CFPB Regulation F: Call Limits, Digital Contact, and Validation

CFPB Regulation F is the Consumer Financial Protection Bureau’s 2021 overhaul of debt collection rules under the Fair Debt Collection Practices Act. It took effect on November 30, 2021, and it fills gaps the original 1977 law left open, especially around email, text messages, and social media.¹ The rule caps how often a collector can call, sets a standard validation notice, delays credit bureau reporting until the collector has made contact, and prohibits lawsuits on debts too old to sue on.

How Often a Collector Can Call You

Regulation F creates what the industry calls the 7-in-7 rule. A collector is presumed to be harassing you if they call more than seven times in seven consecutive days about the same debt. If you actually pick up and talk with them, they must wait at least seven calendar days before calling again, counting the day of the conversation as day one.²

These limits apply per debt, not per person. If a collector is working three of your accounts, they could technically call up to seven times per week on each one. Exceeding the cap on any single account creates a presumption of harassment that the collector has to rebut. Staying under the cap doesn’t guarantee compliance either. A collector who calls six times in two days with clear intent to annoy can still violate the rule.²

Vague Voicemails Are Deliberate

Regulation F carves out a category called a “limited-content message” for voicemails. If a voicemail contains only certain permitted items, it doesn’t count as a “communication” about the debt, so it doesn’t trigger the 7-in-7 limits or require a debt-collector disclosure. A qualifying limited-content voicemail can include only a business name that doesn’t reveal the caller collects debts, a request to call back, a contact person’s name, and a callback number. Optional items include a greeting, the date and time, suggested callback times, and a note that any representative can help. Anything hinting at a debt turns it into a full communication with all the usual rules attached.³ The vagueness is by design.

When and Where They Can Reach You

Collectors cannot contact you before 8:00 a.m. or after 9:00 p.m. in your local time zone. Those are the default inconvenient hours. If you tell a collector a particular time is inconvenient, they must respect that even if it falls within the 8-to-9 window.³

Workplace calls get similar treatment. A collector must stop calling your job if they know or have reason to know your employer prohibits personal calls of that kind. Saying “I can’t take personal calls at work” is enough to trigger the protection. The only exceptions are your direct consent or a court order.⁴

Email, Text, and Social Media Rules

Regulation F formally authorizes collectors to use email, text, and social media, then wraps each channel in privacy safeguards aimed at preventing accidental disclosure of your debt to someone else.

Email

Before emailing you, a collector needs a qualifying basis for using that address. The clearest basis is that you gave the address to the collector or used it to communicate with them about the debt. If the collector inherited the address from the original creditor, that creditor must have sent you a written notice disclosing the transfer, identifying the address that might be used, warning that others with account access could see the messages, and giving you at least 35 days to opt out. If you didn’t opt out during that window, the collector can use it. Employer-provided work email addresses are off limits unless you specifically gave that address to the collector.⁴

Text Messages

Text controls are tighter because phone numbers get reassigned. A collector can text a number you texted them from, but only if you texted from that number within the past 60 days or the collector confirmed through a reassignment database that the number still belongs to you. If your consent to text is more than 60 days old, the collector must reconfirm the number hasn’t been reassigned. Those 60-day checks keep your debt details off a stranger’s phone.⁴

Social Media

Social media contact is restricted to private messaging. A collector cannot post anything related to your debt on a profile, timeline, wall, or any space viewable by the public or your contacts.³ A private friend or connection request must disclose that the sender is a debt collector in the request itself. Failing to do so is a deceptive practice.⁵

Opting Out of Electronic Messages

Every email or text a collector sends must include a clear, simple way to opt out of that channel. For email, that’s typically an unsubscribe link. For texts, it’s a reply command like STOP. Once you opt out, the collector cannot keep using that address or number.³ Opting out of texts doesn’t stop calls or letters. To shut down all contact, you need the cease-communication notice described further down.

The Validation Notice You Should Receive

Within five days of first contacting you, a collector must send a validation notice with enough information to identify the debt and check whether you actually owe it. Regulation F standardized this notice into a model format so the key details are easy to find.⁶

The notice must include the current creditor’s name, an itemized breakdown of the balance showing interest, fees, payments, and credits, and an “itemization date” that anchors those numbers. That date can be the last statement date from the original creditor, the charge-off date, the last payment date, the original transaction date, or the date of a court judgment. You can compare the itemization-date balance against your own records to spot errors. The notice also states a deadline, 30 days from when you receive it, by which you can dispute the debt in writing. If you don’t dispute within that window, the collector may treat the debt as valid. The notice must explain your right to ask for the original creditor’s name and address if it differs from the current one.⁶

Disputing the Debt

A written dispute sent within the 30-day validation period freezes the account. The collector must stop all collection activity on the disputed amount until they mail or electronically deliver verification of the debt or a copy of a court judgment. A single letter forces that pause.⁷

Credit Reporting Comes After Contact

Regulation F blocks a common tactic where collectors reported debts to the credit bureaus before ever attempting real contact. A collector cannot furnish information to a consumer reporting agency until they have either spoken with you about the debt in person or by phone, or mailed you a letter or electronic message and then waited at least 14 days for any undeliverability notice. If the letter bounces during that 14-day window, they cannot report the debt until they satisfy the contact requirement another way.³

The rule does not prevent reporting during your 30-day validation period once the contact-first requirement is met. A debt can hit your credit report before you’ve disputed it. If you think a debt is wrong, disputing in writing right after you get the validation notice buys the most protection.

No Lawsuits on Time-Barred Debts

A debt becomes “time-barred” when the statute of limitations for suing you has expired. Regulation F flatly prohibits collectors from filing a lawsuit or threatening legal action to collect a time-barred debt. The only exception is filing a proof of claim in bankruptcy.⁸

Statutes of limitations vary by state and by debt type. For most consumer obligations like credit cards and medical bills, the window falls between three and six years, though written contracts can run 10 or even 15 years in some states. Here is where things get dangerous. In many states, making a partial payment or acknowledging the debt in writing can restart the statute of limitations. A debt that was time-barred yesterday can become legally enforceable again today if you send even a small payment. Collectors aren’t required to warn you, so be careful about paying anything on an old debt without first confirming whether your state resets the clock.

Threatening to sue on a time-barred debt violates Regulation F and the FDCPA’s ban on threatening actions a collector cannot legally take. Individual statutory damages run up to $1,000, plus any actual damages and your attorney’s fees. In a class action, statutory damages are capped at the lesser of $500,000 or one percent of the collector’s net worth.⁹

Who Else the Collector Can Talk To

Collectors generally cannot discuss your debt with anyone other than you, your spouse, your parents (if you’re a minor), your guardian, your attorney, a credit reporting agency, the creditor, or the creditor’s attorney. No calling your neighbor, your employer, or your adult children about what you owe.⁹

The narrow exception is “location information.” A collector trying to find your address or phone number can contact other people, but must identify themselves by name, cannot reveal they collect debts unless asked, cannot mention the debt, cannot contact the same person more than once, and must stop once they learn you have an attorney.⁹ On social media, a collector seeking location information must use a profile that accurately identifies who they are.

Shutting Down All Contact

You can stop a collector’s communication entirely by sending a written notice stating that you refuse to pay the debt or that you want the collector to stop communicating with you. Once they receive that letter, they can only contact you to confirm they’re stopping collection efforts, to notify you that they or the creditor may pursue a specific legal remedy, or to tell you they intend to take a specific action like filing suit.¹⁰

Stopping communication doesn’t erase the debt. The collector or creditor can still sue you if the statute of limitations hasn’t expired, and the debt can still sit on your credit report.

What to Do If a Collector Breaks the Rules

A collector who violates the FDCPA or Regulation F can be held liable for your actual harm, statutory damages up to $1,000 per individual lawsuit, and your attorney’s fees and court costs. You don’t need to prove actual harm to collect statutory damages. In class actions, courts can award up to the lesser of $500,000 or one percent of the collector’s net worth.⁹

You can submit a complaint through the CFPB’s online portal at consumerfinance.gov/complaint or by calling (855) 411-2372. You can also report the behavior to the Federal Trade Commission at reportfraud.ftc.gov. Complaints don’t get you damages directly, but they create a record regulators use to identify patterns. For personal recovery, you’d file a lawsuit or consult a consumer rights attorney. The FDCPA’s fee-shifting provision means the collector pays your legal costs if you win.

1
Consumer Financial Protection Bureau. Debt Collection Practices (Regulation F) Delay of Effective Date
2
eCFR. 12 CFR 1006.14 – Harassing, Oppressive, or Abusive Conduct
3
eCFR. 12 CFR Part 1006 – Debt Collection Practices (Regulation F)
4
eCFR. 12 CFR 1006.6 – Communications in Connection with Debt Collection
5
Consumer Financial Protection Bureau. 12 CFR 1006.18 – False, Deceptive, or Misleading Representations or Means
6
eCFR. 12 CFR 1006.34 – Notice for Validation of Debts
7
Office of the Law Revision Counsel. 15 USC 1692g – Validation of Debts
8
eCFR. 12 CFR 1006.26 – Collection of Time-Barred Debts
9
Federal Trade Commission. Fair Debt Collection Practices Act
10
Office of the Law Revision Counsel. 15 USC 1692c – Communication in Connection with Debt Collection