Federal TCPA Is Loosening. State AGs Are Tightening. Operators, Pay Attention.

While the FCC is busy proposing to roll back federal telemarketing rules, state attorneys general are heading the opposite direction. The state-level TCPA and DNC enforcement environment in 2026 is meaningfully more aggressive than it was even a year ago, and operators running national outbound programs need to update their compliance map.

Three signals to know

New York raised the per-violation ceiling to $20,000. The state’s maximum fine for violations of its Do-Not-Call list is now $20,000 per call. For a moderate-volume violation, that math is brutal — a single misfired campaign of 1,000 calls into New York can theoretically support a $20 million state-level penalty in addition to whatever federal TCPA damages a private plaintiff might pursue.

Mississippi shifted DNC enforcement to the AG. H.B. 1225 transferred authority over the state’s No-Call program to the Mississippi Attorney General’s office, materially increasing both the resourcing and the political incentive behind state-level enforcement. AG offices are structurally better suited than agency-level staff to bring high-profile enforcement actions, and Mississippi is now positioned to do exactly that.

The 51-AG anti-robocall task force is active. All 50 state attorneys general plus the District of Columbia AG have organized into the Anti-Robocall Litigation Task Force, sharing information, coordinating on multistate enforcement, and developing joint litigation strategy. That coordination materially raises the ceiling on what state-level enforcement can do — multistate actions with the leverage of federal-class enforcement, but with state-law theories of liability.

The strategic shift

For most of TCPA history, the federal layer was the binding constraint. State rules existed but were enforced lightly; the action was in private litigation under the federal statute. That picture is flipping. The federal rulebook is loosening as the FCC proposes to scrap revoke-all, abandon-rate caps, company-specific DNC requirements, and prescriptive callback rules. State AGs and state legislatures are stepping into that vacuum with stricter rules, higher penalty ceilings, and more aggressive enforcement.

The net effect for operators is a more fragmented compliance landscape. A national outbound program now faces a federal rulebook that’s getting simpler, plus a state-by-state patchwork that’s getting more complex. The compliance investment has to shift accordingly: less federal-rule monitoring, more state-rule monitoring; less reliance on FCC guidance, more reliance on AG enforcement signaling.

What operators should be doing

Three operational priorities for the next two quarters:

Build state-level rules into your dialer logic. If your platform treats TCPA compliance as a single set of rules applied uniformly across all dials, you have a structural problem. The rules around quiet hours, consent, DNC scope, and registration vary by state and are increasingly diverging. Your dialer needs to know the called party’s state, apply the state-specific rule, and log the decision for audit.

Track state DNC registrations separately. The federal DNC list is the floor, not the ceiling. There are now 14 states with active state-level DNC registries; some of them have content the federal list doesn’t. Suppression has to run against both layers.

Tune your monitoring for AG announcements. Subscribe to state AG press releases, monitor multistate task-force announcements, and tag your compliance dashboard for any enforcement signaling specific to your industry. By the time a state AG files an action, the operating environment has typically been telegraphed for weeks.

If you’re running an outbound calling or texting program, screening your lists against known TCPA litigators before you dial is one of the cheapest forms of insurance you can buy. TCPALitigatorList.com maintains a continuously updated database of plaintiffs who have already filed TCPA suits — feed it into your dialer’s suppression layer and skip the numbers that have a documented history of turning a single text into a five-figure demand letter.

The bigger picture

The federal-state compliance balance in TCPA is shifting in ways that will materially shape outbound operations through 2027. Operators who treat the federal rollback as an “all-clear” signal are setting themselves up for state-level enforcement surprise. The smarter posture is to view the federal layer as one of many sources of compliance obligation — and increasingly, not the most important one.

Sources: Searchbug 2026 state laws; Hollingsworth on state AG enforcement; Mac Murray Shuster.

The FCC Just Proposed the Biggest TCPA Rollback in a Decade. Here’s What’s on the Block.

The FCC’s pending Further Notice of Proposed Rulemaking is moving from quiet docket item to active industry conversation, and operators running outbound calling or texting programs need to be paying attention. The agency is proposing to gut, simplify, or modernize a half-dozen TCPA and Do-Not-Call rules that have shaped compliance practice for years.

The headline: revoke-all is on death row

The biggest single proposal is the elimination of the “revoke-all” rule, the provision that would have required callers to treat a single revocation of consent as applying to every communication channel and topic from that caller. The rule was originally scheduled to take effect April 11, 2026; the FCC delayed it to January 31, 2027 in January; the FNPRM now proposes to scrap it altogether.

For operators, this is a meaningful operational simplification. Under the current proposal, you’d be able to maintain channel- and topic-specific revocation lists rather than collapsing every opt-out into a single, all-or-nothing suppression flag. That means a customer who texts STOP to your shipping-update SMS doesn’t automatically lose access to your two-factor codes, account alerts, or marketing emails — unless they opt out of those channels separately.

The other proposals worth knowing about

Three other FNPRM provisions matter for day-to-day operations:

Goodbye, company-specific DNC requirement. The FCC proposes to eliminate the rule requiring callers to maintain their own internal Do-Not-Call lists, on the theory that the National DNC Registry plus standard consent-revocation handling already does the job. If finalized, this removes a piece of compliance plumbing that has been standard infrastructure for outbound operations since the early 2000s.

The 15-second/4-ring abandonment rule may also go. Currently, telemarketers can’t “abandon” calls before 15 seconds or four rings. The FNPRM proposes to eliminate the rule entirely, which would relieve dialer-pacing constraints that predictive-dialer operators have spent years optimizing around.

Modernized callback requirements. Instead of a static, prescriptive callback-number rule, the FCC proposes a functional standard: callers must provide a working number that identifies them and accepts opt-out requests. That’s a more flexible standard that aligns better with modern voice-AI and IVR routing.

Reading between the lines

The FNPRM is part of a broader posture shift at the FCC under current leadership: less emphasis on prescriptive consumer-protection mandates, more emphasis on letting the market and litigation police bad actors. That posture is also why we’re seeing the agency walk back the revoke-all rule rather than enforce it — the political appetite for piling more compliance burden on legitimate callers has dimmed.

That doesn’t mean enforcement is going away. State attorneys general have organized into a 51-AG anti-robocall task force, and courts continue to issue plaintiff-favorable rulings in many jurisdictions. The likely net effect of the FNPRM is a federal rulebook that’s lighter and clearer, but a state-level enforcement landscape that gets more aggressive to compensate.

What to do now

The FNPRM isn’t final. There’s a public comment window after Federal Register publication, then a final rule, then any litigation challenges. The earliest you’d see real changes in your compliance program is late 2026, more likely 2027.

That said, three things are worth doing in the interim. First, file or join an industry comment if your business has a position on any of these rules — the agency genuinely reads them. Second, don’t dismantle your revoke-all preparation work yet; the rule could still survive in modified form, and being ready costs less than retrofitting under deadline pressure. Third, keep your channel- and topic-level revocation infrastructure in good repair regardless — it’s still best practice and will outlast any particular regulatory outcome.

If you’re running an outbound calling or texting program, screening your lists against known TCPA litigators before you dial is one of the cheapest forms of insurance you can buy. TCPALitigatorList.com maintains a continuously updated database of plaintiffs who have already filed TCPA suits — feed it into your dialer’s suppression layer and skip the numbers that have a documented history of turning a single text into a five-figure demand letter.

Sources: Privacy World; Blacklist Alliance.