State TCPA laws and lead generation compliance

How state laws layer on federal TCPA

The TCPATCPAThe Telephone Consumer Protection Act, the federal law that governs telemarketing calls and texts, autodialers, prerecorded voice messages and the Do Not Call Registry. Glossary is a federal statute that establishes a national floor for consumer protection in telephone-based marketing. States are not only permitted to enact stricter laws: many have, and the trend is accelerating. For lead generators operating nationally, meeting federal TCPA standards is necessary but may not be sufficient. Contacts with consumers in certain states trigger additional state-level obligations that require separate compliance analysis.

State-level laws affecting lead generation typically fall into three categories. The first is state telemarketing acts, which may impose more restrictive calling hours, additional disclosure requirements, state-specific Do Not Call lists, or enhanced consent requirements that exceed federal TCPA standards. The second is state privacy laws, primarily statutes modeled on California's framework, which affect how consumer data is collected, stored, shared, and monetized, and which may treat the sale of consumer contact information (such as selling leads to buyers) as a regulated data transaction. The third is state wiretapping and call recording laws, which determine whether one-party or all-party consent is required for call recording and which can expose lead generators and buyers to significant liability independent of TCPA.

Federal TCPA preemption limits some forms of state telemarketing regulation. Courts have generally held that states cannot enact laws that conflict with TCPA's specific requirements or that attempt to regulate the same conduct TCPA addresses in a directly contradictory way. However, courts have consistently permitted states to impose additional requirements in areas TCPA does not specifically address (including consent format requirements, data handling obligations, and call recording disclosures) as long as those requirements don't conflict with federal law.

The practical consequence for lead generators is that compliance cannot be analyzed solely at the federal level. Lead generators who run national traffic are effectively operating across 50 different regulatory environments simultaneously, each of which may add layers of obligation beyond federal minimums. The most operationally efficient approach is to identify the most restrictive state standards and adopt them as your national baseline, rather than attempting to maintain state-specific consent and documentation variants for each state where your leads originate.

California: CCPA/CPRA and TCPA

California presents the most complex state compliance environment for lead generators in the United States. The state has enacted multiple overlapping frameworks, each addressing a different aspect of consumer contact and data use, that collectively create a compliance burden substantially beyond federal TCPA requirements. Understanding all three frameworks, and how they interact, is necessary for any lead gen operation that targets California consumers or sources leads from the state.

The California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act (CPRA), gives California consumers broad rights over their personal data. For lead generators, the most operationally significant element is the right to opt out of the "sale" of personal information. Under CCPA/CPRA, "sale" has a broad definition that includes transferring personal data to third parties for valuable consideration, which is precisely what happens when a lead generator sells consumer contact information to a buyer. Lead gen forms targeting California consumers should include CCPA-compliant disclosures and an accessible opt-out mechanism for data sales. Failure to provide this mechanism exposes the lead generator to CCPA enforcement, which is handled by the California Privacy Protection Agency and can result in significant fines.

California's Invasion of Privacy Act (CIPA) makes California a two-party consent state for call recording. Every party to a telephone call must consent to the recording. For pay-per-call operations, this means the call recording disclosure must be made in the IVR before any substantive conversation, before the consumer's words are captured in a recording. Violating CIPA carries its own set of remedies separate from TCPA, including a private right of action with statutory damages. California plaintiffs' attorneys actively litigate CIPA alongside TCPA claims.

California's Automatic Calls Act imposes requirements on automated calls and texts to California consumers that add further obligations to the federal TCPA baseline. California has also been an active enforcement state through its Attorney General's office, with significant consumer protection enforcement history in the telemarketing and data privacy space. The combination of TCPA, CCPA/CPRA, CIPA, and state-specific telemarketing regulation makes California the single most compliance-intensive state for lead gen operations. If you build your compliance program around California requirements, you will meet or exceed almost every other state's standards.

Florida's FTSA: One of the strictest state telemarketing laws

Florida enacted the Florida Telephone Solicitation Act (FTSA) as its state telemarketing statute. As amended in 2021, the FTSA created one of the most plaintiff-friendly telemarketing laws in the country and generated significant class action litigation activity. Florida's large population and active plaintiffs' bar make it a particularly high-risk state for lead generators using automated calling or texting.

The FTSA covers calls and text messages and has a private right of action with statutory damages of $500 per text or call and up to $1,500 per willful violation: a damages structure similar to federal TCPA but under a separate statutory scheme with its own enforcement triggers. The FTSA requires prior express written consentPrior express written consentUnder the TCPA, a written agreement signed by the consumer (an electronic signature counts) that clearly authorizes a seller to make telemarketing calls or texts using an autodialer or a prerecorded or artificial voice to a stated number. Glossary for automated telephone calls or text messages, with the consent being "clearly and conspicuously" disclosed. The clear and conspicuous standard is more specific than the federal consent requirements and has been the subject of significant litigation about what disclosure design and placement satisfy it.

Florida plaintiffs' attorneys filed large numbers of class actions under the FTSA following the 2021 amendments, and Florida consumers became among the highest-risk populations for lead generators using automated systems. The litigation volume prompted the Florida legislature to amend the FTSA again in 2023 to clarify that the law applies to texts sent using an automatic telephone dialing system, which narrowed its scope somewhat by introducing an ATDSATDS / autodialerAn automatic telephone dialing system, a category of equipment regulated by the TCPA. Glossary requirement similar to the federal TCPA framework. However, the FTSA's private right of action and damages structure remain in place, and the law is still among the strictest state telemarketing statutes in the country.

For lead generators with Florida consumers in their traffic, the FTSA creates a specific compliance overlay: your consent language must meet both federal TCPA standards and the FTSA's "clearly and conspicuously" disclosed standard. Consent forms that pass federal TCPA muster may still be challenged under FTSA on disclosure placement or formatting grounds. Florida consumers warrant the same careful compliance treatment as California consumers, particularly for automated calling and texting programs.

Texas, New York, and other high-activity states

Texas has its own telemarketing regulation under the Texas Business and Commerce Code that complements federal TCPA. Texas maintains a state Do Not Call list that is separate from the federal registry: Texas consumers can register on the state DNCDNC / Do Not Call RegistryThe National Do Not Call Registry is a federal list of numbers whose owners have opted out of most telemarketing calls. Glossary list and must be scrubbed from telemarketing contact lists independently. Texas also requires businesses to establish and maintain their own state-specific DNC lists for consumers who request not to be contacted. Unlike the federal registry, which is managed centrally, the Texas framework places some DNC maintenance obligations directly on the contacting entity. For lead generators whose buyers operate in Texas, including Texas state DNC scrubbing in your pre-delivery verification is a buyer expectation and a risk mitigation practice.

New York's telemarketing regulations include disclosure requirements, calling hour restrictions, and state Do Not Call list maintenance. New York General Business Law 399-z bars telemarketing at any time other than 8:00 a.m. to 9:00 p.m. at the customer's location, unless the customer has expressly consented to a call at a different time. New York has also been an active consumer protection enforcement state through the Attorney General's office, with a history of multi-state investigations involving telemarketing and data privacy.

Other states with notable telemarketing or privacy laws relevant to lead generation include Illinois (BIPA, the Biometric Information Privacy Act, which may affect lead gen operations using voice recording, facial recognition, or other biometric data); Michigan (Michigan Consumer Protection Act requirements for telephone solicitation); Maryland (two-party consent state for call recording); and Massachusetts (also a two-party consent state, with active consumer protection enforcement under Chapter 93A). Indiana maintains a state DNC list with independent scrubbing requirements. Wyoming similarly runs a state-level DNC program.

For lead generators running national traffic, attempting to maintain separate state-specific consent language, disclosure formats, and DNC scrubbing protocols for each of these jurisdictions independently creates operational complexity that is difficult to sustain reliably at volume. The practical alternative, adopting the most restrictive applicable standard as your national baseline, is more operationally sustainable and provides a more defensible compliance posture. Meeting California's consent, disclosure, and data rights standards; using universal two-party call recording disclosures; and scrubbing against all available state DNC lists as a standard practice covers the vast majority of state-level exposure with a single compliance architecture.

Operating nationally: Multi-state compliance strategy

For lead generators with national traffic, multi-state compliance requires a deliberate architectural approach rather than a state-by-state reactive response. The goal is a compliance program that satisfies the most demanding state requirements by default, so that leads generated anywhere in the country are covered without requiring state-specific variants of your consent language, form design, or documentation practices.

Adopt California's CCPA/CPRA and TCPA combination as your consent language baseline. California requires the most specific and complete disclosures of any state, and consent language that satisfies California's "clearly and conspicuously" standard while meeting federal TCPA requirements will satisfy most other states as well. Include CCPA-compliant data sale disclosures even if your operation doesn't exclusively serve California traffic: the opt-out mechanism costs little operationally and eliminates a significant California-specific exposure. Include explicit HELP and STOP instructions in any SMS programs to meet CTIA and carrier requirements uniformly.

Implement two-party call recording disclosures universally. The eleven two-party consent states include California, Florida, Maryland, Massachusetts, and Illinois: together, these states account for a very large share of the U.S. consumer population. Running call recording disclosures in every IVR and at the start of every call eliminates the state-by-state analysis problem entirely. The operational cost of a consistent disclosure is negligible; the cost of a CIPA or FTSA call recording violation is not.

Review your compliance program annually against the current state law landscape. State privacy and telemarketing laws are among the most actively evolving areas of consumer protection regulation in the country. New state privacy laws modeled on California's framework have been enacted in Virginia, Colorado, Connecticut, Texas, and other states, with additional states considering legislation. The overall trend is toward stricter consumer data rights and more explicit consent requirements, not toward federal preemption or deregulation. Lead generators who build their programs around federal minimums will face increasing state-level exposure as this regulatory wave continues, while those who build around best-in-class standards maintain defensible compliance postures as new requirements emerge.

Related resources

• TCPA Compliance Hub: Overview of TCPA standards for lead generators
• TCPA Compliance for Lead Generators: Core consent requirements and buyer expectations
• TCPA Compliance Checklist: Operational checklist for multi-state compliance
• FCC One-to-One Consent Rule: Why the FCC rule was vacated and where federal consent rules stand now