.webp)
Cold calling is legal in most major markets in 2026, but every region has its own rules on who you can call, when, and what happens if you ignore an opt-out. Get them wrong, and you can pay anywhere from $500 per call (US TCPA) up to 4% of global revenue (EU GDPR). This guide covers the regimes B2B sales teams hit most often and what cold calling compliance actually requires per region.
Cold calling compliance is not one law. It is a stack of overlapping consumer-protection, privacy, and sector-specific rules for each region. Below is the per-region playbook.
Cold calling is not illegal in any major market in 2026, but it is heavily regulated everywhere. The legal question is rarely "can I cold call?" and almost always "who, when, what do I say, and what records do I keep?"
The regimes break into three buckets: consumer-protection lists (US TCPA, UK TPS, Canada DNCL, Australia DNCR, India TRAI) that govern calls to consumers with a B2B exemption in most cases; privacy regimes (EU GDPR, UK GDPR, Canada PIPEDA) that govern how you obtain and process contact data; and sector regulators (FTC, OFCOM, ICO, CRTC, TRAI, ACMA) that enforce the above and issue the fines.
A B2B SaaS team selling into five countries can easily be subject to all three buckets, plus a different version of each per country. A single global cold calling compliance policy almost never works. You need a per-region playbook.
The Telephone Consumer Protection Act (TCPA) is the main US federal law governing cold calls, enforced by the FCC and the FTC, and the law under which most US cold calling lawsuits are filed.
The TCPA does five things in practical terms:
1. Restricts auto-dialers and prerecorded messages: Calls to wireless numbers using an automatic telephone dialing system (ATDS) or prerecorded voice need prior express written consent. The 2021 Facebook v. Duguid ruling narrowed the ATDS definition, but most teams still treat predictive and power dialers as falling under TCPA scrutiny.
2. Restricts calls to the National Do Not Call Registry (DNC): Telemarketer calls to DNC-registered numbers are prohibited without an established business relationship or written consent. B2B calls to business numbers are not subject to the consumer DNC.
3. Calling hours: No calls before 8 AM or after 9 PM in the called party's local time.
4. Identification: The caller must identify themselves, the company, and a callback number.
5. Opt-outs: A "stop calling me" request goes onto your internal DNC within 30 days and stays there for at least five years.
Penalties run $500 per violation, up to $1,500 per call for willful violations. TCPA suits are commonly filed as class actions, which is why TCPA settlements regularly land in the seven- to nine-figure range.
TCPA's ATDS plus prerecorded message rule applies to all wireless numbers, including business cell phones. The B2B exemption covers the DNC registry, not the ATDS rule. A team using an auto-dialer to call business cell phones still needs to be careful.
DNC compliance means screening your call list against the National Do Not Call Registry, your own internal DNC list, and any state-level DNC lists that apply. It is the operational layer of US cold calling compliance.
The federal registry has roughly 250 million numbers registered, mostly residential and personal mobile. Telemarketers access it via a SAN (Subscription Account Number) with the FTC and scrub at least every 31 days. The B2B exemption removes most friction for teams calling business numbers, but two traps remain: founder cell phones that may be DNC-registered, and state DNC lists in Florida, Indiana, Pennsylvania, and others that go beyond federal TCPA.
Internal DNC list compliance trips up teams the most; If a prospect says "stop calling me," you have 30 days to add them, and after that, any call to that number is a violation, even from a different rep. The fix is a written DNC policy, a single source of truth for opt-outs across channels, and rep training on capturing opt-out requests.
GDPR (General Data Protection Regulation) does not ban cold calling, but it changes the foundation of cold calling compliance in the EU. The phone number you are calling is personal data, and you need a lawful basis to process it. For B2B cold calling, that basis is almost always "legitimate interest" rather than consent.
Legitimate interest means you can call a B2B prospect without explicit prior opt-in if you can document that the call serves a legitimate business interest, the processing is necessary to achieve it, the data subject's rights do not override that interest, and you have completed a Legitimate Interest Assessment (LIA) you can produce on request.
The EU ePrivacy Directive layers country-specific rules on top. Germany and Italy interpret ePrivacy strictly and effectively require prior consent for B2B cold calls in some sectors. France, Spain, Ireland, and the Nordics work with the legitimate interest baseline.
Document an LIA before you start, maintain a clear opt-out honored across channels, send a privacy notice on first contact (usually a follow-up email with a link to your privacy policy), honor data subject access and erasure rights, and keep call records only for the period justified by your basis. GDPR fines top out at the higher of €20 million or 4% of global annual revenue.
Cold calling is legal in the UK in 2026, including B2B, but with rules that differ from the EU. The UK maintains UK GDPR plus the Privacy and Electronic Communications Regulations (PECR), enforced by the ICO.
The key UK layer is the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS):
Both lists must be scrubbed at least every 28 days. The ICO has been aggressive in 2024 and 2025 about pursuing pension and financial services cold callers. The UK also bans cold calling for consumer financial services, which was expanded in 2023 to cover all financial products marketed to consumers.
Practical UK cold calling compliance boils down to four things: screen B2B lists against CTPS every 28 days; screen consumer numbers against TPS (no calls without consent); identify caller, company, and purpose on every call; and provide an opt-out path. OFCOM also enforces silent-call rules. You cannot abandon more than 3% of calls, and abandoned calls must play a recorded ID message.
Canada has two main regimes B2B teams need to know.
The National Do Not Call List (DNCL) is run by the CRTC. Telemarketers register with the CRTC, pay the subscription fee, scrub against the DNCL, and follow these rules: calling hours of 9 AM to 9:30 PM weekdays and 10 AM to 6 PM weekends in the called party's local time; caller ID required on every call; identification at the start (caller name, company, contact info); internal DNC list maintained for at least three years; and a written policy on telemarketing complaints.
B2B exemption: The DNCL exempts calls to existing business customers. B2B prospecting to non-customer companies technically falls under DNCL, though enforcement has focused on consumer telemarketing.
CASL primarily governs commercial electronic messages (email, SMS), not voice. Voice cold calls fall under the DNCL and the Telecommunications Act. Automated voice messages are treated more like electronic messages under CASL principles. Treat any automated dialing or prerecorded message as CASL-adjacent and get consent.
India has one of the strictest regimes in the world. The Telecom Commercial Communications Customer Preference Regulations 2018 (TCCCPR 2018), enforced by the Telecom Regulatory Authority of India (TRAI), require all commercial callers to register and operate through approved channels.
The headline rules: only registered telemarketers can place commercial calls (DLT registration via Jio, Airtel, Vi, or BSNL is mandatory); consumers can block all promotional calls or specific categories; every caller must register a recognizable header (sender ID) with the DLT platform or carriers filter the call; calling hours are 9 AM to 9 PM local time; penalties are paid via security deposits and escalate to telemarketer deregistration for repeat violations.
TRAI applies to commercial calls placed within India to Indian numbers. Many global teams use a local presence provider in India because Indian carriers filter foreign-origin marketing calls aggressively regardless of formal compliance status.
The pattern: GDPR plus ePrivacy is the floor of EU cold calling compliance, but country-specific interpretations vary materially. Build a per-country playbook before launching in a new EU market.
SmartDialer is built on Smartlead's outbound operating system, and several features give SDR teams a cold calling compliance default workflow rather than something to bolt on later.
Every lead in the Call Queue shows a lead-local time and a callable indicator: green for 8 AM to 8 PM in the lead's local timezone, yellow within 1 hour of the boundary, red outside hours. Non-callable leads are pushed to the bottom and grayed out. The TCPA calling-hour rule is built into the workflow rather than left to SDR memory. Hours are configurable globally and per campaign, so a UK campaign runs 9 AM to 9 PM and a US campaign runs 8 AM to 9 PM.
Smartlead's email Global Block List extends to phone numbers. If a lead opts out via email, their phone number is also blocked. SDRs can add phone numbers to the block list directly from the Call Queue. This is the cross-channel opt-out rule that GDPR, CASL, and TCPA all expect, executed as a single source of truth.
At Quick Upload, SmartDialer deduplicates against existing queues, the Global Block List, and recent calls (default 7-day window). A "Called 2 days ago in Campaign X" badge appears in the queue, addressing the "called the same lead three times" problem.
Outside-hours calls are soft-blocked with a warning, and compliance teams can switch to hard blocks.
What SmartDialer does not do: register you with the FCC SAN for DNC scrubbing, file your TRAI DLT registration, produce your GDPR LIA, or replace legal review. Cold calling compliance is the caller's responsibility. SmartDialer defaults to compliant behavior. The legal foundation sits with you.
Most regimes require some record-keeping, and a real cold calling compliance defense lives or dies on what you can produce. The minimum useful set:
Smartlead's Call Logs capture the operational call data automatically. The legal documentation lives in your compliance system of record.
Cold calling is legal in every major market in 2026, but the rules differ by region and the cost of getting them wrong is high enough that a real cold calling compliance program is table stakes. Build a per-region playbook, scrub against the right DNC lists, document your legitimate interest where GDPR applies, honor opt-outs across channels, and pick a calling tool that defaults to compliant behavior.
Yes, with restrictions. Auto-dialers can call manually dialed business numbers freely. Calls to wireless or residential numbers using an ATDS or prerecorded voice require prior express written consent under TCPA. Most teams treat predictive and power dialers as ATDS for safety. Manual click-to-dial is the safest mode.
In the US, yes, manually, for a B2B purpose, but no auto-dialer or prerecorded message without consent. TCPA wireless restrictions apply regardless of B2B or B2C context. In the UK, screen against TPS first. In the EU, you need a legitimate interest basis and an opt-out path.
If you call into Florida, Indiana, Pennsylvania, or a handful of other states with stricter rules, yes. Most compliance providers offer state-level scrubbing. The federal DNC alone is not sufficient in those states.
Honor it immediately. Under TCPA, you have 30 days to add the number to your internal DNC, and it stays five years. Under CASL and UK PECR, opt-outs are honored immediately. Add it to your unified opt-out list the same day across email and phone.
No. GDPR allows B2B cold calling under legitimate interest, provided you have a documented LIA, offer an opt-out, and honor data subject rights. Country-specific ePrivacy rules (Germany, Italy) are stricter. Verify by country before launching.
Legally, in most cases, yes, subject to that country's rules. Practically, local carriers filter foreign-origin calls, jurisdiction in a complaint can be murky, and some regimes (India TRAI) require local registration. Many global teams use a local presence provider in each major market.
TCPA covers voice calls and SMS to wireless numbers. CAN-SPAM covers commercial email. Separate laws, separate enforcement (FCC vs FTC), separate penalties. A cold outreach program running email plus phone is subject to both.
Penalties vary by jurisdiction. US TCPA: $500 per call, up to $1,500 per willful violation, with class actions in the seven- to nine-figure range. UK PECR: ICO fines in the hundreds of thousands of pounds. EU GDPR: up to 4% of global revenue. India TRAI: security deposits and deregistration. Canada DNCL: up to CAD 1,500 per call for individuals and CAD 15,000 per call for corporations.
Join us to elevate your outreach!
Founder, StackOptimise
Smartlead's combination of automation, unlimited inboxes, and easy campaign management has completely transformed how we run cold email campaigns.
.jpg)
Founder, Cold Email Hackers
We have about 15 companies and we use Smartlead for all of them.
Founder, DutchSave Media
One of the things I love about using Smartlead is the deliverability feature. If they landed in the bounce or spam folders, we could resolve this quickly.
Co-Founder, Growth Today
I want to continue to use Smartlead to make operations more seamless - the plan is to bring more clients here and build more SOPs.
Founder, FueltoFly
Smartlead listens to the agencies and customers and builds according to what people want, that has really made things easier for us.
Founder, OutboundSync
We build an infrastructure product, and OutboundSync communicates with Smartlead itself. I love the webhook and API. They're really well done and keep getting better.
Founder, Axoleads
With SmartDelivery, you can put all of that in the hands of the tool. It ensures your emails land in inboxes, and by running a simple test, you can see if you're hitting the mark.
Founder, Claygen
Deliverability is the cornerstone of cold email outreach. You could have the best email copy in the world, but if no one is seeing it, it's useless. I really love the feature where you can actually give client accesses to your clients.
Co-Founder, Cymate
I do not want to switch to another software. Pick a solution you trust, stick with it, and keep refining your copy.
CMO, Avalanche Capital
Managing large volumes of emails through multiple inboxes used to be a logistical nightmare. With Smartlead, the process is seamless. We book thousands of discovery calls through cold emails. These campaigns are generating leads at a scale we never thought possible.
Founder, Growth Engine X
We came for the unlimited inboxes, and we stayed for the API. 1.5M cold emails/month, 7,767+ inboxes managed.
Head of Community & Ecosystem, TxtCart
You cannot replace having 10,000 touches with potential clients. When you have that much distribution and reach, you really start to see incredible results. The simplicity of Smartlead made all the difference. It doesn't require you to be a technical wizard.
Founder, Hyperke
Smartlead has been a game-changer for us. It increased our appointment volume, improved ease of use, and offered valuable features. 80% increase in appointments/month, peak of 276 appointments in a single month.
Founder, Kinetyca
Smartlead has been our cold email backbone from day one. The platform evolves constantly, keeping pace with how deliverability and personalization need to work today. 21% overall reply rate, $175K in 4 months for multiple B2B clients.
Founder, Reachflow
Smartlead is centered around deliverability and constantly evolving. Their API is not like any other platform. Smartlead covers all our needs. The focus on core features like deliverability and API integration is unmatched.
CEO, Halfwarm
Our approach to crafting conversational emails led to reply rates that many of my peers thought were unattainable.
Co-Founder, letstrike
We've grown on zero capital, zero marketing, purely cold emailing - and that's the story we love to tell. The best approach is no approach if you can't handle domain meltdown. The second best is something like Smartlead that's built from the ground up for deliverability at scale.
Founder, Fenixtal
Smartlead's white-labeling and automation let us punch above our weight. The 12M euros sales potential? That's what happens when you combine human creativity with Smartlead's precision.
Co-Founder, Digital Creativs
Nine out of 10. Ninety percent of our clients are on Smartlead unless they come in with an existing setup. That's the default.
Co-Founder, BuildingReach
At the end of the day, you have to take a bet on one tool or another. It was a no-brainer taking that bet on Smartlead. We had to even turn down the volume of our marketing campaigns - Smartlead was capable of driving more volume than our sales team was able to fulfill.
Founder & MD, Prospectiv
Since starting the business in January of this year, we've already generated $200K in sales exclusively from cold email. Smartlead has been central to our operations and has exceeded our expectations.
Founder, Growthlynk
There's so much stuff built on top of it. I would be dead if I had to rebuild it with another tool. I can manage hundreds of senders easily. I can send hundreds of thousands of emails.
Founder, Corebits
The platform's HubSpot integration, real-time Slack updates, and advanced campaign customization have been game changers for our business and our clients'.
Founder, Apex Ascension
From day one, we've never used anything else.
