TCPA + STIR/SHAKEN Compliance for Auto Dialers (USA 2026)

Direct answer: US outbound sales teams in 2026 face four hard rules: (1) the FCC's 1:1 consent rule — every contact must consent to each individual seller, not a generic lead form; (2) STIR/SHAKEN Level A attestation is now table stakes — Level B or C calls are silently labelled "Spam Likely" by carriers; (3) National DNC scrubs must be no older than 31 days; (4) state DNC registries in California, Texas, Florida, and 9 other states must also be checked. Penalties: $500–$1,500 per call, no per-campaign cap. A solo agent making 200 non-compliant calls can owe $100,000+ in statutory damages.

This guide explains every rule with citations, shows where VOIP dialers (PhoneBurner, Kixie, Mojo, Aircall) sit on the compliance spectrum, and explains why a SIM-native mobile dialer like DialMaster changes the math for individual agents and small teams.

Why 2026 Is the Most Dangerous Year Ever for US Outbound Sales

TCPA litigation is the most under-discussed business risk in US sales. The numbers tell the story: 2,628 TCPA cases filed in 2025 — up 60% year over year. Early 2026 filings are running 26.8% ahead of that pace. Plaintiff law firms have industrialized TCPA litigation; a single non-compliant campaign can trigger class-action damages that wipe out a year of revenue.

Three regulatory changes that took effect over 2024–2026 dramatically raised the stakes:

1. The 1:1 Consent Rule (effective Jan 2025). The FCC closed the "lead generator loophole" — a single consent form on a comparison-shopping website can no longer cover calls from multiple sellers. Every individual seller now needs its own express written consent.
2. STIR/SHAKEN Attestation Enforcement (carriers, 2024+). Originating carriers must sign every outbound call with attestation Level A, B, or C. Calls without Level A are increasingly auto-labelled "Spam Likely" or blocked entirely.
3. AI-Voice Reclassification (Feb 2024 FCC ruling). AI-generated voice calls are now legally "artificial or prerecorded" under TCPA — same consent rules as old-school robocalls.

The Four Pillars of TCPA Compliance in 2026

Pillar 1 — 1:1 Express Written Consent

Every contact you call must have a signed consent record naming your specific company, the topics permitted, and the phone number consented for. Generic disclosures like "I agree to be contacted by partners" no longer satisfy the FCC's standard.

Each contact in your dialer queue should have a linked consent record containing:

• Your company's full legal name
• The date and time consent was given
• The specific topic(s) of calls permitted
• The phone number(s) the consumer agreed to receive calls at
• The source URL where consent was captured
• The IP address of the consenting party

Pillar 2 — National + State DNC Scrubbing

The National Do Not Call Registry must be scrubbed within 31 days of every campaign. State registries in California, Texas, Florida, Indiana, Louisiana, Massachusetts, Missouri, North Dakota, Oklahoma, Pennsylvania, Tennessee, and Wyoming must be checked separately.

For solo agents and small teams, a tool like the National DNC Scrubber ($0.005 per scrub) integrated into your CRM is the baseline. Anyone running outbound without DNC scrubbing in 2026 is one complaint away from a 6-figure judgment.

Pillar 3 — STIR/SHAKEN Level A Attestation

STIR/SHAKEN is a carrier-level authentication framework that proves your caller ID isn't spoofed. Calls are signed with three attestation levels:

Here's the catch most VOIP dialer reviews miss: VOIP DIDs from Twilio, Bandwidth, Vonage, and similar carriers often receive Level B attestation by default, because the originating carrier (the VOIP provider) cannot verify the actual person making the call. This is why PhoneBurner, Kixie, and similar tools see steadily declining answer rates in 2025–2026 — carrier filtering is getting more aggressive.

A call placed from your real T-Mobile, Verizon, or AT&T cellular SIM, by contrast, gets Level A attestation automatically — because the carrier knows the caller AND the number. This is the structural advantage of mobile-first dialers like DialMaster.

Pillar 4 — Real-Time Consent Revocation

If a contact asks to be removed during a call, the system must pause future calls to that number immediately. The FCC accepts a 10-business-day grace period, but plaintiff lawyers love to find numbers that were called 11+ days after a revocation. Best practice: instant suppression.

TCPA Penalty Schedule (Per Call, Not Per Campaign)

State AGs in Illinois, Oregon, and Texas are particularly active. Note: there's no statute-of-limitations relief — a single complaint years later can trigger a class action.

Why VOIP Dialers Are Higher-Risk in 2026 (Even If You're Doing Nothing Wrong)

Even with perfect consent and DNC hygiene, VOIP-based dialers carry structural compliance risks SIM-native dialers don't:

• Attestation downgrade. VOIP carriers default to Level B attestation, increasing "Spam Likely" labelling.
• Number recycling. VOIP DIDs are pooled — a DID assigned to you today may have been used by a fraud operation last month. Carrier reputation scoring follows the number, not the owner.
• Complex consent chain. Plaintiff lawyers love arguing that the platform's intermediation muddles the consent record.
• STIR/SHAKEN cost. Premium SHAKEN A-list attestation services start at $500/month per number on top of dialer fees.

How DialMaster Solves This Structurally

DialMaster is built around the only architecture that gives small US sales teams real-SIM Level A attestation by default: your phone places calls directly through your cellular carrier's network. The benefits stack:

• Level A attestation automatic — Verizon, T-Mobile, AT&T, and other carriers sign your calls with full attestation.
• Your number, your reputation — no shared VOIP DID pools with carrier reputation scoring problems.
• Direct consent chain — you're the regulated entity; no intermediary platform muddying the record.
• On-device DNC list — import your scrubbed contact list into DialMaster; the app respects an in-app DND/DNC tag globally.
• Consent record tagging — every imported contact carries a consent metadata field (source URL, timestamp, topic).
• Built-in instant revocation — one-tap "Mark DNC" permanently removes the contact from all future queues with audit log.
• Free Forever plan — 100 free daily compliant calls, no credit card.

The TCPA Compliance Checklist (US Solo Agents and SMB Sales Teams)

1. Audit your lead capture forms. Replace generic "agree to be contacted" with 1:1 consent naming your company specifically.
2. Subscribe to the National DNC Scrubber. Run lists every 31 days minimum.
3. Subscribe to all 12 state DNC registries (or use an aggregator like Possible Now / Compliance Point).
4. Verify your originating carrier provides Level A STIR/SHAKEN attestation. If on VOIP, request the certification letter.
5. Store consent records for at least 5 years. Tag each record with company name, date, topic, source URL, IP.
6. Set up instant revocation workflow. When a contact asks to be removed, suppress within 24 hours.
7. Adopt a SIM-native mobile dialer for outbound. Download DialMaster free.
8. Run a quarterly compliance audit. Pull 50 random calls, verify each has consent and DNC scrub timestamps.
9. Get TCPA insurance. Coverage starts ~$2,500/year for small teams.
10. Train every rep on instant-revocation language and recording protocol.

Frequently Asked Questions

Is an auto dialer legal in the United States in 2026?

Yes, auto dialers are legal under TCPA when you have express written consent for each contact, scrub against the National DNC Registry (and applicable state registries), use Level A STIR/SHAKEN attestation, and honor revocation requests promptly.

What is the 1:1 consent rule and when did it take effect?

The 1:1 consent rule, codified by FCC in 2024 and enforced from January 2025, requires that consumer consent be specific to each individual seller — generic lead-form disclosures covering "partners" or "marketing affiliates" no longer satisfy TCPA. Each seller needs their own named consent.

Does STIR/SHAKEN affect my mobile dialer calls?

Calls placed from your real cellular carrier (Verizon, T-Mobile, AT&T, etc.) receive Level A attestation automatically — the highest level, which avoids "Spam Likely" labels. VOIP dialers typically receive Level B at best, which carriers increasingly flag.

How much can a TCPA lawsuit cost a small sales business?

Statutory damages are $500 per call for negligent violations, $1,500 per call for willful violations, with no per-campaign cap. A class action over 200 non-compliant calls to 10,000 class members can result in $5,000,000+ judgments. Plaintiff lawyers actively prospect for these cases.

Does DialMaster work in the United States?

Yes. DialMaster is Android-native and works with US cellular SIMs from Verizon, T-Mobile, AT&T, Mint, Visible, US Mobile, and any other US carrier. The Free Forever plan covers 100 free daily calls anywhere with cell coverage.

Lower Risk. Lower Cost. Higher Connect Rates.

If you're a solo real estate agent, mortgage broker, insurance agent, or solar sales rep in the US, the math has flipped: paying $140/month for PhoneBurner or $214 for Mojo, while still carrying Level B attestation risk, no longer makes sense. Download DialMaster free and run your next 50 calls through your own cellular SIM. Compare your connect rates — the difference is structural, not marketing copy.

Related reading: PhoneBurner / Mojo / Kixie Alternative · Solar & Mortgage Mobile Dialer · TCPA Compliance Hub