F limits a collector to seven call attempts about one debt in a seven-day period. Once you have actually spoken to the consumer about that debt, you must wait seven days before calling again.
Two things trip teams up.
It is per debt, not per consumer. A consumer with three separate accounts is subject to the limit three times over. That is not a loophole to exploit, and courts take a dim view of it being treated as one.
It is a ceiling, not a target. Building a dialling strategy that hits seven attempts because seven is allowed is one of the most common operational failures in the industry. The rule describes the outer edge of lawful, not the recommended cadence.
Local rules can be stricter. New York City is lowering its limit to three contact attempts in seven days from September 2026, and other jurisdictions have their own numbers. A national campaign running to the federal ceiling will breach several local rules simultaneously.
Calling hours
No contact before 8am or after 9pm in the consumer’s local time zone. The consumer’s, not yours, which matters the moment a portfolio spans more than one zone.
This is the single easiest rule to breach accidentally. A campaign scheduled in one time zone and dialled against a national list will place unlawful calls without anyone intending it. Time zone should be derived per record and enforced by the system, not left to whoever set the campaign window.
Where the penalties differ
This is the part worth understanding before deciding how much risk your dialling strategy carries.
Under the FDCPA, most courts cap statutory damages at $1,000 per lawsuit, regardless of how many wrongful calls were made to that consumer. Under the TCPA, statutory damages attach per call.
That asymmetry is why automated dialling deserves more caution than manual dialling even when the script is identical. A scripting error is bounded. A dialling error scales with the campaign.
Disclosure and identification
Every call must identify the caller and, where required, state that the communication is from a debt collector attempting to collect a debt. Getting this wrong is not a technicality: it is one of the most frequently litigated provisions in the FDCPA.
If an AI agent is placing the call, disclose that too. It costs nothing, it removes an argument you do not want to have, and in several jurisdictions it is becoming an explicit requirement rather than a courtesy.
Prerecorded messages and automated dialling
The TCPA restricts prerecorded and artificial voice messages to consumers without prior express consent, and the limits on prerecorded debt collection calls have tightened. Consent must be documented, tied to the number actually dialled, and revocable.
Three operational points follow:
- Consent state should be checked before dialling, not reconciled afterwards. A call already placed cannot be un-placed.
- An opt-out heard on any call must apply immediately and permanently, and across every future campaign, not just the one running.
- Reassigned numbers are a live risk. Consent given by a previous holder of a number is not consent from the person who answers today.
Cease communication requests
Once a consumer asks in writing that you stop contacting them, you must stop, with narrow exceptions such as notifying them of a specific action. A verbal request to stop calling a particular number should be honoured too, and arguing about the distinction in front of a regulator rarely goes well.
The system requirement here is unglamorous: opt-outs need to be a hard suppression applied at dial time, not a flag someone reviews in a weekly report.
A practical compliance checklist
Before a collections campaign goes out:
- Consent verified per record, at dial time
- Time zone derived per record, calling window enforced by the system
- Attempt counter tracked per debt, not per consumer
- Local limits applied where stricter than federal
- Suppression list applied, including verbal opt-outs
- Disclosure scripted and, if AI is placing the call, stated
- Every call recorded and retained, with the disclosure captured at the top
If any of those is enforced by a person remembering rather than by the platform, it will eventually fail at volume. That is not a criticism of the people. It is arithmetic.
Where automation helps, and where it does not
Automation does not make a call compliant. It makes compliance consistent, which is a different and more useful claim.
A human collector on their fortieth call of the day says a shorter disclosure than they did on their first. An agent says the same one every time. A person scheduling a campaign can forget that a portfolio spans four time zones. A system that derives the window per record cannot.
What automation does not do is decide what is lawful. Rules differ by state and by city, they change, and the platform enforces whatever it has been configured to enforce. That configuration is still your responsibility.
VoiceGun runs disclosure, consent checks, suppression and local calling windows at platform level on collections campaigns, and restricts the agent from settlement negotiation and legal statements by default. Every call is recorded with the disclosure captured, so producing a specific call for a regulator is a lookup rather than an investigation.
The short version
Seven attempts per debt per week, and treat that as a ceiling. Eight to nine in the consumer’s time zone. Consent checked before the dial, not after. Opt-outs suppressed permanently and immediately. Disclose who is calling, and disclose if it is an AI. Record everything.
And read your state rules, because several are stricter than everything above.