TCPA in 2026 — what changed for outbound dialing

If you ran VICIdial through 2024-2025, you saw a lot of TCPA churn. Here's the operator-level summary of what's different in 2026.

1. Reassigned-Numbers Database is fully enforced

Was rolled out in stages 2021-2023. As of 2026, it's fully enforced. If you make a TCPA-regulated call to a number that was reassigned, the RND is your only safe-harbor defense. Skip the check, lose the case.

What to do: pre-clean your lists against the RND before loading into VICIdial. Commercial services (Numeracle, Caller ID Reputation, Possible Now) will bulk-clean for you at sub-cent per number.

2. One-to-one consent rule

The 2024 FCC ruling ended "lead-form-with-50-partner-checkboxes" consent. Now consent must be specific to a single seller — i.e. when you collect a phone number on a form, the consent text must name exactly one company that's allowed to call.

What to do: rebuild your lead-gen forms. Each form = one seller's consent. If you operate multiple businesses, each gets its own form path with its own consent text.

3. Revocation-friendly opt-out

The 2025 ruling requires that opt-out be honored within 10 business days, expanded the methods you must accept (text "STOP", any mention of "stop calling" verbally), and applies the opt-out across all channels for that consumer.

What to do: make sure your VICIdial agents disposition DNC immediately on any opt-out wording. Have a process for SMS opt-outs to flow back to the dialer's DNC table.

4. STIR/SHAKEN attestation pressure

Carriers are dropping calls at attestation B/C as spam. To get attestation A, your caller ID must be a number you legitimately control + your carrier must support it.

What to do: BYO DID. Use one of your own DIDs as outbound CLI per campaign. Make sure your carrier supports STIR/SHAKEN A-attestation for it.

5. State-level pile-up

Florida (FTSA, 2021), Washington (2023), New York (2025), Maryland, Oklahoma — each have their own rules. Some require time-of-day stricter than federal. Some require explicit consent for predictive dialers.

What to do: per-state campaigns + per-state lists. VICIdial supports this via the local_call_time lookup. Maintain state-level DNC lists separately from federal.

What we do at the platform level

We don't do TCPA compliance for you. But we make it easier:

• Audit log on every action — your discovery defense if you get sued.
• Daily snapshots — your dial logs are recoverable for litigation.
• Region pinning — EU calls live on EU servers; useful for GDPR overlay.
• Automatic backups before factory reset — no accidental log loss.

Read these

Not legal advice. But the FCC's official rule pages are surprisingly readable. Subscribe to telecom-law newsletters from Klein Moynihan or Manatt for ongoing updates.