FDCPA Explained: The Law That Governs Every Collection Call Made in Your Name

The Fair Debt Collection Practices Act (FDCPA) is the primary federal law regulating how third-party debt collectors may communicate with, and attempt to collect from, consumers. Enacted in 1977 and enforced today by the Consumer Financial Protection Bureau (CFPB), the law establishes strict rules around contact frequency, permissible hours, required disclosures, and prohibited conduct — and violations can expose collection agencies to statutory damages of up to $1,000 per lawsuit, class-action liability, and regulatory sanctions.^[1][2]

For small and mid-sized businesses, the FDCPA is not just a compliance checkbox — it is a direct business risk. When a company hires a third-party collection agency, that agency’s conduct reflects on the original creditor. Understanding what the FDCPA requires, who it applies to, and where violations most commonly occur is the foundation of responsible accounts receivable management. This guide covers the essentials in plain language

Who Does the FDCPA Apply To?

The FDCPA applies specifically to third-party debt collectors — companies hired to collect debts owed to someone else. This includes:^[3]

• Collection agencies and ARM (Accounts Receivable Management) firms
• Debt buyers who purchase delinquent portfolios
• Law firms engaged in debt collection activities
• BPO providers operating in a third-party collection capacity

Original creditors collecting their own debts are generally not covered by the FDCPA. However, if a creditor hires a third party to collect on their behalf, that third-party collector becomes subject to all FDCPA requirements. This distinction matters enormously when selecting an outsourcing partner — the partner you choose becomes the legal compliance entity for every interaction with your customers.^[4]

The Core Rules Every Debt Collector Must Follow

Permissible Hours and Contact Times

Under the FDCPA and Regulation F, debt collectors may not contact consumers before 8:00 a.m. or after 9:00 p.m. local time at the consumer’s location. When a consumer’s location spans multiple time zones, the collector must restrict contact to times that would be convenient in all potential locations. Contacting a consumer at their workplace is prohibited if the collector has reason to know the employer disallows such communications.^[5][6]

Call Frequency: The 7-in-7 Rule

Regulation F, which modernized the FDCPA in 2021, established a presumption of harassment if a collector places more than seven telephone calls within seven consecutive calendar days about a particular debt, or calls within seven days after having a live telephone conversation with the consumer about that debt. Unanswered calls, voicemails, and limited-content messages all count toward the seven-call threshold. Consent from the consumer can modify this limit, but such consent must be direct and explicit.^[7][8][9]

The Mini-Miranda Disclosure

On every initial contact — whether by phone, letter, or digital channel — the collector must disclose: “This is an attempt to collect a debt, and any information obtained will be used for that purpose.” This statement, known as the “Mini-Miranda,” must also identify the collector as a debt collector in all subsequent communications. Failure to deliver this disclosure on initial contact is itself an FDCPA violation — regardless of whether the underlying debt is valid.^[10][11]

Prohibited Conduct

The FDCPA prohibits a wide range of conduct including:

• Using abusive, obscene, or profane language
• Making threats of violence or unlawful action
• Contacting third parties about the debt (beyond permissible locating inquiries)
• Making false or misleading representations about the debt, the amount owed, or legal consequences
• Collecting fees, interest, or other charges not authorized by the original agreement
• Continuing to contact a consumer after a written cease-and-desist request^[12][2]

What Happens When the FDCPA Is Violated?

FDCPA violations can result in multiple layers of liability:^[2]

Violation Type	Exposure
Individual consumer lawsuit	Up to $1,000 statutory damages per lawsuit + actual damages + attorney fees
Class action lawsuit	Up to $500,000 or 1% of net worth, whichever is less
CFPB enforcement action	Civil penalties, mandatory remediation, operational restrictions
State law claims	Many states have laws that parallel or exceed FDCPA protections

Civil penalties of up to $500,000 can be imposed on repeat offenders in class-action contexts. The FDCPA’s one-year statute of limitations runs from the date of each individual violation — not from when the debt was first assigned — meaning a pattern of non-compliant calls can generate a rolling window of litigation exposure.^[13][2]

How Regulation F Updated the FDCPA for the Digital Age

The CFPB’s Regulation F, which took effect November 30, 2021, was the first comprehensive federal rulemaking under the FDCPA since the statute’s passage. Key additions include:^[14]

• Electronic communications: Email, text, and secure social media messaging are now permissible collection channels, subject to strict opt-out and disclosure requirements^[15]
• Model Validation Notice (MVN): A standardized safe-harbor notice format for initial debt validation communications^[7]
• Limited-Content Messages: A defined safe harbor for voicemails that does not trigger the FDCPA’s “communication” definition, enabling more flexible outreach^[7]
• Record retention: Collectors must retain records demonstrating compliance for three years from the date of any collection activity^[7]
• Deceased consumer protections: The “consumer” definition now extends to deceased individuals, with specific rules for probate communications^[7]

For businesses outsourcing collections, Regulation F compliance is no longer optional — it is table stakes. A BPO partner that cannot demonstrate active Reg F compliance infrastructure is a liability, not an asset.

What to Look for in an FDCPA-Compliant Collections Partner

When evaluating a third-party collections BPO, FDCPA compliance should be a primary screening criterion — not an afterthought. The right partner will:

• Operate a real-time compliance monitoring system with 100% call recording and QA review
• Maintain automated controls for call frequency, time-of-day restrictions, and Mini-Miranda delivery
• Provide clients with audit-ready documentation including call logs, dispute records, and consent tracking
• Train agents on Regulation F requirements and conduct regular refresher certifications
• Carry adequate errors and omissions (E&O) insurance and maintain documented procedures for consumer disputes

→ Use our full 20-point BPO evaluation checklist to vet compliance infrastructure before you sign

How Redial BPO Maintains FDCPA Compliance

At Redial BPO, FDCPA compliance is embedded into every layer of our collections operation — not retrofitted on top of it. Our compliance infrastructure includes:

• Automated call frequency controls that enforce the 7-in-7 rule per consumer, per debt, in real time
• Mini-Miranda scripting integrated into every agent call guide and digital communication template
• 100% interaction recording and QA review, enabling rapid identification and correction of any compliance gaps
• Dedicated compliance team monitoring CFPB guidance updates, Regulation F amendments, and state-level rule changes
• Three-year record retention with structured audit documentation available to clients upon request

“FDCPA violations don’t just create legal risk — they damage the customer relationship you’ve spent years building. Redial’s compliance-first approach protects your brand on every call.”