The FTC amended its Telemarketing Sales Rule in 2024 to prohibit deceptive and abusive practices in B2B calls. CAN-SPAM has never had a B2B exception.
This guide is for U.S. PEO sales teams, SDR leaders, marketing operations, and compliance stakeholders. It walks through a channel-by-channel framework. It is educational guidance, not legal advice.
Key Takeaways
- Rules depend on channel, number type, technology, consent, content, and state.
- "B2B" is not a blanket exemption from telemarketing, email, platform, or state rules.
- Keep one shared record of consent, opt-outs, sources, and campaigns.
- Compliance is an operating system: approved messaging, training, controls, monitoring, escalation.
What Compliance-Safe PEO Outreach Covers
Review everything that reaches a prospect:
- Manual and autodialed calls
- Prerecorded or AI-generated voice and voicemail
- SMS, email, and LinkedIn messages
- Appointment reminders
- List enrichment and outsourced appointment setting
Know who you're contacting
The rules turn on the number and how it's used, not the prospect's job title.
- The National Do Not Call Registry covers personal numbers. FTC guidance says business lines are not covered, but a registered mobile number is treated like a home number.
- The TCPA treats texts as calls, and the FCC has confirmed AI-generated voices are "artificial" voices.
- Several states add their own rules. Florida bars certain calls and texts after an opt-out, whether the recipient is a consumer or a business.
- Oklahoma and Maryland offer only limited B2B exemptions. Washington's B2B exclusion applies to one statute, not every channel.
- Sole proprietors and owners using personal mobile numbers deserve extra caution. Screen them.
Who is responsible
Responsibility spreads across the PEO, reps, lead providers, dialer and CRM vendors, agencies, and appointment setters.
The FTC says sellers remain responsible for current do-not-call procedures even when a telemarketer is hired. CAN-SPAM likewise says a sender cannot contract away responsibility for a marketing vendor.
Put it in writing:
- Contracts that define data sources, consent practices, and suppression duties
- Approved scripts and templates
- Access controls on lists and CRM fields
- Due diligence on vendors before launch
Describe PEO services accurately
NAPEO describes a PEO as a co-employment arrangement that allocates employer responsibilities between the PEO and client, covering payroll, benefits, workers' compensation, and HR support. Keep claims within that.
Never promise that a PEO eliminates all employer liability, guarantees savings, or makes a prospect fully compliant. The FTC requires a reasonable basis for objective claims.
A NAPEO-commissioned study estimated 27.2% annual ROI, but that is a study estimate, not a guarantee. Even IRS certification (CPEO) is not a promise of savings or full legal compliance.
Apply the Rules by Outreach Channel
Voice calls and voicemail
- Do-not-call: Scrub against the Registry (refreshed at least every 31 days) and keep an internal list. Honor internal requests even when the number isn't registered.
- Caller ID: Transmit accurate caller information. Spoofing to deceive is prohibited. STIR/SHAKEN authentication doesn't replace permission to call.
- Hours: The 8 a.m. to 9 p.m. window is a consumer TSR rule, not a universal B2B rule. Washington's is 8 a.m. to 8 p.m. for covered solicitations. Dialing by recipient time zone is the safe default.
- Automation: Prerecorded, AI-voice, and ringless voicemail calls to wireless numbers are subject to TCPA consent rules.
- Revocation: Current rules require honoring revocations within a reasonable time, no more than 10 business days. A newer FCC rule (FCC 26-67) takes effect Nov. 25, 2026. Confirm its status before relying on either version.
SMS and messaging apps
A business purpose or business number does not settle consent. Marketing texts sent with regulated automated technology to wireless numbers generally require prior express written consent.
- Record who consented, when, how, and to what sender and campaign
- Honor "STOP" and plain-language opt-outs, with one confirmation message
- Sync suppression requests across every vendor and platform
- Follow CTIA messaging principles and 10DLC registration, which are industry standards rather than law
CAN-SPAM applies to commercial email, including B2B. Per the FTC's CAN-SPAM guide, you need:
- Accurate sender and header information
- A truthful subject line
- Identification of the message as an ad
- A valid physical postal address
- A clear opt-out, honored within 10 business days
Penalties run up to $53,088 per violating email, per the FTC's January 2024 guide. Confirm the current amount with the FTC, since civil penalties are adjusted periodically.
Google advises against purchasing email addresses. Authenticate your domain with SPF, DKIM, and DMARC, and keep spam rates under 0.10%. Those are provider requirements, not statutes.
LinkedIn and social channels
LinkedIn's User Agreement bars bots, scraping, automated contact downloads, and fake identities. The hiQ v. LinkedIn ruling addressed federal computer-access law, not LinkedIn's contract terms. Send personalized, relevant messages from a real profile. Skip bulk automation.
Call recording and reminders
The federal rule requires only one party's consent, but states differ. The Reporters Committee lists about 11 all-party consent states, including California, Florida, Illinois, Pennsylvania, and Washington. When in doubt, announce the recording at the start of the call.
For reminders, the FCC's no-consent exception is limited to healthcare and excludes telemarketing. A sales-appointment reminder must still respect a prior opt-out. Restrict recording access and set retention rules.
Build a Compliant Outreach Workflow
Set governance before launch
- Name a compliance owner
- Define permitted channels and prohibited tactics
- Approve scripts and templates
- List escalation contacts
- Require legal review for higher-risk campaigns
Validate data before outreach
For each contact, record:
- Source and collection date
- Role and contact type (business line, mobile, personal)
- State, consent evidence, and any earlier opt-out
TopLead, for example, manually sources and verifies contacts and excludes recycled lists. That is the standard to aim for.
Centralize suppression
Combine federal, state, internal, campaign, and vendor exclusions across calling, email, SMS, social, and booking tools. Set an internal deadline faster than the legal maximum. The FTC's email rule allows 10 business days, while Yahoo expects two days for bulk senders.
Add execution controls
- Approved caller ID and sender identity
- Time-zone logic and frequency caps
- Opt-out language in every template
- A claim library of approved PEO statements
- CRM fields logging every touch, outcome, and preference
The TSR also carries recordkeeping duties, generally five years for covered records. Ask counsel how 16 CFR 310.5 applies to you.
Using appointment-setting support
If you outsource, require your vendor to use approved data, scripts, consent practices, suppression lists, reporting, and escalation paths. TopLead runs multi-channel outbound (phone, email, LinkedIn) for PEO firms, verifies decision-makers, integrates with client CRMs, and reports on results.
That is operational support. It is not a legal-compliance certification, and your own oversight duties remain.
Booking and handoff
Confirm the meeting details the prospect requested. Use only permitted follow-up channels. Write consent and contact preferences into the CRM so the account team knows what's allowed next.
Write PEO Outreach That Is Helpful and Defensible
Segment without overreaching
Tailor messages to owners, HR leaders, finance leaders, benefits advisors, and multi-state employers. Anchor on business problems such as growth-stage payroll complexity, benefits cost pressure, or administrative load. Don't infer sensitive personal details.
A message framework
- Identify the sender and company up front
- State why you're reaching out in one sentence
- Tie that reason to a real PEO-related business issue
- Propose one clear next step, not a menu of options
- Include opt-out or disclosure language for the channel you use
Handling common objections
- "Send me information": "Happy to. Is there anything specific your team is focused on so I can tailor it?" Then send only through a permitted channel.
- "We already have a PEO": Ask what's working and when they next review. Don't disparage.
- "Not interested": Acknowledge it. One brief clarifying question is fine. Stop if they decline again.
- "Remove me from your list": Say yes, log it, and run the suppression process immediately. No rebuttal.
Treat any email, call, or LinkedIn template as an adaptable script. Have legal and compliance review it before use. None is universally compliant.
Monitor, Train, and Improve Without Creating New Risk
Train on the rules that matter
Cover the rules that keep outreach compliant:
- Approved channels and identity disclosure
- Consent limits and do-not-contact handling
- Time-zone restrictions and call recording
- Prohibited claims
- Data security and escalation
Role-play opt-out requests and complaints until reps handle them without hesitation.
Track risk next to pipeline
- Consent-record coverage
- Connection and delivery rates
- Opt-out volume and complaints
- Wrong-party contacts
- Failed suppression events
- Vendor exceptions and appointment quality
No reliable PEO-specific opt-out or complaint benchmark exists. The available thresholds are email provider spam rates (Google: below 0.10%; Yahoo: below 0.3%). Set internal baselines rather than borrowing invented numbers.
Respond to incidents
- Pause affected campaigns if warranted to limit further exposure
- Preserve records for investigation and defense
- Honor the opt-out, deletion, or correction request
- Investigate the data source that caused the issue
- Correct or delete data as required by policy and law
- Notify stakeholders and review the vendor
- Document preventive changes so the failure does not repeat
Audit regularly
Review data sources, scripts, suppression lists, recordings, CRM permissions, vendor contracts, and state-law changes on a schedule. Rules change, as the pending FCC revocation rule shows. Recheck requirements before every major campaign.
Frequently Asked Questions
What is the difference between a PEO and an HRIS?
A PEO is an outsourced HR and co-employment arrangement that may cover payroll, benefits, workers' compensation, and compliance administration. An HRIS is mainly software for managing HR information and workflows.
What does PEO stand for?
PEO stands for Professional Employer Organization. It shares employer responsibilities with a client through outsourced HR and administrative services.
Do B2B sales calls need consent under U.S. telemarketing laws?
It depends on the recipient, number, technology, purpose, and state, plus federal rules and your internal do-not-call policy. B2B status alone isn't enough. Confirm current rules with qualified counsel.
Can PEO sales teams cold email business prospects?
Yes, if the email follows CAN-SPAM: honest sender and subject, ad identification, postal address, and working unsubscribe. Use quality list sources, treat personal addresses carefully, and follow state and company rules.
Can sales representatives send text messages to business prospects?
A business purpose or number doesn't automatically remove consent requirements. Keep permission evidence, honor opt-outs, sync vendor suppression, and get legal review first.
What should a compliant outreach record include?
Data source and date, recipient and channel, consent evidence where applicable, outreach history, opt-out status, suppression actions, rep or vendor identity, and campaign details.
