If you are buying leads and calling prospects in multiple states, federal TCPA compliance is only half the battle. At least 15 states now enforce their own telemarketing statutes — commonly called "mini-TCPA" laws — that layer additional restrictions on top of federal rules. Violate one of these state laws and the penalties can dwarf what the FCC hands out.

This guide breaks down the state telemarketing laws that matter most to lead buyers in 2026, including calling hour restrictions, state DNC registry requirements, consent standards, penalty ranges, and the practical compliance steps you need to take before dialing your next batch of aged leads.

Why State Laws Matter More Than Ever in 2026

Three things changed between 2021 and 2026 that made state telemarketing compliance a front-burner issue for every lead buyer:

The mini-TCPA wave. Starting with Florida's SB 1120 in 2021, states began passing their own telemarketing statutes at an accelerating pace. Oklahoma followed in 2022, Connecticut and Maryland in 2023, Georgia in 2024, Texas and Virginia in 2025-2026. Each law adds unique restrictions that go beyond federal TCPA requirements.

The FCC one-to-one consent rule was struck down. In January 2025, the Eleventh Circuit Court of Appeals struck down the FCC's one-to-one consent requirement, ruling the agency exceeded its statutory authority. That means the federal landscape for lead buyers remains relatively permissive — but states are filling the gap with their own stricter consent and calling rules.

TCPA litigation is at record highs. In Q1 2025, 507 TCPA class actions were filed — a 112% increase over Q1 2024. Eighty percent were class actions, and average settlements exceeded $6.6 million. Plaintiffs' attorneys are increasingly filing under state mini-TCPA statutes because the penalties are often higher and the requirements are stricter, making violations easier to prove.

The bottom line: if you are working leads across state lines — and most lead buyers are — you need a state-by-state compliance strategy, not just a federal one.

State-by-State Comparison Table

The table below summarizes the most important compliance points for the states with the strictest telemarketing laws. If you call leads in any of these states, review the detailed section that follows.

The Top 10 Strictest States for Lead Buyers

Based on a combination of penalty severity, consent requirements, calling restrictions, enforcement activity, and private right of action availability, here are the ten toughest states for lead buyers in 2026:

Connecticut's SB 1058 (effective October 2023) is arguably the strictest state telemarketing law in the country. It requires prior express written consent for virtually all telephonic sales calls, limits calling hours to 9am-8pm (the narrowest window of any state), and imposes penalties of up to $20,000 per violation — more than 13 times the typical federal TCPA penalty. Violations are also unfair trade practices under CUTPA, which opens the door to additional penalties and attorney's fees.

For aged lead buyers, this means you cannot call a Connecticut prospect unless you can document valid prior express written consent. An established follow-up cadence with proper consent documentation is essential.

Florida's SB 1120 (effective July 2021) was the law that started the mini-TCPA wave. Key restrictions: calling hours are 8am-8pm (one hour shorter than federal), a maximum of 3 call attempts per 24-hour period, and a broadened autodialer definition that captures most modern dialing systems. The law also creates a presumption that any call to a Florida area code is a call to a Florida resident.

Florida's private right of action allows $500 per non-willful violation and $1,500 per willful violation. For lead buyers working high-volume campaigns, those three-call-per-day limits are the biggest operational constraint.

Maryland's Stop the Spam Calls Act (SB 90, effective January 2024) mirrors Florida's approach with 8am-8pm calling hours, a 3-call-per-24-hour limit, and a requirement for prior express written consent before using any automated dialing system. But Maryland's penalties are far steeper: $10,000 per violation under the Maryland Consumer Protection Act, and $25,000 for repeat violations. Criminal penalties — up to $1,000 fine and one year in prison — are also on the table.

Texas SB 140 (effective September 2025) expanded the state's telemarketing law to cover text messages and created one of the most complex registration requirements in the country. Telemarketers must register with the Secretary of State, pay a $200 fee, post a $10,000 security bond, and submit quarterly reports. Statutory damages of $500-$1,500 per violation are available, plus the law ties violations to the Texas Deceptive Trade Practices Act, which allows treble damages and attorney's fees. Texas also maintains two separate state DNC registries — one for residential/mobile numbers and one for businesses.

Oklahoma's Telephone Solicitation Act (OTSA, effective November 2022) requires consent before using any automated dialing system, limits calls to 8am-8pm, caps contact attempts at 3 per 24 hours, and requires scrubbing against the state's own DNC registry within 30 days of a number appearing. Penalties range from $500-$1,500 per violation, with treble damages for willful violations.

Georgia's SB 73 (effective July 2024) made two changes that should concern every lead buyer: it removed the "knowing" requirement for violations (meaning you can be liable even if you did not know you were violating the law) and it extended vicarious liability to advertisers — the companies whose products are being sold, not just the callers. It also removed statutory damage caps for class actions, meaning a single campaign targeting Georgia residents could generate unlimited aggregate liability.

Virginia's SB 1339 (effective January 2026) extends the Virginia Telephone Privacy Protection Act to cover text messages and requires that text opt-out requests (STOP or UNSUBSCRIBE) be honored for 10 years. Penalties range from $500-$5,000 per violation with a private right of action. The 10-year opt-out window is the longest in the country and creates significant record-keeping requirements for lead buyers.

New York recently nearly doubled its civil penalties for DNC violations to $20,000 per violation. The state requires callers to disclose their identity, purpose, and the entity they represent within 10 seconds of the call beginning, and to inform consumers of their right to be added to an internal DNC list. Each unlawful call is a separate violation — meaning a single campaign can generate astronomical penalties quickly.

Indiana maintains its own state DNC registry (one of roughly a dozen states that still do) and requires telemarketers to get live operator permission before playing any pre-recorded message. Penalties escalate sharply: $10,000 for a first violation and $25,000 for each subsequent violation when enforced by the Attorney General. Indiana also extended vicarious liability to individuals and entities with direct or indirect control over the telemarketer, regardless of where they are located.

Illinois has three overlapping telemarketing statutes: the Telephone Solicitations Act, the Restricted Call Registry Act, and the Automatic Telephone Dialers Act. Calling hours for live calls are 8am-9pm, but autodialers are restricted to 9am-9pm. The state maintains its own Restricted Call Registry, and penalties run $1,000 for a first violation and $2,500 for subsequent violations. Violations are also enforceable under the Consumer Fraud and Deceptive Business Practices Act, giving the AG broad enforcement powers.

Detailed State Breakdowns

Florida: The Law That Started It All

Florida's Telephone Solicitation Act, as amended by SB 1120, created the template that other states have since followed. Here is what you need to know as a lead buyer:

Calling hours: 8:00 AM to 8:00 PM in the recipient's time zone. This is one hour shorter than the federal 8am-9pm window, which means you lose an hour of evening dialing for every Florida lead.

Call attempt limits: No more than 3 attempts to the same number in any 24-hour period. This is a hard cap that applies to calls, texts, and voicemail drops combined. If you use a multi-touch follow-up cadence that includes calls and texts on the same day, you need to count every touch.

Autodialer definition: Florida defines an autodialer as "an automated system for the selection or dialing of telephone numbers or the playing of a recorded message." This is significantly broader than the federal TCPA definition after the Supreme Court's 2021 Facebook v. Duguid decision, and it captures most modern power dialers and predictive dialers.

Florida area code presumption: Any call to a Florida area code is presumed to be a call to a Florida resident or a person physically in the state. This means you cannot avoid Florida law simply because a lead's mailing address is in another state.

Consent: Prior express written consent is required before making sales or marketing calls. Unlike the federal TCPA, Florida removed the established business relationship exemption — meaning even existing customers need to have given written consent.

Penalties: $500 per non-willful violation; $1,500 per willful violation, recoverable through a private right of action.

California: The Privacy Layer

California does not have a single mini-TCPA statute in the Florida mold, but the combination of multiple overlapping laws makes it one of the more complex states for lead buyers.

Calling hours: California follows the federal standard of 8:00 AM to 9:00 PM Pacific Time.

CCPA/CPRA overlay: The California Consumer Privacy Act gives consumers the right to know what personal information you have collected, to delete it, and to opt out of its sale. If you are buying aged leads that include California residents, you need to be prepared to handle CCPA data subject requests — and to verify that your lead vendor obtained proper consent for the data transfer.

Robocall consent: California requires clear, prior consent before making any robocall. The state's robocall restrictions are enforced under multiple statutes, including the California Penal Code.

Internal DNC: California requires telemarketers to maintain an internal DNC list and honor opt-out requests for 10 years from the time of the request.

Practical impact: California's complexity comes from the interaction between telemarketing law and data privacy law. You need to maintain both DNC compliance records and CCPA compliance records for every California lead in your database.

New York: High Penalties, Fast Escalation

Calling hours: 8:00 AM to 9:00 PM local time, consistent with federal standards.

Disclosure requirements: Within 10 seconds of the call beginning, you must disclose your identity, the purpose of the call, and the entity on whose behalf you are calling. You must also inform the consumer that they may add themselves to your internal DNC list. Failure to make these disclosures is a $20,000 penalty per call.

Penalties: Civil penalties of up to $20,000 per violation. Each call is a separate violation. For a lead buyer running even a modest campaign of 100 calls to New York numbers, the theoretical maximum exposure is $2 million.

Practical tip: Build New York's 10-second disclosure into your call scripts. Make it the first thing out of your mouth — before any rapport-building or introduction. It is not optional, and the penalty for skipping it is severe.

Texas: Registration, Bonds, and Treble Damages

Calling hours: 8:00 AM to 9:00 PM, matching federal standards.

Registration requirements: If you are making telemarketing calls to Texas residents, you may need to register with the Texas Secretary of State, pay a $200 filing fee, post a $10,000 security bond, and file quarterly reports. Exemptions exist for publicly traded companies, financial institutions, nonprofits, and certain retail sellers — but most lead buyers and independent agents will not qualify.

State DNC registries: Texas maintains two separate DNC registries — one for residential and mobile numbers (covering unsolicited calls and messages) and one for businesses. You must scrub against both in addition to the federal National DNC Registry.

Text messages: As of September 2025, Texas law explicitly covers text messages, multimedia messages, and similar electronic communications under the same rules as telephone calls.

Senior protections: Texas prohibits coercive or high-pressure sales tactics when contacting individuals aged 65 and older. Repeated contact, aggressive language, or creating artificial urgency to push immediate decisions are specifically prohibited for seniors.

Penalties: Statutory damages of $500-$1,500 per violation through private action. Violations are also actionable under the Texas DTPA, which allows treble damages (up to 3x economic damages) plus mental anguish damages and attorney's fees.

Washington: The 30-Second Rule and One-Year Ban

Calling hours: 8:00 AM to 9:00 PM local time.

30-second disclosure: Washington requires callers to identify themselves, their company, and the purpose of the call within the first 30 seconds. This is more generous than New York's 10-second rule, but it is still a hard requirement.

One-year re-contact ban: If a consumer says they do not want to be called again, you cannot contact them for at least one year. And if the consumer says they want to end the call, you must stop talking within 10 seconds.

Federal DNC integration: Washington law makes calling a number registered on the federal DNC registry a violation of state law, with state-level penalties.

Penalties: Fines of up to $1,000 per violation through regulatory enforcement. Civil damages of $100-$2,000 per violation through private action, plus attorney's fees. Repeat violators face injunctions.

Oklahoma: The Three-Touch Ceiling

Calling hours: 8:00 AM to 8:00 PM local time — one hour shorter than federal.

Contact limits: Maximum of 3 contacts per 24-hour period, counting all calls, texts, and messages combined.

State DNC registry: Oklahoma maintains its own DNC registry through the Attorney General's office. Telemarketers must stop calling within 30 days of a number appearing on the registry.

Automated system ban: The OTSA prohibits "using an automated system for the selection or dialing of telephone numbers" without prior consumer consent. Like Florida's definition, this is broader than the federal TCPA definition and captures most modern dialing systems.

Penalties: $500-$1,500 per violation, with treble damages for willful or knowing violations (up to $4,500 per call).

Georgia: Vicarious Liability Changes Everything

Calling hours: 8:00 AM to 9:00 PM local time.

Vicarious liability: Georgia's SB 73 extended liability beyond the party that actually makes the call to the advertisers — the companies whose products or services are being promoted. If you hire a call center or use a dialer service to work your leads, and they violate Georgia law, you can be held liable as the advertiser.

No "knowing" requirement: You do not need to know you are violating the law to be found liable. This removes one of the most common defenses in telemarketing litigation.

Class actions: SB 73 explicitly allows class action lawsuits. While individual damages were reduced from $2,000 to $1,000 per violation, there is no cap on aggregate class action damages — meaning a large campaign could generate massive exposure.

Practical impact: Georgia's vicarious liability provision means you cannot outsource compliance. Even if you use a third-party dialer or call center, you are on the hook for their violations. Vet your vendors carefully and build compliance monitoring into your contracts.

Illinois: Three Laws, One Headache

Illinois regulates telemarketing through three separate statutes:

1. Telephone Solicitations Act (815 ILCS 413): Covers live telemarketing calls. Calling hours are 8:00 AM to 9:00 PM.
2. Restricted Call Registry Act (815 ILCS 402): Maintains the state's own DNC registry. Telemarketers must stop calling within 45 days of a number appearing on the registry.
3. Automatic Telephone Dialers Act (815 ILCS 305): Restricts autodialer operation to 9:00 AM to 9:00 PM — a narrower window than live calls.

Penalties: $1,000 for first violations, $2,500 for subsequent violations. Violations are also enforceable under the Consumer Fraud and Deceptive Business Practices Act.

Indiana: State Registry and Executive Liability

State DNC registry: Indiana is one of roughly a dozen states that still maintains an active state DNC registry, separate from the federal list. You must scrub against it before calling Indiana numbers.

Live operator requirement: A live phone operator must obtain permission before playing any pre-recorded message to an Indiana consumer.

Vicarious liability: Indiana extended liability to individuals and entities with "direct or indirect control" of the telemarketer, regardless of where those persons or entities are located. This can reach up the chain to agency owners, franchise operators, and marketing directors.

Penalties: $500-$1,500 per violation through private action. AG enforcement carries $10,000 for a first violation and $25,000 for subsequent violations.

Maryland: Criminal Penalties on the Table

Calling hours: 8:00 AM to 8:00 PM — one hour shorter than federal.

Contact limits: Maximum of 3 telephone solicitation calls or texts per individual in a 24-hour period on the same subject matter.

Automated system consent: Prior express written consent is required before using any automated system for selecting or dialing numbers, or for playing pre-recorded voicemail messages.

Penalties: Civil penalties of $10,000 per violation and $25,000 for repeat violations under the Maryland Consumer Protection Act. Additionally, criminal penalties of up to $1,000 fine and one year imprisonment are available. Maryland is one of the few states where telemarketing violations can lead to criminal prosecution.

State DNC Registries: Where You Must Scrub Beyond Federal

Approximately 11 states maintain their own DNC registries that operate alongside the federal National DNC Registry. If you are calling leads in any of these states, you must scrub your lists against both the federal and state registries:

• Colorado
• Florida (enhanced requirements under FTSA)
• Illinois (Restricted Call Registry)
• Indiana
• Louisiana
• Massachusetts
• Missouri
• Oklahoma (AG registry, 30-day scrub requirement)
• Pennsylvania
• Tennessee
• Texas (two registries: residential/mobile and business)
• Wyoming

The cost, update frequency, and exemption rules vary by state. Some registries update monthly, others quarterly. Your compliance checklist should include a schedule for pulling fresh state DNC data on a regular cadence — quarterly at minimum, monthly if you are running high-volume campaigns.

How These Laws Apply to Aged Lead Buyers

If you are buying aged leads from a vendor like Aged Lead Store, the state laws above create several specific compliance considerations:

Consent transfers. When you buy aged leads, you are buying leads where consent was originally given to a different entity. While the FCC's one-to-one consent rule was struck down in 2025, some state laws — particularly Connecticut and Florida — have their own consent requirements that may not recognize transferred consent as readily as federal law does. Document the consent chain for every lead.

Age of the lead matters. Many state DNC registries update regularly. A lead that was DNC-compliant when it was generated six months ago may have since been added to a state registry. Always re-scrub aged leads against both federal and state DNC lists before dialing — even if your vendor already scrubbed them at the time of sale.

Call attempt limits compound with age. Florida, Oklahoma, and Maryland all cap call attempts at 3 per 24-hour period. If you are working aged leads with a multi-day follow-up cadence, those limits constrain how aggressively you can pursue each prospect. Plan your cadence around the most restrictive state in your calling list.

Vicarious liability. Georgia and Indiana both extend liability to entities that control the telemarketing operation. If you are a lead buyer who hires agents or virtual assistants to work your leads, you are liable for their compliance failures. Training and monitoring are not optional.

Record keeping. Virginia's 10-year opt-out window, California's 10-year internal DNC requirement, and the documentation demands of CCPA and state consent laws all require robust record-keeping systems. If you cannot prove compliance, you effectively are not compliant.

Multi-State Compliance Checklist for Lead Buyers

Use this checklist before launching any lead campaign that touches multiple states:

Before You Buy Leads

• Verify your lead vendor provides consent documentation (date, source, language, opt-in method)
• Confirm leads have been scrubbed against the federal National DNC Registry
• Ask whether leads have been scrubbed against applicable state DNC registries
• Review the lead vendor's data handling practices for CCPA compliance (California leads)

Before You Dial

• Re-scrub all leads against federal and applicable state DNC registries (do not rely solely on vendor scrubs)
• Segment leads by state and apply the most restrictive calling hours for each state
• Configure your dialer to enforce per-number daily attempt limits (3/day for FL, OK, MD)
• Prepare state-compliant call scripts with required disclosures (10-sec for NY/CT, 30-sec for WA)
• Verify your caller ID displays accurately (spoofing violates federal and most state laws)

During Campaigns

• Log every call attempt with timestamp, duration, and outcome
• Honor all opt-out requests immediately and record them with date and time
• Maintain an internal DNC list and apply opt-outs within 24 hours for the next calling session
• Monitor daily attempt counts per number to stay within state limits
• Train all agents on state-specific disclosure requirements

Ongoing Compliance

• Update state DNC registry data on a regular schedule (monthly recommended)
• Audit consent documentation quarterly
• Review and update call scripts when state laws change
• Maintain opt-out records for the longest applicable retention period (10 years for VA and CA)
• Document your compliance processes — if you are ever investigated, your process documentation is your first line of defense

Frequently Asked Questions

Do state telemarketing laws apply to me if I am calling from a different state?

Yes. State telemarketing laws apply based on where the consumer is located, not where the caller is located. If you are sitting in Arizona and calling a lead with a Florida area code, Florida's FTSA applies to that call. Several states, including New York and Texas, have explicitly extended their laws to cover out-of-state telemarketers.

If I have valid TCPA consent, am I automatically compliant with state laws?

Not necessarily. Federal TCPA consent may not satisfy stricter state requirements. Connecticut, for example, requires prior express written consent for telephonic sales calls, and its definition of what constitutes valid consent may differ from the federal standard. Florida eliminated the established business relationship exemption that exists under federal law. Always verify that your consent documentation meets the requirements of each state you are calling into.

How do state laws affect my ability to work aged leads?

State laws add friction but do not make aged leads unworkable. The key is re-scrubbing against state DNC registries before dialing (since leads may have been added to registries after they were generated), respecting state-specific call attempt limits, and maintaining documentation of the original consent chain. A solid compliance checklist and a well-designed follow-up cadence will keep you compliant while still allowing you to work your aged leads effectively.

What is the biggest compliance risk for multi-state lead campaigns?

The biggest risk is applying a one-size-fits-all approach. Many lead buyers set their dialer to federal TCPA standards and assume they are covered. But if you are calling into Florida with an 8:45 PM call, or making a fourth attempt to an Oklahoma number in 24 hours, or failing to provide the 10-second disclosure to a New York prospect, you are violating state law — even though you are federally compliant. Segment by state and apply the strictest applicable standard.

Are there states where I should avoid buying leads altogether?

No state is off-limits, but some require more compliance infrastructure than others. Connecticut ($20,000/violation), Maryland ($10,000-$25,000/violation), and New York ($20,000/violation) have the steepest penalties. If you are a solo agent or small operation without a compliance system in place, you may want to build your compliance infrastructure before aggressively pursuing leads in those states. The DNC compliance guide is a good starting point for building that foundation.

Staying Ahead of the Curve

The trend is clear: more states are passing stricter telemarketing laws, and the pace is accelerating. Virginia's SB 1339 took effect in January 2026, and multiple states have proposals in committee right now that could add new restrictions before the end of the year.

For lead buyers, the playbook is straightforward even if the execution is complex: know the law in every state you call into, build compliance into your systems rather than relying on memory, re-scrub your lists regularly, document everything, and train every person who touches a phone on your team.

The agents who build compliance into their workflow — not as an afterthought but as the foundation of how they operate — are the ones who will keep dialing while their competitors are dealing with cease-and-desist letters and class action lawsuits. Start with the compliance checklist, build your scripts with required disclosures, and make sure your lead vendor is doing their part on the consent and DNC front.

State telemarketing compliance is not optional in 2026. It is the cost of doing business — and the lead buyers who treat it that way will be the ones still standing when the next wave of state laws arrives.