B2B cold calling compliance basics for the US, Canada and the UK

United States

Business to business calls are largely exempt from the national do not call registry, but automated dialing and prerecorded messages to mobile numbers carry real risk under the TCPA.

Calls to businesses are generally outside the consumer do not call regime, which is why B2B cold calling remains legal and common. The exposure comes from technology rather than intent: automatic telephone dialing systems, prerecorded voice and artificial voice messages are treated seriously when directed at mobile numbers.

The safe operating position for most teams is manual or click to dial to mobiles, no prerecorded voice without consent, a clear identification of who is calling and why, and an internal do not call list honoured immediately. Several states add their own rules, including calling hour restrictions and registration requirements, so check the states you actually dial.

• Keep an internal do not call list and honour it permanently.
• Avoid prerecorded and artificial voice messages to mobiles.
• Respect local calling hours in the recipient's time zone.
• Identify yourself and your company at the start of every call.

Canada

Canada operates a national do not call list with exemptions for business to business calls, along with rules on identification, calling hours and maintaining an internal do not call list that persists for years after a request.

Email is the stricter side in Canada. CASL requires consent, which can be implied by an existing business relationship or by a business email address published without a statement refusing unsolicited messages. Every message needs clear sender identification and a working unsubscribe that is actioned quickly.

United Kingdom

Live marketing calls to corporate subscribers must be screened against the Corporate Telephone Preference Service, and any organisation that has told you directly not to call must be suppressed. Sole traders and most partnerships are treated closer to individuals, which catches teams out when calling small trades businesses.

Under UK GDPR you also need a lawful basis for processing the contact data, which for B2B prospecting is usually legitimate interests, supported by a balancing assessment, a privacy notice and a straightforward way to object.

The operational habits that satisfy all three

Rather than building a different process per market, build one that clears the highest bar. Screen every list against do not call registries and your own suppression file before delivery. Record when and why each record was added, and keep the match reason with it.

Honour every opt-out within one business day, suppress it permanently across every campaign and every client, and never let a suppressed contact re-enter through a new list. We handle opt-outs this way by default, and anyone can remove themselves through the opt-out page.

• Screen against registries and internal suppression before delivery, not after.
• Store the reason each record was selected.
• Action opt-outs within one business day, permanently.
• Keep an auditable log of what was called, when, and by whom.

What to ask a data vendor about compliance

Ask where the data came from, how opt-outs propagate, whether registry screening happens before delivery, and what happens when a contact objects. A vendor that cannot describe its suppression flow in plain language is leaving the liability with you.

Also ask whether the same record can be sold to your competitor on the same day. It usually can, which is not a compliance issue but is worth knowing. Our approach to sourcing and screening is described on the data quality page.