Your Complete Phone Banking Compliance Guide for the US, EU, and Canada

One wrong call or text can put your campaign at risk.

A phone banking compliance mistake can lead to complaints, blocked numbers, spam labels, lawsuits, or fines. It can also damage supporter trust, which is often harder to rebuild than the campaign list itself.

In 2023, the FCC issued a record $299 million fine for an illegal robocall scheme. In 2024, the FCC finalized a $6 million fine against a political consultant who used AI-generated robocalls that mimicked President Joe Biden’s voice.

The lesson is clear: phone banking compliance is not just a legal detail. It protects your campaign, your volunteers, your supporters, and your ability to reach people when it matters.

This guide covers the major rules campaigns need to understand in the US, EU, and Canada, including TCPA, GDPR, CASL, political calling rules, AI voice rules, calling hours, consent, opt-outs, caller ID, DNC lists, and compliance tools.

This is not legal advice. Use it as a campaign planning guide, then confirm the details with counsel or your compliance lead before launching calls or texts.

Phone banking compliance at a glance

Before we go deeper, here is the practical version.

The safest campaign workflow is simple:

1. Collect consent clearly.
2. Store consent records.
3. Use the right dialer for the right list.
4. Identify the campaign at the start of the call.
5. Honor opt-outs immediately.
6. Keep internal do-not-call lists updated.
7. Call only during allowed local hours.
8. Review state, country, and carrier-specific rules.
9. Test your calling setup before launch.
10. Keep a record of what happened.

Why does phone banking compliance matter for campaigns?

Phone banking often involves sensitive supporter and voter data: names, phone numbers, addresses, donation history, issue preferences, volunteer status, and sometimes employment or membership information.

If that data is mishandled, it can expose supporters to fraud, phishing, harassment, or unwanted outreach. If your calling program ignores consent, opt-outs, or calling rules, your campaign can also face fines, lawsuits, blocked numbers, and reputational damage.

Here is why compliance matters.

Legal and financial protection

Compliance is not optional.

In the US, TCPA violations can carry statutory damages of $500 to $1,500 per call or text, depending on the violation. In 2023, a political phone banking vendor was fined $5.1 million for robocalls tied to voter suppression.

That is why campaigns need to review calling methods, consent, opt-outs, caller ID, scripts, and suppression lists before dialing.

Reputation and trust

People support campaigns they trust.

If your campaign ignores opt-outs, calls too frequently, uses misleading caller ID, or fails to explain why someone is being contacted, supporters may mark your numbers as spam or stop engaging entirely.

Compliance is part of relationship-building.

Deliverability and pickup rates

Compliance also affects whether your calls get through.

Pew Research Center found that eight-in-ten Americans do not generally answer calls from unknown numbers. If your caller ID reputation is weak or your numbers are flagged as spam, your campaign may lose contact before a volunteer even says hello.

Good compliance habits help protect caller ID reputation, reduce spam complaints, and keep your numbers usable.

Better campaign data

Compliance also makes your data cleaner.

When volunteers correctly mark wrong numbers, opt-outs, consent status, timezone, and preferred channels, the next campaign step becomes more accurate. Supporters receive the right follow-up. Opted-out contacts are suppressed. Volunteers waste less time calling the wrong people.

TCPA rules for phone banking: what campaigns must know

The Telephone Consumer Protection Act (TCPA) is the main US law that affects calls and texts. It is especially important for campaigns using dialers, prerecorded voice, artificial voice, SMS, or automated systems.

Start with the FCC’s rules for political campaign calls and texts and the FCC’s consumer guide on robocalls and texts. Then check state laws and your campaign’s own legal guidance.

Political calls and the national DNC registry

Political calls have special treatment under US rules, but they are not free from compliance.

The National Do Not Call Registry generally applies to telemarketing calls, not political calls that are not sales calls. That means a campaign call asking for a vote may be treated differently from a sales call.

But this does not mean political campaigns can ignore opt-outs.

Campaigns should still:

• Maintain internal do-not-call lists.
• Honor do-not-call requests immediately.
• Track opt-outs across calls and texts.
• Check state-level rules.
• Avoid misleading caller ID.
• Follow consent rules for autodialed, prerecorded, artificial voice, or text-based outreach.

Also remember that fundraising, donation asks, or mixed-purpose messages can create different risk than a pure political persuasion or GOTV call. If the message includes fundraising, get legal review before assuming a political exemption applies.

Manual calls vs. autodialed or prerecorded calls

This is one of the most important compliance distinctions for phone banking.

A live manual call is different from a call made with an autodialer, prerecorded voice, artificial voice, or AI-generated voice.

In general:

For mobile numbers, calls made using autodialed technology or artificial or prerecorded voice can require prior express consent. Political organizations are not automatically exempt from that rule.

The practical takeaway: before calling mobile-heavy lists, confirm whether your dialer setup counts as manual, autodialed, prerecorded, artificial voice, or text-based outreach.

Consent rules

Consent should be clear, documented, and tied to the outreach method.

For phone banking, campaigns should record:

• Who consented
• When they consented
• Where they consented
• What they consented to
• Which phone number they provided
• Whether the consent covered calls, texts, prerecorded messages, or only one channel
• Whether they later withdrew consent

Do not bury consent in vague language.

Weak consent language:

“By signing up, you agree to receive updates.”

Better consent language:

“By submitting this form, you agree that [Campaign/Organization] may contact you by phone or text at the number provided about campaign updates, volunteer opportunities, and voting information. Message and data rates may apply. Reply STOP to opt out.”

Have counsel review final consent language before use.

Calling hours and timezones

Under federal TCPA rules, telemarketing calls are generally restricted to 8 AM to 9 PM local time. Political and nonprofit programs still need to review federal, state, and local rules because some states impose stricter calling windows.

Use the contact’s local timezone, not the caller’s timezone.

Before launching a phone bank, confirm:

• The contact’s timezone is available.
• The campaign schedule respects local time.
• Volunteers cannot accidentally call outside allowed windows.
• State rules do not create stricter hours.
• Text follow-ups follow the same review process.

For state-level calling hour guidance, use CallHub’s TCPA compliance checklist.

Disclosure and opt-out

A campaign caller should identify who they are and why they are calling.

A simple opening works:

“Hi, is this [Name]? My name is [Volunteer Name], and I’m calling with [Campaign/Organization] about [Reason].”

If the person asks not to be called again, the volunteer should say:

“Understood. I’ll mark that now.”

Then they should mark the correct opt-out or do-not-call disposition immediately.

For prerecorded messages, make sure the message includes required identification, a callback number where needed, and a clear opt-out mechanism.

For texts, include a simple opt-out path, such as:

“Reply STOP to unsubscribe.”

AI voice and synthetic voice rules

AI voice is no longer a gray area campaigns can ignore.

In 2024, the FCC confirmed that AI-generated voices can qualify as artificial voices under the TCPA. That means AI-generated robocalls can trigger TCPA restrictions and enforcement.

The risk became visible in the 2024 New Hampshire primary, when AI-generated calls mimicked President Joe Biden’s voice. The FCC finalized a $6 million fine against the political consultant behind the calls.

Campaigns should not use AI-generated voice, voice cloning, or synthetic robocalls without legal review.

At minimum, review:

• Whether the call uses artificial or prerecorded voice
• Whether prior express consent is required
• Whether the AI content must be disclosed
• Whether the caller ID is accurate
• Whether state election laws add restrictions
• Whether the content could mislead voters

Never use AI voice to impersonate a candidate, public official, supporter, volunteer, or opponent.

STIR/SHAKEN and caller ID reputation

STIR/SHAKEN helps authenticate caller ID and reduce spoofed calls. It does not make a campaign compliant by itself.

Think of STIR/SHAKEN as caller ID hygiene, not legal permission to call.

Campaigns should still:

• Use accurate caller ID.
• Avoid spoofing or misleading numbers.
• Register numbers where needed.
• Monitor spam labels.
• Rotate numbers carefully.
• Avoid sudden high-volume spikes from new numbers.
• Respond quickly to complaints.
• Keep opt-outs and suppression lists updated.

For more detail, use CallHub’s guide on STIR/SHAKEN call authentication, caller ID reputation, and scam likely numbers.

State-level TCPA and mini-TCPA rules

Federal TCPA rules are not the only rules that matter.

Several states have their own calling rules, often called mini-TCPA laws. These can include stricter calling hours, consent rules, registration requirements, disclosure rules, calling frequency limits, or private rights of action.

Before launching a US phone bank, ask:

• Which states are we calling?
• Are any contacts outside our main campaign state?
• Are we calling mobile numbers?
• Are we using prerecorded, artificial, or automated calls?
• Are we texting?
• Are we fundraising?
• Do state laws treat political, nonprofit, or advocacy calls differently?
• Do we need extra disclosures?

If your campaign calls across multiple states, build compliance rules into the campaign setup instead of leaving volunteers to figure them out.

GDPR for phone banking in the EU

If you are running a campaign in the EU or contacting people in the EU, GDPR may apply.

GDPR focuses on personal data. Phone numbers, names, addresses, donation details, political opinions, union affiliation, and campaign notes can all be personal data. In some cases, political opinions or membership-related data may require extra care because it can be sensitive data.

Originally, EU data protection rules were shaped by the 1995 Data Protection Directive. GDPR was adopted in 2016 and has applied since 2018.

GDPR violations can lead to penalties of up to €20 million or 2% of global annual turnover, depending on the violation.

Have a lawful basis to contact people

Under GDPR, you need a lawful basis to process personal data.

For phone banking, the most common lawful bases campaigns consider are:

• Consent
• Legitimate interest
• Legal obligation, in limited cases
• Public interest, in limited cases

Consent is often the clearest basis for campaign outreach, but it must be specific, informed, freely given, and easy to withdraw.

Legitimate interest may be available in some situations, but it requires a balancing test. You need to show that your interest does not override the person’s rights and expectations.

Do not assume that old supporter data can be reused for a new campaign purpose.

Be transparent with supporters

Supporters have the right to know how their data will be used.

Your forms, petitions, event pages, and donation pages should explain:

• Who is collecting the data
• Why the data is being collected
• How it will be used
• Whether it will be used for calls, texts, or emails
• Who it will be shared with
• How long it will be retained
• How people can opt out or withdraw consent
• How people can access, correct, or delete their data
• How to contact your organization about privacy questions

Do not collect supporter data through one form and use it later for a completely different phone banking campaign without checking whether that new use is covered by the original notice or consent.

Respect data rights and limit access

GDPR gives people rights over their personal data, including access, correction, deletion, restriction, objection, withdrawal of consent, and data portability where applicable.

During a phone bank, volunteers may hear requests like:

“Where did you get my number?”

“Please remove me from your list.”

“What information do you have about me?”

Volunteers do not need to answer every legal question. They need a clear path.

Use this line:

“I understand. I’ll mark that request and make sure it goes to the right team.”

Then route the request to the campaign’s privacy or compliance owner.

Also limit what volunteers can see. They may need name, phone number, region, language preference, last contact outcome, supporter status, opt-out status, or event RSVP status. They usually do not need full donor history, sensitive issue notes, or unnecessary personal details.

Keep retention and security rules clear

Do not keep call notes, recordings, survey answers, consent records, and supporter scores forever by default.

Set a retention policy for each type of phone banking data. Some records may need to be kept for compliance. Others should be deleted, anonymized, or archived when they are no longer needed.

For security, campaigns should:

• Limit access by role.
• Use strong passwords and multi-factor authentication.
• Remove volunteer access after the campaign.
• Avoid sharing lists through personal email.
• Avoid unsecured spreadsheets.
• Train volunteers not to download, screenshot, or copy supporter data.

GDPR phone banking checklist

GDPR compliance should be designed before the campaign starts, not fixed after the list has already been called.

CASL and CRTC rules for phone banking in Canada

In Canada, campaigns need to consider CASL, CRTC rules, privacy laws, and any rules that apply to the organization type.

CASL mainly focuses on commercial electronic messages. It is especially relevant when a campaign sends emails, texts, or other electronic messages that encourage donations, memberships, purchases, or similar actions.

Canadian campaigns should separate three questions:

1. Are we making phone calls?
2. Are we sending texts or emails?
3. Are we asking for donations, memberships, purchases, or other commercial activity?

Each answer can change the compliance review.

Consent, identity, and opt-outs

CASL generally requires consent before sending commercial electronic messages. Consent may be express or implied, depending on the relationship and message type, but campaigns should not rely on implied consent without legal review.

For calls, volunteers should clearly identify the organization.

Example:

“Hi, is this [Name]? My name is [Volunteer Name], and I’m calling with [Organization] about [Reason].”

For texts and emails, include clear sender identification and an easy unsubscribe path.

Every Canadian calling or texting campaign should have a process for:

• STOP replies
• “Do not contact me” requests
• Email unsubscribes
• Call opt-outs
• Wrong number reports
• Internal suppression lists

Some political, charitable, nonprofit, or advocacy messages may have exemptions or special treatment. But those rules can be narrow and depend on the sender, message content, relationship, and purpose.

Do not assume all campaign, charity, or advocacy outreach is exempt.

CASL and Canada phone banking checklist

Compliance rules by phone banking use case

Different phone banking campaigns create different compliance questions.

The same list can create different compliance obligations depending on how you contact people and what you ask them to do.

Phone banking compliance checklist before launch

Before launching any campaign, confirm:

List and consent

• How was the list collected?
• Does consent exist, and what does it cover?
• Are mobile numbers included?
• Are opt-outs and internal DNC contacts suppressed?
• Are contacts segmented by country, state, province, and timezone?
• Does the campaign include fundraising or commercial activity?

Dialer and calling method

• Are calls manual, preview, power, predictive, autodialed, prerecorded, artificial voice, or AI-generated?
• Are mobile number rules reviewed?
• Are calling hours based on the contact’s local time?
• Has caller ID been tested?
• Are spam labeling risks being monitored?

Script and volunteer training

• Does the script identify the campaign or organization?
• Is there a clear opt-out path?
• Do volunteers know how to mark do-not-call requests?
• Do volunteers know not to argue with opt-outs?
• Are they trained not to copy supporter data into personal notes?

Text follow-up

• Is consent required for the text?
• Is sender identity clear?
• Is STOP or opt-out language included where needed?
• Are opt-outs synced back to the campaign record?
• Is 10DLC or carrier registration handled where required?

Data and documentation

• Are consent records stored?
• Are opt-out records stored?
• Are call outcomes tracked?
• Are integrations and sync behavior reviewed?
• Is there a retention period for call data?
• Has legal review been documented for higher-risk campaigns?

Common phone banking compliance mistakes

Most compliance issues come from process gaps, not bad intent.

Avoid these mistakes:

• Treating political calls as fully exempt from compliance.
• Calling mobile numbers with the wrong technology.
• Ignoring state-level rules.
• Using AI voice or voice cloning without legal review.
• Keeping opt-outs buried in call notes instead of suppression lists.
• Showing volunteers more private data than they need.
• Launching a campaign without testing caller ID, opt-outs, dispositions, text follow-up, and data sync.

A small test list can prevent a large cleanup problem later.

How CallHub helps campaigns stay compliant

Compliance is ultimately the campaign’s responsibility, but the right platform can make compliant workflows easier.

CallHub helps phone banking teams manage:

• DNC and suppression lists
• Opt-out dispositions
• Timezone-aware calling
• Caller ID and number management
• Consent and custom fields
• Scripts with opt-out paths
• Call outcomes and reports
• CRM integrations
• Workflow automation

For example, if someone asks not to be called, the script can tell the volunteer what to say, the disposition can mark do not call, and the contact can be removed from future calling lists.

CallHub’s reporting also helps managers review calls attempted, calls answered, opt-outs, wrong numbers, notes, volunteer activity, and follow-up needs.

To explore the calling workflow, see CallHub’s phone banking software. For broader campaign strategy, read the political phone banking guide. For US-specific calling rules, use the TCPA compliance checklist.

Conclusion

Phone banking compliance protects your campaign, your volunteers, your supporters, and your ability to reach people when it matters.

The core habits are simple: know where your list came from, store consent, use the right dialer, identify yourself clearly, honor opt-outs immediately, respect local calling hours, protect supporter data, and test your setup before launch.

CallHub helps teams build these habits into phone banking workflows with scripts, dispositions, opt-out handling, DNC list support, timezone-aware scheduling, reporting, integrations, and automation.

Explore CallHub’s phone banking software to see how campaigns can run organized calling programs while keeping compliance workflows easier to manage.

Frequently asked questions about phone banking compliance

What is phone banking compliance?

Phone banking compliance means following the laws, carrier rules, consent requirements, opt-out processes, and data privacy standards that apply when campaigns call or text supporters, voters, donors, members, or prospects.

Does TCPA apply to political phone banking?

Yes, TCPA can apply to political phone banking, especially when calls involve mobile numbers, autodialers, prerecorded voice, artificial voice, AI-generated voice, or text messages.

Are political calls exempt from the National Do Not Call Registry?

Political calls that are not sales calls are generally treated differently from telemarketing calls. But campaigns should still maintain internal do-not-call lists, honor opt-outs, avoid misleading caller ID, and review state rules.

Can campaigns use AI voice for phone banking?

Treat AI voice as high risk. In 2024, the FCC confirmed that AI-generated voices can qualify as artificial voices under the TCPA. Do not use AI voice, voice cloning, or synthetic robocalls without legal review.

Does GDPR apply to political phone banking?

GDPR can apply if your campaign processes personal data of people in the EU. Campaigns need a lawful basis, transparency, data security, and a process for data rights requests.

Does CASL apply to campaign texts in Canada?

CASL may apply to commercial electronic messages in Canada, including some texts and emails. Political, charitable, nonprofit, and advocacy messages can have exemptions or special rules depending on sender and message type.

What should volunteers say if someone asks not to be called?

Use a simple line:

“Understood. I’ll mark that now.”

Then mark the correct opt-out or do-not-call disposition immediately.

Divyashree BR

A marketer passionate about sharing insights on nonprofits, politics, and advocacies, with a keen focus on how these domains can be effectively digitalized and communicated to reach broader audiences.