Is cold calling legal? B2B cold calling laws in the US, UK and EU, checked at the statute

This guide is for sales leaders, SDR managers, RevOps teams and founders who run or plan a B2B calling program in the US, the UK or the EU. Every rule here was checked against the statute, regulation or regulator's guidance on 30 October 2026, and each is cited in the sources. It's general information, not legal advice: the answer for your team depends on what you sell, who you call, how you dial and where they are, so have counsel review your program before you scale it. For how to run the calls themselves, see the guide to cold calling.

The answer by type of call

The rest of this page explains each law behind the table, then works through a calling list.

The TCPA: 47 U.S.C. 227

The Telephone Consumer Protection Act of 1991 is the federal statute behind most phone marketing lawsuits. For B2B sellers, three parts matter.

• Automated and prerecorded calls. Section 227(b)(1)(A)(iii) makes it unlawful to call a mobile number "using any automatic telephone dialing system or an artificial or prerecorded voice" without the called party's prior express consent. Section 227(b)(1)(B) restricts prerecorded calls to residential lines. Neither covers a live call dialed by a person.
• What counts as an autodialer. The statute defines an automatic telephone dialing system as equipment with the capacity to store or produce numbers "using a random or sequential number generator" and to dial them. In Facebook v. Duguid (1 April 2021), the Supreme Court held that a device must have that random or sequential capacity to qualify, which left most CRM-driven dialers outside the federal definition. State definitions are broader (see below).
• Who can sue, and for how much. Anyone who receives a call in breach of 227(b) can sue for actual loss or $500 per violation, whichever is greater, and a court may triple it for willful or knowing violations (227(b)(3)). For Do Not Call breaches, a person who receives more than one violating call within 12 months from the same entity can sue for up to $500 per violation, also trebled for willful violations (227(c)(5)), with a defense for companies that kept reasonable procedures.

The TCPA doesn't preempt state laws that impose more restrictive rules on intrastate calls (227(f)(1)), which is why the state laws below exist.

The FCC's rules: 47 CFR 64.1200

The FCC writes the rules that carry out the TCPA. The ones a calling team runs into:

Four FCC and court decisions change how these rules work in practice:

• Wireless numbers are presumed residential. In its 2003 order, the FCC said it would "presume wireless subscribers who ask to be put on the national do-not-call list to be residential subscribers." That's where a B2B list is most exposed: a contact's personal mobile on the registry.
• AI voices are artificial voices. In Declaratory Ruling FCC 24-17 (released 8 February 2024), the FCC confirmed that the TCPA's restrictions on artificial or prerecorded voices cover AI technologies that generate human voices. An AI voice agent calling a cold list of mobiles needs the same written consent as a robocall; see AI cold calling.
• The one-to-one consent rule never took effect. On 24 January 2025, the Eleventh Circuit vacated the part of the FCC's 2023 order that would have limited consent to one seller at a time (Insurance Marketing Coalition v. FCC).
• Courts now read the statute themselves. In McLaughlin Chiropractic Associates v. McKesson (20 June 2025), the Supreme Court held that the Hobbs Act doesn't bind district courts in enforcement cases to an agency's interpretation. FCC readings are now persuasive rather than binding in private TCPA suits, so outcomes can vary by court.

The FTC's Telemarketing Sales Rule: 16 CFR 310

The TSR covers telemarketing: a plan, program or campaign to sell goods or services by telephone that involves more than one interstate call (310.2). For business calls, the key provision is the exemption at 310.6(b)(7). It exempts "telephone calls between a telemarketer and any business to induce the purchase of goods or services," with two exceptions:

• Misrepresentation and false statements. Since amendments published in 2024, the exemption doesn't cover 310.3(a)(2), which bans misrepresenting material information such as total cost, restrictions and the nature of what you sell, or 310.3(a)(4), which bans false or misleading statements to induce payment. In plain terms: you may cold call a business, but you may not mislead it.
• Nondurable office and cleaning supplies. Calls selling items such as paper, toner, ink and cleaning solvents to businesses aren't exempt, although the registry and recordkeeping provisions don't apply to them.

The FTC's compliance guide adds that calls to business lines asking employees to buy something for their own use aren't B2B calls at all. For calls the TSR does cover (consumer calls), it requires prompt disclosures, calling hours of 8am to 9pm (310.4(c)), honoring company-specific do-not-call requests and the national registry (310.4(b)(1)(iii)). The FTC says violators can face civil penalties of up to $53,088 per violation, and each call can be a separate violation.

The National Do Not Call Registry

The registry had 259 million active registrations on 30 September 2025, according to the FTC's Data Book for fiscal 2025. The FTC's consumer FAQ is explicit: "The Registry is for personal phone numbers. Business phone numbers and fax lines are not covered." Its guidance for telemarketers adds that most calls to a business made to solicit sales from that business are exempt.

What that means for a B2B list:

• Business main lines and direct dials: no registry scrub needed under federal law.
• Mobile numbers: registered mobiles are treated like home phones. If you can't tell whether a mobile is a business or personal phone, scrub it.
• If you scrub, the FTC requires anyone who must comply to use a version of the registry no more than 31 days old. Exempt organizations may access it free, and data for up to five area codes is free for everyone.
• Established business relationships: a consumer who bought from you can be called for 18 months after the last purchase or delivery, and one who made an inquiry for three months.

State laws: four checked at the statute

States can regulate intrastate calls more strictly, and several do, often with their own private right of action. These four show the range. Each was read on the legislature's own site; the definitions decide whether your calls are covered.

The business exemptions are narrower than most sellers assume:

• Florida and Oklahoma exempt a business-to-business sale only where the seller has operated continuously for at least three years under the same name and at least 50% of its dollar volume is repeat sales to existing businesses, or the buyer will resell the goods or use them in manufacturing or recycling (Fla. Stat. 501.604(10); Oklahoma 775C.5).
• Maryland exempts B2B sales by a solicitor operating for at least three years under the same name, but only from the consent rule. The hours and three-call limits apply to any called party.
• Texas exempts sales to a business that will resell the item or use it in manufacturing (302.056), publicly traded companies and their subsidiaries (302.053), and callers who don't try to close on the phone but arrange a face-to-face sales presentation later (302.059). Whether a video meeting is face to face isn't stated.
• Automated systems. Oklahoma's "automated system for the selection or dialing of telephone numbers" and Florida's similar wording don't use the federal random-or-sequential test, so a parallel or predictive dialer outside the federal definition may still be inside a state one.

Outside the US: the UK and the EU

United Kingdom. Live marketing calls fall under regulation 21 of the Privacy and Electronic Communications Regulations 2003 (PECR). You may not call a subscriber who has told you not to, or a number on the register, unless it was added less than 28 days earlier or the subscriber has told you they don't object. The ICO says that for business calls you need to screen against both the TPS (which some sole traders and partnerships use) and the Corporate TPS, as well as your own do-not-call list. You must always say who's calling, and give a contact address or freephone number if asked. Automated marketing calls need specific consent; general consent, or consent for live calls, isn't enough. The ICO notes its guidance is under review after the Data (Use and Access) Act.

European Union. Article 13 of the ePrivacy Directive requires prior consent for automated calling, and leaves each member state to choose between opt-in and opt-out for live calls. The consent rules apply to natural persons, with member states required to protect the legitimate interests of businesses. Germany is the strict example: section 7(2) of its Act against Unfair Competition bans telephone advertising to consumers without prior express consent, and to other market participants without "at least the latter's presumed consent", which in practice means a B2B caller needs a real reason to believe the business would welcome the call. The GDPR applies to business contacts' names and direct numbers: direct marketing "may be regarded as carried out for a legitimate interest" (Recital 47), a person's objection to direct marketing must always be honored (Article 21), and you must tell people where you got their data at the latest at your first communication (Article 14).

Worked example: checking a calling list

Illustrative example. The company, list and counts are invented to show the method.

Ledgerline (ledgerline.example), a two-year-old practice management software company, plans to call 1,200 contacts at US accounting firms with a parallel dialer. (For where the firm names come from, see the list of accounting firms.) Its RevOps lead works through the list:

Arithmetic: 270 unknown mobiles minus 38 registered leaves 232, plus 170 firm phones gives 402 mobiles. 1,200 minus 38 is 1,162 contacts; 96 + 41 + 23 + 88 = 248 in the four states; 1,162 minus 248 leaves 914 contacts that can be called this week, all with honest openers, accurate caller ID and a do-not-call list checked before every dial. The 248 aren't lost: they're a two-week compliance task.

Checklist before you dial

• Every rep says their name, company and the reason for the call, and never misstates who they are or what they sell.
• Caller ID shows a number people can call back to ask not to be called.
• You keep one do-not-call list, check it before every call and record requests the same day.
• Mobile numbers are tagged business or personal; unknown ones are scrubbed against the registry within the last 31 days.
• No autodialer, prerecorded message or AI voice reaches a mobile without signed written consent for that number.
• You know which states you call into, and you've checked their registration, licensing, hours and call-count rules.
• For the UK, numbers are screened against the TPS and CTPS; for the EU, you've checked the country's opt-in or opt-out choice and recorded your GDPR legitimate interest.
• If you record calls, you tell the other person at the start. Federal law allows recording with one party's consent, but some states require everyone's.
• Counsel has reviewed the program, and you recheck it whenever you change dialers, lists or countries.

Common mistakes

• "B2B means no rules." The TSR's misrepresentation bans, the TCPA's mobile rules and state laws all reach business calls.
• "The TCPA bans cold calls to cell phones." It restricts autodialed, prerecorded and artificial-voice calls, not live calls dialed by a person, though the registry may still cover a personal mobile.
• "Every violation costs $1,500." Statutory damages are $500 per violation; a court may triple them only for willful or knowing violations.
• Assuming one country's rules carry over. A list that's fine to call in the UK after a CTPS screen may need presumed consent in Germany.

Next step: build openers that stay honest and specific with the cold calling scripts, each starting from a checked reason to call.