Outbound calling in the US is governed by two overlapping regimes that are routinely confused. Understanding which is which matters, because they carry very different risk profiles.
TCPA vs TSR at a glance
| TCPA | TSR | |
|---|---|---|
| Type | Federal statute (47 U.S.C. § 227) | FTC regulation (16 C.F.R. Part 310) |
| Regulator | FCC | FTC |
| Private lawsuits | Yes — $500–$1,500 per call | No |
| Civil penalties | FCC forfeitures | Up to $53,088 per violation |
| Core focus | Autodialers, prerecorded voice, consent | DNC Registry, disclosures, deception |
| Where most risk sits | Class actions from serial filers | Regulatory enforcement sweeps |
The asymmetry in the "private lawsuits" row explains why practitioners talk about TCPA risk far more than TSR risk. A regulator has to choose to investigate you. Any recipient of a single text can file a TCPA claim tomorrow.
What the TSR requires
- DNC Registry scrubbing at least every 31 days, under your own Subscription Account Number.
- An internal do-not-call list, maintained and honoured.
- Calling hours of 8am to 9pm in the consumer's local time.
- Prompt disclosure of the seller's identity and the sales purpose of the call.
- Material terms — total cost, restrictions, refund policy — disclosed before payment.
- Accurate caller ID transmitting a name and a number that can be called back.
- Record retention for advertising, scripts, sales records and do-not-call requests.
- Abandonment limits — a call must ring at least 15 seconds or four rings before being dropped.
Where teams get caught
Two patterns recur. The first is treating a DNC scrub as the whole of compliance — it is one TSR requirement among many, and it does not touch the TCPA's consent rules at all. The second is assuming a vendor's scrubbing satisfies your obligation; the TSR puts the duty on the seller, and sharing your SAN with a provider does not transfer it.
Where list hygiene helps
NumberBroom covers the data-quality side: carrier validation, line type, and a known-litigator check at $0.044 per row. Registry scrubbing runs under your own SAN, and consent capture is a process you own. The full picture.
Frequently asked questions
What is the difference between the TCPA and the TSR?
Different statutes, different regulators, different enforcement. The TCPA is a federal statute enforced by the FCC and — critically — by private plaintiffs, who can sue for $500 to $1,500 per call. The TSR is an FTC regulation enforced by the FTC and state attorneys general, with civil penalties up to $53,088 per violation and no private right of action.
You must comply with both. Satisfying one says nothing about the other.
Does the TSR let consumers sue me?
No. The TSR has no private right of action — only the FTC and state AGs enforce it. The lawsuit risk in telemarketing comes from the TCPA, which does allow private suits. This is why TCPA exposure usually dominates practical risk planning even though TSR penalties are nominally larger per violation.
Who is exempt from the TSR?
Several categories sit partly or wholly outside it, including certain banks, credit unions and common carriers regulated elsewhere, plus some intrastate calling. Political calls and calls by tax-exempt non-profits have their own treatment.
Exemption from the TSR does not exempt you from the TCPA, and an internal do-not-call request must always be honoured regardless.
What does the TSR require me to disclose?
Promptly identify the seller and state that the call is a sales call, disclose total cost and material terms before obtaining payment, and disclose material restrictions and refund policy terms. Misrepresenting any material aspect is a separate violation.