Is Cold Calling Legal in 2026? Rules, Risks, and Fines

Is cold calling legal in 2026? Yes. You can still cold call in the US, the UK, and most of the EU. But the rules are strict, and they govern how you dial more than what you say. Here is what is allowed, what is not, and what a slip costs.

TL;DR

• Is cold calling legal? Yes, for B2B calls to business numbers you have scrubbed against do-not-call lists.
• The TCPA is the costly one. It runs $500 to $1,500 per bad call, with no cap.
• Auto-dialers, taped messages, and AI voices need consent first. Most fines start with dialer settings.
• In the UK and EU, a phone number is personal data. You need a lawful basis, a privacy notice, and a real opt-out.
• The fix is dull: clean data, a DNC scrub, sane call hours, and a log of where each number came from.

Is cold calling legal at all in 2026?#

Yes. The real question is which calls are legal, to whom, with what gear, and at what hour.

Think of it like driving. Driving is legal. Driving 90 mph past a school at 2 a.m. in an unlicensed car is not. Nobody bans the act. Regulators ban certain moves inside it.

Cold calling works the same way. Every major market allows B2B calls to strangers. Each one then adds limits on top: list scrubs, consent for auto-dialers, call-time windows, ID duties, and data rules for how you got the number.

So why do so many sales leaders think the answer is no? Because the consumer rules are strict, and people flatten them into "cold calling is banned." The two regimes are not the same. A human dialing a desk line from a company website sits in a very different spot than a taped message sent to a home mobile.

The gap between those two is where every fine lives.

Is cold calling legal under each major law?#

Five rule sets cover most B2B outbound. Here is what each one limits.

Is cold calling legal under the TCPA?#

Yes, if a person dials. The TCPA covers auto-dialers, taped and fake voices, and calls to mobiles. People can sue you direct. Damages run $500 per call, or $1,500 if the breach is willful. There is no cap. This is the law behind the class actions.

Is cold calling legal under the TSR and the US DNC list?#

Yes, with chores. The Telemarketing Sales Rule asks you to scrub the registry every 31 days. Call hours are 8 a.m. to 9 p.m. in the other person's time zone. You must say who you are. Dropped calls must stay under 3%. FTC and FCC fines run past $50,000 per call.

Is cold calling legal under US state laws?#

Often, but the bar is higher. Florida, Oklahoma, Maryland, and Washington all passed their own acts. Several define consent more tightly and let people sue. A campaign that clears federal law can still lose in Florida.

Is cold calling legal in the UK?#

Live calls are. You may not call a number on the TPS or CTPS list. You must stop if the person has told you to. Taped calls need consent first, full stop. The number is personal data, so UK GDPR applies on top.

Is cold calling legal in the EU?#

It depends on the member state. Germany wants consent first, even for business calls. The Netherlands, France, and Spain run opt-out registers. Legitimate interest under Article 6(1)(f) can work for B2B. You still need a written balancing test and a working opt-out.

Is cold calling legal in Canada?#

Yes, with a paper trail. CASL is known for email, but the CRTC voice rules apply here. Scrub the National DNCL, keep to call hours, say who you are, and hold records for three years.

One point is worth learning. How you dial is policed harder than what you say. A weak pitch can still be a legal call. A bad dialer cannot.

Is cold calling legal in every scenario?#

No. Send this table to your sales manager.

Read down the risk column and a pattern shows up. Every high row is either a robot or a person you ignored. None of them is the plain act of calling a stranger.

Is cold calling legal for B2B without extra steps?#

Partly. And the "partly" is where teams get burned.

In the US, the national DNC list covers homes. B2B calls to business lines sit outside its core scope. That sounds clean until two facts land. Many "business" mobiles on bought lists are personal cells. And the TCPA's auto-dialer and taped-voice rules have no B2B carve-out at all. Dial an owner's mobile with an auto-dialer and your B2B pitch will not save you.

In the UK, the CTPS exists for business numbers. Sole traders and small partnerships count as people, with full TPS cover. The ICO has fined B2B callers again and again for skipping the CTPS scrub.

In the EU, GDPR draws no line between work data and home data. firstname.lastname@company.com and a desk line both point to a real person. You need a lawful basis either way.

Short version: B2B status cuts your risk a lot in the US, some in the UK, and almost none in the EU. It never wipes it out.

What are the real fines for illegal cold calling?#

Damages scale with volume. That is why the numbers look so big.

Run the math on a mid-size team. An SDR pod dials 150 numbers a day, five days a week, for a quarter. That is about 9,750 calls. Say the list was never scrubbed and 4% of it sits on the DNC list. That is 390 bad calls. At $500 each, you are at $195,000. Nobody has even claimed willful yet.

Pitch quality does not move that number. Neither does your close rate. So list hygiene is a legal control, not an ops nicety. A clean, sourced list is the cheapest cover you can buy.

How do you keep cold calling legal in practice?#

Six controls cover most of the risk. None of them need a lawyer on call.

First, fix your data.

1. Know where every number came from. Source is the first question in any probe. "We bought a list" is not a defense. Use vendors that publish how they gather data — Tomba lists its data sources for that reason. Store the source on each CRM record.
2. Scrub every list every 31 days. The US DNC, state lists, TPS and CTPS in the UK, and national opt-out lists in the EU. This is a cron job, not a project.
3. Keep your own do-not-call list forever. Log each "take me off your list" within a day. Never take a name back off it. The TSR asks for this on top of the federal registry. It is the most common finding in FTC cases.

Then set up how you dial.

4. Put the dialer in safe mode. Use manual or click-to-dial for any number that could be a mobile. If you run a predictive dialer, cap drops at 3%. Play a proper message within two seconds. Never attach a taped voice without written consent. AI voice agents fall under the fake-voice rules, and the FCC said so plainly.
5. Say who you are in the first ten seconds. Your name, your firm, and a callback number. The US, UK, and Canada all require it. It lifts connect quality too, so there is nothing to argue about.
6. Verify before you dial. A dead number wastes a dial. A number that belongs to someone who never worked there is a compliance event. Run contacts through a phone validator first and both problems go away.

Controls 1 and 6 are the ones teams skip. They also decide whether the other four matter at all. Scrubbing a list you cannot source is auditing a book you did not write.

Is cold calling still worth the paperwork?#

Yes, for the right shape of deal. And the rules double as a quality filter.

Cold calling is still one of the highest-intent B2B channels. It pays off on deals above roughly $20,000 ACV. It pays off on complex products that need live answers. It pays off where email reply rates have sunk to nothing. Work from HubSpot and reviews on G2 show phone beating email on first meetings — when the list is tight, and only then.

That last clause is the whole argument. The habits that make a cold call legal are the habits that make it convert. Known sources. Fresh data. Honored opt-outs. Real buyers. Sane hours. A clean list is small, sharp, and researched. A risky one is big, stale, and scraped.

Teams that treat the rules as a tax dial more and close less. Teams that treat them as a data job dial less and close more.

Want the wider view? Our notes on response rate benchmarks and on sales automation show where phone fits next to email and LinkedIn.

Is cold calling legal when an AI voice makes the call?#

Treat AI voice as your strictest bucket. Regulators already do.

In February 2024, the FCC ruled that AI voices count as "artificial" voices under the TCPA. So an AI cold call needs prior express written consent. That is the robocall bar. Almost no cold program can clear it. Cold means no prior tie. Written consent means a prior tie. The two barely overlap.

What that means in 2026:

• AI voice for cold calls: skip it unless you hold written consent. The risk is $1,500 per call, and people can sue.
• AI voice for inbound and warm callbacks: usually fine when they called you. Say up front that the voice is a bot.
• AI for prep, research, and call notes: no limits. This is where the real time savings sit.
• Predictive dialers: legal, but the drop cap, the two-second rule, and mobile consent make them an expert tool.

The best pattern in 2026 is the same as in 2020. People dial, AI preps. Use research tools to make each dial smarter, not to make more dials per hour. Pulling verified direct lines with a phone finder does more for connect rates than any dialer setting. And it carries none of the legal weight.

What does a compliant cold-call workflow look like?#

Here is the full run, start to finish, for a US and UK campaign.

Steps 2 through 4 are where a data vendor saves you or sinks you. Can your source say where the number came from? Is it still valid? Does the person still work there? If not, steps 5 through 9 are theater.

Teams that mix email and phone fold these steps into one pass. Pull verified contacts, check them, and export a clean list. See Tomba pricing for how the free tier's 25 searches a month, Starter at $49/mo, Growth at $99/mo, and Pro at $249/mo map to your call volume.

Frequently asked questions#

Can I cold call someone who downloaded a whitepaper? Yes, and you stand on firmer ground than a pure cold call. But a download is not "prior express written consent" for a taped or auto-dialed call. Manual dial is fine. The dialer is not.

Does the US DNC list cover business numbers? Not in its core scope. Still, many listed numbers are mobiles used for work. And there is no B2B carve-out from the TCPA. Scrub anyway.

Is cold calling legal for a number I found on LinkedIn? In the US, yes, with a manual dial. In the UK and EU, the number is personal data. You need a lawful basis, a privacy notice, and a suppression check first.

Is cold calling legal in every US state? No. Florida, Oklahoma, and a few others set a higher bar than federal law, and they let people sue. Check state rules before you dial.

How long must I keep call records? The TSR expects 24 months. Canada asks for three years. GDPR asks you to set and log a retention window rather than keep data forever.

Are AI voices allowed on cold calls? No, not without prior express written consent. The FCC put AI voices in the same box as robocalls under the TCPA.

Where to start#

Is cold calling legal? Yes. Calling from a list you cannot source, check, or scrub is where the risk starts. And that is a data problem, not a sales problem.

Fix the data layer first. Build lists from known sources. Verify each contact before it hits the dialer. Keep a record of where every number came from. The Tomba Email Finder gives you verified contacts with a clear trail. It pairs with the phone finder and validator, so your list is clean before the first dial — not after the first complaint. Start free with 25 searches a month and see how much of your list survives.

Related guides#

• Cold Calling Compliance in 2026: Rules, Risks & Checklist
• GDPR & B2B Cold Calling: Regulations in France, the UK, and Germany
• Are Auto Dialers Illegal in 2026? TCPA Rules Explained
• B2B Telemarketing Data in 2026: Sources, Costs & Compliance