Is Cold Calling Against the Law? What the B2B Exemption Does Not Cover

Somebody on a sales team reads that cold calling is regulated, finds a line saying business-to-business calls are exempt, and concludes the rules are somebody else's problem. That conclusion is half right, and the half that is wrong is the half that carries the penalties.

In the United States there are two separate federal regimes, written at different times for different reasons, and they draw their boundaries in completely different places. One of them does largely step back from business calling. The other does not care whether your call is business-to-business at all, because its restrictions attach to the number you dialled and the technology you dialled it with. Reading only the first is the mistake that turns a compliant-looking programme into an expensive one.

This is a plain-English reading of what the cited sources say, not legal advice. Nothing below substitutes for counsel who knows your jurisdiction and your call list.

Texas is the state asked about most often, and it is the general rule in one example: state telemarketing statutes are amended on their own timetable, so a national calling programme is bound by the strictest state on its list rather than by the federal average.

The rule that does exempt most B2B calling

The Telemarketing Sales Rule is the FTC's regime, and its exemptions are unusually explicit. The FTC's compliance guidance states that the Rule exempts "business-to-business calls unless they involve retail sales of nondurable office or cleaning supplies, or solicit sales or charitable contributions from employees" (Complying with the Telemarketing Sales Rule, FTC business guidance).

The same page is equally direct about the National Do Not Call Registry, stating that the prohibition on calling numbers on the Registry "does not apply to business-to-business calls". For a team selling software to operations directors, that is the single most useful sentence in the document, and it is why the Registry is not the compliance instrument people assume it is on the B2B side.

Two carve-outs sit inside the exemption and both are narrower than they look. Retail sales of nondurable office or cleaning supplies are pulled back under the Rule specifically, a carve-out that exists because of a particular pattern of abuse rather than because of any general principle. The second matters far more often.

The carve-out that catches ordinary B2B sellers

The FTC's guidance draws the line by who is being sold to, not by which line was dialled. Its wording is that calls soliciting consumers at their work, meaning "calls to business lines that solicit individual employees to buy products or services for their own use or make personal charitable contributions", are not business-to-business solicitations and are not exempt from the Rule.

That is a boundary about the buyer, and it is easy to cross without noticing. A pitch to a company for a product the company buys is a business-to-business solicitation. A pitch made to the same person, on the same office line, for something they would buy personally is not, whatever the list was called when it was built. Programmes that blur the two, or that work a list mixing company decision-makers with individuals at their workplace, are relying on an exemption that the FTC's own description does not extend to them.

Exempt as business-to-businessThe Rule steps back

• Selling a product or service the business itself buys
• Calls to numbers listed on the National Do Not Call Registry, which the guidance says the prohibition does not cover for B2B calls
• Ordinary vendor prospecting into a company

Not exemptThe Rule applies in full

• Retail sales of nondurable office or cleaning supplies
• Soliciting an employee at work to buy for their own personal use
• Soliciting personal charitable contributions from employees

The statute that ignores the B2B question entirely

The Telephone Consumer Protection Act is a different instrument with a different logic, and it is where a business caller is most likely to be caught, because its central prohibition is not written around who the buyer is.

The statute makes it unlawful to make any call, other than for emergency purposes or with the prior express consent of the called party, using an automatic telephone dialing system or an artificial or prerecorded voice, to "any telephone number assigned to a paging service, cellular telephone service, specialized mobile radio service, or other radio common carrier service, or any service for which the called party is charged for the call" (47 U.S.C. 227). The FCC's implementing rule carries the same language, and adds that where the call includes or introduces an advertisement or constitutes telemarketing, what is required is the prior express written consent of the called party (47 CFR 64.1200).

Read that prohibition against a modern B2B list and the exposure becomes obvious. It attaches to the number, and a large share of direct-dial numbers on any current prospect list are mobile numbers. It attaches to the technology, so power dialers, automated voicemail drops and anything with a synthetic voice sit inside the restricted category rather than beside it. Nothing in that sentence asks whether the call was business-to-business.

Before the programme runs

• ✓Yes: Whether what you sell is bought by the business or by the individual
• ✓Yes: Which numbers on the list are mobile, held as a data field rather than an assumption
• ✓Yes: Whether any dialing technology in use is automated, or any voice is prerecorded
• ✓Yes: Whether your state adds requirements on top of the federal rules
• ✕No: Assuming the B2B exemption in one regime carries into the other
• ✕No: Treating the Do Not Call Registry as the whole of the compliance question

The three practical consequences

The first is that mobile numbers are a data problem before they are a legal one. If your list cannot tell you which direct dials are mobile, you cannot answer the question the statute actually asks, and no amount of scripting compensates for that.

The practical shape of that problem is worth stating, because it is usually discovered late. Contact data vendors label numbers inconsistently: some carry an explicit line-type field, some return a single direct-dial column that silently mixes desk lines and mobiles, and some infer the label from a source that predates a number being ported between carriers. Whichever you buy, the field is a claim rather than a fact, and it ages. A programme that intends to rely on line type has to decide who owns that field, how often it is refreshed, and what the rule is when the label is missing or stale. The conservative default, treating an unlabelled number as though it might be a mobile, is the one that costs connect rate and removes the exposure. Deciding this after the list is loaded means deciding it under pressure, which is how the aggressive default gets chosen by nobody in particular.

The second is that the dialer is a compliance decision, not just a productivity one. Teams evaluate dialers on connect rates and seat cost, and the technology choice sits directly inside the restricted category defined above. The way dialer modes are sold, and what a seat actually costs, is worth reading with that in mind rather than after.

The third is that the federal picture is a floor rather than the whole answer. States legislate on top of it, with their own registries, hour restrictions and registration requirements in some industries, and they do not agree with each other. The only safe version of this step is to check the rules where you are calling and where you are calling into, rather than to generalise from a federal exemption.

Where written outbound sits in this

Email is governed by an entirely separate set of rules, and the mapping between the two is not intuitive. CAN-SPAM, GDPR and CASL draw their lines around consent, identification and opt-out mechanics rather than around dialing technology, which means a programme can be comfortably clear on one side and exposed on the other. The plain-English version for email covers those three regimes, and what the CAN-SPAM Act actually requires covers the US half in more detail.

The two channels also fail differently in ways that have nothing to do with law, and choosing between them on regulatory friction alone tends to produce the wrong answer. Comparing email and calling on how each one fails is the more useful frame, and the ceiling on a calling programme is usually arithmetic rather than legal: how many accounts a caller can actually cover tends to decide the outcome before any compliance question does.

Our own practice is a policy position rather than a legal conclusion. RevenueFlow runs email and LinkedIn and does not run phone outreach for clients, so this page describes calling regulation as it applies to teams who do. The written-channel doctrine we hold to is one message per campaign, with no bumps and no thread replies, and re-approaching an audience means a new campaign on a genuinely different premise rather than another touch in the same thread.

The short version

The Telemarketing Sales Rule does exempt most business-to-business calling, and the FTC's guidance says the Do Not Call Registry prohibition does not apply to B2B calls. The exemption stops where the buyer changes: soliciting an employee at work for something they would buy personally is not a business-to-business solicitation in the FTC's description, and retail sales of nondurable office or cleaning supplies are carved back in.

The Telephone Consumer Protection Act is a separate regime that does not turn on the B2B question. Its prohibition attaches to calls made with an automatic telephone dialing system or an artificial or prerecorded voice to numbers assigned to cellular and similar services, without prior express consent, and prior express written consent where the call is telemarketing. On a list full of mobile direct dials, that is the rule that binds.

Treat mobile identification as a data requirement, treat the dialer as a compliance decision, and check your state rules rather than generalising from the federal exemption. If the honest answer is that the calling programme is too much risk for the return, see what a first written campaign produces instead.

Statutory and regulatory wording above is quoted from the FTC, US Code and eCFR pages linked in the text, retrieved August 2026. Rules change and state law varies. Verify current requirements with counsel before relying on any of this.