Debt Collection Compliance Guide 2025: FDCPA, TCPA, and State Laws

🔑 Key Takeaways:

  • New CFPB Rules - Regulation F (2021) significantly expanded digital communication restrictions
  • Strict Call Limits - Max 7 attempts per week per debt, no more than 1 per day (FDCPA)
  • TCPA Consent Required - Must have express written consent for autodialed/prerecorded calls to cell phones
  • High Violation Costs - FDCPA fines up to $1,000 per violation, TCPA up to $1,500, class actions devastating

Debt collection is the most heavily regulated industry in consumer finance. One compliance mistake—calling too frequently, leaving wrong voicemail, texting without consent—can trigger $1,000-1,500 fines per violation, plus attorney fees, plus potential class action lawsuits that bankrupt collection agencies.

In 2025, debt collectors must navigate FDCPA (Fair Debt Collection Practices Act), TCPA (Telephone Consumer Protection Act), CFPB Regulation F, state-specific laws, and constantly evolving court interpretations. This guide covers federal laws, state variations, and practical compliance strategies.

Federal Laws Governing Debt Collection

Law What It Regulates Key Requirements Penalties
FDCPA (1977) Third-party debt collectors (not original creditors) Communication limits, prohibited practices, validation requirements Up to $1,000 per violation + attorney fees
TCPA (1991) Autodialed and prerecorded calls to cell phones Prior express written consent required for marketing; prior express consent for non-marketing $500-$1,500 per call/text, treble damages if willful
CFPB Reg F (2021) Clarifies FDCPA for modern communication Email/text rules, social media limits, 7-call-per-week limit, voicemail requirements Same as FDCPA ($1,000/violation)
FCRA (Fair Credit Reporting Act) Credit bureau reporting accuracy Accurate reporting, dispute procedures, 7-year reporting limit Actual damages + statutory damages up to $1,000
State Laws Varies by state (licensing, call times, practices) Often stricter than federal (some states ban Sundays, limit interest, require bonds) Varies by state—can exceed federal penalties

FDCPA Core Compliance Requirements

Who FDCPA Covers

Covered: Third-party debt collectors, collection agencies, debt buyers, attorneys collecting debts

NOT Covered: Original creditors collecting their own debts (banks, credit card companies collecting their own accounts)

Important: If original creditor uses different name that implies third party, FDCPA may apply. Courts increasingly expanding who counts as "debt collector."

Communication Frequency Limits (Regulation F - 2021)

7-Call Limit Per Week (Per Debt):

  • Maximum 7 attempts per phone number per debt per 7-day period
  • Counts reset after conversation with consumer (not just leaving voicemail)
  • Only 1 call per day to specific number
  • Calls to different phone numbers count separately but still max 7 total per week

Example: Monday you call consumer's cell (no answer), Tuesday call their cell again (no answer). You CANNOT call cell again Tuesday—must wait until Wednesday. After 7 attempts across Mon-Sun with no conversation, you must wait 7 days before next attempt.

Exception: After you speak with consumer, 7-call counter resets. Can start fresh 7-call cycle.

Permitted Calling Hours

Federal (FDCPA): 8:00 AM - 9:00 PM in consumer's time zone (not yours)

Consumer's local time: If consumer in California (Pacific) and you're in New York (Eastern), can only call 8am-9pm Pacific time

State variations: Some states more restrictive (e.g., no Sunday calls, earlier end times). Follow most restrictive law.

Voicemail Requirements (Regulation F)

Safe Harbor Voicemail: Must include these exact elements:

  1. Debt collector's name (your name or company name)
  2. Request for consumer to call back
  3. Phone number for call back
  4. NO other information (don't mention debt, amount, creditor name)

Compliant voicemail script:

"This is John Smith from Allied Recovery Services. Please call me back at 555-123-4567. Again that's 555-123-4567. Thank you."

NEVER say in voicemail:

  • "This is about a debt" (third-party disclosure violation)
  • "Call me about your Visa account" (identifies debt)
  • "This is urgent/important legal matter" (false urgency)
  • "Call immediately or face consequences" (harassment)

Prohibited Practices (FDCPA Section 806-808)

  • Harassment/abuse: Threats of violence, profanity, repeated calls to annoy
  • False statements: Claiming to be attorney/police, false lawsuit threats, wrong amount owed
  • Unfair practices: Collecting more than owed, contacting consumer at work after told not to, post-dating checks
  • Third-party disclosure: Telling anyone except consumer/spouse/attorney about debt
  • Communication after cease letter: If consumer sends written "cease contact" letter, can only communicate to confirm cessation or notify of legal action
  • Contacting represented consumer: If consumer has attorney, must contact attorney (not consumer directly)

TCPA Compliance for Debt Collection Calls

When TCPA Applies to Debt Collection

TCPA applies when:

  • Calling cell phones using autodialer (predictive dialer, power dialer)
  • Leaving prerecorded/artificial voice messages on cell phones
  • Sending SMS texts to cell phones

Consent requirement:

  • Collection calls: "Prior express consent" required (can be oral or written, often obtained when consumer gave phone number to creditor)
  • Marketing/sales calls: "Prior express written consent" required (must have signature)

Debt collection context: If calling about existing debt, courts generally treat as non-marketing (prior express consent sufficient). However, if offering debt settlement products/services, may be marketing (written consent needed).

Safest approach: Get written consent when possible. When using autodialer/prerecorded messages, ensure creditor obtained consumer's cell number voluntarily (provided on application, contract, etc.) = implied consent.

TCPA "Do Not Call" Rules

If consumer says "don't call me" or "remove me from your list":

  • Must stop calling that number immediately
  • Add to internal do-not-call list
  • Cannot call for at least 30 days
  • Document revocation in case file

Note: TCPA revocation applies to that specific phone number. If consumer has multiple numbers and only revokes one, can still call others (but FDCPA 7-call limit applies across all numbers).

TCPA Penalties (Why This Matters)

  • $500 per violation (each call/text is separate violation)
  • $1,500 per willful violation (if you knew or should have known)
  • Class actions: 100 consumers Ă— $1,500 each = $150,000 minimum exposure
  • No cap on damages: Unlike FDCPA ($1,000 max per case), TCPA damages multiply with every call

Real example: Collection agency called 229 consumers using auto dialer without consent. Settled for $2.2 million ($9,600 per consumer average).

Digital Communication Rules (Email, Text, Social Media)

Email Collection Communications (Regulation F)

Requirements for debt collection emails:

  • Subject line cannot be deceptive or false urgency
  • Must include opt-out mechanism (unsubscribe link or reply "STOP")
  • Honor opt-out within 10 business days
  • Cannot send more than 1 email per day to consumer

Email Frequency Limit: Regulation F doesn't set specific weekly email limit (unlike 7-call phone limit), but general "harassment" provisions still apply. Best practice: 2-3 emails per week maximum.

Validation notice: First email must include validation notice (amount owed, creditor name, consumer rights to dispute). Can be PDF attachment.

Text Message Collection (SMS)

TCPA applies fully to collection texts:

  • Need prior express consent (consumer gave cell number to creditor)
  • Must provide opt-out in every text: "Reply STOP to opt out"
  • Honor STOP requests immediately
  • Character limits make validation notice difficult—link to web page with details

Compliant collection text:

"This is Allied Recovery about your $1,245 Visa account. Call 555-1234 to discuss payment options. Reply STOP to opt out. [link to validation notice]"

Social Media (Regulation F Restrictions)

Heavily restricted—easy to violate:

Prohibited:

  • Public posts on consumer's Facebook/social media (third-party disclosure)
  • Friend requests from collection agency accounts (harassment)
  • Comments on consumer's posts mentioning debt

Permitted (with extreme caution):

  • Private messages IF consumer previously consented to social media contact
  • Even private messages risky—"friend" seeing message notification = possible third-party disclosure

Best practice: Avoid social media for debt collection entirely unless consumer explicitly requests it. Risk too high, benefit too low.

State-Specific Variations (High-Risk States)

State Additional Restrictions
California Rosenthal Act applies FDCPA to original creditors. Cannot call before 8am or after 9pm. Recording must announce if recording call.
New York Must be licensed. Cannot contact consumer at work. 3-day written validation notice required before first call.
Florida Must be licensed ($2,000-5,000 bond). Cannot simulate legal process. Specific regulations on skip tracing.
Texas Must be licensed. Cannot threaten criminal prosecution. Restrictions on post-dated checks.
North Carolina 25+ state-specific prohibited practices beyond FDCPA. Permit required ($50k bond). No Sunday calls.

Key point: When federal and state law conflict, follow stricter law. Many states have "mini-FDCPAs" that exceed federal requirements.

Validation Notice Requirements

Must provide within 5 days of first communication:

Required information:

  1. Amount of debt
  2. Name of creditor owed
  3. Statement consumer has 30 days to dispute debt in writing
  4. If consumer disputes within 30 days, collector will obtain verification and mail to consumer
  5. If consumer requests in writing within 30 days, collector will provide name/address of original creditor (if different)

Regulation F addition (2021): Validation notice must also include:

  • Itemization of debt (principal, interest, fees)
  • Information about consumer's rights
  • How to respond or dispute

Format: Can be written letter, email (if consumer consented to email), or link in text message to web page with validation notice. Use CFPB model validation notice (safe harbor).

Compliant Debt Collection Communication

RoboTalker helps debt collectors maintain FDCPA and TCPA compliance with automated tracking of call frequency, time restrictions, and do-not-call lists.

  • ✔️ Automatic 7-call-per-week limit enforcement
  • ✔️ Time zone detection (8am-9pm consumer's local time)
  • ✔️ Do-not-call list integration
  • ✔️ Also improve recovery rates with multi-channel strategy
Start Free Trial →

Frequently Asked Questions

Technically yes, but extremely risky. Problems: (1) Your personal number will be saved in consumer's phone—they may call you at all hours or harass you, (2) Harder to track/document calls for compliance, (3) If consumer files complaint, your personal number is in record. Best practice: Use company phone system that records calls, tracks frequency automatically, and protects collector identity. If must use cell, use Google Voice or similar business number that forwards to cell. Never give personal cell number to consumers.

Must honor request. FDCPA allows consumer to specify how/when they want contact. If consumer says "only mail," cannot call or text. Document request in writing, update account notes, inform all collectors. Can still send written correspondence (letters) unless consumer sends formal "cease communication" letter under FDCPA Section 805(c)—then can only mail to confirm cessation or notify of specific legal action (lawsuit filing). Violation = $1,000 penalty + attorney fees. Many collectors appreciate mail-only consumers—cheaper than calls and less harassment risk.

Maybe. FDCPA Section 805(a)(2): If consumer has attorney representing them regarding debt AND you know attorney's name/contact, must communicate with attorney (not consumer). Ask consumer: "What is your attorney's name and contact information?" If they provide it, update account, contact attorney only. If consumer says "I'm going to get an attorney" or "I might hire one" but hasn't yet, can continue contacting consumer. Once you have attorney's actual contact info and confirmation they represent consumer on this debt, all contact shifts to attorney. Document conversation where consumer claimed representation.

Yes, UNLESS: (1) Consumer tells you employer prohibits personal calls, (2) Consumer asks you not to call at work, or (3) You know employer prohibits such calls. First call to workplace: If someone other than consumer answers, can only identify yourself and ask for consumer—cannot mention debt (third-party disclosure). If consumer says "don't call me at work," must honor immediately. Document in account. Many collectors avoid workplace calls unless consumer unreachable elsewhere—high risk of third-party disclosure and harassment claims. If you call workplace and co-worker overhears conversation about debt, potential violation.

Yes, but must comply with federal and state wiretapping laws. Federal law (one-party consent): Legal to record if one party consents—debt collector can record without consumer consent. However, 11 states require two-party/all-party consent (California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, Washington). In these states, must announce "this call is being recorded" or get verbal consent before recording. Best practice: Always announce recording at beginning of call: "This call may be monitored or recorded for quality assurance." Protects you legally and as evidence if consumer later claims harassment. Many FDCPA defenses rely on call recordings proving collector acted appropriately.

Compliance Checklist for Debt Collectors

  • âś… Track 7-call-per-week limit per phone number per debt (automatic enforcement)
  • âś… Only call 8am-9pm in consumer's local time zone
  • âś… Compliant voicemails (name, callback number, nothing about debt)
  • âś… Validation notice sent within 5 days of first communication
  • âś… Honor cease communication letters (stop all contact except legal notices)
  • âś… Maintain do-not-call list (internal + National DNC Registry)
  • âś… Get written consent before autodialing cell phones (TCPA compliance)
  • âś… Document all consumer requests (don't call work, don't call at all, mail only, etc.)
  • âś… Train collectors on FDCPA prohibited practices (no threats, false statements, harassment)
  • âś… Record calls (in compliant states) for evidence/training
  • âś… Check state-specific laws for each consumer's state
  • âś… Review compliance quarterly with legal counsel

Debt collection compliance isn't optional—it's survival. FDCPA violations cost $1,000 per incident plus attorney fees. TCPA violations cost $500-1,500 per call and multiply into class actions. One collector making 200 illegal autodial calls = $100,000-300,000 liability. Compliance protects your business, your collectors, and ironically improves recovery rates—consumers more likely to pay collectors who treat them respectfully and legally. Invest in compliance systems, training, and legal review. Cost of compliance is tiny compared to cost of violations.

Related Articles