A mini-TCPA is a state telemarketing law layered on top of the federal TCPA. Most impose a stricter consent standard, a narrower calling window, and a private right of action carrying per-call damages. Federal compliance does not satisfy them: a campaign that crosses state lines answers to every state it dials into, not just its own.
In This Article
Most teams find this out late. The build starts with one script, one consent flow, and one dialer configuration, and the list gets pulled across six states because that is where the addressable market sits. Nothing in the build has a state dimension yet. Three questions decide the build. Where state law diverges from the federal rule. Whose law governs when caller and consumer sit in different places. And how to structure one calling process that holds across all of them. This is operational guidance, not legal advice: the TCPA compliance consulting service page sets out what a campaign audit covers and where the line between compliance operations and legal counsel sits.
Do state telemarketing laws apply if my campaign already follows the federal TCPA?
Yes. State telemarketing laws apply on top of the federal TCPA rather than instead of it, because the TCPA sets a floor rather than a ceiling and expressly preserves state requirements that are more restrictive than the federal standard. The TCPA’s preemption section at 47 U.S.C. § 227(f) says so in terms. The FTC’s Telemarketing Sales Rule works the same way. Neither issues a national permission slip.
A campaign can be fully compliant with the federal rule and exposed in a dozen states. Florida proves it. The 2021 amendment to the Florida Telephone Solicitation Act required prior express written consent for calls and texts placed with an automated system, and attached a private right of action carrying statutory damages. What followed was a wave of class actions against companies whose federal compliance posture was intact: [PLACEHOLDER: filings count and date range, pending docket source]. Florida Statutes § 501.059, the Telephone Solicitation Act carries the current text, including the 2023 amendments that narrowed parts of it.
So the question to carry into a campaign build is not whether you are TCPA-compliant. It is which states you dial into, and what each one demands that the federal rule does not.
What is a mini-TCPA, and how do state laws actually differ from the federal rule?
A mini-TCPA is a state statute regulating telephone solicitation on the same subject matter as the federal TCPA, more tightly. The term is industry shorthand, not a legal category. The statutes it covers are not uniform. They diverge along six dimensions, each carrying a different remediation cost, so it pays to know which ones your campaign is actually sensitive to.
Start with the consent standard. Several states require prior express written consent for a broader set of calls than the federal rule does. Some define the triggering technology more loosely than the federal definition of an automatic telephone dialing system, which pulls equipment you thought was outside the rule back inside it. A consent record that satisfies the federal standard often lacks the disclosures a state requires. That gap sits in your existing database, not your forward process. It is the expensive kind.
The calling window gets its own section below, because it is the one most often misconfigured quietly. Third is the do-not-call list. States maintain their own registry alongside the National DNC Registry, each with its own subscription, refresh cadence, and scrub obligation. Scrub against the federal list alone and those records stay live on your file.
Fourth is registration and bonding, covered further down. Fifth is caller identification and disclosure: what the agent says, how early in the call, and in whose words. Some statutes prescribe the disclosure almost verbatim, which turns it into a script-approval item rather than a training item.
Sixth is enforcement, and it determines how much the other five matter. A statute enforced only by a state attorney general carries a different risk profile from one with a private right of action and per-call statutory damages. The second invites plaintiff-side volume. Florida and Oklahoma both sit in the second category.
$500 per violation, rising to as much as $1,500 for a willful or knowing violation
One dimension travels worse than people expect: the business-to-business carve-out. The TSR exempts most B2B calls from its core provisions. State statutes draw the line differently, and several reach business lines the federal rule leaves alone. If your campaign is B2B and you have been treating that as a general exemption, check it state by state. Working out which of the six dimensions your footprint is exposed to is the scoping step a campaign audit opens with: the campaign compliance audit service page sets out what gets examined and in what order.
Which state’s law applies when your caller and your consumer are in different states?
The consumer’s state governs. Courts have applied state telemarketing statutes to callers with no physical presence in the state, on the basis that the call was received there.
A call center in Pennsylvania dialing a Florida consumer operates under Florida’s rules for the duration of that call. This is the structural misunderstanding that surfaces most often in a first multi-state build, and it usually surfaces after the list is already loaded.
Which raises the harder question: how do you know where the consumer is? Area code is not location. Mobile numbers keep their original area code through every move, and the mismatch compounds in high-migration states. A 312 number can sit in Arizona, and calling-hours logic keyed to that area code runs an hour off in the wrong direction.
The safeguards are unglamorous and they work. Capture state at the point of consent and store it on the record instead of deriving it at dial time. Append and refresh location data on the list rather than trusting the area code. Where the two disagree, apply both states’ rules to that record until the conflict resolves: it costs a small amount of contact rate and removes an entire category of exposure. Where location cannot be established at all, govern the record by the strictest rule set in your footprint.
Mini-TCPA laws by state: what each one adds beyond the federal rule
The table below covers the states that most often change how a campaign gets built. It is not the full fifty-state matrix. It is scoped to what a campaign manager needs at planning time: what the state adds, and whether a private plaintiff can sue you under it.
State | Statute | What it adds beyond the federal TCPA | Private right of action |
|---|---|---|---|
Florida | Fla. Stat. § 501.059 | Prior express written consent for automated calls and texts; 8am–8pm window; state DNC list | Yes |
Oklahoma | Okla. Stat. tit. 15, § 775C (2022) | Consent and automated-dialing provisions modeled closely on Florida’s | Yes |
Maryland | Md. Com. Law § 14-2201 et seq. | Written consent requirement added by 2023 amendment | Yes |
Washington | RCW 19.158; RCW 80.36.400 | Expanded solicitation definitions; violations actionable under the Consumer Protection Act | Yes, via CPA |
Texas | Bus. & Com. Code ch. 302 and ch. 305 | Registration certificate and surety bond before calling; state DNC list | Yes, under ch. 305 |
Louisiana | La. R.S. 45:811 et seq. | State DNC list; registration requirement | Verify |
Mississippi | Miss. Code § 77-3-701 et seq. | State DNC list; separate consent provisions | Verify |
New York | Gen. Bus. Law § 399-p, § 399-z | Disclosure timing requirements; state-of-emergency calling restrictions | Verify |
New Jersey | N.J.S.A. 56:8-119 et seq. | Narrower calling window; registration requirement | Verify |
Pennsylvania | 73 P.S. § 2241 et seq. | State DNC list; registration and bonding | Verify |
Colorado | C.R.S. § 6-1-903 et seq. | State no-call list; separate disclosure rules | Verify |
Michigan | MCL § 445.111 et seq. | Home solicitation provisions reaching telephone sales | Verify |
Read the right-hand column first. A state with a private right of action and per-call statutory damages generates claim volume that an attorney-general-enforcement state does not. That is why Florida and Oklahoma drive campaign design out of proportion to their share of a list.
What are the state telemarketing calling hours, and how do they differ from the federal window?
The federal calling window runs 8am to 9pm in the local time of the person being called. Several states narrow it, and Florida closes an hour earlier at 8pm. That single hour is among the strongest connect windows of the day: [PLACEHOLDER RANGE: connect rate 8pm to 9pm against campaign daily average]. The federal restriction sits in 47 CFR § 64.1200(c), the FCC’s telephone solicitation rule, alongside the caller identification requirements.
Two things go wrong here. Both are configuration, not judgment. The first is setting the dialer window to the call center’s time zone instead of the consumer’s. A window that looks correct on a screen in Chicago runs an hour late on the East Coast and two hours early in the Mountain zone. Violations accrue at the edges of the day, where the dials are densest, and those are the hours a campaign is least willing to give up. The second failure is applying the federal window uniformly across a multi-state file. That puts every Florida record on the wrong side of the line between 8pm and 9pm local, every evening, at volume.
Make the window a property of the record, not the campaign. Where your dialer supports per-record calling windows derived from confirmed consumer location, use them. Where it does not, apply the narrowest window in your footprint to everything and model the cost before launch, rather than discovering it in week three when contact rate lands under forecast.
Do you need to register as a telemarketer in the states you call into?
In the registration states, yes. Those states require a telemarketer to file for a certificate, and often to post a surety bond, before the first dial rather than after it. Texas is the clearest example: it requires both, under Texas Business and Commerce Code chapter 302, the telephone solicitation registration statute, and several other states impose comparable filing, bonding, or script-submission requirements. Exemptions exist and they matter: many statutes carve out calls to existing customers, business-to-business calls, licensed professionals, and nonprofits. The carve-outs are not uniform. A campaign that qualifies in one state will not automatically qualify in the next.
Lead time makes this a schedule item, not a compliance item. Registration is a filing process with review queues, and approval runs [PLACEHOLDER RANGE: X to Y weeks] in the slower states. A campaign that clears legal review in the same week it was meant to launch has cleared nothing if the registrations are still pending. Confirm the state footprint at planning. Start registrations in parallel with list build and script development, not after them. Treat the slowest state as that state’s launch date rather than the whole campaign’s.
A failure worth naming: a campaign launches nationally, discovers mid-flight that two footprint states required registration, and suspends dialing there while the filings process. The compliance exposure is one problem. The forecast damage is the other, because suppressed states get pulled from the file rather than paused, and that volume never returns to the campaign’s numbers.
How do you build one multi-state calling process instead of fifty?
Two architectures work for a multi-state calling process: a single rule set built to the strictest state in your footprint, or state-aware branching keyed to the confirmed state on each record. Most teams end up running a deliberate blend of the two.
Strictest common denominator
One rule set, built to the tightest requirement in your footprint, applied to every record. Consent language carries every disclosure any in-scope state requires. The calling window is the narrowest one. The script contains every mandated disclosure. This is simple to operate, simple to QA, and simple to explain to a regulator. It costs contact rate and volume, and the cost scales with how many states you are in and how strict the strictest one is. One aggressive state tightens the rules for your entire file.
State-aware branching
Dialer logic, script logic, and suppression rules keyed to the confirmed state on each record. Contact rate holds up, and each state runs to its own limits. It costs engineering time and QA surface area, and it introduces a failure mode the first architecture does not have: a record routed to the wrong rule set is a violation that looks like a working campaign on every dashboard you own.
The blend that holds up splits on cost of standardization. Standardize what is cheap to make uniform: consent disclosure language, the calling window, the agent identification script. Branch on what is expensive or impossible to unify: state DNC scrubbing, registration status, call recording consent, and any state-specific mandated language that would make a universal script unreadable. That last constraint is real. A script carrying every disclosure from every state in a wide footprint stops sounding like a conversation, and contact quality degrades in ways that surface in conversion before they surface in compliance.
Architecture is not the deciding factor. Agent-level enforcement is. A consent disclosure that must be read word for word is a control only when deviation carries a consequence in QA.
Multi-state structure drives the sibling decisions in a campaign too. On a lead generation build, the state footprint determines list segmentation and suppression, covered on the B2B lead generation service page. On an appointment setting program, the same footprint shapes qualification criteria and scheduling rules, set out on the appointment setting service page.
Work out which states your campaign actually touches
A campaign compliance audit maps your footprint state by state: consent records, calling windows, registration status, and the suppression rules attached to each. Useful whether you run the fix in-house or not.
Why has the regulatory ground moved so much since 2024?
Three things moved at once. The Supreme Court ended Chevron deference in 2024, federal courts gained room to depart from the agency’s own reading of the rules, and state legislatures kept legislating into the space that opened up.
Start with why federal TCPA practice was ever stable. Most of the operative detail does not live in the statute. It lives in FCC orders and rulemakings interpreting it, and for forty years courts largely deferred to those interpretations under the Chevron doctrine. Loper Bright Enterprises v. Raimondo, the 2024 decision overruling Chevron removed that default. Agency interpretations still carry persuasive weight, but they no longer bind a court that reads the statute differently.
For outbound calling the practical question is narrower: in a private TCPA suit, is a district court bound by the FCC’s interpretation of the rule being sued over? That question ran through the Hobbs Act and reached the Supreme Court in McLaughlin Chiropractic Associates v. McKesson Corp.. [PLACEHOLDER: holding and effective consequence for private TCPA litigation]. Read it with counsel before assuming any FCC order is settled ground under you.
The FCC’s own rules have been moving in the same period, in both directions. Consent revocation requirements were tightened. A one-to-one consent rule aimed at lead generation was adopted and then vacated on appeal before it took effect. [PLACEHOLDER: current status of each, as of publish date]. The pattern matters more than any single rule: a federal requirement you built a process around can be tightened, stayed, or vacated inside a single campaign cycle.
Here is what that means for a multi-state campaign, and it runs counter to intuition. Federal instability raises the relative weight of the state layer. A state statute is text you can read, with an effective date and an amendment history. A federal requirement resting on an agency interpretation is a position that a court may revisit. Neither is permanent, but they fail differently, and a compliance posture built entirely on the federal layer has more moving parts underneath it than it looks like it has.
The safeguard is record-keeping rather than prediction. Date-stamp every compliance decision and record which authority it rested on: the statute, a specific FCC order, a case, or counsel’s read. When one of those moves, you can find every decision that depended on it in an afternoon instead of rebuilding the analysis from scratch. Campaigns that skip this step do not discover the dependency until something has already changed.
How do you keep up when a state changes its telemarketing law?
Put a state-law review on the calendar and give it a named owner. State legislative sessions cluster between January and June, and the amendments coming out of them take effect on July 1 or the following January 1. That gives you two natural review points a year. A quarterly cadence gives you margin. The alternative is finding out from a demand letter.
A review that catches things looks at four things, not one: new statutes in footprint states, new statutes in states you are considering, amendments to statutes you already comply with, and enforcement patterns that signal how an existing statute is being read. The fourth gets skipped most and informs most. A statute on the books for a decade can change its practical meaning through a single appellate decision without a word of the text moving.
Ownership matters more than cadence. In most organizations this sits unclaimed between legal, who own interpretation but not campaign configuration, and campaign operations, who own configuration but do not track legislatures. Name one person accountable for turning a statutory change into a dialer setting, a script revision, and a suppression rule. That is the control. One companion reference is worth keeping open alongside this one. Recording consent varies by state on a different map from the solicitation rules, and it is covered in the state-by-state call recording laws guide.
None of this makes multi-state calling simple. It makes it knowable, which is more useful. A campaign that can name every state in its footprint, the rule set applied to each, and the person who updates them is defensible whether or not it ever has to defend itself.
Frequently asked questions
Which states have mini-TCPA laws?
Most states regulate telephone solicitation in some form. The statutes described as mini-TCPAs are the ones that add a consent standard or a private right of action on top of the federal rule: Florida, Oklahoma, Maryland and Washington are cited most often. Texas, Louisiana, Mississippi, Pennsylvania and several others impose registration, bonding or state do-not-call obligations that change how a campaign gets built.
Does the federal TCPA preempt state telemarketing laws?
No. The TCPA expressly preserves state laws that are more restrictive than the federal standard for intrastate telemarketing, and the FTC’s Telemarketing Sales Rule operates on the same principle. Federal compliance is the starting point, not a defense to a state claim.
Which state's telemarketing law applies if my call center is in a different state from the consumer?
The consumer’s state. Courts have applied state telemarketing statutes to callers with no physical presence in the state, on the basis that the call was received there. Area code is an unreliable proxy for where someone lives, so confirmed location data on each record matters more than the caller’s own location.
Do state mini-TCPA laws apply to business-to-business calls?
The exemption does not travel intact. The federal Telemarketing Sales Rule exempts most business-to-business calls from its core provisions, but state statutes draw the line differently and several reach business lines the federal rule leaves alone. Confirm the exemption state by state rather than treating it as a general carve-out.
What time can telemarketers legally call in each state?
The federal window is 8am to 9pm in the local time of the person being called. Some states narrow it: Florida ends at 8pm. The window follows the consumer’s local time, not the call center’s, which is the most common source of quiet violations in a multi-state campaign.
Do I need separate consent language for each state I call into?
One consent disclosure, written to satisfy the strictest state in your footprint. Most teams carry a single version containing every element any in-scope state requires rather than maintaining several, because one consent record that works everywhere is far easier to audit than a branching set that works conditionally.
Keeping a multi-state footprint current is somebody's job
If nobody owns translating a statutory change into a dialer setting and a script revision, it tends not to happen. Ongoing regulatory tracking and monitoring is one of the things we run for outbound programs.
