Federal TCPA Compliance Isn't Enough Anymore
If your compliance checklist stops at the federal TCPA and the FCC's 3% abandonment cap, you're already behind. Since 2021, at least a dozen states have passed their own "mini-TCPA" statutes — and several of them define "automated system," calling hours, and attempt limits in ways that don't line up with federal rules at all. Florida's FTSA alone has generated thousands of putative class actions since 2021, with statutory damages of $500 to $1,500 per call and no cap on how many calls can be aggregated into a single suit.
The part most dialer admins miss: these state laws don't just add another consent checkbox. Several of them change how call attempts get counted and how "automated" is defined — which means your AMD configuration is now doing compliance work it was never built for, in jurisdictions your legal team may not have mapped.
This isn't a "what is TCPA" primer — if you need that baseline, see Outbound Calling Compliance: A Complete Guide. This post is about the state-by-state gaps that are actually generating litigation in 2026, and what they mean for how you configure AMD and attempt pacing.
The States Actually Driving Litigation Right Now
Three statutes are worth building a specific compliance posture around:
Florida Telephone Solicitation Act (FTSA)
FTSA requires prior express written consent before any call or text placed with an "automated system," backs a state Do Not Call list separate from the federal registry, and restricts calls to 8 a.m.–9 p.m. local time. The current litigation wave isn't about consent at all — it's about the caller ID and two-way communications provision, which requires that called parties be able to see a working number and call or text back. Plaintiffs' firms have been filing on this theory specifically because it's easy to prove and hard to defend: if your outbound CLI doesn't accept inbound callbacks, you're exposed regardless of how clean your consent records are.
Oklahoma Telephone Solicitation Act (TSA)
Effective since November 2022, Oklahoma caps contact attempts at three calls per 24-hour period to the same number, restricts calling to 8 a.m.–8 p.m., and uses a broader definition of "automated system" than the federal TCPA's "automatic telephone dialing system." Oklahoma's cap applies per subject matter, not per campaign — call the same lead three times about one offer and you're done for the day, no matter how many separate campaigns or agents are involved.
Washington Robocall Scam Protection Act (HB 1051)
Washington's law broadens the definition of an "automatic dialing and announcing device" to sweep in predictive dialers that use AMD, requires live callers to identify themselves and their company within the first 30 seconds, and mandates that if a called party indicates they don't want to be called again, the call must end within 10 seconds and the number can't be dialed again for a year.
Quick Comparison
| Rule | Federal TCPA | Florida FTSA | Oklahoma TSA | Washington HB 1051 |
|---|---|---|---|---|
| Consent standard | Prior express written consent (for ATDS/prerecorded) | Prior express written consent | Prior express written consent | Consent + 30-sec identification |
| Calling hours | 8 a.m.–9 p.m. local | 8 a.m.–9 p.m. local | 8 a.m.–8 p.m. local | Not separately restricted |
| Attempt cap | None (abandonment-rate based) | None (consent-based) | 3 calls / 24 hrs, same subject | Must stop within 10 sec of opt-out; no re-dial for 1 year |
| Autodialer definition | Federal ATDS (narrowed by Facebook v. Duguid) | "Automated system" (broader, undefined by case law yet) | Broader "automated system" | Broadened to include predictive dialers using AMD |
| Private right of action | Yes | Yes, $500–$1,500/violation | Yes | Yes |
Where AMD Settings Intersect With These Laws
This is the part that doesn't show up in most legal compliance checklists, because it's an operational detail, not a legal one — but it's where real exposure lives.
Oklahoma's 3-call cap turns AMD false positives into wasted attempts you can't get back. If your AMD engine misclassifies a live answer as a machine (a false positive) and the dialer redials later the same day, you've burned one of three allowed attempts on a call that should have connected. Do that twice and the lead is legally uncontactable for the rest of the day — even though a human answered the phone both times. At a 15–25% false positive rate, which is typical for Asterisk's default AMD, a meaningful share of your Oklahoma-bound attempts are getting consumed by misclassification, not genuine no-answers. We've written in more detail about how attempt-counting rules interact with AMD accuracy in the context of Regulation F's 7-in-7 rule — the same mechanics apply here, just with a tighter window.
Washington's broadened device definition means your AMD-equipped predictive dialer is now squarely "automated" under state law, whether or not it's an ATDS under the federal Duguid standard. That matters because it potentially pulls more of your campaigns into the consent and opt-out mechanics of HB 1051, including the 10-second opt-out rule — which is nearly impossible to honor cleanly if your AMD is slow to hand off a live answer to an agent, because the opt-out clock is running from the moment the called party speaks, not from connection.
FTSA's callback provision indirectly rewards AMD accuracy. A false negative — AMD mistaking a live answer for voicemail and dropping or mishandling the call — means that person never gets a working callback path for that interaction, which is exactly the fact pattern plaintiffs' firms have been pursuing. Reducing false negatives reduces the number of calls where a consumer reasonably claims they couldn't reach you back.
None of these laws were written with AMD accuracy in mind. But in practice, every one of them makes your AMD false positive and false negative rates a direct input into your legal exposure — not just your connect-rate metrics. For a deeper breakdown of how the two error types behave differently and why most dialer teams only track one of them, see AMD False Positive vs. False Negative Rate, Explained.
A Multi-State Compliance Checklist for Dialer Teams
If you're running campaigns into more than one of these states, the checklist looks different from a standard TCPA audit:
- Segment attempt caps by state, not just by campaign. A dialer rule set that allows 6 attempts per day federally will violate Oklahoma's 3-call cap unless you apply a state-specific override.
- Audit your AMD false positive rate before you audit your consent records. Consent paperwork being clean doesn't help if misclassification is burning your attempt budget in capped states.
- Confirm your outbound CLI accepts and routes inbound callbacks. This is the single highest-volume FTSA theory right now and it's a telecom configuration issue, not a legal one.
- Measure AMD handoff latency separately for opt-out-sensitive states. If Washington's 10-second opt-out clock is a concern, your AMD-to-agent handoff time needs to be fast and consistent, not just accurate on average.
- Keep state-specific calling-hour windows in your dialer's time-zone logic, not just your federal 8–9 window — Oklahoma's 8 p.m. cutoff is an hour earlier than federal and FTSA.
- Re-run your abandonment and attempt-counting math per state rather than assuming one national report covers every jurisdiction you call into.
If your reporting is still built around a single national TCPA number, this is the gap that shows up first — often in a demand letter, before it shows up in an audit. Our AMD accuracy audit and measurement framework covers how to build the measurement layer this kind of multi-state exposure actually requires.
Why This Comes Back to AMD Accuracy
Every one of these state laws tightens the margin for error around call attempts, consent, and connection speed. An AMD engine running at a 15–25% false positive rate — the default on most Asterisk-based dialers — doesn't just cost you connect rate anymore. In Oklahoma, it costs you legal attempts outright. In Washington, it slows the handoff that your opt-out clock depends on. In Florida, every misrouted call is a data point a plaintiff's attorney can point to.
amdify.io was built to close that gap, bringing AMD false positive rates down to 1–3% so that attempt caps, opt-out windows, and callback obligations are being measured against calls your dialer actually got right — not against the fallout from misclassification. If you're running campaigns into multiple mini-TCPA states and your AMD accuracy hasn't been audited against this specific risk, that's the place to start. Learn more at amdify.io.