IVR Compliance Requirements: TCPA, Consent, and Disclosures

IVR compliance requirements sit at the intersection of two federal frameworks: the Telephone Consumer Protection Act (TCPA), which governs any call using a prerecorded voice or an autodialer, and the Federal Trade Commission’s Telemarketing Sales Rule (TSR), which layers additional obligations on outbound sales and charitable solicitation calls. To run an automated calling program lawfully, you need the right kind of consent before you dial, specific disclosures and an opt-out inside the message, a scrubbed calling list, records that survive five years of scrutiny, and controls that keep abandonment rates and caller ID accurate. Miss any of those and statutory damages start at $500 per call and climb to $1,500 when a court finds the violation was willful.¹

Which Rules Apply to Which Calls

The TCPA covers all automated calls whether or not anything is being sold. Appointment reminders, fraud alerts, and sales pitches all fall inside it if they use an autodialer or a prerecorded voice to reach a cell phone or residential line without proper consent.¹

The TSR applies specifically to outbound calls intended to sell goods or services or solicit charitable contributions. If your IVR delivers a sales pitch or tries to generate a purchase, the TSR adds its own disclosure requirements, opt-out mandates, and Do Not Call obligations on top of the TCPA. Among other things, the TSR requires telemarketers to promptly and truthfully disclose the seller’s identity, the purpose of the call, and the nature of the goods or services offered.²

The line between informational and marketing calls matters because informational IVR calls (payment reminders, delivery notifications, appointment confirmations) face fewer requirements. But “informational” has limits. A call that opens as a reminder and pivots to an upgrade offer crosses into marketing, triggering the full weight of both frameworks. Categorize every IVR message before deployment and keep that classification documented.

When Your IVR Triggers TCPA Consent

Two separate TCPA provisions can pull an IVR call into the consent rules: the restriction on automatic telephone dialing systems (ATDS) and the restriction on artificial or prerecorded voice calls.

In Facebook v. Duguid, the Supreme Court held that a device qualifies as an ATDS only if it can generate phone numbers using a random or sequential number generator and then store or dial those numbers.³ Systems that dial from a preloaded customer database, with no random or sequential generation capability, don’t meet that definition.

The catch: the ATDS analysis is only half the equation. The TCPA separately restricts calls that use an artificial or prerecorded voice, regardless of how the number was dialed. A standard IVR playing prerecorded messages still triggers TCPA consent requirements even if it never touches a number generator.¹ For most IVR deployments, the prerecorded-voice provision is the one that governs.

Consent Standards by Call Type

The consent you need depends on what the call is about and what kind of line you’re calling.

Informational calls to landlines require prior express consent, which can be oral or written. A customer who provided their home number during a transaction has generally given this level of consent for related informational calls.
Marketing calls to landlines require prior express written consent with a clear disclosure that the consumer agrees to receive calls using prerecorded messages.
Any prerecorded or autodialed marketing call to a cell phone requires prior express written consent. Informational prerecorded calls to a cell phone still require prior express consent of the called party.

Written consent is commonly gathered electronically. To hold up under the E-SIGN Act, the consumer must affirmatively consent to receiving electronic records and the process must show the consumer can actually access the information in the format used.⁴ The consent form itself must clearly disclose that the consumer is agreeing to receive autodialed or prerecorded calls from the specific seller. Vague language or buried disclosures will invalidate the consent.

One-to-One Consent for Leads

In December 2023, the FCC adopted a rule closing what it called the “lead generator loophole.” Under the old model, a consumer visiting a comparison-shopping site could check a single box and inadvertently authorize dozens of sellers to call. The new one-to-one consent rule requires that written consent be given separately for each seller, and requires that any resulting calls or texts be logically and topically related to the website where the consumer gave consent.⁵

The FCC initially set a January 27, 2025 effective date and then postponed it pending judicial review.⁶ Organizations that buy leads through third-party sources should watch this closely. Once the rule takes effect, consent gathered under the old multi-seller model no longer provides TCPA protection.

Documenting Consent and Honoring Revocation

Having consent means nothing if you can’t prove it. Every consent record should capture the exact date and time the consumer agreed, the method used (web form, text message, paper form), the specific disclosure language the consumer saw, and the identity of the seller the consent covers. These records must be immediately retrievable for regulatory inspection or litigation.

Under the TSR, sellers and telemarketers must retain records related to their telemarketing activities for five years from the date the record is produced.⁷ That covers copies of scripts, prerecorded messages, and records of each telemarketing call placed. Scripts and prerecorded messages must be kept for five years from the date they stop being used. Individual call records must include the calling number, called number, date, time, duration, and the script or prerecorded message used.

Consumers can revoke consent at any time and through any reasonable means. The FCC has made clear that revocation doesn’t need to follow the same channel as the original consent. A consumer who gave written consent through a website can revoke it by telling a live agent, sending a text, or using any other reasonable method, and the revocation must be implemented in a timely manner.⁸ Once revoked, the internal Do Not Call list must be updated and all automated contact to that number must stop. Building an in-call opt-out prompt lets consumers revoke consent in real time by pressing a key.

Reassigned Numbers

Phone numbers get reassigned to new subscribers constantly, and calling the new holder creates TCPA liability even if the original subscriber consented. The FCC operates a Reassigned Numbers Database that callers can query before dialing. If the database incorrectly reports that a number hasn’t been reassigned, the caller may be shielded from TCPA liability for that call.⁹ To qualify, the caller must show it originally obtained consent from the intended recipient, it or its authorized agent checked the database before calling, and the database returned an incorrect result. Skipping the check isn’t a violation on its own, but it forfeits the defense.

Required In-Call Disclosures and Opt-Out

The TSR requires every outbound telemarketing call to promptly and clearly disclose the seller’s identity, the fact that the call’s purpose is to sell something, the nature of what’s being sold, and (for prize promotions) that no purchase is necessary to win.² For charitable solicitations, the charity’s name and the purpose of the call must be disclosed. These disclosures need to land in the first moments of the call, not halfway into a recorded message.

Prerecorded telemarketing messages must also include an automated opt-out mechanism the consumer can activate by pressing a key. It must immediately add the called number to the seller’s entity-specific Do Not Call list and disconnect the call. It cannot require the consumer to speak with a live person, navigate a phone tree, or take any complex steps. The opt-out prompt must remain available throughout the entire message.

For informational calls under the TCPA rather than the TSR, identification requirements still apply. The prerecorded message must identify the caller and offer a way to connect with a live operator or hang up. Failing to identify the calling entity or provide a functional opt-out exposes the organization to $500 per call in statutory damages.¹

Do Not Call Scrubbing

Before any calling list is loaded into an IVR dialing platform, it must be scrubbed against the National Do Not Call Registry. The TSR requires this scrub at least every 31 days.¹⁰ Retain records showing the date of each scrub and the changes it produced.

Separately, every organization making telemarketing calls must maintain its own internal Do Not Call list of consumers who directly asked not to be called. Unlike the federal registry, which consumers add themselves to, the internal list must be honored indefinitely. The two lists serve different purposes: the national registry covers consumers who don’t want telemarketing calls from anyone; the internal list covers consumers who told your organization specifically to stop. Both need to feed the IVR workflow automatically so numbers are suppressed without manual steps.

Call Abandonment Cap

When an IVR connects to a live person but no agent is available within two seconds of the person’s greeting, that call counts as “abandoned.” The TSR caps the abandonment rate at 3% of all calls answered by a live person, measured over the duration of a single campaign or, for campaigns running longer than 30 days, over each successive 30-day window.¹¹ The limit looks generous but tightens fast at peak volume. The platform needs real-time abandonment monitoring so staffing can be adjusted before the threshold is breached, and when an abandoned call does occur, a recorded message must play identifying the telemarketer.

Caller ID Rules

Federal law prohibits transmitting misleading or inaccurate caller ID information with the intent to defraud or cause harm. Violations can carry civil forfeitures of up to $10,000 per violation, with continuing violations potentially reaching $1,000,000.¹ The TSR separately requires that outbound telemarketing calls transmit the caller’s telephone number and, where technically feasible, the seller’s name.

The TRACED Act directed the FCC to mandate the STIR/SHAKEN caller authentication framework, which lets carriers verify that transmitted caller ID matches the caller’s actual number.¹² Authentication itself is handled by carriers, but high-volume outbound callers need to work with theirs to make sure calls receive proper attestation. Unauthenticated calls are increasingly filtered or blocked as likely spam, so caller ID hygiene shapes answer rates as well as legal exposure.

Data the IVR Handles

IVR systems collect and process consumer data ranging from account numbers to health information to payment details. Multiple frameworks may apply at once depending on what flows through the system.

Health Information

An IVR that handles protected health information (PHI), such as prescription refill reminders or lab result notifications, falls under HIPAA’s privacy and security rules. All individually identifiable health information disclosed through the system, whether electronically or by voice, is covered.¹³ If a third-party vendor operates the platform, the covered entity must execute a Business Associate Agreement specifying permitted uses and disclosures, appropriate security measures, and breach reporting.¹⁴

Card Payments

IVR systems that collect credit or debit card numbers must comply with the Payment Card Industry Data Security Standard. Sensitive authentication data such as the full card number, CVV, and PIN must never be stored after the transaction is authorized, even encrypted. When consumers enter card numbers via touch-tone, the system must use DTMF masking or suppression so recordings cannot be reverse-engineered to recover card data.¹⁵

Financial Services

Financial institutions using IVR systems to collect or transmit nonpublic personal information must comply with the Gramm-Leach-Bliley Act’s Safeguards Rule, which requires a written information security program appropriate to the organization’s size and the sensitivity of the data. As of 2024, the FTC’s amended Safeguards Rule also requires covered entities to report certain data breaches and security incidents.¹⁶

State Privacy Laws

A growing number of states have enacted comprehensive consumer privacy laws that touch IVR data collection. California, for example, requires businesses to provide privacy notices detailing the categories and purposes of personal information collected, and to honor opt-out requests for the sale or sharing of consumer data. Several other states have passed similar laws with their own notice and consent requirements. Any IVR that collects personal information should be evaluated against the privacy laws of the states where those consumers reside.

Penalties, Enforcement, and Vendor Liability

TCPA enforcement runs on two tracks, and the private litigation side is where the real financial pain concentrates. The TCPA gives individual consumers the right to sue in state court for statutory damages of $500 per illegal call, which a court can increase to $1,500 per call when the violation was willful or knowing.¹ Multiply that by campaign volume: 100,000 calls without proper consent puts $50 million to $150 million on the table. Class action settlements in TCPA cases routinely reach into the millions.

Beyond private suits, the FCC can impose civil forfeitures for TCPA violations, and the caller ID spoofing penalties above stack on top. The FTC enforces the TSR and can pursue civil penalties for violations of the DNC rules, abandonment cap, and disclosure requirements.

Outsourcing to a third-party dialer does not insulate you from liability. The FCC has stated that companies cannot avoid TCPA responsibility by hiring someone else to make the calls. Courts look at whether the company provided the contact lists, scripts, or marketing strategy, and whether the third party was closely integrated with the company’s operations. If the vendor acted with the company’s authority or apparent authority, the company answers for the vendor’s violations. Contracts with any third-party dialing service should include TCPA compliance obligations, indemnification, and audit rights.

Safe Harbors That Limit Exposure

The TSR provides a safe harbor when a telemarketer accidentally calls a number on the Do Not Call Registry. To qualify, the organization must show four things: it maintains written DNC policies and procedures, it trains employees on those procedures and monitors compliance internally, it keeps an in-house suppression list of consumers who directly requested no further calls, and it accessed the National Do Not Call Registry no more than 31 days before the call in question. All four elements have to be documented and provable.

The Reassigned Numbers Database provides a parallel defense when the database incorrectly indicates a number hasn’t been reassigned, and it extends to queries made by a duly authorized agent on the caller’s behalf.⁹

Beyond the specific safe harbors, the operational protection is a paper trail: timestamped consent records with the disclosure language shown, retained scripts and prerecorded messages for five years, documented DNC scrubs, real-time abandonment monitoring, and training records.⁷ When lawsuits or enforcement arrive, the question is rarely whether a mistake happened; it’s whether reasonable systems were in place and whether you can prove it.

State Rules Set the Floor Higher

Federal compliance is the floor, not the ceiling. Most states impose their own telemarketing and robocall restrictions that can be stricter than federal rules. Some have expanded the definition of autodialing systems beyond the narrowed federal definition, tightened calling-hour windows, added registration requirements for commercial telemarketers, or created state-level private rights of action with their own penalty structures. A number of states also maintain their own Do Not Call registries that must be scrubbed separately from the federal list. Any organization running IVR campaigns across state lines needs to map its obligations state by state rather than treating federal rules as a catch-all.

1
Office of the Law Revision Counsel. 47 USC 227 – Telephone Consumer Protection Act
2
eCFR. 16 CFR 310.4 – Abusive Telemarketing Acts or Practices
3
Supreme Court of the United States. Facebook Inc v Duguid – 19-511
4
National Credit Union Administration. Electronic Signatures in Global and National Commerce Act
5
Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent
6
Federal Communications Commission. FCC Postpones Effective Date of One-to-One Consent Rule
7
eCFR. 16 CFR 310.5 – Recordkeeping Requirements
8
Federal Communications Commission. Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991 – FCC 24-24
9
Federal Communications Commission. Reassigned Numbers Database
10
Federal Trade Commission. Telemarketers Required to Scrub Their Call Lists Every 31 Days Beginning January 1 2005
11
eCFR. 16 CFR 310.4 – Abusive Telemarketing Acts or Practices
12
Federal Communications Commission. TRACED Act Implementation
13
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
14
eCFR. 45 CFR 164.504 – Uses and Disclosures
15
PCI Security Standards Council. Protecting Telephone-Based Payment Card Data
16
Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know