Regulation of pay-per-call

Pay-per-call marketing in the United States is shaped by the Telephone Consumer Protection Act (TCPA), by Federal Communications Commission (FCC) rules on consent, by state laws on recording calls, and by the caller-ID authentication framework known as STIR/SHAKEN.^[1][2][3] This page summarises the rules as they stood on 10 September 2026. It is a description of public sources, not legal advice.

The TCPA, enacted on 20 December 1991, prohibits making calls using an automatic telephone dialing system or an artificial or prerecorded voice to numbers assigned to a cellular telephone service without the prior express consent of the called party, with limited exceptions.^[1] It creates a private right of action under which a person may recover actual monetary loss or US$500 per violation, whichever is greater, and a court may treble the award to US$1,500 per violation for wilful or knowing violations.^[1] REPORTED ComplianceHub describes the damages as uncapped, and AffNinja lists TCPA consent, do-not-call rules, misleading disclosures, recording laws and lead reselling as the main compliance risks in pay-per-call.^[4][5]

INFERRED Because the statute's autodialer provisions apply to the making of calls, an inbound call placed by a consumer is generally outside them, which is why pay-per-call is often described as carrying lower TCPA risk than outbound telemarketing; callbacks, SMS follow-ups and transfers to another party can bring an interaction back within the statute's scope.^[1][5]

In 2023 the FCC adopted amendments to its TCPA rules under which a consumer's prior express consent to telemarketing robocalls and robotexts would have to be given to one seller at a time, rather than through a single consent covering many telemarketers, and calls would have to be "logically and topically associated" with the interaction that prompted the consent.^[6][7] The rule was scheduled to take effect on 27 January 2025.^[8][7] Olshan describes its effect on lead generation as requiring consumers to be told, at the time of consent, which companies would be entitled to contact them, even where the consumer wanted an open-ended request.^[8]

On 24 January 2025, the FCC postponed the effective date to 26 January 2026.^[8] The same day, the United States Court of Appeals for the Eleventh Circuit vacated the rule in Insurance Marketing Coalition v. FCC.^[7][9][10] The court held that the FCC had exceeded its statutory authority, because "prior express consent" carries its ordinary meaning: a consumer need only "clearly and unmistakably" state, before receiving the call, that they are willing to receive it, and one-to-one consent is not required.^[7][10][9] Kaufman Dolowich summarises the holding as the restrictions impermissibly conflicting with the ordinary statutory meaning of the phrase.^[6]

REPORTED According to ComplianceHub, the FCC subsequently deleted the vacated language and reinstated the prior version of the rule, so that the operative standard in 2026 is prior express written consent for marketing robocalls and texts without the one-to-one requirement.^[4] AffNinja cautions that the vacatur does not make lead generation loose, and that Federal Trade Commission guidance still warns against misleading consent language and false claims of affiliation with government agencies, insurers, law firms or lenders.^[5]

REPORTED ComplianceHub reports that businesses must honour opt-outs made through "any reasonable means", that the FCC points to a ten-business-day standard for processing them, that a single confirmation message may be sent after an opt-out, and that a delayed rule on the scope of revocation is scheduled to take effect on 31 January 2027.^[4] These dates have not been checked against the FCC docket by this site's editors and are marked accordingly.

Most US states require only one-party consent to record a phone call, so that a participant may record without telling the other party; a smaller group requires the consent of all parties.^[2] Justia's survey lists California, Florida, Washington, Illinois, Maryland, Massachusetts, New Hampshire and Pennsylvania as all-party consent states, and notes variations or ambiguity in Connecticut, Delaware, Michigan, Montana, Nevada and Oregon.^[2] In California, the state Supreme Court held in Kearney v. Salomon Smith Barney that the all-party rule applies to a call between a person in California and a person in a one-party state.^[2] The federal wiretap statute, 18 U.S.C. § 2511, is a one-party consent law.^[2] Platforms accordingly offer recording disclosures and transcription described as compliance features, and AffNinja lists recording legality in the caller's state as one of the checks a publisher must make.^[11][5]

STIR/SHAKEN is a suite of protocols intended to combat caller-ID spoofing on public telephone networks by attaching digital certificates to call information so that providers can verify whether a caller ID is legitimate.^[3] It defines three attestation levels: full ("A"), where the provider recognises the whole number as belonging to the originating subscriber; partial ("B"), where the call comes from a known customer but the number cannot be fully verified; and gateway ("C"), where the call can be verified only as coming from a known gateway.^[3] Following the TRACED Act of December 2019, the FCC required large carriers to implement the systems by 30 June 2021 and smaller and rural carriers by 30 June 2023.^[3] The framework is relevant to outbound and transfer traffic rather than to the inbound calls that make up most pay-per-call volume.^[3][5]

AffNinja describes the compliance layer of a pay-per-call operation as do-not-call scrubbing, consent logs and call-recording rules, kept as proof if a buyer or regulator asks.^[5] Its checklist for publishers asks whether consent was clear, specific and documented; whether numbers are scrubbed where required; whether recording is legal in the caller's state; whether the landing page implies government, Medicare, legal or lender affiliation; and whether the platform shows why a call was rejected.^[5]

UNKNOWN State "mini-TCPA" statutes such as Florida's telephone solicitation act, vertical-specific rules such as the Medicare marketing rules for third-party marketing organisations and state patient-brokering laws, and the consent-capture products used to evidence consent are not yet described here, because the editors have not verified them against primary sources; they are listed on the What we do not know page.^[5]

• Pay-per-call – main article
• How it works
• History
• Glossary