> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# TCPA federal voice guard: the one 422 you can't unset

> The 8 AM–9 PM recipient-local federal dialing window for US voice, why it is the only compliance control the platform owns outright, how its fail-closed posture differs from every other gate, and how to resolve a 422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED when it stops your campaign.

# TCPA federal voice guard

Every compliance gate you read about elsewhere in these docs — quiet hours,
opt-out lists, frequency caps, country rules — exists because **you** turned
it on, and it stands down the moment you turn it off. The US federal TCPA
voice dialing window is the exception. It is the one compliance control the
platform owns outright: always on, no tenant setting, no opt-out flag, and
no way to weaken it from your account. When a campaign launch or dialer
send comes back with `422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED`, this page
tells you which control you hit, why it can't be disabled, and how to
schedule around it.

## The 8 AM–9 PM recipient-local federal window

US federal law — 47 U.S.C. § 227(b)(1)(B) — draws a hard window for
outbound calls to US recipients: **8:00 AM to 9:00 PM in the recipient's
local time**, every day. Campaign and dialer voice sends to +1 recipients
are checked against that window at send time. Outside the window the send
is refused with HTTP 422.

The statutory exposure sits at **$500–$1,500 per call**, assessed against
whatever platform the operator was using — not the tenant configured a bad
setting. That's the asymmetry that explains the design: for every other
gate, the risk of a misconfiguration is yours to price, so the control is
yours to own. For the federal window, the penalty is not yours to waive,
so the control is not yours to disable. It is the **sole** compliance
control on the platform with that posture — everything else is
tenant-owned and default-open.

Where the block surfaces depends on the path:

| Path                                            | What happens outside the window                                                                                 |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| Campaign launch / dialer send to a +1 recipient | Hard block — `422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED`                                                          |
| Ad-hoc 1:1 call from the dashboard              | Dials through with an advisory log; your own opt-in voice gate (below) is the only thing that can hard-block it |
| Any non-voice channel, or any non-+1 recipient  | Not evaluated — the federal window applies to US voice only                                                     |

### Two error codes, two different owners

Voice blocks carry one of two distinct codes so audit filtering can
separate them:

* **`TCPA_FEDERAL_DIALING_WINDOW_BLOCKED`** — the federal window itself.
  No setting on your account can widen it; the recovery is to schedule
  into the window.
* **`TCPA_DIALING_WINDOW_BLOCKED`** — your own tenant opt-in voice gate
  (your quiet-hours configuration) holding a send. This one *is* yours to
  loosen, tighten, or disable.

Both return HTTP 422 with window details in the error payload. A block
from the federal guard also carries `next_allowed_at` — the UTC instant
of the next 8 AM in the recipient's timezone — so you can schedule
instead of polling.

## Fail-closed, when everything else fails open

Resolve a recipient's timezone and the window math is deterministic. The
guard's real defining trait is what happens when the timezone **can't**
be resolved — and it's the opposite of every other gate:

* **Every other compliance gate fails open.** An unresolvable timezone at
  your own quiet-hours gate defaults to allow (`skip` policy) — an
  infra hiccup on your configuration can't silently black-hole your
  outbound.
* **The federal voice guard fails closed.** A +1 recipient whose timezone
  can't be derived from the area code is **blocked**, even at 2 PM
  somewhere inside the nominal window. Without a timezone, the platform
  can't prove the call is inside the federal window, and the penalty
  floor is too high to guess at $500–$1,500 per call.

That asymmetry is intentional and load-bearing: skip-policies exist for
controls you own, where a false refusal is worse than a false pass. The
federal guard is the opposite trade — a false pass carries statutory
liability measured per call, so the default lands on refuse. A fail-open
posture on the federal guard would quietly correspond to "TCPA
enforcement stops when the timezone lookup is undeployable" — which is
not a posture anyone can sign for.

The same logic is why no `skip` flag exists on this path: enabling one
would convert fail-closed into fail-open at the exact wrong moment.

## What the tenant opt-in gate adds — and what it never relaxes

Your own voice gate — **Settings → Quiet hours**, the `voice` channel —
layers **on top of** the federal window, never underneath it. Its
defaults are conservative (8 AM–9 PM, fail-open `skip` on unknown
timezones) and you've opted in explicitly by enabling that channel.

What the opt-in gate **can** do:

* **Tighten** the window — narrowing your outbound hours to, say,
  9 AM–8 PM recipient-local.
* Add **consent logic** and `unknown_timezone_policy` behavior to your
  own posture.
* Hold ad-hoc 1:1 calls that would otherwise dial through with only an
  advisory log.

What it **never** does:

* Widen the 8 AM–9 PM federal window.
* Convert the federal fail-closed timezone posture to fail-open.
* Exempt a campaign send from the federal check because a prior-express
  consent record exists — the consent carve-out is read by non-voice
  channels only.

In short: you can always be **stricter** than the federal floor. You can
never be **looser**.

## The RMD prerequisite

US voice origination also carries a **Robocall Mitigation Database**
filing requirement. Register your STIR/SHAKEN status and mitigation plan
through `POST /compliance/rmd` before originating US voice — Orbit stores
the filing, tracks the lifecycle (`draft → submitted → active`), and
surfaces recertification deadlines in the read endpoint. The endpoint
shapes and prerequisites are documented in the
[send gates reference](/compliance/send-gates).

This is a tenant-owned filing — the platform tracks it; it doesn't
originate it. Don't conflate it with the hard guard above: RMD is about
*who is allowed to originate US voice*, the federal window is about
*when voice may dial*.

## Mini-TCPA overlays on top

The federal window is a floor, not the whole rule. Several US states own
"mini-TCPA" statutes with stricter hours, day-of-week bans, or both.
Federal law expressly permits stricter state rules, so the binding
posture for any +1 recipient is the **intersection** — the most
restrictive of the federal window and any applicable state overlay. A
campaign send blocked at 8:30 PM toward a Florida recipient stays
blocked even though the federal hour would pass: Florida's overlay ends
at 8 PM and bans Sunday dialing outright.

Overlays compose as **most-restrictive-wins** — they can tighten past
the federal window but never widen it, and the block error carries the
specific statute citation so you can trace the refusal to the rule that
caused it. The full overlay table (states, hours, banned days,
statutes) lives at
[US state calling windows](/compliance/state-calling-windows).

## Error codes you'll actually see

| Code                                      | Owner                        | Resolution                                                                                               |
| ----------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------- |
| `422 TCPA_FEDERAL_DIALING_WINDOW_BLOCKED` | Platform — not unsettable    | Schedule at `next_allowed_at`; never retry in a loop                                                     |
| `422 TCPA_DIALING_WINDOW_BLOCKED`         | You — your opt-in voice gate | Search your quiet-hours configuration for the `voice` channel; narrow or disable it                      |
| `422 TCPA_STATE_DIALING_WINDOW_BLOCKED`   | Statute overlay              | Read the error details for the state citation; the overlay outranks the federal hour                     |
| `422 TCPA_TIMEZONE_UNKNOWN`               | Federal guard, fail-closed   | Pass `recipientTimezone` explicitly, or fix the record's area code so the guard can resolve the timezone |

If you're debugging which gate actually fired, the code is the answer —
`FEDERAL` in the name means the platform's hard guard; no `FEDERAL`
means your own tenant-side configuration.

## See also

* [US state calling windows](/compliance/state-calling-windows) — the mini-TCPA overlay table and how the intersection resolves
* [Send gates](/compliance/send-gates) — the RMD filing endpoint, quiet hours, DNC, and the rest of the gate stack
* [Quiet hours configuration](/guides/quiet-hours-configuration) — your opt-in voice gate, consent overrides, and timezone policies
* [Outbound send gating](/concepts/send-gating-and-quiet-hours) — how this guard fits the full chain of send-time controls
* [Error codes reference](/reference/error-codes) — every code above, in one table