This guide covers the rules in the major markets where our clients operate: United States (federal TCPA and state laws), Canada (CASL and DNC), United Kingdom (PECR and CTPS), and the European Union (GDPR). We are not attorneys and this is not legal advice, but it is a practical, accurate summary of where the line sits and how reputable programs stay well on the safe side.
Most B2B teams lose 40–60% of qualified prospects to broken handoffs and weak qualification. Take our 2-minute diagnostic to find out where your pipeline is bleeding — and how to fix it.
Start the Quiz → Takes 2 minutes. No email required to start.Related Article: Cold Calling Lists
Related Article: Cold Calling Statistics
Is Cold Calling Legal at All?
Yes, in most jurisdictions, when done properly. Blanket “cold calling is illegal” claims you read online are almost always about specific restricted uses (automated consumer calls without consent, for example), not the practice generally. B2B cold calling to business numbers is legal across the United States, UK, Canada, Australia, and most of the EU, subject to do-not-call registries and specific procedural rules.
United States: TCPA and the National Do Not Call Registry
The TCPA (Telephone Consumer Protection Act)
The TCPA, enforced by the Federal Communications Commission (FCC), is the core federal law. The key rules for cold callers:
- Calls to consumer wireless numbers using an automatic telephone dialing system (ATDS) generally require prior express consent.
- Pre-recorded (robocall) messages to consumers require prior express written consent.
- The TCPA does not apply to calls between businesses using non-automated dialing.
- The statutory damages are $500 per violation, tripled to $1,500 for willful violations.
The National Do Not Call Registry
Maintained by the FTC, the registry lets consumers opt out of telemarketing calls. Businesses making sales-related calls to consumers must:
- Scrub their call lists against the DNC registry every 31 days.
- Honor any do-not-call request immediately and for 5 years minimum.
- Maintain an internal do-not-call list alongside the federal one.
- Note that B2B calls to business numbers are generally exempt.
State-Level Rules
Several states add restrictions on top of federal law. Florida (Florida Telephone Solicitation Act), Oklahoma, and Washington have been particularly active. California imposes specific disclosure rules. Always verify the rules in each state you are calling into.
Canada: CASL and the CRTC DNCL
Canada has two main rules. The Canadian Anti-Spam Legislation (CASL) covers commercial electronic messages but does not apply to voice calls. For phone calls, the CRTC Do Not Call List (DNCL) is the equivalent of the US DNC registry. Businesses must register as telemarketers, subscribe to the DNCL, and scrub their calling lists against it.
B2B calls to business numbers are generally exempt, similar to US rules.
United Kingdom: PECR and the CTPS
The UK has two key rules. PECR (Privacy and Electronic Communications Regulations) governs marketing calls. The Telephone Preference Service (TPS) covers consumer numbers and the Corporate Telephone Preference Service (CTPS) covers business numbers.
Unlike the US, the UK requires callers to scrub against the CTPS for business calls, not just consumer calls. This is a meaningful difference. Fines from the ICO can reach up to 500,000 pounds.
European Union: GDPR and National Telemarketing Rules
GDPR does not directly prohibit cold calling but does require a lawful basis for processing personal data. For B2B prospecting, “legitimate interest” is the usual basis, but it requires documenting a legitimate interest assessment (LIA) and offering an easy opt-out.
Individual EU countries have their own rules on top of GDPR. Germany requires prior consent for consumer calls under the UWG (unfair competition law). France has the Bloctel registry. Italy has restrictive telemarketing rules. Always verify country-specific rules.
GDPR fines can reach 4 percent of global annual revenue or 20 million euros, whichever is higher, but the realistic range for cold calling violations is far smaller.
Penalties: The Real-World Cost of Getting It Wrong
- TCPA: $500 per violation standard, $1,500 per violation willful. Class actions can stack these quickly into millions.
- US DNC violations: up to $43,792 per violation (FTC penalty ceiling).
- UK PECR: up to 500,000 pounds per enforcement action.
- EU GDPR: up to 20 million euros or 4 percent of global revenue.
- Canada CRTC: up to $15,000 per violation for corporations.
A Practical Cold Calling Compliance Checklist
- Document your lawful basis for calling (B2B legitimate interest, consent, existing business relationship).
- Scrub lists against all applicable DNC registries every 31 days.
- Maintain an internal do-not-call list with the date and reason for each entry.
- Provide your company name and a call-back number at the start of every call.
- Honor do-not-call requests immediately and in writing.
- Do not use auto-dialers or pre-recorded messages to consumer numbers without explicit written consent.
- Record your calls only in compliance with one-party or two-party consent laws (varies by state and country).
- Train callers on the rules at least annually.
- Document a written compliance policy and audit it quarterly.
- Get legal review in each new country before launching.
Related Article: Cold Calling Outsourcing
Related Article: B2B Cold Calling Services
How DemandNexus Ensures Compliance
At DemandNexus, compliance is built into our operating model. We scrub every call list against all applicable DNC registries before dialing, maintain internal do-not-call lists that persist across clients, train callers on country-specific rules, and audit our own call recordings quarterly. If a prospect asks to be removed, they are removed within 60 seconds across every client we work with.
FAQs
Is it illegal to cold call a business?
In the United States, Canada, and Australia, calling business numbers is generally legal. In the UK, you must also scrub against the CTPS registry for business numbers. In the EU, you need a documented lawful basis under GDPR.
Do I need consent to cold call?
For B2B calls to business numbers, usually no. For consumer calls, usually yes (especially if using auto-dialers or recordings). The safest posture is to always offer an easy opt-out at the start of every call.
What is the fine for violating the TCPA?
$500 per violation, $1,500 per willful violation. Class actions can multiply this into six or seven figures quickly.
Do I need to scrub against the Do Not Call registry for B2B calls?
In the US, B2B calls to business numbers are exempt from the federal DNC. In the UK you must scrub against the CTPS even for business calls.
