Cold calling compliance: what TCPA and GDPR mean for B2B mobile numbers

What the TCPA actually restricts

The TCPA restricts automated dialing systems, prerecorded voice and artificial voice to US mobile numbers without prior express consent. A human dialling a business contact is not the target of the law.

The Telephone Consumer Protection Act is a 1991 US law aimed at robocalls. Its sharpest teeth apply to three things directed at mobile numbers: automatic telephone dialing systems, prerecorded voice messages and artificial voice. Using any of those to call or text a mobile without prior express consent carries statutory damages per call, which is why class action lawyers watch this space.

Ordinary B2B cold calling, where a rep selects a number and dials it, sits outside the high risk zone. Texting platforms and autodialers are where exposure concentrates. The national do not call registry is aimed at residential consumers, so calls to business lines and business mobiles are generally outside it, but several states run their own rules on calling hours, registration and mini TCPA statutes that cover more technology.

• Dial manually or with click to dial rather than an autodialer when calling US mobiles.
• Never send prerecorded or AI voice messages to a mobile without prior express consent.
• Treat text messages as calls under the TCPA, because the law does.
• Keep an internal do not call list and honour it permanently, across every campaign.
• Check state level rules for the states you dial most, especially Florida and Oklahoma.

How GDPR applies to a business mobile number

GDPR treats a business mobile number as personal data because it identifies a person. Processing it for outreach needs a lawful basis, most often legitimate interest, supported by a balancing test and a fast opt-out.

GDPR does not distinguish between a personal mobile and a mobile someone uses for work. If the number reaches an identifiable person, it is personal data and the regulation applies in full. The same is true of a work email that contains a name.

Most B2B outreach runs on legitimate interest. That is a genuine legal basis, but it is not a formality. You must be able to show three things: a real business reason for the contact, that the processing is necessary for it, and that the person's rights do not override your interest. A relevant offer to a carefully matched professional passes that test far more comfortably than a bulk blast, which is one more reason tight ICP screening matters.

Transparency is the other half. The person is entitled to know where their data came from and why you hold it, and your privacy notice must say so. When someone objects, you stop, and you keep proof that you stopped.

• Document a legitimate interest assessment before a European campaign, and refresh it when targeting changes.
• Only collect fields you actually use. GDPR calls this data minimisation.
• Tell prospects in the first touch where you got their details.
• Action objections immediately and keep the suppression record.
• Keep data current. Holding stale records is itself a compliance weakness.

The ePrivacy layer that decides if you may call at all

Alongside GDPR, each European country has ePrivacy rules that govern unsolicited calls and emails. Some countries allow B2B calls with an opt-out, others expect opt-in for email, and most run do not call registries you must screen against.

GDPR governs how you handle the data. The ePrivacy rules, implemented country by country, govern whether you may make the approach. Germany is the strictest large market: unsolicited B2B email effectively requires prior consent, and cold calls to businesses rely on presumed consent, which courts read narrowly. France allows B2B email on an opt-out basis when the offer matches the recipient's role. Ireland, the Netherlands and the Nordics each run their own blend, and most maintain a do not call register that businesses can join.

The practical routine is to pick the countries you will actually sell into, record the calling and emailing position for each, and screen every list against that country's registry before the first dial. Our country pages note the calling rules and registries market by market.

Habits that keep a programme clean in every market

Screen before dialling, identify yourself on every call, honour opt-outs instantly and forever, and keep records of all three. These four habits satisfy the core of every regime.

Every regime above reduces to the same operational discipline. Screening removes people who have asked not to be called. Identification removes the deception complaint that starts most investigations. Instant suppression turns an objection into proof of good practice rather than a second complaint. Records turn your word into evidence.

This is also how we run the data side. Suppression requests flow into a single list applied to every future batch, wrong or stale records are replaced rather than argued about, and the opt-out page is linked from every list email we send.

• Screen new lists against the relevant do not call registries before the first dial.
• State your name, company and reason for calling in the first sentence.
• Log every opt-out with a date and apply it across all campaigns permanently.
• Keep a short written note of your lawful basis and targeting logic for each market.