Skip to main content

​
TCPA federal voice guard

Every compliance gate you read about elsewhere in these docs — quiet hours, opt-out lists, frequency caps, country rules — exists because you turned it on, and it stands down the moment you turn it off. The US federal TCPA voice dialing window is the exception. It is the one compliance control the platform owns outright: always on, no tenant setting, no opt-out flag, and no way to weaken it from your account. When a campaign launch or dialer send comes back with 422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED, this page tells you which control you hit, why it can’t be disabled, and how to schedule around it.

​
The 8 AM–9 PM recipient-local federal window

US federal law — 47 U.S.C. § 227(b)(1)(B) — draws a hard window for outbound calls to US recipients: 8:00 AM to 9:00 PM in the recipient’s local time, every day. Campaign and dialer voice sends to +1 recipients are checked against that window at send time. Outside the window the send is refused with HTTP 422. The statutory exposure sits at 500–500–1,500 per call, assessed against whatever platform the operator was using — not the tenant configured a bad setting. That’s the asymmetry that explains the design: for every other gate, the risk of a misconfiguration is yours to price, so the control is yours to own. For the federal window, the penalty is not yours to waive, so the control is not yours to disable. It is the sole compliance control on the platform with that posture — everything else is tenant-owned and default-open. Where the block surfaces depends on the path:

​
Two error codes, two different owners

Voice blocks carry one of two distinct codes so audit filtering can separate them:
  • TCPA_FEDERAL_DIALING_WINDOW_BLOCKED — the federal window itself. No setting on your account can widen it; the recovery is to schedule into the window.
  • TCPA_DIALING_WINDOW_BLOCKED — your own tenant opt-in voice gate (your quiet-hours configuration) holding a send. This one is yours to loosen, tighten, or disable.
Both return HTTP 422 with window details in the error payload. A block from the federal guard also carries next_allowed_at — the UTC instant of the next 8 AM in the recipient’s timezone — so you can schedule instead of polling.

​
Fail-closed, when everything else fails open

Resolve a recipient’s timezone and the window math is deterministic. The guard’s real defining trait is what happens when the timezone can’t be resolved — and it’s the opposite of every other gate:
  • Every other compliance gate fails open. An unresolvable timezone at your own quiet-hours gate defaults to allow (skip policy) — an infra hiccup on your configuration can’t silently black-hole your outbound.
  • The federal voice guard fails closed. A +1 recipient whose timezone can’t be derived from the area code is blocked, even at 2 PM somewhere inside the nominal window. Without a timezone, the platform can’t prove the call is inside the federal window, and the penalty floor is too high to guess at 500–500–1,500 per call.
That asymmetry is intentional and load-bearing: skip-policies exist for controls you own, where a false refusal is worse than a false pass. The federal guard is the opposite trade — a false pass carries statutory liability measured per call, so the default lands on refuse. A fail-open posture on the federal guard would quietly correspond to “TCPA enforcement stops when the timezone lookup is undeployable” — which is not a posture anyone can sign for. The same logic is why no skip flag exists on this path: enabling one would convert fail-closed into fail-open at the exact wrong moment.

​
What the tenant opt-in gate adds — and what it never relaxes

Your own voice gate — Settings → Quiet hours, the voice channel — layers on top of the federal window, never underneath it. Its defaults are conservative (8 AM–9 PM, fail-open skip on unknown timezones) and you’ve opted in explicitly by enabling that channel. What the opt-in gate can do:
  • Tighten the window — narrowing your outbound hours to, say, 9 AM–8 PM recipient-local.
  • Add consent logic and unknown_timezone_policy behavior to your own posture.
  • Hold ad-hoc 1:1 calls that would otherwise dial through with only an advisory log.
What it never does:
  • Widen the 8 AM–9 PM federal window.
  • Convert the federal fail-closed timezone posture to fail-open.
  • Exempt a campaign send from the federal check because a prior-express consent record exists — the consent carve-out is read by non-voice channels only.
In short: you can always be stricter than the federal floor. You can never be looser.

​
The RMD prerequisite

US voice origination also carries a Robocall Mitigation Database filing requirement. Register your STIR/SHAKEN status and mitigation plan through POST /compliance/rmd before originating US voice — Orbit stores the filing, tracks the lifecycle (draft → submitted → active), and surfaces recertification deadlines in the read endpoint. The endpoint shapes and prerequisites are documented in the send gates reference. This is a tenant-owned filing — the platform tracks it; it doesn’t originate it. Don’t conflate it with the hard guard above: RMD is about who is allowed to originate US voice, the federal window is about when voice may dial.

​
Mini-TCPA overlays on top

The federal window is a floor, not the whole rule. Several US states own “mini-TCPA” statutes with stricter hours, day-of-week bans, or both. Federal law expressly permits stricter state rules, so the binding posture for any +1 recipient is the intersection — the most restrictive of the federal window and any applicable state overlay. A campaign send blocked at 8:30 PM toward a Florida recipient stays blocked even though the federal hour would pass: Florida’s overlay ends at 8 PM and bans Sunday dialing outright. Overlays compose as most-restrictive-wins — they can tighten past the federal window but never widen it, and the block error carries the specific statute citation so you can trace the refusal to the rule that caused it. The full overlay table (states, hours, banned days, statutes) lives at US state calling windows.

​
Error codes you’ll actually see

If you’re debugging which gate actually fired, the code is the answer — FEDERAL in the name means the platform’s hard guard; no FEDERAL means your own tenant-side configuration.

​
See also