Speed is the promise. Compliance is the substance.

Every contact record represents a real person. The laws covered here exist to protect those people from unwanted calls, deceptive email and uses of their information they didn't expect. They also protect your business: complaints, carrier blocking, deliverability problems and legal claims tend to follow programs that ignore them.

A useful way to think about it is that compliance attaches to the use, not just the data. The same phone number might be fine to mail a postcard to, risky to call manually without checking Do Not Call lists, and off-limits for an automated marketing text without the right written consent. Before any campaign, ask three questions:

1. Which channel? Postal mail, email, phone calls and text messages are each governed differently.
2. What permission exists? Consent, an existing relationship, an opt-in, or none at all — and who it was given to.
3. Where are the people? State and national laws turn on where the recipient lives, not where you are.

As a buyer, you are responsible for using data lawfully. Licensing data from anyone — including us — does not transfer consent, and it doesn't exempt you from any of the rules below.

The table below summarizes the rules most likely to affect a contact data program. Each is explained in more detail further down the page.

The Telephone Consumer Protection Act (TCPA) is the core federal law for telephone outreach. It is enforced by federal regulators and also gives individuals the right to sue, which is why it generates a great deal of litigation. Text messages are generally treated as calls under the TCPA.

Autodialers and prerecorded voice

The TCPA places its strictest limits on calls made with an automatic telephone dialing system (often called an autodialer) and on calls using an artificial or prerecorded voice. What counts as an autodialer has been heavily litigated, and some states have their own telemarketing laws that define automated systems more broadly than federal law. If you use any software that dials or sends texts at scale, treat consent as required and get specific legal advice about your platform.

Two levels of consent

• Prior express consent is generally required for non-marketing autodialed or prerecorded calls and texts to mobile numbers — for example, informational messages. Someone providing their number for a related purpose can, in some contexts, amount to this kind of consent.
• Prior express written consent is generally required for marketing calls and texts made with an autodialer or a prerecorded or artificial voice. It is a signed agreement (electronic signatures can qualify) that clearly authorizes the specific seller to deliver marketing messages to a specific number, with a disclosure that consent is not a condition of purchase.

Consent is personal to whoever obtained it. Consent given to one company generally doesn't authorize a different company to call or text, which is why a purchased phone list on its own is not a basis for automated marketing calls or texts.

Other TCPA obligations

• Calling hours. Federal rules restrict telephone solicitations to between 8 a.m. and 9 p.m. in the recipient's local time. Some states are stricter.
• Revocation. People can withdraw consent, and they don't have to use a particular phrase or method. Honor opt-outs — "stop," a verbal request, a reply email — promptly and across channels.
• Identification. Telemarketers must identify themselves and the business they're calling for, and transmit accurate caller ID information.
• Reassigned numbers. Mobile numbers change hands. Consent from a previous owner of a number doesn't carry over, which is one reason phone hygiene matters.

The National Do Not Call Registry, managed by the Federal Trade Commission, lets people register phone numbers to signal that they don't want telemarketing calls. Federal rules under both the TCPA and the FTC's Telemarketing Sales Rule restrict sales calls to registered numbers, with narrow exceptions — such as an established business relationship or the recipient's written permission to call.

What telemarketers generally have to do

• Access the national registry and remove registered numbers before calling, refreshing on the schedule the rules require.
• Check the do-not-call lists that some states maintain separately, along with their own rules on timing and exemptions.
• Maintain an internal do-not-call list of people who've asked your company specifically not to call, and honor it regardless of registry status.
• Have a written do-not-call policy and train the people and vendors who call on your behalf.

B2B numbers aren't a free pass

The registry is aimed at consumer numbers, and business-to-business calls are treated differently under parts of the rules. But direct dials and mobile numbers in B2B records are often personal phones, and state rules differ. Scrubbing B2B calling lists against DNC lists is a sensible default.

Scrubbing only works if it's current, because registrations change constantly. Our data hygiene guide explains phone type identification and DNC scrubbing in more detail.

The CAN-SPAM Act sets the federal baseline for commercial email in the US. It applies to messages whose primary purpose is advertising or promoting a product or service — and it applies to business-to-business email as well as email to consumers. It is an opt-out law: it doesn't require prior consent, but it does require the following.

• Accurate header information. "From," "To," "Reply-To" and routing details must accurately identify the sender.
• Honest subject lines. The subject must reflect the content of the message.
• Identification as an ad. The message must be clearly and conspicuously identified as an advertisement unless the recipient has given prior affirmative consent.
• A valid physical postal address. Every message must include the sender's valid physical postal address.
• A clear way to opt out. Recipients must be told how to stop receiving messages, and the mechanism must work.
• Prompt honoring of opt-outs. Opt-out requests must be honored promptly — the rule sets a deadline of ten business days — and you can't sell or transfer the addresses of people who opted out.
• Responsibility for vendors. If someone sends email on your behalf, both of you can be responsible for compliance.

Beyond the legal minimum

Legal and deliverable aren't the same thing. Mailbox providers judge senders by engagement, complaints and bounces, and cold sends to unvalidated lists damage sender reputation quickly. For email to consumers, our expectation is opt-in: send marketing email to people who agreed to receive it. For B2B outreach, validate addresses, keep volumes measured, personalize to a genuine business reason and make opting out effortless.

The US doesn't have a single national privacy law. Instead, a growing number of states have passed comprehensive consumer privacy laws that govern how businesses collect, use, sell and share their residents' personal information. Each law has its own applicability criteria, so whether one applies to a given business depends on factors like revenue, the volume of residents' data it handles and how much of its business involves selling data.

California: CCPA as amended by the CPRA

California's Consumer Privacy Act, expanded by the California Privacy Rights Act, is the most developed of these laws. Two terms matter most for data licensing:

• "Sale" covers making personal information available to another business for money or other valuable consideration — a broad definition that can capture many data exchanges.
• "Share" covers disclosing personal information for cross-context behavioral advertising, whether or not money changes hands.

California residents have rights that include the right to:

• Know what personal information a business collects about them and how it's used and disclosed;
• Delete personal information, subject to exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of their personal information; and
• Limit certain uses of sensitive personal information, without being discriminated against for exercising rights.

Businesses that sell or share personal information generally must give notice and offer a clear way to opt out, and must honor recognized browser-based opt-out preference signals. California's law also applies to information about people in their professional capacity, so B2B contact data is in scope.

Other states

Several other states — including Virginia, Colorado, Connecticut, Texas and Oregon, among others — have comprehensive privacy laws built on similar ideas: notice, rights to access and delete, and rights to opt out of the sale of personal data and of targeted advertising. Many require opt-in consent before processing sensitive data. Details differ meaningfully, including whether data about people acting in a business capacity is covered, so map your program state by state with counsel.

Some states regulate data brokers specifically — generally, businesses that collect and sell personal information about people with whom they don't have a direct relationship. California, Vermont, Texas and Oregon maintain data broker registries, and the businesses that meet each state's definition must register and provide certain information.

Definitions, exemptions and obligations vary from state to state. California's Delete Act, for example, provides for a centralized mechanism through which consumers can ask registered data brokers to delete their personal information. Other states' laws focus on registration, disclosures and security.

For buyers and data owners, these laws are worth understanding for a few reasons:

• They signal a broader regulatory direction toward transparency about where data comes from and who holds it.
• Deletion and opt-out requests increasingly flow through to downstream users, so licensed data needs a way to receive updates and suppressions.
• A data owner that begins licensing data about people it has no direct relationship with may itself need to consider whether these laws apply.

If your program involves people outside the United States, different — and often stricter — rules apply. Two come up most often.

GDPR (European Union) and similar laws

The General Data Protection Regulation applies to personal data of people in the EU and can reach businesses outside it. It requires a lawful basis for processing (consent is one of several), transparency about how data is used, data minimization, respect for individuals' rights — including access, deletion and objection to direct marketing — and safeguards for international transfers. Separate electronic marketing rules generally require consent for marketing email and texts to individuals. The UK has its own closely related regime.

CASL (Canada)

Canada's Anti-Spam Legislation governs commercial electronic messages, including email and text. Unlike CAN-SPAM, it is consent-based: you generally need express or implied consent before sending, and every message must identify the sender, include contact information and offer a working unsubscribe mechanism. Canada's federal and provincial privacy laws also govern the collection and disclosure of personal information.

Contact and demographic data licensed for marketing must not be used to decide whether someone qualifies for credit, insurance, employment, housing or similar benefits. Those decisions are governed by consumer reporting laws that impose strict requirements on accuracy, disclosure and dispute rights. Marketing data is not built, sourced or licensed for that purpose.

The same principle shapes how we handle requests generally: we ask what you intend to do with the data, and the stated purpose determines what we can provide.

Buyers are responsible for using data lawfully. Before we deliver data, we expect a clear, permissible purpose, and our license terms reflect these expectations:

If a request depends on getting around consent, Do Not Call or privacy rules, we'll decline it. That's not a judgment about you — it's how we keep the data, and everyone who uses it, on solid ground.

We don't claim certifications or blanket compliance — no data provider can honestly guarantee that a buyer's use will be lawful. What we can describe is how we work:

• We ask about purpose first. Every request starts with what you're trying to do, and the answer shapes what we scope.
• We review provenance. For data owners, we review how data was collected and what people were told before taking anything to market.
• We don't offer sensitive data. No health data, precise geolocation, children's data or financial account data.
• We suppress opt-outs we receive. Requests to opt out or delete are honored and applied to future deliveries.
• We offer hygiene alongside data. Phone type identification, DNC scrubbing, email validation and postal standardization help buyers start from a cleaner, lower-risk list.
• We provide only what's needed. Fields are scoped to your purpose rather than delivered by default.
• We transfer data securely. Deliveries use secure transfer methods rather than open attachments.

Have a question about your own data or a specific use case? Use our contact page — we'd rather talk it through before a campaign than after.